GENERAL PERSONAL DATA PROCESSING POLICY OF MOVITRONIC S.A.S.

DEFINITIONS

For the purposes of this Privacy Policy, the following terms mean:

Privacy notice

Verbal or written communication generated by the data controller and addressed to the data subject regarding the processing of their personal data, informing them of the existence of the information processing policies that will apply to them, how to access those policies, and the purposes of the intended processing of the personal data.

Database

An organised set of Personal Data that is subject to Processing. For the purposes of this document, Database means one containing information about the Data Subjects.

Data of minors (children and adolescents)

This means the personal information of those who have not reached the age of 18. Those between the ages of 0 and 12 are considered children, while those between 12 and 18 are treated as adolescents. Processing this personal data is prohibited, except where the data is public in nature or in the cases set out by law.

Personal data

Any information linked to, or that may be associated with, one or more specific or identifiable natural persons.

Semi-private personal data

Data that is not intimate, restricted or public in nature and whose knowledge or disclosure may be of interest not only to the data subject but also to a group of persons or to society in general. In this case, its Processing requires the express authorisation of the Data Subject. For example: financial data and data relating to dealings with social security bodies (EPS, AFP, ARL, Cajas de Compensación).

Sensitive personal data

Sensitive data means data that affects the data subject’s privacy or whose improper use may affect the Data Subject’s privacy or has the potential to give rise to discrimination against them.

Private data

Data which, because of its intimate or restricted nature, is relevant only to the Data Subject.

Public data

Personal data that is not semi-private, private or sensitive. Among others, it includes data relating to a person’s civil status, their profession or trade, and their status as a merchant or public servant. By its nature, public data may be contained, among other places, in public registers and documents.

Data Processor

A natural or legal person, public or private, who, alone or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller (MOVITRONIC).

Habeas data

The right of any person to know, update and rectify the information collected about them in databases and in the files of public and private entities.

Data Controller

The natural or legal person, public or private, who, acting alone or with others, decides on the Database and/or the Processing of the data.

Data Subject

The natural person whose Personal Data is subject to Processing. For the purposes of this document, Data Subjects means MOVITRONIC’s suppliers, contractors, employees, customers, users and visitors.

Processing

Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

For the purposes of this Personal Data Processing Policy, MOVITRONIC is the Data Controller.

DATA CONTROLLER AND DATA PROCESSOR

Those responsible for the Processing of the Data Subjects’ Personal Data and other information are:

IDENTIFICATION DETAILS

LEGAL NAME

MOVITRONIC S.A.S.

NIT

830.146.283-6

ADDRESS

Calle 134 D 45 A 34

PHONE

(601)914 3894

EMAIL

contador@movifit.co

III. PURPOSE AND PROCESSING

PURPOSES

The purposes for which MOVITRONIC will process the Data Subjects’ Personal Data are:

• In relation to the customer database:
  • Performing the service contracts entered into with customers.
  • Using the Personal Data for marketing and/or commercialising new MOVITRONIC services or products.
  • Measuring satisfaction levels.
  • Carrying out surveys.
  • Contacting data subjects to send reminders about maintenance and warranty expiry, and to inform them about the causes that could lead to loss of coverage.
  • Running loyalty campaigns.
  • Sending invitations to events.
  • Offering MOVITRONIC products and services.
  • Communicating information about financing products for the acquisition of MOVITRONIC goods and services.
• In relation to the prospective customer database:
  • Contacting Data Subjects to offer them goods and services of interest to them, to receive offers from MOVITRONIC, to invite them to take part in programmes, projects and events, and to share policies, projects, programmes, results and organisational changes.
  • Providing the Data Subjects’ information and personal data to MOVITRONIC’s subsidiaries, branches or affiliates, to commercial partners, or to other companies or persons that MOVITRONIC engages to process the information and fulfil the purposes described in this Policy.
  • Providing the Data Subjects’ information and personal data to commercial partners so that they may contact the Data Subjects to offer them goods and services of interest, receive offers from the data subjects, invite them to take part in programmes, projects and events, and share policies, projects, programmes, results and organisational changes.
• In relation to the MOVITRONIC employee database:
  • Communicating commercial and after-sales campaigns.
  • Inviting them to MOVITRONIC events.
  • Informing them about training and refresher activities for compliance with the Standards set by MOVITRONIC.
  • Communicating news and updates about MOVITRONIC products and services.
  • Sending access credentials for the virtual platforms provided for MOVITRONIC.
  • Sending information to recover passwords for access to the systems provided for MOVITRONIC.
  • Updating data.
• In relation to the supplier database:
  • Making the corresponding payments to suppliers and maintaining commercial relationships.
  • Complying with MOVITRONIC’s internal processes for the administration of suppliers and contractors.
• In relation to the visitor database:
  • Controlling and preserving the security of MOVITRONIC’s people, property and information.

PURPOSES COMMON TO ALL DATABASES:

• Managing all information necessary to comply with MOVITRONIC’s tax obligations and its commercial, corporate and accounting records.
• Sharing policies, projects, programmes and organisational changes.
• Controlling and preserving the security of MOVITRONIC’s people, property and information.
• Carrying out processes within MOVITRONIC for development, operational and/or systems administration purposes.
• Suggesting products or services (including those of third parties) that MOVITRONIC believes may be of interest to the Data Subject.
• Contacting them as a potential customer to keep them informed and to offer our services or improve existing ones.
• Assessing the level of satisfaction with our services and those of the Website, and carrying out studies on the Data Subject’s consumption habits, preferences and services of interest.
• Maintaining communication with the Data Subject.
• Responding to questions, complaints, claims, comments or suggestions regarding the products and/or services offered by MOVITRONIC.
• Carrying out the process of filing, updating the systems, and protecting and safeguarding MOVITRONIC’s information and databases.
• Any other purposes determined by the Data Controllers in the course of obtaining Personal Data for Processing, in order to comply with legal and regulatory obligations as well as with MOVITRONIC’s policies.

PROCESSING OF PERSONAL DATA

MOVITRONIC will process the Data Subjects’ Personal Data in order to fulfil the purposes described in this Policy. Within such processing, MOVITRONIC may carry out the following:

• Communicating with Data Subjects for contractual, informational or commercial purposes.
• Establishing communication between MOVITRONIC and the Data Subjects for any purpose related to the purposes set out in this policy, whether by calls, text messages, e-mail and/or physical mail.
• Offering or informing the Data Subject about MOVITRONIC products and/or services that may be of interest to them, as well as providing general information by e-mail as part of an update, communication, news item or Newsletter.
• Where applicable, using the information to handle claims, complaints and suggestions regarding the services offered by MOVITRONIC.
• Carrying out or implementing the acquisition or offering of products or services by MOVITRONIC.
• Collecting information about the device being used to view or use the Website, such as the IP address or the type of Internet browser or operating system used, and linking it to personal information to ensure that the Website provides the best online experience.
• Assessing use of the Website (anonymously and in aggregate), as well as producing statistics on the Data Subjects’ activity — for example, times of visits, frequency of visits and the website that referred them to the Website — so as to personalise the Data Subjects’ experience on the Website.
• Inviting and contacting Data Subjects so that they may take part in conferences, workshops and any other event held by MOVITRONIC.
• Auditing, studying and analysing the information in the Databases in order to design commercial strategies and to increase and/or improve the products and services offered by MOVITRONIC.
• Combining the Personal Data with information obtained from other partners or companies, or sending it to them in order to implement joint commercial strategies.
• Providing the Data Subjects’ information and Personal Data to MOVITRONIC’s subsidiaries, branches or affiliates, to commercial partners, or to other companies or persons that MOVITRONIC engages to process the information and fulfil the purposes described in this Policy.
• Where the information must be disclosed in order to comply with laws, regulations or legal proceedings, to ensure compliance with the terms and conditions, to stop or prevent fraud or attacks on the security of MOVITRONIC or of others, to prevent technical problems, or to protect the rights of others as required by the terms and conditions or by law.
• Where applicable, consulting, storing and using financial information obtained from third-party database administrators, subject to the Data Subject’s prior express authorisation for such consultation.
• Any others described in this policy or permitted by law, as well as those necessary to fulfil the purposes described in this document.

DATA PROVIDED AND HOW IT IS OBTAINED

MOVITRONIC may expressly ask the Data Subjects for, or collect from their behaviour, the data necessary to fulfil the purpose of the Databases, which includes, among others:

• In relation to the customer, supplier and visitor databases:
  • First and last names,
  • identification number,
  • date of birth,
  • mailing address,
  • contact telephone number,
  • e-mail address,
  • commercial and judicial background,
  • commercial and family relationships with other companies or with public entities,
  • needs and interests,
  • place of work,
  • fingerprints,
  • photographs or images of the face and body,
  • signature,
  • needs and interests,
  • dates and times of access to MOVITRONIC’s premises, and any other data necessary to achieve the purposes described.
• Data collected for the database of staff of MOVITRONIC’s dealer network:
  • First and last names,
  • identification number,
  • date of birth and age,
  • mailing address,
  • neighbourhood and contact telephone number,
  • e-mail address,
  • signature,
  • needs and interests,
  • the company or business they work for,
  • the position they hold at the company or business they work for;
  • accounting, financial and credit information,
  • health insurance provider,
  • any other data necessary to achieve the purposes described.

The data may be provided explicitly to MOVITRONIC through registration or onboarding forms, collected in person through its employees, service providers or representatives, obtained by consulting third-party database administrators, or collected implicitly from target-group analysis operations, from the purchase of the products or services offered by MOVITRONIC, or from the Data Subjects’ behaviour such as claims, requests for information, surveys, proposals, offers, visits to MOVITRONIC’s premises, or participation in projects, programmes and events, among others. MOVITRONIC will only collect and/or process data considered Sensitive Data in the cases permitted by law. In those cases, the Data Subjects are not required to provide such data or to authorise its processing. Once such data has been provided and the corresponding consent granted, the data will be collected and processed solely for the purposes described in this Privacy Policy.

COOKIES

MOVITRONIC uses cookies and other tools that automatically collect information about people when they use the Website, on the understanding that entering the Website is unequivocal conduct constituting authorisation. The type of information that may be collected in this way includes:

• Information about the Uniform Resource Locator (URL),
• Information about the browser used by the Data Subject,
• Details of the pages visited by the Data Subject,
• IP address,
• Clicks,
• Hyperlinks
• Queries

Most Internet browsers are set up to accept cookies. Users can change this setting to block them or to be alerted when they are being sent to their device.

AUTHORISATION FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA AND OTHER INFORMATION

By voluntarily providing any of the Personal Data in the manner set out in this Policy and/or by express verbal or written authorisation, the Data Subject expressly or unequivocally authorises MOVITRONIC to collect their Personal Data and any other information they may provide, as well as to carry out the Processing of their Personal Data in accordance with this Privacy Policy and the applicable legal provisions.

VII. CHANGES TO THE PROCESSING POLICY.

Any substantial change or amendment to this Privacy Policy will be communicated to the Data Subjects in a timely manner by means of a notice on the Website or by e-mail.

VIII. INFORMATION AND DATA OF MINORS

As a general rule, MOVITRONIC does not use, store or carry out any processing of the personal data of minors, unless strictly necessary. However, should data of minors be collected for any reason, MOVITRONIC will take into account respect for and the prevalence of the rights of minors, their best interests and their fundamental rights, in accordance with the provisions of personal data protection legislation.

STORAGE OF PERSONAL DATA

The Data Subject expressly authorises MOVITRONIC to store the Personal Data in the manner it deems most secure and appropriate for the due protection of the Data Subjects’ data.

SECURITY MEASURES FOR THE PROTECTION OF PERSONAL DATA AND OTHER INFORMATION

The security measures in place at MOVITRONIC seek to protect the Data Subjects’ data in order to prevent its loss, alteration, and unauthorised use and access. To that end, MOVITRONIC diligently implements the human, technical and administrative measures reasonably available to it.

The Data Subject expressly accepts this form of protection and declares that they consider it appropriate and sufficient for all purposes.

RIGHTS OF DATA SUBJECTS

MOVITRONIC informs Data Subjects that, under current legislation, they have the right to know, update and rectify their information and/or to revoke the authorisation for its processing. In particular, the rights of data subjects, as established in article 8 of Law 1581 of 2012, are:

• To know, update and rectify their Personal Data
• To request proof of the authorisation granted
• To be informed, upon request, of the use made of their Personal Data;
• To file complaints with the Superintendencia de Industria y Comercio for breaches of the provisions of the law
• To revoke the authorisation and/or request the deletion of the data
• To access their Personal Data that has been subject to Processing, free of charge.

AREA IN CHARGE OF REQUESTS, ENQUIRIES AND CLAIMS

The area in charge of handling the Data Subjects’ requests, enquiries and claims for the exercise of their rights to know, update, rectify and delete their data and to revoke their authorisation is XXX of MOVITRONIC, which may be contacted at the following e-mail address contador@movifit.co and/or at the following telephone number (601) 9143894

PROCEDURE TO EXERCISE YOUR RIGHTS

Should they wish to exercise their rights, the Data Subject must send an e-mail or physical letter to the contact addresses set out in this Privacy Policy. The procedure to be followed for such communications is set out below:

Requests and Enquiries About Personal Data: Where the Data Subject or their successors wish to consult the information held in the Databases, MOVITRONIC will respond to the request within a maximum of ten (10) business days. In compliance with the provisions of Law 1581 of 2012, where it is not possible to address the enquiry within that period, the Data Subject will be informed, the reasons for the delay will be explained and the date on which the enquiry will be addressed will be indicated, which may not exceed five (5) business days following the expiry of the first period.

Revocation of authorisation, withdrawal or deletion from the Database and claims About Personal Data: Where the Data Subject or their successors consider that the information contained in the Databases should be corrected, updated or deleted, or where they notice the alleged failure to comply with any of the duties set out in Law 1581 of 2012, they may file a claim with MOVITRONIC, which will be processed under the following rules:

• The claim shall be made by means of a request addressed to MOVITRONIC identifying the Data Subjects, describing the facts giving rise to the claim and providing the address, and attaching the documents to be relied upon.
• If the claim is incomplete, MOVITRONIC may require the interested party, within the five (5) days following receipt of the claim, to remedy the deficiencies.
• Where two (2) months have elapsed from the date of that request without the applicant providing the required information, the claim shall be deemed withdrawn.
• Where MOVITRONIC is not competent to resolve the claim, it shall refer it to the appropriate party within a maximum of two (2) business days and shall inform the Data Subject of the situation, whereupon it shall be released from any claim or liability for the use, rectification or deletion of the data. Once the complete claim has been received, where it cannot be resolved promptly and provided it is technically possible, a note reading "claim in progress" and the reason for it shall be added to the database within no more than two (2) business days. That note must remain until the claim is decided. The maximum period for addressing the claim shall be fifteen (15) business days counted from the day following the date of its receipt.

Where it is not possible to address the claim within that period, the Data Subject shall be informed of the reasons for the delay and of the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiry of the first period. Withdrawal or deletion shall not proceed where there is a contractual duty to remain in MOVITRONIC’s database.

XII. CONTACT

Any question or additional information will be received and handled by sending it to the contact addresses set out in this Privacy Policy.

IDENTIFICATION DETAILS

LEGAL NAME

MOVITRONIC S.A.S.

NIT

830.146.283-6

ADDRESS

Calle 134 D 45 A 34

PHONE

(601)914 3894

EMAIL

contador@movifit.co

XIII. VALIDITY PERIOD OF THE DATABASE

MOVITRONIC’s Databases, as well as the Personal Data included in them, will remain in force for as long as necessary to fulfil their purposes.

XIV. APPLICABLE LEGISLATION

The national legislation in force on the protection of Personal Data is contained in Law 1581 of 2012, Decree 1377 of 2013 and Law 1266 of 2008, and the rules that amend or supplement them