Personal data processing policy.

Privacy policy: purpose and scope

Article 15 of the Colombian Constitution recognizes every person’s right to know, update, correct and/or request deletion of personal information collected or processed in public or private databases.

Law 1581 of October 17, 2012 developed this right through Colombia’s General Personal Data Protection Rules. These rules were regulated by Decrees 1377 of 2013 and 886 of 2014, now incorporated into Decree 1074 of 2015, among other provisions.

HONOR LEGAL S.A.S., hereinafter HONOR LEGAL, adopts this Personal Data Processing Policy in compliance with applicable law and to protect information concerning its employees, contractors, clients, partners, associates and other persons relevant to its operation.

Personal data obtained through operations requested from or carried out with HONOR LEGAL will be processed according to the principles and duties established by Law 1581 of 2012 and related regulations.

This policy provides stakeholders with sufficient information and establishes guidelines for protecting personal data processed through HONOR LEGAL’s procedures. It applies to all physical and digital databases for which HONOR LEGAL acts as Data Controller and, where applicable, when it acts as Data Processor.

Its purpose is to explain the relevant processing activities and purposes, and the rights Data Subjects may exercise before HONOR LEGAL.

Applicable principles

The following principles apply consistently and comprehensively to the development, interpretation and application of data protection law:

Processing of personal data

Under Law 1581 of 2012 and the consents granted by Data Subjects, HONOR LEGAL may collect, store, use, circulate and/or delete personal data. Processing will take place only for authorized purposes described in this policy or in specific consents, or where a legal or contractual obligation requires it.

Transfer and transmission of personal data

HONOR LEGAL may transfer or transmit personal data to third parties that provide services required for its operation or as necessary for contractual, legal and ordinary business relationships. It will take reasonable measures to ensure that anyone with access to personal data complies with this policy, applicable data protection principles and legal obligations.

When data is transmitted to processors located in or outside Colombia, HONOR LEGAL will use contractual clauses that disclose and regulate that circumstance.

Data Subject rights

HONOR LEGAL will respect the following rights whenever it processes personal data:

• Know, update and correct personal data held by the Data Controller or Processors.
• Request evidence of the consent granted, except where consent is not legally required.
• Request information regarding the use made of personal data.
• File complaints with the competent authority for violations of applicable data protection rules.
• Withdraw consent and/or request deletion when processing violates constitutional or legal principles, rights and guarantees, provided there is no legal or contractual duty to retain the data.
• Access personal data that has been processed, free of charge.

Consent of the Data Subject

Unless an exception applies, processing requires the Data Subject’s prior and informed consent through a method that can later be verified. Consent may be written, oral or shown by unequivocal conduct, such as submitting a résumé, sending a proposal, or entering premises with visible video-surveillance notices.

Cases in which consent is not required

• Information required by HONOR LEGAL in connection with a commercial, contractual, legal or voluntary relationship, or pursuant to a judicial order.
• Publicly available data.
• Medical or health emergencies.
• Processing authorized by law for tax, historical, accounting, statistical, employment or financial purposes.
• Data related to identity or civil status records.
• Anyone accessing personal data without prior consent must still comply with Law 1581 of 2012 and all current related provisions.

Information provided when requesting consent

• The processing to which the personal data will be subject and its purpose.
• The optional nature of answers involving sensitive data or data concerning children and adolescents.
• The Data Subject’s rights.
• The identity, physical or electronic address and telephone number of the Data Controller.

HONOR LEGAL will retain evidence that this information was provided and will supply a copy to the Data Subject upon request.

Persons to whom information may be disclosed

• Data Subjects, their successors or legal representatives.
• Public or administrative authorities acting within their legal powers or under a judicial order.
• Third parties authorized by the Data Subject or by law.

Duties of Data Controllers and Processors

Duties of the Data Controller

When acting as Data Controller, HONOR LEGAL will comply with the following duties and all other applicable requirements:

• Guarantee the full and effective exercise of habeas data rights at all times.
• Request and retain a copy of the Data Subject’s consent under the conditions required by law.
• Inform the Data Subject of the purpose of collection and the rights arising from the consent granted.
• Keep information under appropriate security conditions to prevent alteration, loss, unauthorized consultation, use or access.
• Ensure information supplied to a Data Processor is truthful, complete, accurate, current, verifiable and understandable.
• Update information and promptly communicate changes to the Data Processor.
• Correct inaccurate information and notify the Data Processor.
• Supply only data whose processing has been authorized or is otherwise permitted by law.
• Require Data Processors to respect security and privacy obligations at all times.
• Handle inquiries and requests within the terms established by law.
• Adopt procedures that ensure compliance, particularly for inquiries and complaints.
• Inform the Data Processor when information is disputed by a Data Subject and the claim remains unresolved.
• Inform Data Subjects, upon request, about the use of their data.
• Notify the data protection authority of security breaches that place Data Subjects’ information at risk.

Duties of Data Processors

Data Processors, including HONOR LEGAL when it acts in that capacity, will comply with the following duties and all other applicable requirements:

• Guarantee the full and effective exercise of habeas data rights at all times.
• Keep information under appropriate security conditions to prevent alteration, loss, unauthorized consultation, use or access.
• Update, correct or delete data within the time limits established by Law 1581 of 2012 and related rules.
• Update information reported by Data Controllers within five business days of receipt.
• Handle Data Subject inquiries and complaints under this policy.
• Allow access only to persons legally entitled to the information.
• Notify Colombia’s Superintendence of Industry and Commerce of security breaches that create risks in the management of Data Subjects’ information.
• Verify that the Data Controller has authorization to process the Data Subject’s personal data.

Personal data incident management

An incident is any irregularity that affects or could affect the security of a database or the information it contains. Anyone who becomes aware of an incident must notify HONOR LEGAL, which will take appropriate action.

Unless a competent authority submits a duly reasoned request, HONOR LEGAL will not disclose information about systems, networks, files or other assets affected by cybercrime or system abuse. Information required by an administrative or judicial order will be delivered to the competent authority under applicable law.

Where an incident creates a risk to the proper use of personal data, it will be reported to Colombia’s Superintendence of Industry and Commerce as the national data protection authority.

Handling inquiries

Inquiries submitted to HONOR LEGAL must contain at least:

• The Data Subject’s full name and, where applicable, the name of the representative or successor.
• A description of the information or action requested.
• Physical or electronic address and contact telephone number.
• Signature, identification number or corresponding validation procedure.
• Submission through a channel made available by HONOR LEGAL.

Security and video surveillance

HONOR LEGAL uses video-surveillance cameras for physical security purposes in accordance with the Superintendence of Industry and Commerce’s guidance on personal data protection in video-surveillance systems.

Images will be retained for no more than 90 days unless they support a complaint, claim or judicial proceeding, in which case they may be retained until the matter is resolved.

Private security operators may collect visitor information for identification and access-control purposes. Improper use by a security contractor remains that contractor’s responsibility, and it must comply with this policy.