Personal Data Processing Policy

PRIVACY NOTICE

This Privacy Notice (hereinafter the “Notice”) establishes the terms and conditions under which Grupo Akzara SAS , identified with NIT 900.983.715-1 and with address at Calle 10 # 36 32, floor 2, Medellín, will process your personal data.

1. TREATMENT AND PURPOSE:

The treatment that Grupo Akzara SAS will carry out with personal information will be the following:

The collection, storage, use, circulation for the following purposes; Carry out the relevant procedures for the development of the company's corporate purpose in relation to compliance with the purpose of the contract entered into with the Owner of the information. Make invitations to events and offer new products and services. Manage procedures (requests, complaints, claims). Conduct satisfaction surveys regarding the goods and services offered by Grupo Akzara SAS. Provide contact information to the sales force and/or distribution network, telemarketing, research of Grupo Akzara SAS . Contact the Owner by telephone to carry out surveys, studies and/or confirmation of personal data necessary for the execution of a contractual relationship. Contact the Owner by electronic means - SMS or chat to send news related to loyalty campaigns or service improvement. Contact the Owner by email to send extracts, account statements or invoices in relation to the obligations arising from the contract entered into between the parties. Provide the services offered by Grupo Akzara SAS and accepted in the signed contract.

2. RIGHTS OF THE OWNER:

As the owner of your personal data, you have the right to:

(i) Access free of charge to the data provided that have been subject to processing.

(ii) Know, update and rectify your information in the face of partial, inaccurate, incomplete, fractional data that may lead to error, or data whose processing is prohibited or has not been authorized.

(iii) Request proof of the authorization granted.

(iv) Submit complaints to the Superintendency of Industry and Commerce (SIC) for violations of the provisions of current regulations.

(v) Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual obligation that prevents their deletion.

(vi) Refrain from answering questions about sensitive data. Answers regarding sensitive data or data about children and adolescents will be optional.

3. MECHANISMS TO KNOW THE TREATMENT POLICY

The Owner can access our Information Processing Policy, which is published electronically at the web address http://www.akzaraspa.com

PERSONAL DATA PROCESSING POLICY

AIM:

Establish the criteria for the collection, storage, use, circulation and deletion of personal data processed by Grupo Akzara SAS

SCOPE:

This policy applies to all personal information registered in the databases of Grupo Akzara SAS, which acts as the controller of personal data.

OBLIGATIONS:

This policy is mandatory and strictly enforced by Grupo Akzara SAS.

DATA CONTROLLER:

Akzara Group SAS, a legally constituted commercial company, identified with NIT 900.983.715-1, with its main address at Carrera 36 # 1 sur 75 in the city of Medellín, Republic of Colombia. Website www.akzaraspa.com Telephone 604 5886767 in the city of Medellín.

TREATMENT AND PURPOSE:

The treatment that Grupo Akzara SAS will carry out with personal information will be the following:

Collection, storage, use, circulation for the following purposes: Carry out the relevant procedures for the development of the company's corporate purpose in relation to compliance with the purpose of the contract entered into with the Owner of the information. Make invitations to events and offer new products and services. Manage procedures (requests, complaints, claims). Conduct satisfaction surveys regarding the goods and services offered by Grupo Akzara SAS. Provide contact information to the sales force and/or distribution network, telemarketing, research of Grupo Akzara SAS .

Contact the Owner by telephone to carry out surveys, studies and/or confirmation of personal data necessary for the execution of a contractual relationship. Contact the Owner by electronic means – SMS or chat to send news related to loyalty campaigns or service improvements. Contact the Owner by email to send statements, account statements or invoices in relation to the obligations arising from the contract entered into between the parties.

Provide the services offered by Grupo Akzara SAS and accepted in the signed contract.

RIGHTS OF THE OWNERS:

As the owner of your personal data, you have the right to:

(i) Access free of charge to the data provided that have been processed.

(ii) Know, update and rectify your information in the event of partial, inaccurate, incomplete, fractional data that may lead to error, or data whose processing is prohibited or has not been authorized.

(iii) Request proof of the authorization granted.

(iv) Submit complaints to the Superintendency of Industry and Commerce (SIC) for violations of the provisions of current regulations.

(v) Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual obligation that prevents their deletion.

(vi) Refrain from answering questions about sensitive data. Answers regarding sensitive data or data about children and adolescents will be optional.

ATTENTION TO REQUESTS, CONSULTATIONS AND COMPLAINTS

The Customer Service area is the department in charge of processing requests from the owners to make their rights effective. Requests, Queries and Complaints will be handled by email at akzaraspa@hotmail.com

PROCEDURE FOR THE EXERCISE OF THE RIGHT TO HABEAS DATA

In compliance with the regulations on the protection of personal data, Grupo Akzara SAS presents the procedure and minimum requirements for the exercise of your rights:

In order to file and process your request, we ask you to provide the following information:

Full name and surname / Contact information (Physical and/or electronic address and contact telephone numbers),

Means to receive a response to your request / Reason(s)/fact(s) that give rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete, access the information) / Signature (if applicable) and identification number.

The maximum term provided by law to resolve your claim is fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to address the claim within said period,

term, Grupo Akzara SAS will inform the interested party of the reasons for the delay and the date on which their claim will be attended to, which in no case may exceed eight (8) business days following the expiration of the first term. Once the terms indicated by Law 1581 of 2012 and other regulations that regulate or complement it have been fulfilled, the Holder who is denied, totally or partially, the exercise of the rights of access, update, rectification, deletion and revocation, may bring his case to the attention of the Superintendence of Industry and Commerce - Delegation for the Protection of Personal Data.

VALIDITY:

This Personal Data Processing Policy is effective as of January 1, 2022.

The databases in which personal data will be recorded will be valid for the same period of time that the information is kept and used for the purposes described in this policy. Once that purpose(s) is(are) fulfilled and provided that there is no legal or contractual obligation to retain your information, your data will be deleted from our databases. The personal data provided will be kept as long as its deletion is not requested by the interested party and provided that there is no legal obligation to retain it.