PERSONAL DATA PROCESSING POLICY

PERSONAL DATA PROCESSING POLICY

The following is the internal manual of policies and procedures for the treatment and protection of personal data of COLBRAND COLOMBIA SAS., In accordance with Statutory Law 1581 of 2012, Decree 1377 of 2013 and Decree 886 of 2014. This document It is structured with the purpose of being an easy guide to guarantee the constitutional right that all people have to know, update and rectify the information that COLBRAND COLOMBIA SAS collects or has collected from them. in databases, as well as the other rights, freedoms and constitutional guarantees referred to in article 15 of the Political Constitution and the right to information enshrined in article 20 of the same, and especially, for the attention of queries and claims against people's right to computer self-determination.

1. OBJECTIVE

Comply with the necessary processes for the processing of personal data in execution or development of its corporate purpose in accordance with the provisions of Law 1581 of 2012, Regulatory Decree 1377 of 2013, Sole Regulatory Decree 1074 of 2015, and other regulations that modify, complement or derogen.

2. SCOPE

The treatment of personal databases applies to personal information of clients, suppliers, collaborators or any other person who facilitates the use of their personal data to COLBRAND COLOMBIA SAS. The use of personal data includes its consultation, storage, updating, transfer and revocation.

3. DEFINITIONS

For the purposes of this internal manual of policies and procedures for the treatment and protection of personal data, and in accordance with the terms of the law, the following definitions must be taken into account:

· Attorney: Person who is legally empowered to represent another person and act on their behalf.

· Records: Set of documents kept by the company containing personal information regulated by law.

· Authorization: Prior, express and informed consent of the owner to carry out the processing of their personal data.

· Database: Organized set of personal data that is subject to treatment.

Cause-holder: Person who has succeeded or has been subrogated by any other title the right of others.

· Consultation: Request for information on the personal data contained in a database, which is formulated by the Owner of the same or the person authorized to do so.

Personal data: Information linked or that may be associated with one or more specific or determinable natural persons.

· Private data: That data that due to its intimate or reserved nature is only relevant for the owner.

· Public data: It is the data that is not semi-private, private or sensitive. Public data, among others, are data related to the marital status of individuals, their profession or trade and their status as a merchant or public servant.

Semi-private data: Data that is not intimate, reserved, or public in nature and whose knowledge or disclosure may be of interest not only to its owner but to a certain sector or group of people.

Sensitive data: Those that affect the privacy of the owner or whose improper use may generate discrimination, such as: those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations or human rights, data related to health, sexual life and biometric data.

Responsible for the treatment: Natural or legal person, public or private, who, after entering into a contract with the Data Controller, carries out Personal Data Processing activities on behalf of the latter. Such Quality will be acquired by COLBRAND COLOMBIA SAS. in the event of signing a data transmission agreement, by means of which, processing activities are entrusted to you.

Responsible for the treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the Treatment of the data.

· Third: Any natural or legal person other than the people who belong to COLBRAND COLOMBIA SAS.

· Headline: Natural person whose personal data are subject to treatment.

Transfer: The data transfer takes place when the person in charge and / or person in charge of the processing of personal data located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is inside or outside the country.

· Transmission: Treatment of personal data that implies the communication of the same within or outside the Colombian territory when it is intended to carry out a treatment by the person in charge on behalf of the person in charge.

· Treatment: Any operation or set of operations that is executed on personal data, such as the collection, storage, use, circulation or deletion of the same.

Claim: Request or demand made by the owner of personal data or the person authorized to do so, around the personal data included in a database.

4. POLICY

COLBRAND COLOMBIA SAS., Hereinafter COLBRAND, identified with NIT 900.800.912-1, with main address at Avenida Calle 82 no 12-39, Bogota, Colombia, telephone (4327086) and website www.argentobourbon.com, is responsible for the processing of personal data managed in the databases or files of clients, suppliers, collaborators or any other natural person in accordance with Law 1581 of 2012, Regulatory Decree 1377 of 2013, Sole Regulatory Decree No 1074 of 2015 and the other rules that repeal, modify or complement them.

Any area or collaborator of COLBRAND that, due to its functions, is in charge of processing databases with personal information must comply with the provisions of this policy.

For the development of an adequate personal data treatment policy, COLBRAND takes into account the following aspects:

4.1 Guiding principles

In all the acts carried out by COLBRAND, its employees, managers and other personnel designated by it, for the adequate treatment of personal data that make up its databases, in the interpretation and execution of its policies and in this manual, the following principles:

to. Principle of legality: During all the stages and activities of information processing by COLBRAND or whoever it designates as the person in charge of processing, the rules that regulate the matter at the national level will be applied, mainly, laws 1266 of 2008 and 1581 of 2012, decrees 1377 of 2013, 886 of 2014 and 1727 of 2009, compiled in chapters 25, 26 and 27 of DU 1074 of 2015 and all those that regulate, add, modify or delete them. b. Principle of purpose: In the processing of information, activities that are related to the purpose previously established by COLBRAND c. Principle of freedom: The processing activities to which the personal data will be submitted will be executed only when the owner of the same has previously and expressly issued authorization for this purpose, unless they are those that, by virtue of the provided by Article 10 of Law 1581 of 2012, do not require authorization from the owner. d. Principle of truthfulness or quality: COLBRAND has acquired a commitment with the holders of the information that make up its databases, to guarantee that it is truthful, complete, exact, updated, verifiable and understandable, consequently, it will refrain from treating partial data , incomplete, fractioned or misleading. and. Principle of transparency: COLBRAND has adopted a series of suitable mechanisms to guarantee that the owner obtains, at any time and without restrictions, information about the existence of data that concerns him. F. Principle of access and restricted circulation: Access to the information that makes up the databases will be restricted to specialized personnel previously trained to handle this type of information. COLBRAND will not publish the personal information object of treatment on the internet or other means of dissemination or mass communication. g. Security principle: COLBRAND has adopted a series of technical, human and administrative measures, according to the nature of the data being processed, to prevent them from being adulterated, lost, consulted, used or accessed by unauthorized personnel. h. Principle of confidentiality: COLBRAND has adopted a protocol, which guarantees the owners of the information that make up its databases, that the people who intervene in the processing of their personal data, will keep confidentiality about said information, even after the work is completed. treatment, or its contractual relationship.

4.2 Purpose of the databases

Personal information will be used by COLBRAND for the sole purpose of carrying out the operation of its corporate purpose through accounting, tax, administrative, human resources and commercial management with clients, suppliers and collaborators.

The purposes for the personal data held by COLBRAND COLOMBIA SAS are described below:

Customers:

- Carry out the pertinent steps for the development of its activity.

-Send information on affiliated brands, offer new products and services.

-Carry out loyalty, advertising and marketing campaigns in general.

-Develop marketing studies to identify consumer preferences.

-Manage requests, complaints and claims.

-Provide contact information to third parties that allow the development of commercial activities.

-Histories of commercial relations as an element of analysis.

-Technical and Administrative Management, sending communications, establishing communication channels and sending information of interest to the client and / or suppliers.

The use of personal data for advertising activities, or offering products and services will be carried out on the following days and times:

Email: Monday to Friday: between 8:00 am and 8:00 pm Saturdays, Sundays and holidays: between 10:00 am and 6:00 pm

SMS: Monday to Friday: between 8:00 am and 8:00 pm Saturdays, Sundays and holidays: between 10:00 am and 6:00 pm

Telephone calls: Monday to Friday: between 8:00 am and 6:00 pm Saturdays: between 10:00 am and 6:00 pm Sundays and holidays: no telephone calls will be made

Employees:

-Advance processes of selection, hiring and monitoring of personnel, payroll management, safety and health at work.

-Fulfill the obligations derived from current employment contracts.

-Send corporate communications via email.

Communications and / or notices addressed to employees will be made within the working hours established by the Company.

Suppliers:

- Carry out the pertinent procedures for the linking of suppliers.

-Technical and Administrative Management, sending communications, establishing communication channels and sending information of interest to the client and / or suppliers.

Communications and / or notices addressed to suppliers will be made within the administrative working hours established by the Company.

4.3 Request for data to link your interested parties

COLBRAND, for the linking of its interested parties, may require the following personal data:

-Personal identification data: identification document data, marital status, family data, gender, age, signature, nationality, age, fingerprint, photographs, work history, academic history, profession, art, trade or economic activity.

-Location data: address, phone, cell phone, email, social networks.

-Data of socioeconomic content: certification of bank account, financial data, credit data, economic data, type of home, business references, employment references and bank references.

-Sensitive data: medical tests, treatments and medications.

COLBRAND uses various security video and audio media for protection and control. This information may be used as evidence in any judicial or administrative process and will be treated in accordance with the provisions of Law 1581 of 2012.

4.4 Authorizations

COLBRAND requests authorization from any natural person with whom it establishes commercial or employment relationships, whether supplier, client or collaborator, so that their personal data can be processed according to the purpose established in each case.

4.5 Information security and control

COLBRAND has technical and administrative measures and trained human resources to guarantee the security of the personal data obtained, which rest in its databases and files, avoiding its adulteration, loss, consultation or unauthorized or fraudulent access.

Personal data is stored electronically and must remain in the database

data, such as active, inactive or historical and may not be deleted until they are no longer used, according to the instructions for Storage of personal data.

COLBRAND employees in charge of the processing of personal data, undertake to comply with the provisions of the data processing policy and to maintain the confidentiality of the same, in accordance with the acceptance and signing of the Labor Contract at the time of their connection.

4.6 Rights of the holders

In accordance with the provisions of article 8 of Law 1581 of 2012, the owner of personal data has the following rights against COLBRAND in its capacity as data controller:

-Know, update and rectify your personal data.

-Request proof of the authorization granted to COLBRAND except when it is excepted as a requirement for the Treatment in the terms of the law.

-Be informed, upon request, of the use that has been given to your personal data.

-Present before the Superintendency of Industry and Commerce, complaints for infractions to the protection and treatment of personal information.

-Revoke the authorization and / or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment.

The holders of the information can exercise their rights free of charge, through the following email: servicioalcliente@colbrand.com or by sending a written communication on behalf of COLBRAND COLOMBIA SAS to the following address: Avenida Calle 82 No 12-39, Bogota -Colombia.

4.7 Duties of those responsible for the processing of personal information

In accordance with the provisions of the law, COLBRAND's duties regarding personal data are:

-Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.

-Request and keep a copy of the respective authorization granted by the Owner.

-Duly inform the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.

-Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

-Ensure that the information provided to the Treatment Manager, if it exists, is true, complete, accurate, updated, verifiable and understandable.

- Update the information, communicating in a timely manner to the Person in Charge of Treatment, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it is kept up-to-date.

-Rectify the information when it is incorrect and communicate the pertinent to the Person in Charge of Treatment.

- Provide the Treatment Manager, as the case may be, only data whose Treatment is previously authorized in accordance with the provisions of this law.

-Require the Person in Charge of Treatment at all times, respect the security and privacy conditions of the Information of the Holder.

-Process inquiries and claims formulated in the terms indicated in the law.

- Adopt an internal manual of policies and procedures to guarantee adequate compliance with data protection and, in particular, for the attention of queries and complaints.

- Inform the Treatment Manager when certain information is under discussion by the Holder, once the claim has been submitted and the respective process has not been completed.

-Inform at the request of the Owner about the use given to their data.

- Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.

-Fulfill the instructions and requirements issued by the Superintendency of Industry and Commerce.

4.8 Responsible for the processing of personal information

-Corporate name: COLBRAND COLOMBIA SAS.

-NIT: 900.800.912-1

-ISIC: 4772

-Address: Bogota, Colombia.

-Physical address: Avenida Calle 82 No 12-39

-email: customerservice@colbrand.com

-Web: www.argentobourbon.com

- Landline: 432 7086

4.8.1 Queries

The owner, successor or attorney-in-fact of the information, may know their personal data subject to treatment, or proof of the authorization granted to COLBRAND, through the email servicioalcliente@colbrand.com

The query must contain at least the following data:

-The name, identification, address of the owner, email, cell phone number.

-The documents that prove the identity or representation.

-The clear and precise description of your requirement or request.

The customer service area is in charge of managing consultation requests. In case of finding that the data is not complete, it will request the interested party within five (5) business days following receipt of the same, to make the necessary corrections.

The request will be answered within a maximum term of fifteen (15) business days from the date of receipt. When it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the query will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

The response will be sent to the owner's email or, failing that, to the physical address, registered in the database.

4.8.2 Claims

The owner, successor or attorney-in-fact may file a claim with COLBRAND, via email customer service@colbrand.com, when they consider that the information contained in the database must be subject to correction, updating, deletion, revocation or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, Regulatory Decree 1377 of 2013, Decree Sole Regulation 1074 of 2015 and the other regulations that complement, modify or repeal them.

The claim may only be exercised by the owner, after proof of their identity, or by the successor, after proof of their identity and the quality granted. When the identity or quality granted is not proven, the claim will be considered as not submitted.

The claim must contain at least the following information:

-The name, identification, address of the owner, email, cell phone number.

-The documents that prove the identity or representation

-The clear and precise description of your requirement or request.

If the customer service area receives the claim and finds that the data is not complete, it will request the interested party within five (5) days after receiving the claim thate the necessary corrections are made.

The request will be answered within a maximum term of fifteen (15) business days from the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their claim will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

COLBRAND is responsible for registering in the National Registry of Databases, the claims presented by the owners, successors or attorneys-in-fact, during the first and second semester of each year, within the first 15 business days of February and August, respectively. . COLBRAND as the person responsible for the processing of personal data, must update the information of the claims presented by the holders (Decree 003/2018).

4.9 Responsible for the treatment of personal information

In the terms of Law 1581 of 2012, the person in charge of the treatment is the natural or legal person, public or private, who by himself or in association with others, carries out the Processing of personal data on behalf of the Person Responsible for the Treatment, whenever COLBRAND deals directly and exclusively with the databases created by it.

4.10 Transfer and transmission of information

COLBRAND will provide the personal data subject to treatment to the following people:

-Information holder.

-Public or administrative entities in the exercise of their legal functions or by court order.

-Third parties authorized by the owner or by law.

-Third parties to which COLBRAND entrusts its treatment for the development of the corporate purpose.

COLBRAND will supply personal data to third parties as long as it has the authorization of the owner or the document that proves its legal representation is presented. In this case, the third party, from the moment they receive the information, becomes in charge of its treatment and must comply with legal obligations.

Any third party who, due to their relationship with COLBRAND, is entrusted with the processing of personal data, will require prior authorization from the owner to process their personal data and the signing of a contract between the Responsible and those in charge for the processing of personal data under

its control and responsibility, in which the scope of the treatment will be indicated, the activities that the person in charge will carry out on behalf of the person in charge for the treatment of personal data and the obligations of the person in charge towards the owner and the person in charge.

4.11 International transfers

COLBRAND transfers personal data to third parties in other countries as long as they provide adequate levels of data protection in accordance with the standards set by the Superintendency of Industry and Commerce on the matter.

5. Exceptions

This policy does not apply to databases and files that:

-They have as their purpose the national security and defense, as well as the prevention, detection, monitoring and control of money laundering and the financing of terrorism.

-They are intended and contain intelligence and counterintelligence information.

-They have journalistic information and other editorial content as their purpose.

-They are intended to provide information on purchases made by customers (post-purchase service), the delivery or improvement of them, and information related to products that are requested by the same customer.

6. Data Protection Officer

In accordance with the provisions of article 23 of Decree 1377 of 2013, COLBRAND has appointed a personal data protection team, which has the duty to ensure the effective implementation of the policies and procedures for the protection of personal data and the good data management practices.

This team has the following responsibilities:

-Promote the development and implementation of a system that allows managing the risks of the processing of personal data.

-Coordinate the definition and implementation of the controls of the Comprehensive Personal Data Management Program.

-Serve as liaison and coordinator with the other areas of the organization to ensure a transversal implementation of the Personal Data Management Program.

-Promote the culture of data protection within COLBRAND

-Maintain an inventory of personal databases held by the organization.

- Register the organization's databases in the National Registry of Databases operated by the Superintendency of Industry and Commerce and update the report according to the instructions established by the authority.

-Obtain the declarations of conformity from the SIC when required.

-Review the contents of the international data transmission contracts that are signed with managers not resident in Colombia.

- Analyze the responsibilities of each position in the organization, to, if applicable, design a training program in the protection of personal data specific to each of them.

-Perform a general training on personal data protection for all company employees.

-Perform the necessary training for new employees, who have access to personal data managed by the organization, due to the conditions of their employment.

-Integrate data protection policies within the activities of the other areas of the organization.

-Measure participation, rate performance, in data protection training.

- Require that, within the analysis of employee performance, it is found to have satisfactorily completed training on personal data protection.

-To ensure the implementation of internal audit plans to verify compliance with their policies for the treatment of personal information.

-Accompany and assist the organization in attending to the visits and requirements made by the Superintendency of Industry and Commerce.

-Tracking the personal data management program.

-Prepare reports to be delivered to the Management of COLBRAND COLOMBIA SAS. and its shareholders

7. Privacy notice

In compliance with Law 1581 of 2012 on Data Protection and concordant regulations, this privacy notice aims to inform the owner about the treatment to which the data stored in our databases will be subjected, and to inform whether they will be subject to to transmission and / or transfer to third parties. The treatment conditions are as follows:

1. COLBRAND COLOMBIA SAS., Identified with Nit.900.800.912-1, with main address at Avenida Calle 82 No 12-39, Bogota, Colombia, telephone 4327086 and website www.argentobourbon.com, will be responsible for the processing of personal data that appear registered in its databases and files.

2. The processing of personal data is done for the purpose of carrying out the accounting, fiscal, administrative, commercial and human resources management of COLBRAND COLOMBIA SAS., More precisely to maintain the commercial and labor relationship between the parties, as which involves, among other things, the management of clients, suppliers and human resources, electronic commerce, own advertising, the sending and / or reception of communications, billing, payments, the contracting and provision of goods and services, and the security management of the Company.

The owner of the personal data has the following rights against COLBRAND COLOMBIA SAS. in your capacity as data controller:

-Know, update and rectify your personal data.

-Request proof of the authorization granted to COLBRAND except when it is excepted as a requirement for the Treatment in the terms of the law.

-Be informed, upon request, of the use that has been given to your personal data.

-Present before the Superintendency of Industry and Commerce, complaints for infractions to the protection and treatment of personal information.

-Revoke the authorization and / or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment.

The owner of the databases can exercise their rights through the following email: customer service@colbrand.com

For more information, you can consult our Personal Data Treatment Policy on the page www.argentobourbon.com.

8 validity

This policy is effective as of June 01, 2017 and until the issuance of others or a substantial change in them.

In case of making any modification, considering the determinations provided by law, COLBRAND COLOMBIA SAS. publish the updated document on its website, www.argentobourbon.com.