Personal Data Processing Policy

1. Identification of the Data Controller:
   LINEXPERTS CONSULTORÍA EMPRESARIAL S.A.S., hereinafter LINEXPERTS identified with NIT 900569187-6, located at Carrera 7B No. 123-46 in Bogotá, telephone 57-1-3841740 / 3005549906, e-mail: info@linexperts.com.
2. DEFINITIONS:
   1. Autorización: Prior, express and informed consent of the Data Subject to carry out the Processing of personal data.
   2. Database: An organized set of personal data that is subject to Processing.
   3. Personal data: Any information linked or that can be associated to one or several determined or determinable natural persons.
   4. Data Processor: A natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller.
   5. Data Controller: A natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the processing of the data.
   6. Data Subject: Natural person whose personal data are subject to Processing.
   7. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
3. Purposes and Treatment to which the Personal Data will be subjected: The personal data that LINEXPERTS collects, stores, uses, circulates and deletes, and in general, treats will be used for any of the following purposes:
   1. Regarding the operation of LINEXPERTS
      1. Recurso Humano
         The processing of the data will be carried out for the selection and/or hiring process, performance of functions or provision of services, administration of human resources, retirement or termination of employment contracts. The above depending on the type of legal relationship between the data subject and LINEXPERTS (including, among others, applicants or applicants for positions, employees, former employees and trainees).
      2. LINEXPERTS Suppliers and Contractors
         The processing of data will be carried out for purposes related to the development of the contractual management process of products or services that LINEXPERTS requires for its operation in accordance with current regulations.
      3. Safety in LINEXPERTS installations
         The treatment will be carried out for the surveillance and security of people, property and facilities LINEXPERTS.
      4. Purposes for the cases in which LINEXPERTS acts in the capacity of Agent
         In cases where LINEXPERTS acts as an agent, the processing of personal data to which it has access is limited exclusively to the purposes related to the execution of the contractual relationship and in any case on behalf of the responsible, safeguarding at all times the security of the databases on which the order exists.
4. Rights of Owners:
   1. Know, update and rectify personal data against LINEXPERTS as responsible and responsible for the treatment. This right may be exercised among others to partial, inaccurate, incomplete, incomplete, fractioned, misleading, or those whose treatment is expressly prohibited or has not been authorized.
   2. Request proof of the authorization granted to LINEXPERTS as Responsible, except when expressly excepted as a requirement for treatment, in accordance with the provisions of Article 10 of Law 1581 of 2012.
   3. Be informed by LINEXPERTS upon request, regarding the use that has been given to the personal data of the Holder.
   4. File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
   5. To revoke the authorization and/or request the deletion of the personal data. The revocation and/or deletion will not proceed when the Data Subject has a legal or contractual duty to remain in the database.
   6. Access free of charge to personal data that have been subject to Processing.
   7. Voluntarily answer questions that relate to sensitive data or minors.
5. Underage Data:
   The provision of personal data of minors is optional and must be done with the express authorization of the parents or legal representatives of the minor.
6. SENSITIVE DATA:
   Sensitive personal data correspond to those that affect the privacy of the Data Subject or whose improper use may cause discrimination, such as those that reveal race or ethnicity, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights, or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data, among others. When there are exceptions under which the Processing of sensitive personal data is allowed, this must be done informing the Holder that he/she is not obliged to authorize the Processing of sensitive personal data, informing which are the sensitive data and the purpose of the processing, as well as obtaining the express consent of the person to whom the respective sensitive data belongs.
7. Holder’s Authorization: Notwithstanding the exceptions provided by law, the Processing requires the prior, express and informed authorization of the Data Subject, which must be obtained by any means that may be subject to consultation and subsequent verification. Authorization may also be obtained from unequivocal conduct of the Data Subject that allows to reasonably conclude that he/she gave his/her consent for the Processing.
8. Cases in which authorization is not required: The authorization of the Holder shall not be necessary in the case of:
   1. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
   2. Data of a public nature.
   3. Cases of medical or sanitary emergency.
   4. Processing of information authorized by law for historical, statistical or scientific purposes.
   5. Data related to the Civil Registry of Persons.
9. Attention to Petitions, Inquiries and Claims:
   To make requests, inquiries or claims related to the Processing of Personal Data, the Data Subject or his/her assignees may use any of the following communication channels:
   • At LINEXPERTS headquarters: Carrera 7B No. 123 – 46 Monday to Friday during business hours (8:00 AM to 5:30 PM)
   • Landline telephone: (571) 3841740 / 3005549906
   • E-mail: info@linexperts.com
   • Person or area responsible for handling requests, inquiries and complaints: Requests, inquiries or complaints received through the various channels will be directed to the area that LINEXPERTS has designated for the attention of requests, inquiries or complaints.
10. Procedure to exercise the Rights:
    1. 1. Inquiries
          They will be resolved within a maximum term of ten (10) business days from the date of receipt, and when it is not possible to answer the consultation within such term, the Data Subject will be informed before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which the request will be answered, which in no case may exceed five (5) business days following the expiration of the first term.
       2. Claims
          Persons who believe that the information contained in a LINEXPERTS database should be corrected, updated or deleted, or who notice the alleged breach of any of the duties contained in Law 1581 of 2012, may file a complaint with LINEXPERTS, through any of the communication channels described in paragraph 8, and it must contain the following information:
          1. Name and identification of the Holder.
          2. The precise and complete description of the facts giving rise to the claim.
          3. The physical or electronic address to send the response and report on the status of the procedure.
          4. The documents and other evidence that are intended to be asserted.

    If the claim is incomplete, LINEXPERTS will require the applicant within five (5) days of receipt to correct the faults. After two (2) months from the date of the requirement, if the petitioner does not submit the requested information, it will be understood that he/she has abandoned the request.

    Upon receipt of the completed claim, LINEXPERTS will include in the respective database a legend that says “claim in process” and the reason for it, within a period not exceeding two (2) business days. This legend will remain until the claim is decided.

    The maximum term to address the claim will be fifteen (15) working days from the day following the date of receipt, and if it is not possible to respond within that period, LINEXPERTS will inform the person concerned the reasons for the delay and the date on which it will be addressed, without exceeding, in any case, eight (8) working days following the expiration of the first term.

11. Effective date of the Information Treatment Policy and period of validity of LINEXPERTS databases:
    This policy is effective as of its issuance and the databases subject to processing shall remain in force as long as it is necessary to comply with the purposes stated in paragraph 2 of this policy.
12. DATA PROTECTION AUTHORITY:
    The state data protection authority to which to refer in cases of doubts or complaints about the use of personal data is the Superintendence of Industry and Commerce.

DOCUMENT CHANGE CONTROL

• Version 01: Creation
  Distribution: Operations Manager
• Version 02: Adaptation of logo and wording in the document
  Date: 23/11/2020
  Distribution: Operations Manager
• Version 03: Adjustments in the wording, inclusion of definitions, creation of a separate chapter on sensitive data, detailing when Linexperts acts as the person in charge.
  Date: 10/02/2022
  Distribution: Innovation and New Business Expansion Manager. Contractor – Data Protection Expert.