PROCESSING POLICY OF PERSONAL DATA

AMAZÓNICA BELEZA

Generalities. This document establishes the Personal Data Processing Policies of the commercial company CATANGO SAS (hereinafter, the ENTITY), in compliance with the provisions of Law 1581 of 2012 and Decree 1377 of 2013, and it describes the mechanisms by means of which the ENTITY guarantees an adequate handling of the personal data collected in its databases, in order to allow the holders to exercise the right of Habeas Data. Responsible.administracion@amazonicabeleza.comDefinitions: Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data; Database: Organized set of personal data that is subject to Treatment; Personal data: Any information linked or that can be associated with one or more specific or determinable natural persons; Manager: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller; Responsible: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Treatment of the data; Owner: Natural person whose personal data is subject to Treatment; Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or disposal.

Principle of legality: The processing of personal data is a regulated activity that must be subject to the provisions of the law and the other provisions that develop it; Principle of purpose: The Treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Holder; Principle of freedom: Treatment can only be exercised with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent; Principle of veracity or quality: The information subject to Treatment must be truthful, complete, exact, updated, verifiable and understandable. The Processing of partial, incomplete, fragmented or misleading data is prohibited; Principle of transparency: In the Treatment, the right of the Owner to obtain from the Treatment Manager or the Treatment Manager, at any time and without restrictions, information about the existence of data that concerns him or her must be guaranteed; Principle of restricted access and circulation: Treatment is subject to the limits derived from the nature of personal data, the provisions of the law and the Constitution. In this sense, the Treatment can only be done by persons authorized by the Owner and/or by the persons provided for by law. – Personal data, except public information, may not be available on the Internet or other means of disclosure or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or third parties authorized by law; Security principle: The information subject to Treatment by the Treatment Manager or Treatment Manager must be handled with the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized access. authorized or fraudulent;

Principle of confidentiality: All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks included in the Treatment, being able to only supply or communicate personal data when this corresponds to the development of activities authorized by law and in the terms thereof. Database content. General information such as full name number and type of identification, gender and contact information (email, physical address, landline and mobile phone) is stored in the ENTITY's databases. In addition to these, and depending on the nature of the database, the ENTITY may have specific data required for the treatment to which the data will be submitted. In the databases of employees and contractors, additional information on work and academic history is included, Sensitive data required by the nature of the employment relationship (photograph, composition of the family group, biometric data). Sensitive information may be stored in the databases with the prior authorization of its owner, in compliance with the provisions of articles 5 and 7 of Law 1581 of 2012. Treatment. The information contained in the entity's databases is subject to different forms of treatment, such as collection, exchange, updating, processing, reproduction, compilation, storage, use, systematization and organization, all of them partially or totally in compliance with the purposes set forth herein. The information may be delivered, transmitted or transferred to public entities, business partners, contractors, affiliates, subsidiaries, solely for the purpose of fulfilling the purposes of the corresponding database. In any case, the delivery, transmission or transfer will be made after signing the commitments that are necessary to safeguard the confidentiality of the information. Personal information, including sensitive information, may be transferred, transmitted or delivered to third countries, regardless of the level of security of the regulations that regulate the handling of personal information.

In compliance with legal duties, the ENTITY may provide personal information to judicial or administrative entities. The ENTITY will ensure the correct use of personal data of minors, guaranteeing that the applicable legal requirements are complied with and that all treatment is previously authorized and is justified in the best interests of minors. Purpose. The purpose of the information collected by the ENTITY is to allow the proper development of its corporate purpose. In addition, the ENTITY keeps the necessary information to comply with legal duties, mainly in accounting, corporate, and labor matters. The information about clients, suppliers, partners and employees, current or past, is kept in order to facilitate, promote, allow or maintain labor, civil and commercial relationships. The information about market players, customers, suppliers and consumers of our products and services is stored in order to comply with the activities of its object, particularly those related to the development, planning and implementation of programs, projects, plans, policies, contracts or agreements necessary to promote coffee growing in Colombia. Rights of the holders. In accordance with the provisions of article 8 of Law 1581 of 2012, the owners may:

– Know, update and rectify their personal data before the ENTITY or the Managers . This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Treatment is expressly prohibited or has not been authorized.

– Request proof of the authorization granted to the ENTITY, except when expressly excepted as a requirement for Treatment, in accordance with the provisions of article 10 of this law.

– Be informed by the ENTITY or the Manager, upon request, regarding the use that has been given to your personal data.

– Submit complaints to the Superintendence of Industry and Commerce for violations of the provisions of this law and the other regulations that modify, add or complement it.

– Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the ENTITY or the Person in Charge has incurred in conduct contrary to this law and the Constitution.

– Free access to your personal data that has been processed. Obligations of the entity. The ENTITY shall:

• Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.
• Request and keep, under the conditions provided in this law, a copy of the respective authorization granted by the Holder.
• Duly inform the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
• Guarantee that the information provided to the Processor is truthful, complete, accurate, up-to-date, verifiable and understandable.
• Update the information, promptly communicating to the Person in Charge of the Treatment, all the news regarding the data that has previously been provided and adopt the other necessary measures so that the information provided this is kept up to date.
• Rectify the information when it is incorrect and communicate what is pertinent to the Manager.
• Provide the Processor, as the case may be, only data whose Treatment is previously authorized in accordance with the provisions of this law.
• Require the Manager at all times to respect the security and privacy conditions of the Holder's information.
• Process queries and claims formulated in the terms indicated in this law.
• Adopt an internal manual of policies and procedures to ensure adequate compliance with this law and, in particular, for dealing with queries and complaints. < /span>
• Inform the Manager when certain information is under discussion by the Holder, once the claim has been submitted and the respective procedure has not been completed.
• Inform at the request of the Owner about the use given to their data.
• Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.

Inquiries will be answered within three (3) business days from the date of receipt of the respective request. When it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which your query will be answered, which in no case may exceed three (3) business days following the expiration of the first term. Procedures for submitting and responding to queries, complaints and claims. Claims must be made in writing or by email, according to the information contained in this document, and must contain, at least, the following information:

• Identification of the Holder
• Description of the facts that give rise to the claim
• Address of the holder
• Documentation to be submitted as evidence If the claim is incomplete, The interested party will be required within five (5) days after receiving the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim.

In the event that the person who receives the claim is not competent to resolve it, he or she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform of the situation to the interested party. Once the complete claim is received, a legend that says "claim in process" and the reason for it will be included in the database, within a term not exceeding two (2) business days. Said legend must be kept until the claim is decided. The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt.

When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be addressed. claim, which in no case may exceed eight (8) business days following the expiration of the first term. Validity of the database. The ENTITY's Personal Information Treatment Policies will be in force as of March 1, 2013. The ENTITY reserves the right to modify them, under the terms and with the limitations provided by law. The databases managed by the ENTITY will be maintained indefinitely, while its object is developed, catangousa@catango.com.co "> administracion@catango.com.co, gmercadeo@catango.com.co , through your designated service advisor or by phone to +1 (305) 2858591. Adress 5077 NW 114 PATH DORA, FL 33178