PERSONAL DATA PROCESSING POLICY
MASCONTROL CONSULTORES S.A.S.

---

This document aims to account for a policy of protection, management and administration of personal data of those people who for some reason have links with the company MASCONTROL CONSULTORES S.A.S.

This policy is the document required by law, which establishes the rules and regulations for the company to carry out the processing of personal data, for which MASCONTROL CONSULTORES S.A.S. is recognized as complying with the law and in development of the policy of responsibility for the treatment of information, this policy of storage, treatment and use of personal data has been designed, ensuring compliance with the relative regulations in force in Colombian legislation and the integrity of those of the rights that assist the holders of information.


For all purposes of this document, MASCONTROL CONSULTORES S.A.S. as data controller makes their identification and contact data available to interested parties:

• NAME: MASCONTROL CONSULTORES S.A.S.
• NIT: 901.009.962 - 1
• ADDRESS: Medellín – Antioquia
• ADDRESS: Carrera 89 # 38 – 31, Apto 301
• EMAIL: info@mascontrolconsultores.co
• WEB PAGE: www.mascontrolconsultores.co

MASCONTROL CONSULTORES S.A.S. develops personal information processing operations, in accordance with the regulations established in the Colombian legal system regarding the protection of personal data, ensuring at all times respect for the rights of the owners and providing the necessary guarantees to safeguard the privacy and intimacy of the people who deliver their information on a daily basis, recognizing that it is necessary to provide services with quality and commitment.

In accordance with the foregoing, the processing of personal data has been drafted and inspired by the provisions of Law Law 1581 of 2012, Decree 1377 of 2013, article 15 of the Political Constitution, Regulatory Decree 886 of 2014, Decree 090 of 18 January 2018 and Judgment C-748 of 2011, its interpretation must be based on the aforementioned normative elements and on criteria of autonomy and good faith.

The related regulations may be modified or added, which in any case will be an integral part of this policy.


MASCONTROL CONSULTORES S.A.S. guarantees that the information collected from its clients, suppliers, applicants, employees, shareholders, and other persons, regardless of the type of relationship that binds them, is treated with the greatest diligence and care for purposes to improve the commercial and inter-institutional experience with each of the aforementioned; Thus, the protection of rights is given within the framework of Habeas Data, privacy, intimacy, good name and image, for this purpose all actions will be governed by principles of good faith, legality, computer self-determination, freedom and transparency; all the above principles, which are in turn legal obligations, which we intend to comply with in the constant search to generate relationships of business and interpersonal trust.

In accordance with the foregoing, we guarantee that all persons from whom their data is collected will have the opportunity to request that they be brought to their attention, corrected, modified or deleted.

When the information collected belongs to minors, the authorization for data handling will be granted by their parents, guardians or curators and will be managed taking into account the provisions on sensitive data contained in article 05 and following of Law 1581 of 2012 and in article 06 of Decree 1377 of 2013.

In order to achieve a greater understanding of the relevant concepts regarding the protection of personal data, it is important to establish a definition regarding the most basic concepts in the matter, namely:


In accordance with the provisions of article 03 of Law 1581 of 2012 and article 03 of Decree 1377 of 2013, below are the most relevant definitions for the interpretation and application of this Personal Data Protection Policy:

• HOLDER: Natural or legal person whose personal data is processed.
• TREATMENT: Anyer operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion.
• AUTHORIZATION: Prior, express and informed consent of the holder to carry out the processing of personal data.
• DATABASE: Organized set of personal data that is subject to treatment.
• PERSONAL DATA: Any information linked to or that may be associated with one or more determined or determinable natural persons.
• PUBLIC DATA: Is all that personal information that the Colombian legal system has expressly determined as public data; for which it is not necessary to request the authorization of the owner of the information.
• SEMI-PRIVATE DATA: Is all that personal information that is not intimate, reserved, or public and whose knowledge is only of interest to a certain sector of society; for its treatment it is required to have the express authorization of the owner of the personal data.
• PRIVATE DATA: Is all that personal information that, due to its intimate or reserved nature, only interests the owner; for its treatment, the express authorization of the owner of the personal data is required.
• SENSITIVE DATA: It is all that information of special protection, since it is related to the intimacy of the owner and its improper treatment can generate discrimination.
• DATA PROCESSING MANAGER: Natural or legal person, public or private, who, by itself or in association with others, processes personal data on behalf of the data controller.
• RESPONSIBLE FOR DATA PROCESSING: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or data processing.
• PRIVACY NOTICE: Verbal or written communication generated by the person in charge, addressed to the owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable, the way to access them and the purposes of the treatment that is intended to give personal data.
• TRANSFERENCE: The transfer of data takes place when the person responsible and/or in charge of processing personal data, located in Colombia, sends the information or personal data to a receiver, who in turn is responsible treatment and is inside or outside the country.
• TRANSMISSION: Processing of personal data that implies the communication of the same within or outside the territory of the Republic of Colombia when its purpose is to carry out a treatment by the person in charge on behalf of the person in charge.
• CONSULTATION: Request submitted to the person responsible and/or in charge of processing personal data, by the owner of the personal data or the persons authorized by law, requesting information about the personal data that is object of treatment by MASCONTROL CONSULTORES S.A.S. and/or update of these.
• CLAIM: Request submitted to the person responsible and/or in charge of processing personal data, by the owner of the personal data or the persons authorized by law, requesting the correction, updating, deletion or revocation of the authorization granted to MASCONTROL CONSULTORES S.A.S.


In MASCONTROL CONSULTORES S.A.S., the personal information of the owners is treated according to this personal data treatment policy that will be applied in accordance with the regulations established in the Colombian law, decrees and jurisprudence; That is why it is necessary to mention the principles that found it and the way in which the handling of personal data must be understood by all officials, who, due to their management within the company MASCONTROL CONSULTORES S.A.S. , have contact with any personal information of clients, allies, beneficiaries, etc.

• LEGALITY: The processing of personal data by MASCONTROL CONSULTORES S.A.S. will respect and put into practice all constitutional, legal and regulatory norms that exist or may come to exist.
• FREEDOM: The collection, use, disposal and all other activities that may be carried out with personal data will require, in any case, the express authorization of the owner of the data. Exceptions regarding the request for data by judicial or administrative authorities are excluded from the foregoing.
• PURPOSE: The purpose of personal data processing will be that indicated in the authorization given by the owner; so that,The modification in the use of data will depend on the authorization expressed by the owner.
• TRUTHFULNESS: The information collected will be truthful and complete; It will not be treated or falsified for any reason and will be permanently subjected to quality checks.
• TRANSPARENCY: Mechanisms will be provided for data owners to access the information that has been collected about them, and may at any time request its updating, correction or deletion.
• ACCESS AND RESTRICTED CIRCULATION: MASCONTROL CONSULTORES S.A.S. will do everything in its power to achieve security in the collected data, it will not make it available to other entities unless there is an express authorization of the holder; They will not be marketed or made known to outsiders. The data you collect will not be processed in the mass media, except for those cases in which photographs are published, which will require authorization. The obligation to maintain restricted access to information will be an obligation of means and not of result, since it will be understood that the obligation is to facilitate security mechanisms, but not to make them impenetrable.
• SECURITY: This policy requires the creation of internal protocols for the use of information in order to prevent company officials from having unlimited access to information stored on physical and magnetic media.
• CONFIDENTIALITY: Each and every one of the people who have access to the information must maintain the confidentiality of each of the data; Thus, confidentiality agreements will be signed with employees who have access to personal information of clients, shareholders, allies, beneficiaries, etc.


The treatment of data includes the collection, storage, administration, use, transfer, transmission and destruction, in the manner permitted by law and is carried out with the following specific purpose for each case or digital or physical database that is stored in MASCONTROL CONSULTORES S.A.S.:

• PROCESSING OF PERSONAL DATA OF APPLICANTS: The data of the applicants of MASCONTROL CONSULTORES S.A.S., will be processed in accordance with the following purposes: a) Generate a contractual commitment, b)Application of medical-occupational exams, c) Recruitment and selection of personnel, d) Corroborate the veracity of the information provided, e) Participate in evaluations to identify the necessary skills for the required position, f) Attention to queries, requests, requests, actions and claims, made by the holder of the information or by their heirs, g) Use and preserve the information consecrated in the video surveillance system used to guarantee the security of the goods, facilities and people that are within the company and its branches.

• EMPLOYEE PERSONAL DATA PROCESSING: The data of employees and former employees of MASCONTROL CONSULTORES S.A.S., will be processed in accordance with the following purposes: a)Compliance with labor obligations under the responsibility of MASCONTROL CONSULTORES S.A.S., b) Maintenance of records of labor and contractual relations for the legally established terms, c)< /b> Compliance with the signed contract, that is, carrying out the management, development, compliance and control of the contractual relationship, d) Human resources, payment and payroll management, payments and reports to the system general social security, employee information, personnel management, including everything corresponding to the Occupational Health and Safety and Management System, e) Image use for card preparation, identification systems, publication of images of employees on the website and internal and external communication channels, f) Conservation and archiving of the resumes of active and inactive employees, g)Retention of contact information and sociodemographic profile of active and inactive employees,h)Investigation and control of labor absenteeism due to work-related accidents and general illness, j) Attention to internal or external audit processes, k)Application of medical-occupational examinations, l) Attention to queries, requests, requests, actions and claims, made by the owner of the information or by their heirs, or by entities of the General System of Social Security in health to which the owner is or has been linked, m) Use and preserve the information enshrined in the video surveillance system used to guarantee the security of assets, facilities and pPeople who are inside the company and its branches.

• PROCESSING OF PERSONAL DATA OF SUPPLIERS AND CONTRACTORS: The data of suppliers and contractors of MASCONTROL CONSULTORES S.A.S., will be processed in accordance with the following purposes: a) Fulfillment of contractual obligations by MASCONTROL CONSULTORES S.A.S., b) Generate a contractual and commercial commitment, c) Confirm the veracity of the information, d) Accounting, fiscal and administrative management, e)Management of suppliers and contractors, such as requests for quotes, invoicing, payments, reports to State entities, < b>f) Reports or interactions that by law or internal policies are required to be made, g) Fee payments, h) Audit the services provided by providers, i) Attention to queries, requests, requests, actions and claims, made by the owner of the information or by their heirs, j)Disseminate events special s, news, novelties and activities of interest, k) Use and preserve the information consecrated in the video surveillance system used to guarantee the security of the goods, facilities and people that are within the company and its branches.

• PROCESSING OF PERSONAL DATA OF SHAREHOLDERS: The data of the shareholders of MASCONTROL CONSULTORES S.A.S., will be processed in accordance with the following purposes: a) Keep carry out the calls and general meetings of shareholders and prepare the respective minutes of the meeting, b) Execute the distribution of dividends that may be appropriate, c) Respond to the surrender requests of accounts, d) Respond to requests to inspect the company's accounting books, e) Respond to requests to review the company's financial statements, f) Exercising the rights conferred by the ownership of shares within a company, g) Attending to queries, requests, requests, actions and claims, made by the owner of the information or by their heirs, h) Use and preserve the information consecrated in the video surveillance system used to guarantee the security of the goods, facilities and people who are inside the company and its branches.

• PERSONAL DATA OF CLIENTS: The data of the users of MASCONTROL CONSULTORES S.A.S., will be treated in accordance with the following purposes: a)Generate a commitment contract and confirm the veracity of the information, b)Compliance with the purpose of the company and attention to the service offered, c) Commercial and contractual relationship based on its purpose, < b>d)Sending communications about services offered by MASCONTROL CONSULTORES S.A.S., e)Billing, administrative management and customer management, f)< /b> Management of collections and payments of the credits or portfolios held, g) Evaluate the quality of the service, h) Attention to queries, requests, requests, actions and claims, made by the owner of the information or by their heirs, i) Use and preserve the information enshrined in the video surveillance system used to guarantee the security of the goods, facilities and people who that are within the company and its branches, j) Sending promotions, discounts, offers, information about the company, k) Reporting to the risk centers that the MASCONTROL CONSULTORES S.A.S., considers pertinent, in case of non-payment by the client.

TREATMENT OF SENSITIVE DATA

Sensitive data is considered to be that which has the potential to affect the privacy of the owner or whose improper use may generate discrimination. Those that contain images, videos, fingerprints, photographs, recordings, voice, facial or palm recognition, etc. are part of the category of sensitive data.

Their treatment must be based on criteria of respect, understanding of difference, prohibition of discrimination and protection of privacy. All officials who make use of the data must act under the aforementioned criteria under penalty of sanctions established for that purpose.

COLLECTION OF INFORMATION

The employees, directors or shareholders of MASCONTROL CONSULTORES S.A.S., who, in carrying out the activities require data collection, will limit themselves to requesting those personal data that are strictly pertinent and adequate for the purpose for which they are collected in compliance with the purpose of the company, also will not use deceptive or fraudulent means to collect and carry out trbinding of personal data. It is prohibited to collect data beyond those indicated and authorized by the owner; Likewise, any manipulation or form of deception is prohibited at the time of requesting the authorization of the owner or his representative, consequently, it must be reported clearly and always establishing the understanding of the owner in the data processing.
< br>

CHAPTER IV
DUTIES OF MASCONTROL CONSULTORES S.A.S., AS RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

In accordance with the legal and specific definitions of this data processing policy, MASCONTROL CONSULTORES S.A.S., will act as responsible for the processing of personal data and will comply with the duties established in article 17 of Law 1581 of 2012.

The employees or officials will be considered in charge of the treatment and not responsible and will assume their responsibility as such and will have as main obligations:

a) Guarantee the holder, permanently, the full and effective exercise of the right of Habeas Data; understanding by this the right to know, update and rectify the information that rests on him in the personal databases that are managed by the person in charge of treatment,
b) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access,
c) Timely update, rectify or delete the data under the terms of the law,
d) Update the information reported by those responsible for treatment within five (05) business days from its receipt,
e) Process the queries and claims made by the owners in the terms indicated in the law,
f) Adopt an internal manual of policies and procedures to guarantee adequate compliance with the law and, in particular, for the attention of queries and claims by the owners,
g) Record in the database the legend "claim in process" in the manner in which it is regulated by law,
h) Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of personal data,
i) Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce,
j) Allow access to information only to people who can have access to it,
k) Inform the Superintendence of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the holders,
l) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

CHAPTER V
OF THE HOLDER
AUTHORIZATION OF THE HOLDER

It will be the policy of MASCONTROL CONSULTORES S.A.S., to maintain proof, even summary, of the authorization given by the owner for the processing of their data or those of their dependents, said file ( which may be digital or physical) must rest as a set that will have a manager and a protocol for its use.

The authorizations will be recorded in physical or digital media; Their models or acceptance formats will be available at the registered office and on their web portal www.mascontrolconsultores.co

CASES IN WHICH AUTHORIZATION IS NOT REQUIRED

In accordance with the provisions of current regulations, there are some cases in which authorization is not required for data processing and which are described below:

a) Information required by a public or administrative entity in the exercise of its legal functions or by court order,
b) Data of a public nature,
c) Cases of medical or health emergency,
d) Treatment of information authorized by law for historical, statistical or scientific purposes,
e) Data related to the civil registry of individuals.

In the above cases, the officials of MASCONTROL CONSULTORES S.A.S., will not require authorization to transmit data collected in their databases, the certification of the occurrence of any of the above causes will suffice to make use of the data . It will be essential to document the occurrence of the exceptional circumstance, because if there is no way to verify it, this will be considered an irregular treatment of personal data. This way of documenting the exceptional facts about data processing will be established in formats for each case and the administrative order must be attached.or judicial record, the clinical history, the certification of the investigation or any other certification indicating the reason why the treatment was carried out without authorization.

PREROGATIVES AND OTHER RIGHTS OF INFORMATION HOLDERS

Holders may submit requests to MASCONTROL CONSULTORES S.A.S., in relation to the following topics:

a) Access, know, rectify and update your personal data; this right will be known by the name of Habeas Data,
b) Request proof of the authorization granted for the processing of your data,
c) Receive information regarding the use that has been given to your personal data,
d) Go before the authorities, especially before the Superintendency of Industry and Commerce, and file complaints for violations of the provisions of current regulations and in this document,
e) Modify and revoke the authorization and/or request the deletion of personal data,
f) Have knowledge and free access to your personal data that has been processed.

CHANNELS OF ATTENTION TO THE HOLDER

In order to exercise their rights, the owners must formally submit their requests through the following communication channels:

• Written communications filed at the main address located at Carrera 89 # 38 – 31, Apto 301, Medellín – Antioquia, from Monday to Friday during office hours 8:00 am – 12 noon and 2:00 pm – 5:00 pm,
• Email: info@mascontrolconsultores.co

PROOF OF AUTHORIZATION

It may be physical or electronic. The repositories or files in which the activities carried out are reported will be kept in the commercial company and will be guarded by the person in charge for that purpose.

LIMITS OR RESTRICTIONS TO THE RIGHTS OF THE HOLDER

According to the provisions of article 21 of Decree 1377 of 2013, the consultation of personal information carried out by the owner will be free at least once every calendar month, and whenever there are substantial modifications to this Information Treatment Policy that motivate new queries. In accordance with this, in consultations that occur more frequently than once per calendar month, MASCONTROL CONSULTORES S.A.S., may charge the owner the costs of shipping, reproduction and, where appropriate, certification of documents.

The revocation of the authorization and/or request for deletion of personal data will not proceed when the owner has a legal or contractual obligation to remain in the databases of MASCONTROL CONSULTORES S.A.S.

Likewise, the information related to inactive holders may remain in the databases in compliance with the regulations of the General Social Security System and the Tax Statute, which require the conservation of historical and accounting information for strictly legal periods, being inadmissible. deletion in certain cases.

PROCEDURES TO MAKE EFFECTIVE RIGHTS OF THE HOLDERS

The holders, or their successors in title, may consult the personal information of the holder that rests in any database. Consequently, MASCONTROL CONSULTORES S.A.S., that the owners can exercise their rights through the following mechanisms:

QUERIES

In accordance with the legal obligations, in the event of a query, the following procedure will be followed:

• Prior to submitting applications, the commercial company will enable physical or electronic communication channels that are simple enough to guarantee access to personal data by data owners. These access and communication channels must facilitate in any case the rights of the owners and will be done through pre-established forms, whether physical or virtual,
• Once the query is received, it will be directed to the area in charge of personal data administration. Which will identify it, file it and proceed to study it,
• Within a maximum term of ten (10) business days from the date of receipt, the response to the query must be sent according to the communication channel established by the applicant at the time of their request, whether physical or electronic. ,
• If for any reason beyond the control of the data controller, it is not possible to attend the query within the term mentioned in the previous paragraph, the interested party will be informed two (02) business days prior to expiration, stating the reasons for the delay. and indicating the date on which your query will be answered, which in no case may exceed five (05) daysworking days following the expiration of the first installment,

CLAIMS

In accordance with the provisions of the laws that regulate the matter, the owner, his heirs or representatives, may file claims when they consider that the information contained in the database should be corrected, updated or deleted; Likewise, they may do so when they consider that the data controller has not complied with current regulatory provisions. Claims will be processed as follows:

• Once the query and complaint channels have been established that must be made known to the general public, the interested parties will present their complaints by means of a communication addressed to MASCONTROL CONSULTORES S.A.S., establishing their identification, the facts that lead them to present their claim, your information for notification and those documents that you intend to assert,
• If necessary, MASCONTROL CONSULTORES S.A.S., as the person responsible for personal data, may require the claimant to add their request within a period of five (05) days in order to respond. After two (02) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim,
• In the event that the person who receives the claim is not competent to resolve it, he or she will transfer it to the appropriate person within a maximum term of two (02) business days and will inform the interested party of the situation,
• Once the complete claim is received, a legend will be included in the database that says "claim in process" and the reason for it, within a term not exceeding two (02) business days. This legend must be kept until the claim is decided,
• The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be addressed, which in no case may exceed eight (08) business days following the expiration of the first term,
• Claims may be about rectification, updating or deletion of your personal data, after proof of your identity.

RECTIFICATION, UPDATING AND DELETION OF DATA

We will proceed in accordance with the requests of the owners of the data, provided that they present their requests in accordance with the minimum standards on the subject. The deletion will not require wielding arguments beyond the simple will of the data and therefore there will be no room for replication by the data controller.

The request for rectification, updating or deletion must be submitted through the means described above and will contain:

• The name and address of the holder or any other means to receive the response,
• Documents proving the identity or personality of your representative,
• The clear and precise description of the personal data with respect to which the holder seeks to exercise any of the rights,
• If given other elements or documents that facilitate the location of personal data,
• We will proceed in accordance with the requests of the owners of the data, provided that they submit their requests in accordance with the minimum standards on the subject. The deletion will not require wielding arguments beyond the simple will of the data and therefore there will be no room for replication by the data controller.

The images and/or diagnostic aids that are not claimed within six (06) months will be destroyed through the most appropriate method by which the impact on the environment is minimized.

THIRD PARTY AUTHORIZATION

When a holder authorizes third parties to make inquiries or request the updating and rectification of their personal data, they must send MASCONTROL CONSULTORES S.A.S. the respective authorization in person or by email, through which they are authorized for the exercise of their rights as owner. The presentation of the authorization constitutes a mandatory requirement for the provision of information, which seeks to guarantee its confidentiality against unauthorized third parties. The authorization must contain at least the following:

• Identification of the authorizing holder,
• Copy of the holder's citizenship card,
• Name and identification data of the authorized person,
• Time for which you can consult, update or rectify the information,
• Voluntary and free character of the authorization.

CHAPTER VI
TRANSMISSION OF PERSONAL DATA

MASCONTROL CONSULTORES S.A.S., in development of its purpose, may transmitpersonal data that is made with a person in charge vice versa to allow the person in charge to carry out the treatment on behalf of the person in charge. In these cases, it is not required to inform the holder or have his consent. In any case, there must be a data transmission contract or clause indicating at least the following:

• Scope of the treatment (Activities that the person in charge will carry out on behalf of the person in charge),
• Obligations of the manager towards the owner and person responsible for personal data.

CHAPTER VII
IMAGES AND VIDEOS CAPTURE

In the development of events, activities or contests that are carried out in MASCONTROL CONSULTORES S.A.S., it may capture images by means of a camera or video recorder with the purpose of keeping records or memories of the activity carried out and use them for campaigns and advertising guidelines on social networks, on its website or any other means of dissemination that allows promoting the commercial company and the services it offers.

During the events, MASCONTROL CONSULTORES S.A.S., will make available to attendees a privacy notice, strategically located for easy viewing or may require individual authorization, where the holders are informed about the operations of registration, recording and/or capture of images that are going to be carried out and in this way it is possible to obtain consent for the use of the rights over their image in photographs, procedures analogous to photography, audiovisual productions (videos) and catalogs of services, with the intention of reproducing or publishing them in physical, electronic, optical, magnetic or network media, for the development of marketing strategies for MASCONTROL CONSULTORES S.A.S.

Similarly, in the development of work activity, the employees of MASCONTROL CONSULTORES S.A.S., may be captured in images and videos, only for work purposes that allow the proper development of the object of the commercial company for verification of compliance with working hours, a strategically located notice will be placed for easy viewing or may require authorization individually, where the owners are informed about the registration, recording and/or image capture operations that are going to be carried out and in this way it is possible to obtain consent for the use of the rights over their image in photographs, procedures analogous to photography, audiovisual productions (videos) and others.

The personal information contained in the images will be treated in accordance with the principles and rules defined in this policy and in the current regulations on the protection of personal data, allocating it exclusively for the purposes that are informed and authorized by its owner. The images of children and adolescents may only be obtained and published when said treatment is previously and expressly authorized by their legal representative, ensuring respect for their prevailing rights and the special requirements contemplated in article 12 of Decree 13771 of 2013.

VIDEO SURVEILLANCE SYSTEM

MASCONTROL CONSULTORES S.A.S. uses various means of video surveillance in different internal and external sites of its facilities for security and organizational control purposes. The existence of these mechanisms will be informed through the visible dissemination of video surveillance announcements, all strategically located for easy identification. The video surveillance system will not inspect areas in which the owner's privacy is a priority.

The system will be used to guarantee the safety of goods, facilities and people who are in the facilities of the commercial company.

This information may be used as evidence in any type of process before administrative or judicial authorities subject to and in compliance with applicable regulations.

CHAPTER VIII
VALIDITY

This Policy for the Treatment of Personal Information exists since June 24, 2017 and it is updated as of February 11, 2021

Substantial changes or modifications that are incorporated into this policy will be communicated to the owner at least ten (10) days prior to its implementation. Notification of changes will be made through the appropriate means of communication.

VALIDITY OF THE DATABASES

The personal data included in the database of MASCONTROL CONSULTORES S.A.S., will be valid for the period necessary to fulfill its purposes and to allow compliance with its legal obligations.and contractual.

MARÍA FERNANDA HURTADO
C. C. 1.037.573.147
Legal representative
MASCONTROL CONSULTORES S.A.S