POLICY FOR THE TREATMENT OF PERSONAL DATA

October 2023.

In compliance with Law 1581 of 2012, which establishes provisions for the protection of personal data, MARCELA PALACIO PUERTA on behalf of PP&A SAS., as responsible for the processing of your personal data, establishes the guidelines for such treatment under the following articles:

I. GENERAL RULES

ARTICLE ONE: DATA CONTROLLER: PP&A SAS. identified with NIT 901.744.795-8, headquartered in Bogotá, Website www.palacioabogados.com, and phone number (1)6108614, will act as the data controller of your personal data, using them for the purposes for which it is authorized, established in the articles of this policy, and in accordance with the current regulations.

The person in charge of handling queries, complaints, updates, and withdrawal of consent is MARCELA PALACIO PUERTA, who can be contacted at the following email address: info@palacioabogados.com

Initially, PALACIO & ABOGADOS ASESORES S.A.S. will be directly responsible for processing Personal Data; however, it reserves the right to delegate such processing to a third party, national or foreign, demanding compliance with the policies implemented here, as well as those arising from Colombian legal regulations.

ARTICLE TWO: STORED INFORMATION: PALACIO & ABOGADOS ASESORES S.A.S. collects information and personal data when a User fills out the contact form available through the website, landing page, or via Google forms. The user freely provides personal information, mainly related to their full name, type and number of identification document, nationality, home address, email address, telephone number, as well as any other necessary data for proper identification and verification of the user.

ARTICLE THREE: USE OR PURPOSE OF INFORMATION: The authorization granted by the User for the handling of personal data allows PP& A S.A.S. to collect, transfer, store, use, circulate, delete, share, update, and transmit said data for the following purposes: 1) Informing about permanent new services of PP & A S.A.S. and/or its brand PALACIO & ABOGADOS ASESORES; 2) Informing about academic products developed by the working team of PP & A S.A.S. and/or its brand PALACIO & ABOGADOS ASESORES; 3) Informing about new temporary services; 4) Informing users about new strategic alliances; 5) Informing users about general interest business agreements; 6) Sending commercial or promotional information about the services of PP & A S.A.S. and/or its brand PALACIO & ABOGADOS ASESORES; 7) Sending information about the service portfolio of PP & A S.A.S. and/or its brand PALACIO & ABOGADOS ASESORES; 8) Sending general interest information; 9) Using tracking technologies or cookies directly set by PP&A SAS and/or its brand PALACIO & ABOGADOS ASESORES or a third-party marketing or advertising service provider; 10) Sharing necessary information with a third party in case of merger or acquisition of the company; 11) Sending seasonal greetings or congratulations.

ARTICLE FOUR: RIGHTS OF DATA SUBJECTS. PP & A S.A.S., through procedures defined in this policy, guarantees data subjects the exercise of their legal rights established in Article 8 of Law 1581 of 2012, such as:

a) Knowing, updating, and rectifying their personal data against the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized;

b) Requesting proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for processing, in accordance with the provisions of Article 10 of Law 1581 of 2012;

c) Being informed by the Data Controller or Data Processor, upon request, about the use that has been given to their personal data;

d) Filing complaints before the Superintendence of Industry and Commerce for breaches of the provisions of this Law 1581 of 2012 and other regulations that modify, add, or complement it;

e) Revoke the authorization and/or request the deletion of the data when the processing does not comply with constitutional and legal principles, rights, and guarantees. The revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that the Data Controller or Processor has engaged in behaviors contrary to this law and the Constitution;

g) Access their personal data that have been subject to processing, free of charge.

ARTICLE FIVE: AUTHORIZATION. PP & A SAS. will request, at the latest at the time of collecting information, the authorization of the data subject for the use and processing of their personal data. This authorization will be kept physically and/or electronically.

In any case, PP & A SAS. will take the necessary technical and physical measures to preserve and facilitate access to the data processing authorization.

ARTICLE SIX: REVOCATION OF AUTHORIZATION. The data subject may request the revocation of the authorization granted to PP & A SAS. at any time. However, such revocation may not be applicable when the data subject has a legal or contractual duty to remain in the entity’s database(s).

To request the revocation of the authorization, the data subject must send a complaint to the entity following all the rules established for this purpose in Article Nine of this policy.

ARTICLE SEVEN: PROCESSING OF SENSITIVE DATA. It is optional for the data subject to provide answers to questions regarding sensitive data or data concerning girls, boys, and adolescents. Sensitive data is understood, in accordance with Law 1581 of 2012, to be those that affect the privacy of the Data Subject or whose improper use may lead to discrimination.

ARTICLE EIGHT: INQUIRIES. The data subject, their heirs, or representatives may inquire about the information of the data subject stored in the database(s) of PP & A SAS.

For this purpose, the data subject, heir, or representative must send a written request to the email address info@palacioabogados.com. PP & A SAS. will respond within ten (10) business days counted from the date of receipt of the request. However, if unable to respond within said period, PP & A SAS. will inform the interested party of the reasons for the delay and indicate the date when the inquiry will be answered, which shall not exceed five (5) business days following the expiration of the initial term.

ARTICLE NINE: COMPLAINTS. The data subject or heir who considers that the information contained in the database(s) of PP & A SAS. should be corrected, updated, or deleted, or who notes an alleged breach of the duties established in Law 1581 of 2012 and other laws that develop it, may file a complaint with the entity.

This complaint must be made in writing and sent to the email address info@palacioabogados.com, containing: 1) identification of the data subject. 2) A precise description of the facts giving rise to the complaint. 3) Notification data, physical and/or electronic address. 4) Any other documents that the complainant wishes to submit.

If the complaint is submitted incompletely, PP & A SAS. will request the interested party to correct the deficiencies within five (5) days following the receipt of the complaint. After two (2) months from the date of the requirement, if the applicant has not provided the requested information, it will be considered that they have withdrawn the complaint.

If the recipient of the complaint is not competent to resolve it, it will be forwarded to the appropriate authority within a maximum term of two (2) business days, and the situation will be informed to the interested party. Once the complete complaint is received, a legend will be included in the database stating “complaint in process” and the reason for it, within a term not exceeding two (2) business days. This legend must be maintained until the complaint is resolved. The maximum term to address the complaint will be fifteen (15) business days counted from the day following the date of its receipt. If it is not possible to address the complaint within said term, the reasons for the delay will be informed to the interested party and the date on which the complaint will be addressed will be indicated, which in no case may exceed eight (8) business days following the expiration of the initial term.

ARTICLE TEN. MODIFICATIONS TO THE DATA TREATMENT POLICY. PP & A SAS. reserves the right to unilaterally modify its policies and procedures for the treatment of personal data at any time. However, any changes will be published and announced. Likewise, previous versions of this personal data treatment policy will be kept.

The continuous use of the services or non-disconnection from them by the data subject after the notification of the new guidelines constitutes acceptance of the same.

ARTICLE ELEVEN. PRIVACY NOTICE. PP & A SAS. undertakes to publish on its website and in any appropriate means, the notice that the data processing is subject to this data policy, and there it will also publish any modification, correction, or addition made to it.

ARTICLE TWELVE. EFFECTIVENESS. This policy comes into effect as of October 23, 2023. The personal data provided will be kept as long as their deletion is not requested by the interested party and as long as there is no legal obligation to keep them.