This Policy on the Protection of Personal Data shall apply to all Databases and/or Files that contain Personal Data that may be subject to Treatment by Paulo Emilio Bravo Consultores S.A.S. or by any Consortiums that have expressly named Paulo Emilio Bravo Consultores S.A.S. as the party responsible for the project’s management or for its Comprehensive Management System, in which case it shall act in the capacity of Party Responsible for Treatment, unless it is expressly provided that it will act in the capacity of Party that Performs Treatment, in which case it shall be subject to the Personal Data Protection policies of the Party Responsible for Treatment or its equivalent.

Name: Paulo Emilio Bravo Consultores S.A.S., hereinafter the COMPANY. Domicile: Santiago de Cali, Valle del Cauca. Address: Calle 22N # 6AN 24. E-mail: peb@peb-sa.com. Telephone number of the Party Responsible for Treatment: + 57 (2) 4010352 or 320 273 0984

a) Authorization: Prior, express and informed consent by the Owner to perform Treatment of personal data.

b) Privacy notice: Written or verbal communication issued by the Party Responsible for Treatment to the Owner regarding the Treatment of his/her personal data, informing on the existence of the applicable information treatment policy, how to access such policy and on the personal data will be used.

c) Database: Organized set of personal data that will be subject to Treatment.

d) Personal data: Any information related to or that may be associated with one or several determined or determinable individuals.
e) Public data: Any data that is not semi-private, private or sensitive. Public data include, among others, information people’s marital status, profession or trade and status as civil servant or business owner. Due to their nature, public data may be contained, among others, in public records, public documents, official bulletins and final court rulings that are not confidential.

f) Sensitive data: It is defined as data that affects the intimacy of the Owner or whose improper use may lead to discrimination of the user, such as data that disclose his/her racial or ethnic origin, political orientation, philosophic or religious convictions, membership of unions or social or human rights organizations or organizations that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as information related the user’s health, sexual life and biometric data.

g) Party that Performs Treatment: Individual or legal entity, public or private, that on its own account or jointly with others performs Treatment of personal data on the account of the Party Responsible for Treatment.

h) Party Responsible for Treatment: Individual or legal entity, public or private, that on its own account or jointly with others, makes decisions on the database and/or the Treatment of data.

i) Owner: Individual whose personal data will be subject to Treatment.

j) Treatment: Any operation or set of operations on personal data, such as data collection, storage, use, dissemination or suppression.

k) Transfer: Data transfer takes place when the Party Responsible for Treatment and/or the Party that Performs Treatment of personal data, located in Colombia, sends the information or personal data to a receiving party, who in turn shall become the Party Responsible for Treatment, and which may be located within our outside the country.

l) Transmission. Treatment of data involving their communication within or outside the Republic of Colombia, when the purpose of the Party that Performs Treatment is to perform Treatment on behalf of the Party Responsible for Treatment.

The COMPANY, acting in the capacity of Party Responsible for Treatment of Personal data, for the effects of adequately performing its services and business activities, as well as to strengthen its relationships with third parties, collects, stores, uses, disseminates and suppresses the Personal Data of individuals with whom it relates to, including, without limitation, workers and their families, shareholders, clients, providers, creditors and debtors.

The COMPANY performs Treatment of Personal Data for the following purposes:

5.1. General Purposes:

• Process
• Confirm
• Comply
• Provide the services and/or products acquired directly or with the involvement of third parties
• Promote and advertise our activities, products and services
• Carry out transactions
• Prepare reports for different national administrative control and oversight bodies, police agencies or legal authorities, financial entities and/or insurance companies
• Enter into contractual relationships
• For internal administrative purposes and/or for business purposes, such as: market research, audits, accounting reports, statistical analysis, or invoicing
• Collection
• Storage
• Recording
• Accounting records
• Correspondence
• To strengthen relations with clients by sending them relevant information, to accept requests to submit offers and to address petitions, complaints or claims (PQR’s, by its acronym in Spanish), by a project or in the commercial process, to assess the quality of customer service, among others
• To possibly contact, by e-mail or any other means, individuals with whom it has or has had relations, such as, without limitation, workers and their families, shareholders, clients, distributors, suppliers, creditors and debtors, for the purposes mentioned above.

5.2. Information on shareholders and partners:

• Make dividend payments.
• Control shareholdings and publish the names of the largest shareholders.
• Contacts
• Fulfillment of legal decisions and administrative, legal, tax and regulatory requirements.
• 5.3. Information on suppliers and creditors:
• For business purposes.
• Accounting.
• Fulfillment of legal decisions and administrative, legal, tax and regulatory requirements.
• Fulfillment of contractual obligations, to which effect information may be transferred to third parties such as financial entities, notaries, attorneys, etc.
• To carry out processes involving suppliers.
• Any other use authorized by the supplier in writing for use of his/her information.
• Transmission of information and personal data for auditing processes.

5.4. Information on clients:

• For business purposes.
• Advertising and marketing.
• Accounting.
• Fulfillment of contractual obligations, to which effect information may be transferred to third parties such as financial entities, notaries, attorneys, etc.
• Fulfillment of legal decisions and administrative, legal, tax and regulatory requirements.
• Transmission of information and personal data for auditing processes.
• Invoicing

5.5. Information on employees, former workers, pensioners, and candidates to fill vacancies:

• For payroll effects (EPS, ARL, pension and severance funds, family compensation funds, etc.)
• In the event of judicial and legal requirements.
• Accounting and payroll processing.
• Recruiting and selecting personnel to fill vacancies.
• Process, confirm and comply with labor legal and extra-legal obligations derived from the employment contract.
• Perform transactions.
• Payment of extra-legal benefits.
• Audits.
• Statistical analysis.
• Education and training
• Share personal data with banks, companies that offer benefits to our current employees, among others.

The COMPANY acknowledges the importance of the security, privacy and confidentiality of the personal data provided by individuals, and is consequently committed to adequately protecting and managing such data, in accordance with the legal regime on the protection of personal data, and specifically with the provisions of this policy and the privacy notice.

• The law prohibits any Treatment of sensitive Personal Data, except when express, prior and informed authorization has been given by the Owner, among other exceptions laid out in Article 6 of Law 1581 of 2012.

In this case, in addition to complying with the requirements set out in the authorization, the COMPANY shall:

• Inform the Owner that because of the sensitive nature of the information, he/she is not required to authorize its Treatment.
• Inform the Owner which sensitive data will be subject to Treatment and the purpose of such Treatment.

IMPORTANT: No activity shall be conditioned to provision of sensitive personal data by the Owner.

According to the provisions of Article 7 of Law 1581 of 2012 and article 12 of Decree 1377 of 2013, the COMPANY shall only perform Treatment, i.e., collect, store, use, disseminate and/or suppress Personal Data on children and adolescents when such Treatment is performed in the higher interests of the children and adolescents and their fundamental rights are respected.

 Once the above requirements have been fulfilled, the COMPANY must obtain Authorization from the legal representative of the child or adolescent, subject to the minor’s right to exercise his/her right to be heard, and such opinion shall be assessed taking into consideration the minor’s matureness, independence and capacity to understand the matter.

The Owner is an individual whose personal data have been collected, stored, or used by the Party Responsible for Treatment. The Owner shall have the following rights, which may be exercised at any time:

a) To know, update and correct his/her personal data with the Party Responsible for Treatment, whenever the data is partial, inaccurate, incomplete, fractioned or misleading, or any data for which treatment is expressly prohibited or has not been authorized. In any case, the Owner shall have the obligation of providing truthful information.

b) To request proof of the authorization given to the Party Responsible for Treatment, except when such authorization is not required for treatment, pursuant to the provisions of article 10 of Law 1581 of 2012.

c) To receive information, based on a request addressed to the Party Responsible for Treatment, on the use given to his/her personal data.

d) To submit to the Superintendence of Industry and Commerce complaints related to any breach of the provisions of the Law on Protection of Personal Data.

e) Revoke the authorization and/or request the suppression of data whenever the Treatment does not abide by the principles, rights and constitutional and legal guarantees, as long as the Owner has no legal or contractual obligation of remaining in the database. Such revocation and/or suppression shall be fulfilled when the Superintendence of Industry and Commerce has determined that the Treatment given by the Party Responsible for Treatment has been in breach of the Law on Protection of Personal Data and the Constitution.

f) Have access at no cost to his/her personal data that has been subject to Treatment by the Party Responsible for Treatment.

Any operation on personal data, i.e., to collect, store, use, disseminate or suppress the data, requires the prior and informed authorization by the Owner, which may be obtained by any means that can be subsequently verified.

9.1. Collection of personal Data: Pursuant to the principles of purpose and freedom, data collection must be limited to the personal data that are relevant and adequate for the purpose for which they are collected or required pursuant to applicable law, to which end the COMPANY must request authorization to perform data treatment from the owner at the time the information is gathered, and inform him/her in an unequivocal and clear manner:

a) The treatment to be given to the personal data and the purpose of treatment; b) the facultative nature of the responses to the questions made, when such questions are related to sensitive data or data on children or adolescents; c) the rights he/she has as owner; d) the identification, physical or electronic address and telephone number of the COMPANY, the party Responsible for Treatment.

The COMPANY must maintain the proof of fulfillment of the provisions of this section, and must deliver a copy to the Owner at his/her request.

Except in the cases expressly provided for by law, no personal data may be collected without the authorization of the Owner.
9.2 Cases in which authorization is not required: Authorization from the Owner is not required in the following cases:

a) Information required by a public or administrative entity in performance of its legal duties or by court order; b) Public data; c) Cases of medical or health emergency; d) Treatment of information authorized by law for historic, statistical or scientific purposes; e) Data related to an individual’s civil registration records.

9.3 Form for obtaining the authorization: The owners or those legitimately authorized to treat their data, pursuant to the provisions of article 20 of Decree 1377 of 2013, may state their authorization (i) in writing, (ii) orally, or (iii) by means of unequivocal behaviors of the owner that enable reasonably concluding that he/she has granted authorization. Under no circumstance will silence be interpreted as unequivocal behavior.

The COMPANY, in accordance with legal provisions on this matter, has issued a notice that informs owners of their right to exercise their rights related to the treatment of personal data, which is available at the website www.peb-sa.com or by e-mail at peb@peb-sa.com.

9.4 Proof of authorization: The COMPANY shall preserve proof of the authorization for treatment granted by the Owners of personal data.
103. 9.5 Data collected prior to issuance of Decree 1377 of 2013: The following shall apply to data collected prior to issuance of Decree 1377 of 2013:

a) The COMPANY must request the owners’ authorization to continue performing treatment on their personal data through the following mechanisms: (i) in writing, (ii) orally, or (iii) by means of unequivocal behaviors of the owner that enable reasonably concluding that they have granted authorization, to which effect they must be informed of this policy and the manner in which they may exercise their rights.

b) Notwithstanding the above, the COMPANY may implement alternative mechanisms for the effects of the provisions of item a), such as notices in newspapers of widespread national circulation, local newspapers or magazines, or the COMPANY’s website, among others, whenever:

• The mechanisms listed above impose an undue burden on the COMPANY or it is not possible to request consent for personal data Treatment from each Owner and inform them of the Treatment of Information policy and the manner to exercise their rights.
• The owners’ contact data is not available because it is not held in its files, records, or databases, or because it is out of date, incorrect, incomplete, or inaccurate.

c) When within thirty (30) business days counted from the date of implementation of any of the above communication mechanisms, the Owner has not contacted the Party Responsible for Treatment or the Party that Performs Treatment to request the suppression of his/her personal data in the aforementioned terms, the Party Responsible for Treatment and the Party that Performs Treatment may continue to perform the Treatment of the data contained in their databases for the effects or purposes indicated in this Policy on Treatment, which was communicated to the owners by means of the aforementioned mechanisms, without prejudice for the owner’s right to exercise his/her rights and request the suppression of data at any time.

The Owners or their successors may exercise their right to know, update, correct and suppress data and to revoke the authorization by submitting a petition, inquiry or claim regarding the personal information of the Owner held in the database of the COMPANY.

Petitions and Inquiries: Petitions or inquiries must be made in writing, either by letter addressed to Manuel José Bravo Fernández, at the address Calle 22N # 6AN-24, Oficina 608, Santiago de Cali, Valle del Cauca, or by e-mail at peb@pebsa.com, which must include: the name and identification number of the Owner, a description of the petition or inquiry, address and e-mail.

A reply to the petition or inquiry will be made within a maximum of ten (10) business days from the date of reception. If it is not possible to address the petition or inquiry within such term, notice will be given to the interested party, indicating the reasons for the delay and setting a new date by which the reply to the inquiry or petition will be given, which under no circumstance shall be later than five (5) business days from the end of the first term.

Claims: The Owners or their successors who believe the information contained in the database of the COMPANY should be corrected, updated or suppressed, or when they become aware of any alleged breach of any of the duties contained in this document or in Law 1581 of 2012 or in the Constitution, may submit a claim.

The claim must be in writing, either by physical letter addressed to Manuel José Bravo Fernández, at the address Calle 22N # 6AN-24, Oficina 608, Santiago de Cali, Valle del Cauca, or by e-mail at peb@pebsa.com, which must include: the name and identification number of the Owner, a description of the facts that are grounds for the claim, address, e-mail and any relevant documents as attachments.

If the claim is incomplete, a request will be made to the interested party within five (5) business days from reception of the claim to complete the information. If within two (2) months from the date of the request the interested party fails to submit the required information, it shall be understood that the interested party has desisted from the claim.

Once the full claim has been received, a notice will be included in the database that reads "claim in progress " and the reason for the claim, within two (2) business days, at the latest. Such notice shall remain in place until the claim has been resolved.

The maximum term to address the claim shall be fifteen (15) business days from the following day from the date of receipt. If it is not possible to address the claim within such term, notice will be given to the interested party on the reasons for the delay and the date on which response will be given to the claim, which under no circumstance shall be later than eight (8) business days from the expiration of the initial term.

Requirement for processing. The Owner or his/her successor can only submit a complaint to the Superintendence of Industry and Commerce once the inquiry or claim procedure before the COMPANY has been exhausted.

The COMPANY reserves the right to update or amend this Policy on Privacy at any time, in order to incorporate any new regulatory requirements, internal policies or new requirements for providing and offering its services or products.

Such amendments will be available to the public through the website http://peb-sa.com

This Policy on the Treatment and Protection of Personal Data shall become effective as of the date on which it is issued.