Personal Data Processing Policy

NOTICE OF PRIVACY

This Privacy Notice (hereinafter the “Notice”) establishes the terms and conditions under the Grupo Akzara SAS , identified with NIT 900.983.715-1 and with address at Calle 10 # 36 32 floor 2 of Medellín, will carry out the processing of your personal data.

1. TREATMENT AND PURPOSE:

The treatment that Grupo Akzara SAS will carry out with personal information will be as follows:

The collection, storage, use, circulation for the following purposes; Carry out the pertinent steps for the development of the company's corporate purpose in what has to do with compliance with the purpose of the contract entered into with the Owner of the information. Make invitations to events and offer new products and services. Manage procedures (requests, complaints, claims). Carry out satisfaction surveys regarding the goods and services offered by Grupo Akzara SAS. Provide contact information to the commercial force and/or distribution network, telemarketing, research of the Akzara SAS Group . Contact the Owner through telephone means to carry out surveys, studies and/or confirmation of personal data necessary for the execution of a contractual relationship. Contact the Owner through electronic means – SMS or chat to send news related to loyalty campaigns or service improvements. Contact the Owner via email to send statements, account statements or invoices in relation to the obligations derived from the contract entered into between the parties. Provide the services offered by Grupo Akzara SAS and accepted in the signed contract.

2. RIGHTS OF THE OWNER:

As the owner of your personal data, you have the right to:

(i) Access free of charge to the data provided that has been processed.

(ii) Know, update and rectify your information regarding partial, inaccurate, incomplete, fragmented, misleading data, or those whose processing is prohibited or has not been authorized.

(iii) Request proof of the authorization granted.

(iv) Submit complaints to the Superintendence of Industry and Commerce (SIC) for violations of the provisions of current regulations.

(v) Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual duty that prevents deletion.

(vi) Refrain from answering questions about sensitive data. Responses that relate to sensitive data or data of children and adolescents will be optional.

3. MECHANISMS TO KNOW THE TREATMENT POLICY

The Owner can access our Information Processing Policy, which is published electronically at the web address http://www.akzaraspa.com

PERSONAL DATA PROCESSING POLICY

AIM:

Establish the criteria for the collection, storage, use, circulation and deletion of personal data processed by Grupo Akzara SAS

SCOPE:

This policy applies to all personal information registered in the databases of Grupo Akzara SAS, who acts as the person responsible for the processing of personal data.

OBLIGATIONS:

This policy is mandatory and strict compliance for Grupo Akzara SAS

RESPONSIBLE FOR THE TREATMENT:

Akzara SAS Group, legally constituted commercial company, identified with NIT 900.983.715-1, with main address at Carrera 36 # 1 sur 75 in the city of Medellín, Republic of Colombia. Page www.akzaraspa.com Telephone 604 5886767 in the city of Medellín.

TREATMENT AND PURPOSE:

The treatment that Grupo Akzara SAS will carry out with personal information will be as follows:

The collection, storage, use, circulation for the following purposes: Carry out the pertinent steps for the development of the company's corporate purpose in what has to do with the fulfillment of the purpose of the contract entered into with the Owner of the information. Make invitations to events and offer new products and services. Manage procedures (requests, complaints, claims). Carry out satisfaction surveys regarding the goods and services offered by Grupo Akzara SAS. Provide contact information to the commercial force and/or distribution network, telemarketing, research of the Akzara SAS Group .

Contact the Owner through telephone means to carry out surveys, studies and/or confirmation of personal data necessary for the execution of a contractual relationship. Contact the Owner through electronic means – SMS or chat to send news related to loyalty campaigns or service improvements. Contact the Owner via email to send statements, account statements or invoices in relation to the obligations derived from the contract entered into between the parties.

Provide the services offered by Grupo Akzara SAS and accepted in the signed contract.

RIGHTS OF THE OWNERS:

As the owner of your personal data, you have the right to:

(i) Access free of charge to the data provided that has been processed.

(ii) Know, update and rectify your information regarding partial, inaccurate, incomplete, fragmented, misleading data, or those whose processing is prohibited or has not been authorized.

(iii) Request proof of the authorization granted.

(iv) Submit complaints to the Superintendence of Industry and Commerce (SIC) for violations of the provisions of current regulations.

(v) Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual duty that prevents deletion.

(vi) Refrain from answering questions about sensitive data. Responses that relate to sensitive data or data of children and adolescents will be optional.

ATTENTION TO PETITIONS, CONSULTATIONS AND CLAIMS

The Customer Service area is the department in charge of processing the holders' requests to make their rights effective. Requests, Queries and Claims will be attended to by email akzaraspa@hotmail.com

PROCEDURE FOR THE EXERCISE OF THE RIGHT OF HABEAS DATA

In compliance with the regulations on the protection of personal data, Grupo Akzara SAS presents the procedure and minimum requirements for the exercise of your rights:

For the filing and attention of your request, we ask you to provide the following information:

Full name and surname / Contact information (Physical and/or electronic address and contact telephone numbers),

Means to receive a response to your request / Reason(s)/fact(s) that give rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete, access to the information) / Signature (if applicable) and identification number.

The maximum period provided by law to resolve your claim is fifteen (15) business days, counting from the day following the date of receipt. When it is not possible to attend to the claim within said

term, Grupo Akzara SAS will inform the interested party of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. Once the terms indicated by Law 1581 of 2012 and the other rules that regulate or complement it have been met, the Owner who is denied, totally or partially, the exercise of the rights of access, updating, rectification, deletion and revocation, may bring your case to the attention of the Superintendency of Industry and Commerce – Delegation for the Protection of Personal Data.

VALIDITY:

This Policy for the Processing of Personal Data applies as of January 1, 2022.

The databases in which personal data will be recorded will have a validity equal to the time in which the information is maintained and used for the purposes described in this policy. Once that purpose(s) is fulfilled and as long as there is no legal or contractual duty to retain your information, your data will be deleted from our databases. The personal data provided will be kept as long as its deletion is not requested by the interested party and as long as there is no legal duty to retain them.