TREATMENT AND PROTECTION OF PERSONAL DATA POLICY OF AROCA VIVES ABOGADOS S.A.S.

Aroca Vives Abogados S.A.S., with its principal office located in the city of Barranquilla at Carrera 57 # 74 – 144, and available via email at info@arocavives.com or by phone at +57 3176372834 | +57 (605) 310 0090 (“Aroca Vives”), hereby presents its Personal Data Treatment and Protection Policy, in compliance with Articles 15 and 20 of the Colombian Constitution, Law 1581 of 2012, and Regulatory Decree 1377 of 2013.

1. OBJECTIVE

This Policy applies to all holders of personal data processed by Aroca Vives Abogados.

2. DEFINITIONS

For the purposes of this Policy and in accordance with current data protection regulations, the following definitions shall apply:

2.1. Authorization:

Prior, express, and informed consent granted by the Data Subject for the processing of their personal data.

2.2. Privacy Notice

A verbal or written communication issued by the Data Controller to the Data Subject, informing them of the existence of data processing policies, the means to access them, and the purposes for which their personal data will be processed.

2.3. Database

An organized set of personal data that is subject to processing.

2.4. Personal Data

Any information that is linked to, or can be associated with, one or more identified or identifiable natural persons.

2.5. Private Data

Information that, due to its intimate or confidential nature, is relevant only to the data subject.

2.6. Public Data

Public data refers to information that is not classified as semi-private, private, or sensitive. It includes, among others, data such as an individual’s marital status, profession or occupation, and their registration as a merchant (e.g., Chamber of Commerce) or public official. By its nature, public data may be found in public registries, official documents, government bulletins, and final judicial rulings not subject to confidentiality. This data may be obtained and shared freely, without restriction, regardless of whether it relates to general, private, or personal matters.

2.7. Semi-private Data

Semi-private data refers to information that is neither intimate, confidential, nor public in nature, and whose access or disclosure may be of interest not only to the data subject but also to a specific group of individuals or to society at large.

2.8. Sensitive Data

Sensitive data refers to information that affects the data subject’s privacy or that, if misused, could result in discrimination. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or political parties — including data related to the rights and guarantees of opposition political groups — as well as information concerning health, sexual orientation, and biometric data.

2.9. Data Processor

A natural or legal person, public or private, who, by themselves or in association with others, carries out the Processing of personal data on behalf of the Controller.

2.10. Data Controller

A natural or legal person, public or private, who, by themselves or in association with others, determines the purpose and means of Processing personal data and/or the structure of the database.

2.11. Data Subject

A natural person whose personal data is subject to Processing.

2.12. Processing

Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

2.13. Transfer

The transfer of data occurs when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient who, in turn, is the Controller and is located either within or outside the country.

2.14. Transmission

The Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia, when the Processing is carried out by the Processor on behalf of the Controller.

3. PRINCIPLES

All processing of personal data shall be governed by the principles and provisions established in the Law and this Policy.

 4. RESPONSIBLE FOR DATA PROCESSING

Aroca Vives shall be deemed responsible for the processing of personal data in accordance with the current regulatory framework and this Data Processing Policy.

 5. PURPOSES OF DATA PROCESSING

The personal information and data provided may be used by Aroca Vives, as the Data Controller, to fulfill the Company’s objectives and functions, including but not limited to statistical analysis, commercial and IT purposes, monitoring of services provided, marketing, user notification and contact, accounting and payroll management, execution of contractual relationships, and other purposes applicable to each data subject. Additionally, specific uses authorized by the data subject shall apply, all in accordance with the guiding principles for the processing of personal data.

Personal data will be collected, stored, organized, used, circulated, transmitted, transferred, updated, rectified, deleted, eliminated, and generally managed in accordance with, and proportional to, the purpose(s) of each processing, and for a reasonable and necessary period. For this purpose, Aroca Vives will consider the applicable provisions, as well as administrative, accounting, tax, legal, and historical aspects of the information.

6. AUTHORIZATION FOR THE USE OF PERSONAL DATA

Access to the website and services offered by Aroca Vives shall be deemed as consent to data processing when the data involved do not require prior informed consent from the Data Subjects. In all other cases, Aroca Vives will request prior and informed authorization from the Data Subjects.

Data Subjects may provide their authorization (i) in writing, (ii) verbally, or (iii) through unequivocal conduct that reasonably implies consent. Silence shall not be construed as such consent under any circumstances.

7. RIGHTS OF THE DATA SUBJECT

The rights of the Data Subject are as follows:

Right to update, access, and deletion: To know, update, and rectify their personal data with the Data Controllers or Data Processors designated by Aroca Vives. This right may be exercised in cases of partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or unauthorized.

Right of proof: To request evidence of the authorization granted, except when expressly exempted as a requirement for processing.

Right to information: To be informed, upon request, about the use made of their personal data.

Right to complaints and claims: To file complaints with the Superintendence of Industry and Commerce for violations of this law and its amendments.

Right of revocation: To revoke the authorization and/or request deletion of the data when processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce determines that the Controller or Processor has engaged in conduct contrary to this law and the Constitution.

Right of access: Access free of charge to your personal data that have been subject to Processing.

8. PROCEDURES FOR EXERCISING YOUR RIGHTS AND RESPONSIBLE PARTIES

8.1. Inquiry Procedure:

Data Holders may request access to their personal information held by Aroca Vives, who will provide all information contained in the individual record or linked to the identification of the Holder.

Requests must be submitted via email to info@arocavives.com or by sending a written communication to the administrative address of Aroca Vives Abogados S.A.S., located in Barranquilla at Carrera 57 #74-144.

Responses will be provided within a maximum period of ten (10) business days from the date of receipt. If it is not possible to respond within this timeframe, the requester will be informed of the delay, the reasons for it, and the new response date, which shall not exceed five (5) business days after the original deadline.

8.2. Procedure for Filing Claims:

A Data Holder who believes that the information contained in a database should be corrected, updated, or deleted, or who suspects a breach of any duties established by law, may file a claim with Aroca Vives, which will be processed according to the following rules:

(i) The claim must be submitted by means of a request addressed to Aroca Vives via email at info@arocavives.com or by sending a written communication to the administrative address of Aroca Vives Abogados S.A.S., located in Barranquilla at Carrera 57 #74-144. The claim must include the identification of the Holder, a description of the facts giving rise to the claim, the address, and any supporting documents the claimant wishes to provide.

If the claim is incomplete, the interested party will be requested to correct the deficiencies within five (5) days following receipt of the claim. If the requested information is not provided within two (2) months from the date of the request, the claim will be considered abandoned.

If the person receiving the claim is not authorized to resolve it, they will forward it to the competent party within a maximum term of two (2) business days and inform the claimant of the situation.

(ii) Once the completed claim has been received, it will be labeled with the status “claim in process” and the reason for the claim, within no more than two (2) business days. This status will be maintained until the claim is resolved.

(iii) The maximum term to address the claim shall be fifteen (15) business days from the day following its receipt. If it is not possible to address the claim within this term, the interested party will be informed of the reasons for the delay and the new date when the claim will be addressed, which shall not exceed eight (8) business days after the first term has expired.

8.3. Procedure for Updating, Rectification, and Deletion of Data

Aroca Vives Abogados will rectify and update, at the request of the Holder, any information that is proven to be incomplete or inaccurate, following the procedure for filing claims. For this purpose, the Holder must send the request via email to info@arocavives.com or by written communication addressed to the administrative office of Aroca Vives Abogados S.A.S., located in Barranquilla at Carrera 57 #74-144, indicating the update, rectification, or deletion requested and attaching the supporting documentation.

8.4. Procedure for Revocation of Authorization

Personal data owners may revoke their consent to the processing of their personal data at any time, provided that it is not restricted by any legal or contractual provision, by submitting a claim via the email address info@arocavives.com or by sending a written communication to the administrative address of Aroca Vives Abogados S.A.S., located in Barranquilla at Carrera 57 #74-144.

9. EFFECTIVENESS

This Data Treatment and Protection Policy is effective as of the date of its issuance.

10. MODIFICATIONS

This Policy may be modified by Aroca Vives when required, without prior notice, provided that such modifications are not substantial. Otherwise, they will be communicated in advance to the Data Holders.