GENERAL PERSONAL DATA PROCESSING POLICY OF GROWTEK S.A.S.

I.DEFINITIONS

For the purposes of this Privacy Policy, the following terms shall mean:

Privacy notice

Verbal or written communication generated by the controller and addressed to the data subject for the processing of their personal data, informing them of the existence of the information processing policies that will apply to them, how to access those policies, and the purposes for which the personal data is intended to be processed.

Database

An organised set of Personal Data that is subject to Processing. For the purposes of this document, a Database means one containing information about the Data Subjects.

Data of minors (children and adolescents)

Means the personal information of those who have not reached the age of 18. Those between the ages of 0 and 12 are considered children, while those between 12 and 18 are treated as adolescents. Processing this personal data is prohibited, except where the data is public in nature or in the cases indicated by law.

Personal data

Any information linked to, or that may be associated with, one or more specific or identifiable natural persons.

Semi-private personal data

Data that is not intimate, confidential or public in nature, and whose knowledge or disclosure may be of interest not only to its data subject but also to a group of people or to society in general. In this case, the express authorisation of the Data Subject is required for its Processing. For example: financial data, and data relating to relationships with social security entities (EPS, AFP, ARL, Family Compensation Funds).

Sensitive personal data

Sensitive data means data that affects the data subject’s privacy, or whose improper use may affect the Data Subject’s privacy or have the potential to give rise to discrimination against them.

Private data

Data that, because of its intimate or confidential nature, is only relevant to the Data Subject.

Public data

Personal data that is not semi-private, private or sensitive. Among others, it includes data relating to a person’s marital status, their profession or trade, and their status as a merchant or public servant. By their nature, public data may be contained in, among others, public registries and documents.

Data Processor

A natural or legal person, public or private, who, alone or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller (GROWTEK).

Habeas data

The right of any person to know, update and rectify the information collected about them in the databases and files of public and private entities.

Data Controller

The natural or legal person, public or private, who, acting alone or with others, decides on the Database and/or the Processing of the data. For the purposes of this Personal Data Processing Policy, GROWTEK is the Data Controller.

Data Subject

The natural person whose Personal Data is subject to Processing. For the purposes of this document, Data Subjects means GROWTEK’s suppliers, contractors, employees, customers, users and visitors.

Processing

Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

II.DATA CONTROLLER AND DATA PROCESSOR

Those responsible for the Processing of the Data Subjects’ Personal Data and other information are:

IDENTIFICATION DETAILS

LEGAL NAME

GROWTEK S.A.S.

NIT (TAX ID)

902017006-0

ADDRESS

CL 45 19 50 BL 2 OF 4 ARCO IRIS DE LA COLINA, PEREIRA RISARALDA.

PHONE

+57 317 6879301

EMAIL

ACCOUNTING@GROWTEK.CO

III.PURPOSE AND PROCESSING

A. PURPOSES

The purposes for which GROWTEK will process the Data Subjects’ Personal Data are:

• In relation to the customer database:
  • Performing the service contracts entered into with customers.
  • Using the Personal Data for marketing and/or commercialising new GROWTEK services or products.
  • Measuring satisfaction levels.
  • Conducting surveys.
  • Contacting data subjects to send reminders about maintenance and warranty expiry, as well as to inform them of the grounds that could lead to loss of coverage.
  • Running loyalty campaigns.
  • Sending invitations to events.
  • Offering GROWTEK products and services.
  • Communicating information about financing products for the acquisition of GROWTEK goods and services.
• In relation to the prospective customer database:
  • Contacting Data Subjects to offer them goods and services of interest to them, to receive offers from GROWTEK, to invite them to take part in programmes, projects and events, and to share policies, projects, programmes, results and organisational changes.
  • Providing the Data Subjects’ information and personal data to GROWTEK’s subsidiaries, branches or affiliates, to commercial partners, or to other companies or persons that GROWTEK engages to process the information and fulfil the purposes described in this Policy.
  • Providing the Data Subjects’ information and personal data to commercial partners so that they may contact the Data Subjects to offer them goods and services of interest to them, receive offers from the data subjects, invite them to take part in programmes, projects and events, and share policies, projects, programmes, results and organisational changes.
• In relation to the GROWTEK employee database:
  • Communicating commercial and after-sales campaigns.
  • Inviting them to GROWTEK events.
  • Informing them about training and refresher activities for compliance with the Standards set by GROWTEK.
  • Communicating news and updates about GROWTEK products and services.
  • Sending access credentials for the virtual platforms provided for GROWTEK.
  • Sending information to recover passwords for access to the systems provided for GROWTEK.
  • Carrying out data updates.
• In relation to the supplier database:
  • Making the corresponding payments to suppliers and maintaining commercial relationships.
  • Complying with GROWTEK’s internal processes for the administration of suppliers and contractors.
• In relation to the visitor database:
  • Controlling and preserving the security of GROWTEK’s people, property and information.

PURPOSES COMMON TO ALL DATABASES:

• Managing all information necessary to comply with GROWTEK’s tax obligations and its commercial, corporate and accounting records.
• Sharing policies, projects, programmes and organisational changes.
• Controlling and preserving the security of GROWTEK’s people, property and information.
• Carrying out processes within GROWTEK for development, operational and/or systems administration purposes.
• Suggesting products or services (including those of third parties) that GROWTEK believes may be of interest to the Data Subject.
• Contacting them as a potential customer to keep them informed and to offer our services or improve the existing ones.
• Assessing the level of satisfaction with our services and with those of the Website, and conducting studies on consumption habits, preferences and services of interest to the Data Subject.
• Maintaining communication with the Data Subject.
• Responding to questions, complaints, claims, comments or suggestions regarding the products and/or services offered by GROWTEK.
• Carrying out the process of archiving, updating systems, and protecting and safeguarding GROWTEK’s information and databases.
• Any other purposes determined by the controllers in the course of obtaining Personal Data for Processing, in order to comply with legal and regulatory obligations as well as with GROWTEK’s policies.

B. PROCESSING OF PERSONAL DATA

GROWTEK will process the Data Subjects’ Personal Data in order to fulfil the purposes described in this Policy. Such processing may include the following:

• Communicating with Data Subjects for contractual, informational or commercial purposes.
• Establishing communication between GROWTEK and the Data Subjects for any purpose related to the purposes set out in this policy, whether by telephone calls, text messages, email and/or physical mail.
• Offering or informing the Data Subject about GROWTEK products and/or services that may be of interest to them, as well as providing general information by email as part of an update, communication, news item or Newsletter.
• Where applicable, using the information to handle claims, complaints and suggestions regarding the services offered by GROWTEK.
• Carrying out or implementing the acquisition or offering of products or services by GROWTEK.
• Collecting information about the device being used to view or use the Website — such as the IP address or the type of Internet browser or operating system used — and linking it to personal information to ensure that the Website provides the best online experience.
• Assessing use of the Website (anonymously and in aggregate), as well as compiling statistics on Data Subjects’ activity, such as times of visits, frequency of visits and the website that referred them to the Website, so that the Data Subjects’ experience on the Website can be personalised.
• Inviting and contacting Data Subjects to take part in conferences, workshops and any other event organised by GROWTEK.
• Auditing, studying and analysing the information in the Databases in order to design commercial strategies and to expand and/or improve the products and services offered by GROWTEK.
• Combining the Personal Data with information obtained from other partners or companies, or sending it to them, in order to implement joint commercial strategies.
• Providing the Data Subjects’ information and Personal Data to GROWTEK’s subsidiaries, branches or affiliates, to commercial partners, or to other companies or persons that GROWTEK engages to process the information and fulfil the purposes described in this Policy.
• Where the information must be disclosed in order to comply with laws, regulations or legal proceedings; to ensure compliance with the terms and conditions; to stop or prevent fraud or attacks on the security of GROWTEK or others; to prevent technical problems; or to protect the rights of others as required by the terms and conditions or by law.
• Where applicable, consulting, storing and using financial information obtained from third-party database administrators, subject to the Data Subject’s express authorisation for such consultation.
• Any others described in this policy or permitted by law, as well as those necessary to fulfil the purposes described in this document.

IV.DATA PROVIDED AND HOW IT IS OBTAINED

GROWTEK may expressly request from Data Subjects, or collect from their behaviour, the data necessary to fulfil the purpose of the Databases, which includes, among others:

• In relation to the customer, supplier and visitor databases:
  • First and last names,
  • Identification number,
  • Date of birth,
  • Mailing address,
  • Contact telephone number,
  • Email address,
  • Commercial and judicial background,
  • Commercial and family relationships with other companies or with public entities,
  • Needs and interests,
  • Place of work,
  • Fingerprints,
  • Photographs or images of the face and body,
  • Signature,
  • Needs and interests,
  • Dates and times of access to GROWTEK’s premises, and any other data necessary to achieve the purposes described.
• Data collected for the database of staff of GROWTEK’s dealer network:
  • First and last names,
  • Identification number,
  • Date of birth and age,
  • Mailing address,
  • Neighbourhood and contact telephone number,
  • Email address,
  • Signature,
  • Needs and interests,
  • The business or company they work for,
  • The position they hold in the business or company they work for;
  • Accounting, financial and credit information,
  • Health promotion entity,
  • Any other data necessary to achieve the purposes described.

The data may be provided explicitly to GROWTEK through entry or onboarding forms; collected in person through its employees, service providers or representatives; obtained by consulting third parties that administer Databases; or collected implicitly from target-group analysis operations, from the acquisition of the products or services offered by GROWTEK, or from the Data Subjects’ behaviour, such as claims, requests for information, surveys, proposals, offers, visits to GROWTEK’s premises, and participation in projects, programmes and events, among others. GROWTEK will only collect and/or process data considered Sensitive Data in the cases permitted by law. In such cases, Data Subjects are not obliged to provide such data or to authorise its processing. Once such data has been provided and the corresponding consent given, the data will be collected and processed solely for the purposes described in this Privacy Policy.

V.COOKIES

GROWTEK uses cookies and other tools that automatically collect information from people when they use the Website, on the understanding that entering the Website is unequivocal conduct constituting authorisation. The type of information that may be collected in this way includes:

• Uniform Resource Locator (URL) information,
• Information about the browser used by the Data Subject,
• Details of the pages visited by the Data Subject,
• IP address,
• Clicks,
• Hyperlinks
• Queries

Most Internet browsers are configured to accept cookies. Users can change this setting to block them or to be alerted when they are being sent to their device.

VI.AUTHORISATION FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA AND OTHER INFORMATION

By voluntarily providing any Personal Data in the manner set out in this Policy and/or by express verbal or written authorisation, the Data Subject expressly or unequivocally authorises GROWTEK to collect their Personal Data and any other information they may provide, and to carry out the Processing of their Personal Data in accordance with this Privacy Policy and the applicable legal provisions.

VII.CHANGES TO THE PROCESSING POLICY.

Any substantial change or modification to this Privacy Policy will be communicated to Data Subjects in a timely manner by means of a notice on the Website or by email.

VIII.INFORMATION AND DATA OF MINORS

As a general rule, GROWTEK does not use, store or carry out any processing of the personal data of minors, unless strictly necessary. However, should data of minors be collected for any reason, GROWTEK will take into account respect for and the prevalence of the rights of minors, their best interests and their fundamental rights, in accordance with the provisions of personal data protection legislation.

IX.STORAGE OF PERSONAL DATA

The Data Subject expressly authorises GROWTEK to store their Personal Data in whatever manner it deems most secure and appropriate for the proper protection of the Data Subjects’ data.

X.SECURITY MEASURES FOR THE PROTECTION OF PERSONAL DATA AND OTHER INFORMATION

GROWTEK’s security measures seek to protect the Data Subjects’ data in order to prevent its loss, alteration, and unauthorised use and access. To that end, GROWTEK diligently implements the human, technical and administrative measures reasonably available to it.

The Data Subject expressly accepts this form of protection and declares that they consider it appropriate and sufficient for all purposes.

XI.RIGHTS OF DATA SUBJECTS

GROWTEK informs Data Subjects that, under current legislation, they have the right to access, update and rectify their information and/or to revoke the authorisation for its processing. In particular, the rights of data subjects as set out in article 8 of Law 1581 of 2012 are:

• To access, update and rectify their Personal Data
• To request proof of the authorisation granted
• To be informed, upon request, of the use made of their Personal Data;
• To file complaints with the Superintendencia de Industria y Comercio for breaches of the provisions of the law
• To revoke the authorisation and/or request deletion of the data
• To access their Personal Data that has been subject to Processing free of charge.

AREA RESPONSIBLE FOR REQUESTS, ENQUIRIES AND CLAIMS

The area responsible for handling Data Subjects’ requests, enquiries and claims for the exercise of their rights to access, update, rectify and delete their data and to revoke their authorisation is GROWTEK’s HUMAN RESOURCES DEPARTMENT, which may be contacted at the following email address ACCOUNTING@GROWTEK.CO and/or the following telephone number +57 317 6879301.

PROCEDURE FOR EXERCISING YOUR RIGHTS

Should you wish to exercise your rights, the Data Subject must send an email or physical letter to the contact addresses set out in this Privacy Policy. The procedure to be followed for such communications is as set out below:

• Requests and enquiries regarding Personal Data: Where the Data Subject or their successors in title wish to consult the information held in the Databases, GROWTEK will respond to the request within a maximum of ten (10) business days. In compliance with the provisions of Law 1581 of 2012, where it is not possible to address the enquiry within that period, the Data Subject will be informed, the reasons for the delay will be explained, and they will be given the date on which their enquiry will be addressed, which may not exceed five (5) business days following the expiry of the first period.
• Revocation of authorisation, withdrawal or deletion from the Database, and claims regarding Personal Data: Where the Data Subject or their successors in title consider that the information contained in the Databases should be corrected, updated or deleted, or where they identify an alleged breach of any of the duties set out in Law 1581 of 2012, they may submit a claim to GROWTEK, which will be handled under the following rules:
  • The claim must be made by means of a request addressed to GROWTEK identifying the Data Subjects, describing the facts giving rise to the claim and providing an address, attaching any supporting documents.
  • If the claim is incomplete, GROWTEK may request the interested party to remedy the deficiencies within five (5) days of receiving the claim.
  • If two (2) months elapse from the date of the request without the applicant providing the information requested, they will be deemed to have withdrawn the claim.
  • Where GROWTEK is not competent to resolve the claim, it will refer it to the appropriate party within a maximum of two (2) business days and will inform the Data Subject of the situation, whereupon it will be released from any claim or liability for the use, rectification or deletion of the data. Once the complete claim has been received, where it cannot be resolved promptly and provided it is technically feasible, a legend reading "claim in progress" together with the reason for it will be added to the database within no more than two (2) business days. That legend must remain until the claim has been decided. The maximum period for addressing the claim will be fifteen (15) business days from the day following the date of its receipt.
  • Where it is not possible to address the claim within that period, the Data Subject will be informed of the reasons for the delay and of the date on which their claim will be addressed, which may in no case exceed eight (8) business days following the expiry of the first period. Withdrawal or deletion will not proceed where there is a contractual duty to remain in GROWTEK’s database.

XII.CONTACT

Any questions or additional information will be received and processed by sending them to the contact addresses set out in this Privacy Policy.

IDENTIFICATION DETAILS

LEGAL NAME

GROWTEK S.A.S.

NIT (TAX ID)

902017006-0

ADDRESS

CL 45 19 50 BL 2 OF 4 ARCO IRIS DE LA COLINA, PEREIRA RISARALDA

PHONE

+57 317 6879301

EMAIL

ACCOUNTING@GROWTEK.CO

XIII.VALIDITY PERIOD OF THE DATABASE

GROWTEK’s Databases, and the Personal Data contained in them, will remain in force for as long as necessary to fulfil their purposes.

XIV.APPLICABLE LEGISLATION

The national legislation in force on the protection of Personal Data is contained in Law 1581 of 2012, Decree 1377 of 2013 and Law 1266 of 2008, and any provisions amending or supplementing them.