POLICY FOR THE PROCESSING OF PERSONAL DATA OF IMPLAMEQ S.A.S.

1. SCOPE OF APPLICATION OF THE PERSONAL DATA PROCESSING POLICY OF IMPLAMEQ S.A.S.

IMPLAMEQ S.A.S., a commercial company identified with NIT.900.515.661-4, with address at calle 5 B2 # 30-14, piso 2, in the city of Cali, Valle del Cauca, in compliance with
The provisions of article 15 of the political constitution, Law 1581 of 2012 and its regulatory decrees, as RESPONSIBLE FOR THE PROCESSING, informs its SHAREHOLDERS, EMPLOYEES, CANDIDATES FOR A VACANT, SUPPLIERS, CLIENTS, and in general to
all natural persons who provide or have provided their personal data the content of this PERSONAL DATA TREATMENT POLICY, which aims to communicate to the owners of personal data what type of data we will use and the conditions in which IMPLAMEQ SAS will treat all personal data that is provided to us personally, directly and indirectly.

IMPLAMEQ SAS, will comply at all times with current regulations on the protection of personal data, will guarantee the exercise of the rights of habeas data of all holders of personal data that are in its databases and files, will develop controls and measures technical, legal and organizational tending
to establish security conditions, in order to avoid access, loss, adulteration and fraudulent use of the data under which it holds the status of RESPONSIBLE FOR THE TREATMENT OF PERSONAL DATA.

2. DEFINITIONS.

With the aim of helping to determine in a simple way the meaning of the technical word frequently used in the field of personal data protection, any owner of personal data of which IMPLAMEQ S.A.S., holds the quality of
RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA, you must understand the following
terms like this:

• Authorization: Prior, express and informed consent of the Holder to carry out the processing of personal data. (Source: Statutory Law 1581 of October 17, 2012).
• Database: Organized set of personal data that is the object of
Treatment. (Source: Statutory Law 1581 of October 17, 2012).
• Consent of the owner: It is a manifestation of the will, informed, free and unequivocal, through which the owner of the personal data accepts that a third party use their information for commercial purposes.
• Queries: The Holders or their successors may consult the information
Owner’s staff that resides in any database, be it the public or private sector. The Treatment Manager or Treatment Manager must provide them with all the information contained in the individual record or that is linked to the identification of the Owner. (Source: Statutory Law 1581 of October 17, 2012).
• Personal data: Refers to the information of natural persons
(identified or identifiable), regarding both their identity (name and surname, address, affiliation, etc.) and their existence and occupations (studies, work, illnesses, etc.)
• Public Data: It is the data classified as such according to the mandates of the law or the
Political Constitution and all those that are not semi-private or private, in accordance with this law. Public, among others, are the data contained in public documents, duly executed judicial decisions that are not subject to reservation and those relating to the civil status of individuals. (Source: Statutory Law 1266 of 2008).
• Semi-private Data: The data that does not have an intimate, reserved nature, is semi-private.
nor public and whose knowledge or disclosure may interest not only its owner but also a certain sector or group of people or society in general, such as the financial and credit data of commercial activity or services referred to in Title IV of this law. (Source: Statutory Law 1266 of 2008).
• Private Data: It is the data that due to its intimate or reserved nature is only relevant
for the holder. (Source: Statutory Law 1266 of 2008).
• Sensitive data: For the purposes of this policy, sensitive data is understood to be those that affect the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, convictions religious or philosophical, membership in trade unions, social or human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data.
• In charge of the treatment: He is the one who manipulates the personal data, but
it does not decide how or to what end. Their work is operational and is done based on the indications and instructions of the person responsible for the treatment.
• Habeas Data: It is the right that every owner of information has to know,
update, rectify or oppose the information concerning your personal data.
• Protection of personal data: It is a fundamental right that they have
all natural persons. Seeks the protection of your intimacy and privacy against a possible violation due to the improper treatment of personal data captured by a third party.
• Claim: The Holder or her successors in title who consider that the information
contained in a database must be subject to correction, update or deletion, or when they notice the alleged breach of any of the duties contained in this law, they may file a claim with the Data Controller or the Treatment Manager. (Source: Statutory Law 1581 of October 17, 2012).

• Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the Treatment of the data. (Source: Statutory Law 1581 of October 17, 2012.
• Treatment: Any physical or automated operation or procedures that
allow to capture, register, reproduce, conserve, organize, modify, transmit personal data.
• Data processing: As a general rule, consent is required by
part of the owner of the personal data to be able to carry out any treatment of their data.
• Owner of personal data: It is the natural person whose personal data is
object of treatment by a third party.

3. EXERCISE OF RIGHTS BY THE HOLDER.

If you as the owner of personal data wish to consult, claim, modify, update, rectify, suppress or revoke the authorization granted regarding the processing of your data, you can contact us through the channels that we have arranged for this purpose, which are identified below: the query or claim may be made via email by directing your communication to the following email address:
[email protected] or direct your physical communication to the address of LA
RESPONSIBLE located at calle 5 B2 # 30-14, piso 2, in the city of Cali, Valle del Cauca. You must include in the “subject” of your communication the term “CONSULTATION OR CLAIM OF
HABEAS DATA “
4. WAYS TO EXERCISE THE RIGHT OF HABEAS DATA BEFORE IMPLAMEQ S.A.S.

4.1.1 ON YOUR OWN NAME: You as the owner of personal data found in databases and files of IMPLAMEQ S.A.S., you will have the right to know, update, access, rectify, delete, request proof of authorization
granted, be informed regarding the use of your data, revoke the authorization granted.
4.1.2 EXERCISE OF THE RIGHT THROUGH AN ATTORNEY: This right may
be exercised by the duly identified interested party or by the attorney-in-fact of the owner of the personal information (a copy of the power of attorney must be attached with the request). If the request is submitted by a person other than the owner of the personal information, without complying with the presentation of the suitable document that supports the representation, it must be considered as not presented and no response will be given to said request .
4.1.3 EXERCISE OF THE RIGHT OF MINORS: Minors must
exercise your right to habeas data through whoever proves your legal representation.

5. CONSULTATION AND CLAIM PROCEDURE.

5.1 CONSULTATION PROCEDURE: The holders of the information, who wish to carry out
queries, must take into account that IMPLAMEQ S.A.S., as RESPONSIBLE FOR THE

TREATMENT, will provide said persons with all the information contained in the individual record or that is linked to the identification of the owner. The consultation will be formulated through the channels enabled in paragraph 3 “EXERCISE OF THE
RIGHTS OF THE HOLDER ”of this policy and will be attended within a maximum term of ten (10) business days from the date of receipt of the request. When it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the query will be attended, which in no case may exceed five (5) business days after expiration. of the first term, without prejudice to the provisions contained in special laws or regulations issued by the National Government that may establish lower terms, taking into account the nature of the personal data.

5.2 CLAIM PROCEDURE: The Holder who considers that the information contained in a database of IMPLAMEQ S.A.S., must be subject to correction, updating or deletion, or when he notices the alleged breach of
Any of the duties contained in law 1581, may file a claim with the person responsible for the treatment or the person in charge of the treatment, which will be processed under the following rules:

1) The claim will be formulated by means of a request addressed to the person in charge of the treatment or the person in charge of the treatment, with the identification of the holder, the description of the facts that give rise to the claim and the address, accompanying the documents that you want to enforce.
2) If the claim is incomplete, the interested party will be required within five
(5) days following receipt of the claim to correct the faults. After two months from the date of the request without the applicant presenting the required information, it will be understood that the claim has been withdrawn.
3) In the event that the person who receives the claim is not competent to resolve it, he / she will send it to the corresponding person within a maximum term of two business days and will inform the interested party of the situation.
4) Once the complete claim is received, within a term not exceeding two (2) business days, a legend that says “claim in process” and the reason for it will be included in the database. Said legend must be maintained until the claim is decided.
5) The maximum term to attend the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend to the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be attended, which in no case may exceed eight business days following the expiration of the first term.

6. CHANGES IN THE PERSONAL DATA PROCESSING POLICY OF IMPLAMEQ S.A.S.
IMPLAMEQ S.A.S., informs that in the event of introducing changes to this PERSONAL DATA TREATMENT POLICY, these will be published at the following electronic address: www.implameq.com/privacy The foregoing in order to maintain all
holders of personal data informed and updated on the conditions of use of their data. If you, as the owner of personal data, do not agree with the changes, we ask you to exercise your right to habeas data according to the channels
established in numeral 3 “EXERCISE OF THE RIGHTS OF THE HOLDER” of the present
politics.

7. GUIDING PRINCIPLES OF PROTECTION OF PERSONAL DATA APPLIED BY IMPLAMEQ S.A.S., IN THE PROCESSING OF PERSONAL DATA.

IMPLAMEQ S.A.S. is committed to maintaining the freedom, integrity, transparency, confidentiality, veracity and availability of personal data SHAREHOLDERS, EMPLOYEES, CANDIDATES FOR A VACANT, SUPPLIERS, CLIENTS and
any other natural person who maintains your data in our databases and files. IMPLAMEQ S.A.S., guarantees the application of the general principles for the treatment of this type of data, contemplated in Law 1581, which are:

• LEGALITY REGARDING DATA PROCESSING. The processing of personal data is a regulated activity, for which IMPLAMEQ S.A.S., will compulsorily comply with what is established in Law 1581 and in the other provisions that the
develop.
• PURPOSE. IMPLAMEQ S.A.S., will apply treatment to personal data always obeying a legitimate purpose which will be previously informed to the owner.
• FREEDOM. IMPLAMEQ S.A.S., will only process personal data when it has the
prior, express and informed consent of the owner.
• TRUTH OR QUALITY. The personal data processed by IMPLAMEQ S.A.S., must be true, complete, exact, updated, verifiable and understandable.
• TRANSPARENCY. IMPLAMEQ S.A.S., will guarantee the owner of the personal data, at any time and without restrictions, to obtain information about the
existence of data that concerns him.
• ACCESS AND RESTRICTED CIRCULATION. IMPLAMEQ SAS, undertakes that the processing of personal data will be carried out by entities authorized by the owner and / or by the persons provided for in law 1581. Personal data may not be available on the internet or other means of dissemination or mass communication , except that the access is technically controllable to provide restricted knowledge only to the holders or authorized third parties.
• SECURITY. The information subject to treatment by IMPLAMEQ S.A.S., is
will handle with the technical, human and administrative measures necessary to

provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
• CONFIDENTIALITY. IMPLAMEQ S.A.S., undertakes that the people who
who intervene in the processing of personal data that are not public in nature will be obliged to guarantee the reservation of the information, even after the end of their relationship with any of the tasks that comprise the treatment, being able only to supply or communicate personal data when this corresponds to the development of authorized activities.

8. CONSENT AND REVOCATION.

IMPLAMEQ S.A.S., informs that, by means of the free, prior, express and informed authorization, you, as the owner of personal data, authorize that your personal data be captured, stored, transmitted, used, updated, circulated and generally processed
in accordance with the purposes that are related in this POLICY OF PROCESSING OF PERSONAL DATA.
Any owner may at any time revoke their consent for the processing of their data, provided that it is legally and / or contractually permitted, by sending a communication and / or request through the channels that appear in the numeral
3 “EXERCISE OF OWNER’S RIGHTS” of this policy, providing a copy of
Your identification document (ID and / or passport) in order to prove your identity.

9. TREATMENTS AND PURPOSES APPLIED TO PERSONAL DATA.

You as the owner of personal data, through your prior, express and informed authorization, accept that your data be collected, stored, used, circulated and generally processed for the following purposes:

9.1 GENERAL PURPOSES OF THE TREATMENT.

In this section, the purposes of data treatment are reported that will apply in a general way to anyone who holds the quality of owner of a personal data that is in our databases and files:

1. Respond to requests, queries and complaints that are made through any of the channels that IMPLAMEQ S.A.S. has made available, to exercise the right to habeas data.
2. Transfer or transmit personal data to entities and / or judicial authorities and / or
administrative, when they are required in relation to their purpose and necessary for the fulfillment of their functions.

9.2 SHAREHOLDERS.

The treatment of personal data of shareholders of IMPLAMEQ S.A.S., will be carried out in accordance with the provisions of the Commercial Code and other similar norms or that regulate this matter. The purposes that will be applied to the personal data of the shareholders will be the following:

1. Make the payment of dividends.
2. Comply with judicial, administrative and legal decisions related to its quality of shareholder.
3. Allow the exercise of your rights related to your participation
shareholding.
9.3 PURPOSES FOR EMPLOYEES, INTERNSHIPS AND CANDIDATES FOR VACANCIES.

IMPLAMEQ S.A.S., will be responsible for the handling of personal data provided by workers and in the same way for the use and protection of these. The personal data that we collect from workers and practitioners will be used to:

1. Establish and manage the recruitment, selection and hiring process that IMPLAMEQ S.A.S.
2. Carry out tests and other evaluations that are deemed convenient in order to
identify the relevance of hiring the person as a worker for
IMPLAMEQ S.A.S.
3. Incorporate your personal data in the employment contract, as well as in the other documents that are necessary to manage the employment relationship and
Obligations derived from the same that are in charge of THE EMPLOYER
as RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA.
4. Manage the personal data of the owner and those of her family nucleus to carry out affiliation procedures with health providers -EPS-, savings banks.
family compensation, labor risk administrators −ARL−, and others
necessary for IMPLAMEQ S.A.S., to fulfill its duty as an employer.
5. Respond to the worker before requests for the issuance of certificates, certificates and other documents requested from IMPLAMEQ S.A.S., as a cause of the labor contractual relationship.
6. Manage personal data to make the correct payment of the payroll, including the realization of discounts for payments to third parties that the WORKER has previously authorized.
7. Have the worker’s personal data for a correct assignment of their work tools (including IT tools such as email, computers, mobile phones, access to databases, etc.).
8. Evaluate the performance and results derived from the employment relationship.

Regarding the candidates for a vacancy, THE DATA CONTROLLER informs them that their personal data that is processed during the selection process will be stored in a physical and / or digital file or folder that will be identified with the name

of the holder; the folder or file may be accessed by the management of the company or by whoever chooses to commission the management of the pre-contractual relationship.
THE RESPONSIBLE will keep the information that resides in the file or folder of the
Applicant for a vacancy for a maximum term of THREE (3) months. Once the aforementioned period has ended, the folder or file will be destroyed or deleted.

9.4 SUPPLIERS OF GOODS AND / OR SERVICES AND CONTRACTORS.

The personal data that we collect from the suppliers and their workers will be processed to apply the following purposes:
1. Collect, register, update and maintain your personal data for the purpose of
inform, communicate, organize, control, attend, accredit the activities in relation to their status as supplier and contractor staff of IMPLAMEQ S.A.S.
2. Analyze financial, technical and other aspects that allow the
IMPLAMEQ S.A.S., identify the supplier’s compliance capacity.
3. Develop and apply processes of selection, evaluation, preparation of responses to a request for information, prepare requests for quotation and proposal, and / or
award of contracts
4. Manage the data of the SUPPLIER or CONTRACTOR to carry out the processes of payment of invoices and collection accounts presented IMPLAMEQ S.A.S.
5. Comply with the obligations derived from the commercial relationship established with
THE SUPPLIER.
6. Transfer information to administrative authorities required by reason of their functions in order to comply with the legal obligations in our charge.
IMPLAMEQ S.A.S., understands that your personal data and those of third parties that you provide, such as workers authorized to carry out the management or service entrusted, references and commercial certifications, have the authorization of
the holders to be delivered and treated in accordance with this POLICY OF
TREATMENT OF PERSONAL DATA.

9.5 CLIENTS.

The personal data that we collect from our business prospects and working clients will be processed to apply the following purposes:

1. Register it as a commercial prospect in our databases and files.
2. Register you as a client in our databases and files.
3. Comply with and follow up on the obligations contracted by you with
IMPLAMEQ S.A.S.
4. Contact you when requested.
5. Provide, process, complete and monitor the goods and services purchased and / or contracted by you.
6. Carry out billing, clarification tasks and manage the collection of your financial obligations as a CLIENT.

7. Send via email or any other equivalent electronic means of known or unknown information regarding the account statements of the goods and / or services acquired in IMPLAMEQ S.A.S.

10. PERSONAL DATA OF SENSITIVE CHARACTER REFERRED TO IN LAW 1581 OF 2012.

The treatment of personal data of boys and girls applied by IMPLAMEQ S.A.S. will be carried out always respecting the following requirements:

I. Always respond to and respect the best interests of children and adolescents.
II. Always ensure respect for their fundamental rights on the part of the person in charge.
III. That, as far as possible, said treatment is carried out taking into account the opinion of the minor holders of the personal information,
considering the following factors:

 Maturity
 Autonomy
 Ability to understand the purpose of said treatment
 Explain the consequences of treatment

The evaluations of the previous characteristics will not be carried out by IMPLAMEQ S.A.S., in general. IMPLAMEQ S.A.S., or any manager or third party involved in the processing of personal data of minors, must always ensure the proper use of this type of personal data.

The owners of personal data, in accordance with current regulations regarding the protection of personal data, are not obliged to authorize the processing of their sensitive data; However, in cases where such data is necessary, IMPLAMEQ
S.A.S., must obtain the explicit consent to process said data.

IMPLAMEQ S.A.S., will identify the sensitive data that it eventually collects or stores to meet the following objectives:

• Implement special attention and reinforce its responsibility towards the treatment of this type of data, which translates into a greater demand in terms of compliance with the principles and duties established by the current regulations on data protection.
• Establish the levels of technical, legal and administrative security to treat this information properly.
• Increase access and use restrictions by IMPLAMEQ staff.
S.A.S., in its capacity as EMPLOYER and as workers of its suppliers.

11. PERSONAL DATA COLLECTED THROUGH VIDEO SURVEILLANCE SYSTEMS.

Capturing and / or processing images for surveillance purposes is a very widespread practice in our societies. The video surveillance carried out by IMPLAMEQ S.A.S., has the general objective of guaranteeing the security of the goods and people who are
at our headquarters. Any use other than that previously reported will be previously reported to the data owner. The images captured by the video surveillance systems of IMPLAMEQ S.A.S., will be subject to compliance with the provisions of Law 1581 of 2012, especially its guiding principles.

12. VALIDITY.

This policy has been in force since May 18, 2017.