VI.1. Collection of Personal Data

OlarteMoure will only process the Personal Data that have been authorized by the Data Subject in a prior, express and informed manner by means of an Authorization granted in writing, verbally or by means of an unequivocal conduct on the part of the Data Subject. The copy of the mentioned Authorization will be kept by OlarteMoure.

At the time the Data Subject grants his or her Authorization, OlarteMoure will inform him or her of the Purposes and the Processing to which his or her Personal Data will be subject, his or her rights and the means by which he or she may exercise them. The Data Subject may revoke his or her authorization and request the immediate deletion of his or her Personal Data through the channels established in this Policy, unless he or she has a contractual or legal duty to remain in the Database.

OlarteMoure reserves the right to collect personal data from different stakeholders such as image, fingerprint and other identification data, at the time of entering any of its facilities located in Bogota, Medellin, Barranquilla, Bucaramanga or Cali, for security reasons and for the sole purpose of complying with surveillance protocols. In this case, the authorization will be given by the unequivocal conduct of entering the facilities, in accordance with the corresponding privacy notices.

OlarteMoure will not be obliged to request the Authorization of the Personal Data Holder when it concerns: i) information required by a public or administrative entity in the exercise of its legal functions or by court order; ii) Public Data; iii) cases of medical or health emergency; iv) information authorized by law for historical, statistical or scientific purposes; and, v) data related to the Civil Registry of Persons.

VI.2. Access to Personal Data

Access to the Databases that are under the responsibility of OlarteMoure will only be available to OlarteMoure Personnel who need to access and process the information for the performance of their duties.

OlarteMoure will not share or deliver the Databases or the Personal Data stored in them to third parties with whom it does not have any kind of relationship. However, in cases where it is required to achieve the authorized Purposes, the Personal Data may be legitimately transmitted to business partners or suppliers, with whom the corresponding personal data transmission agreement will be signed to protect the information and the rights of the Data Subjects and to take all relevant measures to ensure that the Processing of the information by its Agents and/or its business partners or service providers is carried out in compliance with this Policy.

For all purposes, OlarteMoure may only deliver information contained in its Databases to: the Holders, their assignees or their legal representatives; public or administrative entities in the exercise of their legal functions or by court order; third parties authorized by the Holder or by law. OlarteMoure reserves the right to request additional documentation in order to verify the quality of the person requesting the information.

VI.3. Purposes and Processing of the Personal Data of our Stakeholders

Notwithstanding what is stated in the Authorization request, OlarteMoure will process the Personal Data of its Stakeholders for the following purposes:

6.3.1 Our Shareholders

6.3.1.1 Purposes of Personal Data Processing

a) Maintain an efficient communication with information that is useful for the development and fulfillment of the existing obligations with our shareholders.

b) To carry out all administrative, accounting and tax activities that allow OlarteMoure to comply with its social, corporate, credit or any other kind of obligations with its shareholders.

c) To keep our shareholders informed about current issues related to OlarteMoure’s commercial activities and the development of its corporate purpose.

d) Submit information to control and surveillance authorities and support internal or external auditing processes.

6.3.2 Our Human Talent

6.3.2.1 Purposes of Personal Data Processing

a) Perform all activities necessary to properly execute existing contracts with OlarteMoure employees and comply with the obligations arising therefrom, including the payment of salaries, social benefits and others arising from the employment relationship.

b) Execute the current contract with OlarteMoure and verify compliance with internal policies of OlarteMoure and its business purposes including, but not limited to compliance with legal or contractual obligations with third parties.

c) Maintain efficient communication of information that is useful for the development and fulfillment of existing contracts with employees.

d) Manage information systems and communications OlarteMoure, including, generate copies and backup files of the information contained in the equipment provided by OlarteMoure.

e) Improve the content and navigability of the website, as well as ensure compliance with its terms and conditions.

f) Conduct corporate welfare programs for workers, corporate compliance, monitoring of the Health and Safety Management System of OlarteMoure and for health promotion and prevention activities.

g) Conduct medical and occupational health examinations and issue certificates of fitness for work.

h) Take and store photographs in the framework of events held internally to develop publications in corporate media.

i) Send communications by physical mail, email, mobile devices, or through any other analog and/or digital means of communication with commercial, advertising or promotional information about services, events, promotions, campaigns and/or contests of commercial or advertising nature, advanced by OlarteMoure.

j) Keep our employees informed about current issues related to the activities of OlarteMoure and the development of its corporate purpose.

k) Submit information to control and surveillance authorities, support internal or external audit processes and perform statistical studies or accounting processes.

l) Send information related to the liquidation, completion of activities and participation in future selection processes, after the termination of the labor contract.

m) To develop selection, evaluation and employment processes, to carry out security studies and to maintain an efficient communication of the information that is useful for the development of these processes.

n) Know and evaluate the information related to their academic, professional and labor activities.

o) Carry out statistical studies or accounting processes and support internal or external auditing processes.

p) Submit information to authorities or under court order.

6.3.2.2 Tratamiento de los Datos Personales de nuestros Talento Humano

a) Treatment of the Personal Data of our Human Talent

OlarteMoure may collect Sensitive Personal Data of its Human Talent in order to comply with the obligations arising from the contract signed or to be signed with them, the purposes mentioned in paragraph 6.3.2.2, the requirements made by public or judicial authorities and legal, labor, accounting or tax obligations that may apply.

In these cases, OlarteMoure undertakes to request the Authorization for the Processing of Sensitive Personal Data of employees, in accordance with the provisions of paragraph 6.1 of this Policy and the requirements of the Colombian Personal Data Protection Regime. Additionally, OlarteMoure shall inform the employees of the Sensitive Personal Data that would be subject to Processing, the specific purposes of its Processing and that, since it is Sensitive Personal Data, the employee is not obliged to provide it, unless such information is strictly necessary for the performance of his or her duties or to safeguard other fundamental rights such as health and life. In the aforementioned cases or in the event that the collection of the Sensitive Personal Data is necessary for the fulfillment of a legal, labor, accounting or tax obligation, the employee will cease to provide the information and OlarteMoure will undertake to limit the access of its Personnel to this information.

OlarteMoure may have access to the Sensitive Personal Data of applicants in selection processes, during the development of the evaluation process and the security study. In the event that the applicant is chosen and is linked to OlarteMoure, your information will be subject to the same Processing of Personal Data of employees. On the contrary, in case the applicant is not selected, his/her Personal Data will be removed from OlarteMoure’s Databases, remaining only the Personal Data of public and contact nature.

b) Processing of Personal Data of minors provided by our Human Talent

OlarteMoure may request from employees Personal Data of minors with respect to which the employee performs affiliations, links to the Health System or for the development of corporate welfare programs. In these cases, OlarteMoure will take into account: i) respect for the fundamental rights of minors; and, ii) respect for the best interests of children and adolescents.

Likewise, OlarteMoure will make its best effort to verify that the person acting as legal representative of the child or adolescent actually has this capacity. However, OlarteMoure will rely on the good faith of the Workers who grant the Authorization for the Processing of Personal Data of minors and indicate that they have the status of legal representatives.

6.3.3 Our Suppliers or Contractors

6.3.3.1 Purposes of Personal Data Processing

a) Contact and hire suppliers of services or products that OlarteMoure requires for the development of its activities and the provision of its facilities or offices; as well as make the necessary requests to report the accounting, legal and tax information related to them.

b) To carry out all the necessary activities to properly execute the existing contracts with the Suppliers.

c) Verify the information in credit bureaus or restrictive lists, with the purpose of using it as an element of analysis in the commercial relationship, and when necessary, make the necessary reports.

d) Keep our suppliers informed about current issues related to their commercial activities and the development of their corporate purpose.

e) To carry out accounting, fiscal, administrative, due diligence, invoicing and other tasks related to the commercial relationship.

f) Send commercial information about the activities carried out by OlarteMoure and the launch of new products or services.

g) Improve the content and navigability of the website, as well as ensure compliance with its terms and conditions.

h) Send communications by physical mail, email, mobile devices, or through any other analog and / or digital means of communication with commercial, advertising or promotional information about services, events, promotions, campaigns and / or contests of commercial or advertising, advanced by OlarteMoure.

i) Submit information to control and surveillance authorities.

j) Support internal or external audit processes and perform statistical studies or accounting processes.

6.3.3.2 Processing of Personal Data

OlarteMoure will limit itself to collect and process corporate Personal Data from its Suppliers who are natural persons or from the workers and/or collaborators of our Suppliers or Contractors who are legal entities.

In the latter case, OlarteMoure will request the Supplier’s Authorization, who will also be authorizing the Processing of Personal Data of its employees and collaborators. OlarteMoure will understand that the supplier is in the capacity to grant the mentioned Authorization and that in that sense its workers and contractors have authorized the treatment of their data as workers or collaborators of the legal person with whom OlarteMoure has a commercial relationship, as well as that the person who signs the Authorization has the capacity to do so.

6.3.4 Our Clients or Service Users

6.3.4.1 Purposes of Personal Data Processing

a) To adequately provide the contracted services, as well as to keep them informed about the progress, status, activities and other issues related to the contracted services.

b) Contact clients in case of complaints, claims or suggestions about OlarteMoure’s service, carry out satisfaction campaigns, follow up on the provision of its services and evaluate the quality of the services provided by the workers.

c) Carry out accounting, fiscal, administrative, due diligence, invoicing, and other tasks related to the commercial relationship.

d) Verify the information in credit bureaus, in order to use it as an element of analysis in the commercial relationship, and when necessary, make the necessary reports.

e) Keep our clients informed about current issues related to their commercial activities and the development of their corporate purpose.

f) Send commercial information about the activities carried out by OlarteMoure and about the launching of new products or services.

g) Send communications by physical mail, email, mobile devices, or through any other analog and / or digital means of communication with commercial, advertising or promotional information about services, events, promotions, campaigns and / or contests of commercial or advertising, advanced by OlarteMoure.

h) Submit information to control and surveillance authorities and support internal or external audit processes.

i) To carry out statistical studies or accounting processes.

6.3.4.2 Processing of Personal Data

OlarteMoure will limit itself to collect and process corporate Personal Data of its Clients who are natural persons or of the workers and/or collaborators of our Clients who are legal entities.

In the latter case, OlarteMoure will request the Customer the Authorization for the Processing of Personal Data of its employees and collaborators by means of the corresponding Authorization signed by the legal representative. OlarteMoure will understand that the Client is in the capacity to grant the mentioned Authorization and that the person who grants it has the quality of legal representative.

6.3.5 Our Business Contacts

6.3.5.1 Purposes of the Processing of Personal Data

a) Keep our partners informed about current issues related to their business activities and the development of their corporate purpose.

b) Send commercial information about the activities carried out by OlarteMoure and about the launching of new products or services.

c) Improve the content and navigability of the website, as well as ensure compliance with its terms and conditions.

d) Send communications by physical mail, email, mobile devices, or through any other analog and / or digital means of communication with commercial, advertising or promotional information about services, events, promotions, campaigns and / or contests of commercial or advertising, advanced by OlarteMoure.

e) Submit information to control and surveillance authorities.

f) Carry out statistical studies or accounting processes and support internal or external auditing processes.

6.3.5.2 Treatment of Personal Data

OlarteMoure will limit itself to collect and process corporate Personal Data from its Business Contacts who are natural persons or from the employees and/or collaborators of our Business Contacts who are legal entities.

In the latter case, OlarteMoure will request to the Business Contacts the Authorization for the Processing of Personal Data of their employees and collaborators by means of the corresponding Authorization signed by the legal representative. OlarteMoure will understand that the Commercial Contacts are in the capacity to grant the mentioned Authorization and that the person who grants it has the quality of legal representative.

Likewise, OlarteMoure will collect Personal Data in the events it carries out, sponsors or participates in, in which case it will request the Authorization in the corresponding event and the Treatment of this information will be subject to the provisions established for the Treatment of the information of the Commercial Contacts. Likewise, it shall be understood that it is authorized through unequivocal conduct with the delivery of the information by the attendees when they voluntarily provide their data to be contacted and deliver personal business cards.

6.4 Commitment to privacy and security

OlarteMoure is committed to the confidentiality and security of the Personal Data stored in its Databases, under access and availability restrictions, preventing its consultation by unauthorized third parties.

Based on the above, OlarteMoure guarantees the Holders of the Personal Data the conservation of the same under security conditions typical of the industry, which prevent its adulteration, loss, theft, public consultation, use or unauthorized or fraudulent access, as well as the implementation of internal practices that contribute to a safe environment of the information.

OlarteMoure implements reasonable organizational, technical and administrative measures designed to protect the information under its responsibility. However, it cannot guarantee the complete security of any data transmission over the Internet or data storage systems. If you have reason to believe that your interaction with OlarteMoure is no longer secure we ask you to inform us immediately through your usual point of contact at OlarteMoure or the channels indicated in paragraph 8.1 above.

6.5 Processing of Unsolicited Personal Data of Minors

OlarteMoure services are not directed to minors, therefore, OlarteMoure will refrain from the Processing of Personal Data of children or adolescents. In case it is necessary to collect or process Personal Data of minors, OlarteMoure will limit itself to the Processing of Public Personal Data or will request the corresponding Authorization of their legal representative.

OlarteMoure will make its best effort to verify that the person acting as legal representative of the child or adolescent actually has this quality. However, it will rely on the good faith of whoever grants the Authorization for the Processing of Personal Data of the child or adolescent and indicates that he/she is the legal representative.

6.6 Processing of Unsolicited Sensitive Personal Data

OlarteMoure appreciates the prudence and discretion of the Data Controllers in the disclosure of the Sensitive Personal Data when they are not directly requested and requests that under no circumstances they be disclosed to OlarteMoure without having granted their prior, express, free and informed Authorization. If you have any doubts regarding the need to provide Sensitive Personal Data, please contact us prior to providing it.

In those cases in which it is absolutely necessary, OlarteMoure will inform the Data Controllers the Sensitive Personal Data that would be subject to Processing, the specific Purposes of its Processing and that, since it is Sensitive Personal Data, it is not obliged to provide it.

6.7 Unsolicited Personal Data

Prior to the formal commencement of commercial or labor relations with OlarteMoure, it is possible that Personal Data may be sent to us without the prior and express Authorization granted by the Data Subject. In these cases, the Data Subject accepts that by means of his unequivocal conduct, consisting of sending his information to OlarteMoure, he authorizes the Processing of his Personal Data with the Purpose strictly related to the procedure or request made to OlarteMoure.

The Authorization by unequivocal conduct shall apply, including but not limited to, the sending of information from: i) people who wish to work in OlarteMoure; and, iii) people who wish to be linked as suppliers of OlarteMoure. Notwithstanding the foregoing, and only in the event that the relationship with these third parties is formalized, the corresponding Authorization will be requested to continue with the Processing of Personal Data.

6.8 Temporary Limitations on the Processing of Personal Data

OlarteMoure will keep a record of its Stakeholders’ information before, during and after termination of the contractual relationship, which may include Personal Data and only for the purposes mentioned above. This information will be retained for a reasonable retention period based on: (i) the time during which we have a relationship with you and provide you with our services; and, (ii) there is a legal, accounting or administrative obligation and/or legal, administrative, auditing or regulatory requirements to which we are subject.

In any case, we will store the Personal Data for a maximum period of CY + 20 (current year + 20 years). At the end of this time, we will destroy the Personal Data or delete it from our Databases.

6.9 Prohibition or revocation of the Authorization for the Processing of Personal Data

The Data Subjects are free to prohibit or not to authorize the Processing of their Personal Data by OlarteMoure, except on occasions when, due to legal or contractual requirements, the conservation of this Personal Data is necessary. However, in the event that some of the members of our Stakeholders do not authorize the use of their Personal Data or request the revocation of the Authorization, OlarteMoure may not be able to continue with the business relationship or can not continue to provide services for not having the necessary information for these purposes.

In that sense, in case of insistence by the Data Subject on the revocation of authorization for the Processing of Personal Data, OlarteMoure is not responsible for the pre-contractual or contractual breach, or for the transfer of particular benefits that may be accessed by third parties with whom OlarteMoure communicates on an ongoing basis, as a result of the non-authorization or revocation of authorization for the Processing of personal data.

The Holders have the following rights:

7.1 To know, update and rectify their Personal Data: the Holders may exercise this right against partial, inaccurate, incomplete, fractioned, or misleading data.

In compliance with the principles that should govern the Processing of Personal Data, OlarteMoure undertakes to make its best effort to ensure that the information contained in its Databases is accurate, complete and updated. To this end, OlarteMoure may request its Customers, Suppliers and employees to update their Personal Data on an ongoing basis.

7.2 Right to request proof of the Authorization: the Data Controllers may request proof of the Authorization granted for the Processing of their data, except in the cases indicated in paragraph 5.9 of this Policy.

7.3 Right to be informed about the use that has been given to their Personal Data: the Data Controllers have the right to know at any time the use that has been given to their Personal Data, upon request addressed to OlarteMoure or its Manager.

7.4 Right to revoke the authorization and/or to request the deletion of the Personal Data: the Personal Data Holders may revoke the authorization granted to OlarteMoure for the Processing of their Personal Data, if they evidence that the constitutional and legal principles, rights and guarantees have not been respected. Likewise, the Data Controllers have the right to request the deletion of the Personal Data on which its Processing is not expressly prohibited or has not been authorized.

7.5 Right to access their Personal Data: the Holders of Personal Data subject to Processing may access them free of charge.

7.6 Right to file complaints: the Owners of Personal Data may file complaints before the Superintendence of Industry and Commerce for infringements to the provisions of the regulations in force.

7.7 Right to refrain from answering questions about sensitive data: the Data Controllers may refrain from answering questions about sensitive Personal Data. Responses regarding Sensitive Data or minors shall be optional.