PERSONAL DATA PROCESSING POLICY

PERSONAL DATA PROCESSING POLICY

The internal Manual of policies and procedures for the treatment and protection of personal data of COLBRAND COLOMBIA SAS is presented below, in accordance with Statutory Law 1581 of 2012, Decree 1377 of 2013 and Decree 886 of 2014. This document It is structured with the purpose of being an easy guide to guarantee the constitutional right that all people have to know, update and rectify the information that COLBRAND COLOMBIA SAS collects or has collected from them. in databases, as well as the other rights, freedoms and constitutional guarantees referred to in article 15 of the Political Constitution and the right to information enshrined in article 20 of the same, and especially, for the attention of queries and claims against the right of computerized self-determination of people.

1.OBJECTIVE

Comply with the necessary processes for the processing of personal data in execution or development of its corporate purpose in accordance with the provisions of Law 1581 of 2012, Regulatory Decree 1377 of 2013, Sole Regulatory Decree 1074 of 2015, and other regulations that modify, supplement or repeat.

2.REACH

The treatment of personal databases applies to personal information of clients, suppliers, collaborators or any other person who facilitates the use of their personal data to COLBRAND COLOMBIA SAS. The use of personal data includes consultation, storage, updating, transfer and revocation.

3. DEFINITIONS

For the purposes of this Internal Manual of policies and procedures for the treatment and protection of personal data, and in accordance with the terms of the law, the following definitions must be taken into account:

· Attorney: Person who is legally empowered to represent another person and act on their behalf.

Files: Set of documents kept by the company containing personal information regulated by law.

Authorization: Prior, express and informed consent of the owner to carry out the processing of their personal data.

Database: Organized set of personal data that is subject to treatment.

Successor in title: Person who has succeeded or has surogated by any other title the right of others.

Consultation: Request for information about the personal data contained in a database, which is formulated by the Holder therefore or the person authorized to do so.

Personal dates: Information linked or that can be associated with one or several determined or determinable natural persons.

Private dates: That data that due to its intimate or reserved nature is only relevant to the owner.

Public data: It is the data that is not semi-private, private or sensitive. Public data is considered, among others, data related to the marital status of people, their profession or trade and their status as merchants or public servants.

Semi-private data: The data that is not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to its owner but to a certain sector or group of people.

Sensitive data: Those that affect the privacy of the owner or whose improper use may generate discrimination, such as: those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations or human rights, data relating to health, sexual life and biometric data.

Person in charge of the treatment: Natural or legal person, public or private, who, after entering into a contract with the Data Controller, performs personal data processing activities on behalf of the latter. Such Quality will be acquired by COLBRAND COLOMBIA SAS. in case of signing a data transmission agreement, by means of which, treatment activities are entrusted to it.

Responsible for the treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Treatment of the data.

Third: Any natural or legal person other than the people who belong to COLBRAND COLOMBIA SAS.

Headline: Natural person whose personal data is processed.

Transfer: The transfer of data takes place when the person in charge and/or in charge of the processing of personal data located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is located inside or outside the country.

Transmission: Treatment of personal data that implies the communication of the same inside or outside the Colombian territory when its purpose is to carry out a treatment by the person in charge on behalf of the person in charge.

Treatment: Any operation or set of operations carried out on personal data, such as the collection, storage, use, circulation or deletion of the same.

Claims: Request or requirement formulated by the owner of personal data or the person authorized to do so, regarding the personal data included in a database.

4.POLICY

COLBRAND COLOMBIA SAS., hereinafter COLBRAND, identified with NIT 900.800.912-1, with main address at Avenida Calle 82 no 12-39, Bogota, Colombia, telephone (4327086) and website www.argentobourbon.com, is made responsible for the processing of personal data managed in the databases or files of clients, suppliers, collaborators or any other natural person in accordance with Law 1581 of 2012, Regulatory Decree 1377 of 2013, Sole Regulatory Decree No. 1074 of 2015 and the other regulations that repeal, modify or complement them.

Any area or collaborator of COLBRAND that, due to its functions, is in charge of processing databases with personal information must comply with the provisions of this policy.

For the development of an adequate personal data processing policy, COLBRAND takes into account the following aspects:

4.1 Guiding principles

In all the acts carried out by COLBRAND, its employees, managers and other personnel designated by it, for the adequate treatment of personal data that make up its databases, in the interpretation and execution of its policies and in this manual, the following principles:

to. Principle of legality: During all the stages and activities of information processing by COLBRAND or whoever it designates as treatment manager, the regulations that regulate the matter at the national level will be applied, mainly, laws 1266 of 2008 and 1581 of 2012, decrees 1377 of 2013, 886 of 2014 and 1727 of 2009, compiled in chapters 25, 26 and 27 of DU 1074 of 2015 and all those that regulate, add, modify or delete them. b. Principle of purpose: In the treatment of information, the activities that are related to the purpose previously established by COLBRAND c. Principle of freedom: The treatment activities to which the personal data will be subjected will be carried out only when the owner of the same has previously and expressly issued authorization for this purpose, unless they are of those who, by virtue of the provided by article 10 of law 1581 of 2012, do not require authorization from the owner. d. Principle of veracity or quality: COLBRAND has acquired a commitment with the holders of the information that makes up its databases, to guarantee that it is true, complete, exact, updated, verifiable and understandable, consequently, it will refrain from processing partial data. , incomplete, fractional or misleading. and. Principle of transparency: COLBRAND has adopted a series of suitable mechanisms to guarantee that the owner obtains, at any time and without restrictions, information about the existence of data that concerns him. F. Principle of restricted access and circulation: Access to the information that makes up the databases will be restricted to specialized personnel previously trained to handle this type of information. COLBRAND will not publish the personal information subject to treatment on the internet or other means of dissemination or mass communication. g. Security principle: COLBRAND has adopted a series of technical, human and administrative measures, according to the nature of the data subject to treatment, to prevent them from being adulterated, lost, consulted, used or accessed by unauthorized personnel. h. Principle of confidentiality: COLBRAND has adopted a protocol, which guarantees the holders of the information that makes up its databases, that the people involved in the processing of their personal data will keep said information confidential, even after the work is finished. of treatment, or its contractual relationship.

4.2 Purpose of the databases

Personal information will be used by COLBRAND with the sole purpose of carrying out the operation of its corporate purpose through accounting, fiscal, administrative, human resources and commercial management with clients, suppliers and collaborators.

The purposes of the personal data held by COLBRAND COLOMBIA SAS are described below:

Clients:

-Carry out the pertinent steps for the development of its activity.

-Send information from affiliated brands, offer new products and services.

-Carry out loyalty, advertising and marketing campaigns in general.

-Develop marketing studies to identify consumer preferences.

-Manage requests, complaints and claims.

-Provide contact information to third parties that allow the development of commercial activities.

-Historical of commercial relations as an element of analysis.

-Technical and Administrative Management, sending communications, establishing communication channels and sending information of interest to the client and/or suppliers.

The use of personal data for advertising activities, or offering of products and services will be carried out on the following days and times:

Email: Monday to Friday: between 8:00 am and 8:00 pm Saturdays, Sundays and holidays: between 10:00 am and 6:00 pm

SMS: Monday to Friday: between 8:00 am and 8:00 pm Saturdays, Sundays and holidays: between 10:00 am and 6:00 pm

Telephone calls: Monday to Friday: between 8:00 am and 6:00 pm Saturdays: between 10:00 am and 6:00 pm Sundays and holidays: no telephone calls will be made

Employees:

-Advance processes of selection, hiring and monitoring of personnel, payroll management, safety and health at work.

-Comply with the obligations derived from current labor contracts.

-Send corporate communications via email.

Communications and/or notices addressed to employees will be made within business hours established by the Company.

Providers:

-Carry out the relevant procedures for the linking of suppliers.

-Technical and Administrative Management, sending communications, establishing communication channels and sending information of interest to the client and/or suppliers.

Communications and/or notices addressed to suppliers will be made within the administrative working hours established by the Company.

4.3 Request for data to link your interested parties

COLBRAND, for the linking of its interested parties, may require the following personal data:

-Personal identification data: identification document data, marital status, family data, gender, age, signature, nationality, age, footprint, photographs, work history, academic history, profession, art, trade or economic activity.

-Location data: address, telephone, cell phone, email, social networks.

-Socioeconomic content data: bank account certification, financial data, credit data, economic data, type of home, commercial references, work references and bank references.

-Sensitive data: medical tests, treatments and medicines.

COLBRAND uses various audio and video security means for protection and control. This information may be used as evidence in any judicial or administrative process and will be treated in accordance with the provisions of Law 1581 of 2012.

4.4 Authorizations

COLBRAND requests authorization from any natural person with whom it establishes commercial or labor relations, be it a supplier, client or collaborator, so that their personal data can be processed according to the purpose established in each case.

4.5 Information security and control

COLBRAND has technical, administrative measures and trained human resources to guarantee the security of the personal data obtained, which rest in its databases and files, avoiding its adulteration, loss, consultation or unauthorized or fraudulent access.

Personal data is stored electronically and must remain in the database

data, such as active, inactive or historical data and may not be deleted until they are no longer used, in accordance with the Personal Data Storage instructions.

COLBRAND employees in charge of processing personal data undertake to comply with the provisions of the data processing policy and to maintain their confidentiality, in accordance with the acceptance and signing of the Labor Contract at the time of their employment.

4.6 Rights of the holders

In accordance with the provisions of article 8 of Law 1581 of 2012, the owner of personal data has the following rights against COLBRAND in its capacity as data controller:

-Know, update and rectify your personal data.

-Request proof of the authorization granted to COLBRAND except when it is excepted as a requirement for Treatment under the terms of the law.

-Be informed, upon request, of the use that has been given to your personal data.

-Submit to the Superintendence of Industry and Commerce, complaints for violations of the protection and treatment of personal information.

-Revoke the authorization and/or request the deletion of the data when the Treatment does not respect the constitutional and legal principles, rights and guarantees.

The holders of the information can exercise their rights for free, through the following email: servicioalcliente@colbrand.com or by directing a written communication on behalf of COLBRAND COLOMBIA SAS to the following address: Avenida Calle 82 No 12-39, Bogota -Colombia .

4.7 Duties of those responsible for the processing of personal information

In accordance with the provisions of the law, the following are the duties of COLBRAND regarding personal data:

-Guarantee the Owner, at all times, the full and effective exercise of the right of habeas data.

-Request and keep a copy of the respective authorization granted by the Owner.

-Duely informed the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.

-Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

-Guarantee that the information provided to the Treatment Manager, if it exists, is true, complete, accurate, updated, verifiable and understandable.

- Update the information, communicating in a timely manner to the Treatment Manager, all the news regarding the data that has previously been provided and adopt the other necessary measures so that the information provided to it is kept updated.

-Crectify the information when it is incorrect and communicate what is pertinent to the Treatment Manager.

- Provide the Treatment Manager, as the case may be, only data whose Treatment is previously authorized in accordance with the provisions of this law.

-Demand from the Treatment Manager at all times, respect for the security and privacy conditions of the Owner's information.

-To process the queries and claims formulated in the terms indicated in the law.

- Adopt an internal manual of policies and procedures to guarantee adequate compliance with data protection and, especially, for the attention of queries and claims.

- Inform the Treatment Manager when certain information is under discussion by the Owner, once the claim has been filed and the respective procedure has not been completed.

-Inform at the request of the Owner about the use given to their data.

- Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.

-Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

4.8 Responsible for the processing of personal information

-Company name: COLBRAND COLOMBIA SAS.

-NIT: 900.800.912-1

-ISIC: 4772

-Address: Bogotá, Colombia.

-Physical address: Avenida Calle 82 No 12-39

-email: clientservice@colbrand.com

-Web: www.argentobourbon.com

-Landline: 432 7086

4.8.1 Queries

The owner, successor in title or proxy of the information, may know their personal data subject to treatment, or proof of the authorization granted to COLBRAND, through the emailservicioalcliente@colbrand.com

The query must contain at least the following data:

-The name, identification, address of the owner, email, cell phone number.

-Documents proving identity or representation.

-The clear and precise description of your requirement or request.

The customer service area is in charge of managing consultation requests. In case of finding that the data is not complete, it will request the interested party, within five (5) business days following its receipt, to make the necessary corrections.

The request will be attended to within a maximum term of fifteen (15) business days from the date of receipt thereof. When it is not possible to respond to the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the query will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

The response will be sent to the owner's email or, failing that, to the physical address, registered in the database.

4.8.2 Claims

The owner, successor in title or proxy may file a claim with COLBRAND, via email customer service@colbrand.com , when they consider that the information contained in the database should be corrected, updated, deleted, revoked or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, the Regulatory Decree 1377 of 2013, Sole Regulatory Decree 1074 of 2015 and the other regulations that complement, modify or repeat them.

The claim can only be exercised by the owner, after proving his identity, or by the successor, after proving his identity and the quality granted. When the identity or quality granted is not accredited, the claim will be considered as not presented.

The claim must contain at least the following information:

-The name, identification, address of the owner, email, cell phone number.

-Documents proving identity or representation

-The clear and precise description of your requirement or request.

If the customer service area receives the claim and finds that the data is not complete, it will request the interested party within five (5) days of receipt of the claim to make the necessary corrections.

The request will be attended to within a maximum term of fifteen (15) business days from the date of receipt thereof. When it is not possible to address the claim within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their claim will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

COLBRAND is responsible for registering in the National Registry of Databases, the claims presented by the owners, successors in title or representatives, during the first and second semester of each year, within the first 15 business days of the month of February and August, respectively. . . COLBRAND as responsible for the processing of personal data, must update the information of the claims presented by the owners (Decree 003/2018).

4.9 Personal Information Processor

Under the terms of Law 1581 of 2012, the person in charge of the treatment is the natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Treatment Manager, whenever COLBRAND deals directly and exclusively with the databases created by it.

4.10 Transfer and transmission of information

COLBRAND will provide the personal data subject to processing to the following persons:

-Owner of the information.

-Public or administrative entities in the exercise of their legal functions or by court order.

-Third parties authorized by the owner or by law.

-Third parties to whom COLBRAND entrusts their treatment for the development of the corporate purpose.

COLBRAND will provide personal data to third parties provided it has the authorization of the owner or the document proving its legal representation is presented. In this case, the third party, from the moment it receives the information, becomes the person in charge of your treatment and must comply with legal obligations.

Any third party that, due to their relationship with COLBRAND, is entrusted with the processing of personal data will require prior authorization from the owner to process their personal data and subscription of a contract between the Responsible Party and those in charge of processing personal data under

its control and responsibility, in which the scope of the treatment will be indicated, the activities that the person in charge will carry out on behalf of the person in charge for the processing of personal data and the obligations of the person in charge towards the owner and the person in charge.

4.11 International transfers

COLBRAND transfers personal data to third parties in other countries provided that they provide adequate levels of data protection in accordance with the standards set by the Superintendence of Industry and Commerce on the matter.

5.Exceptions

This policy does not apply to databases and files that:

-Have the purpose of national security and defense, as well as the prevention, detection, monitoring and control of money laundering and the financing of terrorism.

-Have the purpose and contain intelligence and counterintelligence information.

-Have the purpose of journalistic information and other editorial content.

-Have the purpose of providing information on purchases made by customers (post-purchase service), delivery or improvement of them, and information related to products that are requested by the same customer.

6. Data Protection Officer

Pursuant to the provisions of Article 23 of Decree 1377 of 2013, COLBRAND has appointed a personal data protection team, which has the duty to ensure the effective implementation of personal data protection policies and procedures and good data management practices.

This team has the following responsibilities:

-Promote the development and implementation of a system that allows managing the risks of personal data processing.

-Coordinate the definition and implementation of the controls of the Comprehensive Personal Data Management Program.

-Serve as a liaison and coordinator with the other areas of the organization to ensure a transversal implementation of the Personal Data Management Program.

-Promote the culture of data protection within COLBRAND

-Maintain an inventory of personal databases held by the organization.

- Register the organization's databases in the National Registry of Databases operated by the Superintendency of Industry and Commerce and update the report in accordance with the instructions established by the authority.

-Obtain the declarations of conformity from the SIC when required.

-Review the contents of the international data transmission contracts that are signed with non-resident managers in Colombia.

- Analyze the responsibilities of each position in the organization, to, if applicable, design a specific personal data protection training program for each of them.

-Carry out general training on personal data protection for all company employees.

-Carry out the necessary training to new employees, who have access due to the conditions of their employment, to personal data managed by the organization.

-Integrating data protection policies into the activities of the other areas of the organization.

-Measure participation, qualify performance, in data protection training.

- Require that, within the performance analysis of the employees, it is found that they have satisfactorily completed the training on protection of personal data.

-Ensure the implementation of internal audit plans to verify compliance with their personal information treatment policies.

-Accompany and assist the organization in the attention of the visits and the requirements made by the Superintendence of Industry and Commerce.

-Perform monitoring of the personal data management program.

-Prepare reports to be delivered to the Management of COLBRAND COLOMBIA SAS. and its shareholders

7.Privacy Notice

In compliance with Law 1581 of 2012 on Data Protection and concordant regulations, the purpose of this privacy notice is to inform the owner about the treatment to which the data stored in our databases will be subjected, and to inform if they will be subject to transmission and/or transfer to third parties. The treatment conditions are as follows:

1. COLBRAND COLOMBIA SAS., identified with Nit.900.800.912-1, with main address at Avenida Calle 82 No 12-39, Bogota, Colombia, telephone 4327086 and website www.argentobourbon.com , will be responsible for the treatment of personal data that appears registered in its databases and files.

2. The processing of personal data is done for the purpose of carrying out the accounting, fiscal, administrative, commercial and human resources management of COLBRAND COLOMBIA SAS., more precisely to maintain the commercial and labor relationship between the parties, which involves, among other things, the management of clients, suppliers and human resources, electronic commerce, own advertising, sending and/or receiving communications, billing, payments, contracting and provision of goods and services, and the security management of the Company.

The owner of the personal data has the following rights against COLBRAND COLOMBIA SAS. in its capacity as data controller:

-Know, update and rectify your personal data.

-Request proof of the authorization granted to COLBRAND except when it is excepted as a requirement for Treatment under the terms of the law.

-Be informed, upon request, of the use that has been given to your personal data.

-Submit to the Superintendence of Industry and Commerce, complaints for violations of the protection and treatment of personal information.

-Revoke the authorization and/or request the deletion of the data when the Treatment does not respect the constitutional and legal principles, rights and guarantees.

The owner of the databases can exercise their rights through the following email: customerservice@colbrand.com

For more information, you can consult our Personal Data Processing Policy on the page www.argentobourbon.com.

8.Validity

This policy enters into force as of June 1, 2017 and until the issuance of others or substantial change thereof.

In case of making any modification, considering the determinations provided by law, COLBRAND COLOMBIA SAS. publish the updated document on your website, www.argentobourbon.com.