INMECOLSA S.A. a company incorporated and existing under the laws of the Republic of Colombia, with NIT 800.065.608-9, domiciled in Bogotá, D.C., with main offices in Bogotá D.C., telephone +57-12770863 (“Inmecolsa S.A.”), is an entity committed to the protection of personal data and all information that may be associated or related to natural persons, determined or determinable (the "Personal Data"),to which it has access in its commercial activities. Inmecolsa S.A. receives, collects, uses, manages, analyzes, segments, indexes, transmits, transfers, stores and, in general, processes Personal Data such as identification (name, identity number, age, gender, date of birth), contact (telephone , email, address), visits, financial information, consumer behavior, among others, as the entity in charge of processing Personal Data, information that may be obtained in the course and for the performance of its commercial activities.

This Information Treatment Policy of Inmecolsa S.A. (the "Policy") is addressed to business partners, suppliers, customers, workers, collaborators, contractors of Inmecolsa S.A. and, in general, to any person whose Personal Data is being or will be processed by Inmecolsa S.A. (the "Holders”). This Policy will apply to all processing of Personal Data carried out within the territory of the Republic of Colombia by Inmecolsa S.A. and, as appropriate, those third parties with whom Inmecolsa S.A. agrees to all or part of the performance of any activity related to the processing of Personal Data with respect to which Inmecolsa S.A. acts as responsible for it's treatment.

Types of Personal Data.

Inmecolsa S.A. collects the following Personal Data:

• Name, identity document number, address, telephone, physical or postal address, email, and contact information.
• Nationality, date of birth, citizenship card, gender and marital status.
• Occupation, Workplace, position and contact information.
• Information that is sent to us or consulted through social network databases, among other means where you have included your Personal Data.
• IP address and browser type when obtained electronically.
• Information obtained by cookies, web beacons, web crawlers y scripts.
• Financial information.
• Any information necessary to satisfy special requests.
• Information you provide related to your business preferences or in the course of participating in surveys, contests or promotional offers.
• Images, photographs and fingerprints.
• Personal Data that is considered sensitive matter.

Treatment and Purposes.

Inmecolsa S.A., in the course of its business activities, will collect, use, manage, store, analyze, anonymize, index, segment, profile, transmit, transfer and perform various operations with Personal Data. The Personal Data processed by Inmecolsa S.A. must be submitted only to the purposes indicated below or those that are accepted by the Holders at the time of the collection of Personal Data. Likewise, those in charge or third parties who have access to Personal Data by virtue of the law, contract or other binding document, will carry out the treatment to achieve the following purposes:

For customers: (a) the creation of the personal account on the Inmecolsa S.A. website, (b) the processing of orders and online requests, (c) the sending of promotional messages, catalogs and newsletters, (d) contact with the client in the case of any situation with the delivery of an order, (e) the notification of winners of online promotions, (f) the management of the Inmecolsa S.A. page account, (g) the carrying out of promotions and marketing specifically directed to clients, (h) legal age verification, (i) comply with tax, contractual and legal obligations; (j) evaluate and classify customers and suppliers, (j) protect the rights of Inmecolsa S.A., in accordance with legal provisions, (k) complete transactions, obtain billing data and issue invoices, (l) carry out statistical analysis of the data collected to optimize the operation of the service provided, (m) customize the website and/or applications for mobile phones according to the tastes and interests of the Holders and (n) share the information through social networks and pages from Internet.

For employees: (a) the administration of the human resources of Inmecolsa S.A., including, but not limited to, the evaluation of the candidates interested in being employees of Inmecolsa S.A., the employment relationship with Inmecolsa S.A., training processes, performance evaluation, advancing social welfare and occupational health programs, issuance of labor certifications, (b) the management of resume packs and recruitment days for hiring personnel,

For suppliers and contractors: (a) comply with the internal processes of Inmecolsa S.A. regarding the management of suppliers and contractors,

General: (a) manage all the information necessary to comply with the tax obligations and commercial, corporate and accounting records of Inmecolsa S.A. and its clients, (b) the process of filing, updating systems, protection and custody of information and databases, (c) carrying out campaigns to update Personal Data to guarantee their integrity, (d ) carry out internal investigations in accordance with the different policies of the company in case of suspicious activities that may affect the good name of Inmecolsa S.A., (e) the sending of the modifications to this Policy, as well as the request of new authorizations for the treatment of Personal Data, (f) transmit Personal Data to third parties with whom contracts have been entered into for this purpose or documents have been signed, such as addendums or declarations, that allow the transmission of Personal Data, for commercial, administrative and/or operations, (g) to comply with the purposes mentioned above, to transfer, transmit, transfer, share, deliver, and / or disclose Personal Data to t third parties, inside and outside the national territory, even to countries that do not provide adequate levels of protection of Personal Data.

Holders Rights.

In accordance with the law, the Holders have the following rights:

• Update: Update the Personal Data stored in the Inmecolsa S.A. databases. to maintain its integrity and truthfulness.
• Knowledge and Access:Know and access your Personal Data stored by Inmecolsa S.A. or the managers. This access will be allowed free of charge upon request at least once a month.
• Prueba:Solicitar prueba de la autorización otorgada a Inmecolsa S.A., salvo que la ley indique que dicha autorización no es necesaria o que la misma haya sido validada con arreglo a lo establecido en el Decreto 1074 de 2015.
• Complain: Submit to the Superintendence of Industry and Commerce complaints for violations of the law when the procedural requirement has been exhausted and go to Inmecolsa S.A. in the first instance.
• Rectification:Rectify the information and Personal Data that are under the control of Inmecolsa S.A.
• Revocation:Request the revocation of the authorization, as long as there is no legal duty or contractual obligation of the Owner with Inmecolsa S.A., according to which the Owner does not have the right to request the deletion of their Personal Data.
• Request:Submit applications to Inmecolsa S.A. or the person in charge regarding the use they have given to their Personal Data.
• Suppression:Request the deletion of your Personal Data from the Inmecolsa S.A. databases, as long as there is no legal duty or contractual obligation of the Holder with Inmecolsa S.A., according to which the Holder does not have the right to request the deletion of your Personal Data.

The Holders may exercise their legal rights and carry out the procedures established in this Policy by contacting the company via email ventas@inmecolsa.com. Inmecolsa S.A. will be responsible for responding to complaints, requests or claims in accordance with the provisions of the Colombian regulations for the protection of Personal Data and within the terms established therein.

Procedure for the Exercise of Rights by the Holders.

For the exercise of your rights to know, update, rectify and delete the Personal Data stored in the databases of Inmecolsa S.A. and revoke the authorization for the use and storage of said personal information, the Owner of the Personal Data must direct the respective request or claim in writing to the contact information of the area in charge of Personal Data.

The request or claim will be answered in writing within ten (10) business days following its effective notification to Inmecolsa S.A. Said response term may be extended for an equal period before the expiration of the initial term.

In the event that the request or claim related to the Personal Data is related to several databases, the Holder must direct said request to the area in charge of Personal Data.

Consultation The owner of the information will be able to consult their personal data free of charge at least once every calendar month. In order to know the personal data that is subject to treatment by Inmecolsa S.A., the owner of the information may submit a written request indicating the information that they wish to know through any of the mechanisms indicated above

The request will be addressed in writing within a maximum term of ten (10) business days from the date of receipt of the same. When it is not possible to attend to the request within said term, this fact will be informed to the applicant in writing, stating the reasons for the delay and indicating the date on which his query will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

Claims: In accordance with the provisions of article 14 of Law 1581 of 2012, when the Holder or his successors in title consider that the information contained in a database must be corrected, updated or deleted, or when it must be revoked due to the warning of the alleged breach of any of the duties contained in Law 1581 of 2012, may submit a written claim to Inmecolsa S.A., which will be processed under the following rules:

The rights of rectification, update or deletion or revocation of consent may only be exercised by:

• The owner or his successors, after proof of identity.
• The Legal Representative, prior accreditation of the representation
• By stipulation in favor of another or for another.

When the request is made by a person other than the holder and it is not proven that the same acts on behalf of the former, it will be deemed not submitted. The request for rectification, updating, deletion or revocation must be submitted in writing through the means provided by Inmecolsa S.A. and contain, at a minimum, the following information:

• The name and address of the owner or any other means to receive the response.
• The documents that prove the identity of the applicant and, if applicable, that of his representative with the respective authorization.
• The clear and precise description of the personal data with respect to which the owner seeks to exercise any of the rights and the specific request.
• When appropriate, other elements or documents that facilitate the location of personal data.

The request will be addressed in writing within a maximum term of ten (10) business days from the date of receipt of the same. When it is not possible to attend to the request within said term, this fact will be informed to the applicant in writing, stating the reasons for the delay and indicating the date on which his query will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

The request or claim will be answered in writing within ten (10) business days following its effective notification to Inmecolsa S.A. This response term may be extended for an equal period before the expiration of the initial term.

In the event that the request or claim related to the Personal Data is related to several databases, the Holder must direct said request to the area in charge of Personal Data.

Personal Data Protection Area.

The dependency of Inmecolsa S.A. in charge of receiving and dealing with Requests, Complaints and Claims related to Personal Data can be contacted at ventas@inmecolsa.com.

Validity.

This Policy will come into force as of December 15, 2021. The Personal Data that is stored, used or transmitted will remain in the Inmecolsa S.A. database, based on the temporality criterion, for as long as necessary for the comply with the purposes mentioned in this Policy, for which they were collected. In this way, the validity of the database is closely related to the purposes for which the Personal Data was collected.

Modifications.

This Policy may be modified from time to time by Inmecolsa S.A. and will be part of the contracts entered into by Inmecolsa S.A., where appropriate. Any substantial modification of this Policy will have to be previously communicated to the Holders through efficient mechanisms, such as the Inmecolsa S.A. website. and/or emails. If required by applicable law, the authorization of the Holders will also be sought. By substantial modifications are understood, among others, those related to the exercise of the rights of the Holders and with the purposes of the processing of Personal Data when this may affect the authorization.