Data Processing and Personal Data Protection Policy (Law 1581 of 2012) of Arquitectura y Concreto S.A.S.

Objective

Arquitectura y Concreto S.A.S., identified with Tax ID No. 800.093.117-3, is committed to the privacy of the personal information of its clients, employees, allies, suppliers, contractors, and all those persons who in one way or another have a direct or indirect relationship with the company.

For this reason, it has adopted the following Data Processing and Personal Data Protection Policy, in order to comply with the provisions of Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, and other regulations that modify, supplement, or replace them.

This document is structured with the purpose of establishing the corporate criteria and guidelines for the collection, storage, use, circulation, deletion, and in general, the proper processing of personal data processed by Arquitectura y Concreto S.A.S., of its stakeholders mentioned, as well as serving as an easy guide to guarantee the constitutional right that all persons have to know, update, and rectify the information that is received, collected, or has been collected from them in its capacity as Data Controller or Data Processor in its databases, as well as the other rights, freedoms, and constitutional guarantees referred to in Article 15 of the Political Constitution and the right to information enshrined in Article 20 of the same, and in particular, for handling inquiries and complaints regarding the right to information self-determination of persons.

By applying this Policy, Arquitectura y Concreto S.A.S. guarantees the rights to privacy, intimacy, and good name of the persons whose personal data is subject to processing, and consequently, all company actions shall be governed by the principles of good faith, legality, truthfulness, transparency, confidentiality, and information security.

This Data Processing and Personal Data Protection Policy is mandatory for all areas of Arquitectura y Concreto S.A.S., and applies to all personal information registered in both physical and digital databases of Arquitectura y Concreto S.A.S., which acts in its capacity as Data Controller and, where applicable, as Data Processor of personal data, in accordance with Statutory Law 1581 of 2012 regulated by Decree 1377 of 2013 compiled by Decree 1074 of 2015.

Definitions

For the purposes of this document and in accordance with the terms of the law, the following definitions must be taken into account in an integrated manner:

Authorization: Prior, express, and informed consent of the Data Subject for the processing of personal data.

Database: An organized set of personal data that is subject to Processing.

Inquiry: A request for information about the personal data that are recorded in a database, which is made by the Data Subject or the person authorized to do so.

Personal Data: Any information linked to or that may be associated with one or several specific or determinable natural persons.

Public Data: Data that the law or the Constitution determines as such, as well as all those that are not Semi-Private or Private Data.

Private Data: Data that by its intimate or reserved nature is only relevant to the Data Subject.

Semi-Private Data: Data that is not intimate, reserved, or public in nature, and whose knowledge or disclosure may be of interest not only to the Data Subject, but to a certain sector or group of persons.

Sensitive Data: Data that affects the intimacy of the Data Subject or whose improper use may lead to discrimination, such as those revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.

Data Processor: A natural or legal person, public or private, who, by themselves or in association with others, carries out the processing of personal data on behalf of the Data Controller.

Habeas Data: The power of the Data Subject of Personal Data to demand from its administrators access to, inclusion, exclusion, correction, addition, updating, and certification of Personal Data, as well as limitation on its disclosure, publication, transmission, or transfer.

Complaint: A request or demand made by the Data Subject or the person authorized to do so, regarding personal data included in a database.

Data Controller: A natural or legal person, public or private, who, by themselves or in association with others, makes decisions about the database and/or the Processing of data.

Data Subject: A natural person whose personal data is subject to Processing.

Data Transfer: Occurs when the Data Controller and/or Data Processor of Personal Data sends information or Personal Data to a recipient, who is in turn a Data Controller.

Data Transmission: Processing of Personal Data that involves their communication within or outside the territory of Colombia, for the purpose of having a Data Processor carry out the Processing on behalf of the Data Controller.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

Principles

Arquitectura y Concreto S.A.S. is committed to promoting and guaranteeing the rights to privacy, intimacy, and good name of persons whose personal data is subject to processing, and consequently, commits to handling the collected data under the following principles:

Good Faith Principle: It is one of the fundamental principles of law, and is understood as the duty to proceed with loyalty in our legal relationships, as well as the right to expect that others proceed in the same manner.

Legality Principle: It consists of giving prevalence to the Law over the activities and actions of the administration and private individuals.

Truthfulness Principle: Information that is subject to Processing must be truthful, complete, up-to-date, verifiable, and understandable.

Transparency Principle: Data Subjects have the right to obtain, at any time and without restrictions, information about the existence of Personal Data that concern them.

Confidentiality Principle: All persons involved in the processing of personal data that are not Public Data are obligated to guarantee the confidentiality of the information, even after their relationship with Arquitectura y Concreto S.A.S. has ended, and may only reveal personal data when it corresponds to the development of activities authorized in Law 1581 of 2012 and under its terms.

Authorization for the Processing of Personal Data

The Personal Data included in the databases of Arquitectura y Concreto S.A.S. come from information collected through the different channels established by the company, with prior authorization from the data subject, by virtue of relationships arising from the development of its corporate purpose, commercial, contractual, labor, or any other nature. The company will request authorization from data subjects for the processing of their information.

Authorization must be requested at the time of collection of personal data, in a prior and express manner, indicating the purpose for which the data is being collected, the rights they have as data subjects, and the means to exercise them, and informing them of this policy, which will be available for permanent public consultation on the website www.arquitecturayconcreto.com.

Authorization may also be obtained through unequivocal conduct of the Personal Data Subject, which allows it to be reasonably concluded that they have given their consent for the Processing of their information. Such conduct must clearly express the will to authorize Processing. The Data Subject's consent may be obtained through any means that may be subject to subsequent consultation, such as: written, verbal, virtual communication, or through unequivocal conduct that allows it to be reasonably concluded that authorization was granted, such as when entering the facilities of Arquitectura y Concreto with knowledge of the existence of video surveillance systems.

Personal data collected by Arquitectura y Concreto S.A.S. are stored on physical and digital media, either owned or contracted with specialized providers that guarantee information security levels, seeking to safeguard the personal data of Data Subjects.

Arquitectura y Concreto will maintain adequate proof of authorizations, respecting the principles of privacy and confidentiality of information.

When prior and express authorization from the data subject is not available, Arquitectura y Concreto will refrain from carrying out any processing of personal data, except in the following events, for which authorization is not required:

Adoption of measures for the execution of a contract entered into with the Data Subject.

Public Nature Data.

Consultations in restrictive lists for compliance with SAGRILAFT policies.

Sending information required by a judicial or administrative authority, in the exercise of its functions.

Processing for historical, statistical, or scientific purposes.

Processing of Personal Data of a public nature, or those related to the civil registry of persons.

Databases

Arquitectura y Concreto S.A.S. has three (3) personal databases, and the location of the data subject in one or several of them depends on their relationship with the information controller. The databases are named as follows:

Suppliers and/or Contractors: Composed of information subjects from whom Arquitectura y Concreto S.A.S. receives or has received goods or services.

Employees and/or Applicants: Composed of information subjects who have, may have, or have had a labor relationship with Arquitectura y Concreto S.A.S.

Clients and/or Contacts: Composed of information subjects to whom Arquitectura y Concreto S.A.S. provides, may provide, or has provided goods or services.

Purposes

The Personal Data of the Data Subjects are collected and processed by Arquitectura y Concreto S.A.S. in the development of its corporate purpose and with the following purposes:

Suppliers and/or Contractors

The information requested from the supplier and/or contractor may include information of the natural or legal person, as applicable, and their Legal Representative, Accountant, External Auditor, Commercial Agent, and any collaborator who directly or indirectly provides their services and/or labor at the facilities of Arquitectura y Concreto S.A.S. or its projects, among others:

To carry out the selection and hiring process of the supplier and/or contractor, in accordance with internal procedures, which are of an accounting, financial, commercial, logistical, quality nature, among others.

To verify commercial and reputational background for the proper functioning of the SAGRILAFT system, as well as those related to fraud, corruption, national and transnational bribery, and other illegal activities, by the supplier and/or contractor, and their employees, partners, allies, among others, including when necessary, the consultation and reproduction of sensitive data such as fingerprints, image, voice, among others.

To enter into agreements and manage contractual relationships.

To offer products and/or provide services through any medium or channel in accordance with technological advances and the profile of the supplier and/or contractor.

To carry out commercial, statistical, risk, market, and financial analyses and investigations.

To carry out all necessary actions to confirm and update the supplier's and/or contractor's information.

To respond to requests from competent judicial or administrative authorities, seeking in all cases to disclose only the pertinent and necessary information to respond to the respective request.

To consult in the different social security databases, directly or through PILA information operators such as ARUS (OPERATIONAL LINK), SOI, MI PLANILLA, FEDECAJAS, among others, as well as in the different Compensation Funds, SENA, and other databases related to the fulfillment of labor obligations, social security, and parafiscal contributions, of the supplier and/or contractor.

To carry out all necessary activities for the fulfillment of the different contractual stages in the relationship with suppliers and/or contractors.

To maintain a digital file with information corresponding to each contract and/or service orders.

Issuance of contractual certifications.

To manage and respond to requests, inquiries, complaints, and claims regarding the personal data of subjects and/or of any nature.

Other purposes determined in processes of obtaining Personal Data for their processing, and in any case in accordance with the Law and within the framework of the corporate purpose of Arquitectura y Concreto S.A.S.

Arquitectura y Concreto S.A.S. may, with the supplier and/or contractor database, transmit personal information about their Legal Representatives, their shareholding composition, External Auditor, among others, to affiliated companies and/or any person or entity that is part of the corporate group of Arquitectura y Concreto S.A.S. and/or a legal entity that constitutes, or in which Arquitectura y Concreto S.A.S. is included as part of it, or to guarantee due diligence. It may also transmit the database for the fulfillment of the contractual purpose and/or with third-party providers that allow the updating and cleaning of the database.

The above takes into account the due control in the terms of regulatory decree 1377 of 2013 or the regulation that adds, modifies, or replaces it, and Chapter VII. Transfer and transmission of personal data of this policy.

Employees and/or Applicants

The information that Arquitectura y Concreto S.A.S. collects from job applicants is processed with the purpose of conducting the admission assessment and the hiring process of the applicant. The personal data provided by applicants and obtained during the selection process will only be used for the purposes of their participation in the same. Regarding the processing of employees' personal data, the purpose is the management of labor relations, as well as the development of the different activities established by Arquitectura y Concreto S.A.S.:

To carry out selection, admission, and hiring processes to fill the different vacancies within the company and/or its subsidiaries, which includes the transmission of the applicant's personal information to external allies who collaborate with the tests that make up the selection process, such as psychologists, polygraph operators, medical service companies, companies specialized in heights courses and occupational health and safety, among others, respecting due control and diligence in the terms of regulatory decree 1377 of 2013 or the regulation that adds, modifies, or replaces it.

To fulfill obligations contracted with the personal data subject, regarding the payment of salaries, social benefits, and other compensation provided for in the employment contract, as provided by law.

Affiliation of coverage contracts in collective insurance policies.

To fulfill obligations contracted with the personal data subject, in relation to the execution of the employment contract.

To carry out activities required by the administrative area, including, but not limited to: full identification of the employee, filing and handling of their contact information and their family, medical, academic, and professional information.

Consultation in lists for compliance with the SAGRILAFT system and control of security mechanisms and protocols, and video surveillance of the infrastructure and different facilities of Arquitectura y Concreto and its projects, including when necessary, the consultation and reproduction of sensitive data such as fingerprints, image, voice, among others.

To offer corporate wellness programs for employees and their families, as well as the communication of events and institutional programs.

Issuance of income certifications, withholdings, and employment certificates regarding their status as an employee.

To implement the biosafety protocols ordered by the National Government for carrying out labor and productive activities in adequate health conditions, as a consequence of pandemics, epidemics, or other diseases.

To implement and execute the different programs ordered by the local, departmental, or national government, regarding the prevention of drug addiction, smoking, and alcoholism, workplace harassment, sexual harassment, stress, and any other psychosocial risk that may directly or indirectly affect the employee and/or their family group.

To know and follow up on the health status of employees.

To consult employees' personal data in the different social security databases, directly or through PILA information operators such as ARUS (OPERATIONAL LINK), SOI, MI PLANILLA, FEDECAJAS, among others, as well as in the different Compensation Funds.

To consult employees' disability data with the EPS, ARL, or authorized medical service providers.

Capture and use of photographs and/or video recordings with their data to be published in the company's repositories or to those to whom it transfers or transmits in the terms of Law 1581 of 2022 and its regulatory decree, such as social networks like Twitter, Instagram, Youtube, Facebook, Tik Tok, or others known or to be known, the Arquitectura y Concreto website and even for publication in printed and/or advertising media of large or small format.

To use personal data, images, videos, film recordings of different types taken with their authorization for the creation of promotional campaigns of Arquitectura y Concreto. These photos and/or video recordings may be processed in material format or support, in printed editions or on electronic, optical, magnetic media, on networks (Intranet and Internet), data messages or similar, and in general for any medium or support known or to be known in the future.

To manage and respond to requests, inquiries, complaints, and claims regarding the personal data of subjects and/or of any nature.

Arquitectura y Concreto S.A.S. may transmit employee information to suppliers, consultants, and contractors with whom the Company develops activities for financial well-being and legal compliance. It may also transmit and/or transfer employees' personal data when there is a contractual and/or legal link with affiliated companies and/or any person or entity that is part of the corporate group of Arquitectura y Concreto S.A.S. and/or a legal entity that constitutes, or in which Arquitectura y Concreto S.A.S. is included as part of it.

Clients and/or Contacts

To make invitations to events and offer new products or services, discounts, promotions, through any medium or channel, in accordance with technological advances and the client's profile.

To publicize and participate in campaigns and/or contests promoted by Arquitectura y Concreto related to its corporate purpose.

To request family information for the development of campaigns, events, and/or contests promoted by Arquitectura y Concreto.

To carry out all necessary actions to confirm and update client information, including when necessary, the consultation and reproduction of sensitive data such as fingerprints, image, voice, among others.

Consultation in restrictive lists for compliance with SAGRILAFT policies.

To conduct satisfaction surveys regarding the goods and services offered.

To conduct surveys, studies, personal data confirmation, and send news related to loyalty campaigns, service improvement, sending extracts, account statements, or invoices.

To consult personal data of clients and/or potential clients in the different social security databases, directly or through PILA information operators such as ARUS (OPERATIONAL LINK), SOI, MI PLANILLA, FEDECAJAS, or whoever performs this function, among others, as well as in the different Compensation Funds and Social Programs Potential Beneficiary Identification System (SISBEN).

To fulfill obligations arising from the contractual relationship.

To manage and respond to requests, inquiries, complaints, and claims regarding the personal data of subjects and/or of any nature (sales, after-sales service, customer service, among others).

To transfer and/or transmit contact information to the commercial force and/or distribution network, telemarketing, market research, and/or when the commercialization and procedures of real estate projects are outsourced.

Regarding audio and video surveillance installed at the facilities of Arquitectura y Concreto S.A.S. and/or captured during telephone calls, they are used for protection, control, and quality purposes. The collected information will be used for security, internal control, and quality purposes for people, property, and facilities. This information may be used as evidence in any judicial or administrative proceeding and may be provided to authorities upon request.

Arquitectura y Concreto may transfer or transmit contact information to affiliated companies and/or any person or entity that is part of the corporate group and/or a legal entity that constitutes, or in which Arquitectura y Concreto S.A.S. is included as part of it, to offer its products or services. It may also transmit and/or transfer personal data with financial entities, banking intermediaries and/or Banks, so that they can make projections and analyze credit viability, offer financial products and services, and in general, make commercial and financing offers for the acquisition of real estate units with Arquitectura y Concreto. It may also transmit contact information to the commercial force and/or distribution network, telemarketing, market research, and/or when the commercialization and procedures of real estate projects are outsourced.

Processing of Databases

Arquitectura y Concreto S.A.S. is not required to collect and process personal data by any law of the Republic of Colombia, but since it does so to fulfill the aforementioned purposes, it submits to and complies with the provisions of Law 1581 of 2012, regulatory decree, and other regulations that modify and/or replace it.

Arquitectura y Concreto S.A.S. stores and manages its databases in an automated manner, using electronic or computer tools.

The Processing to be carried out by the Data Controller of the Databases will be carried out in accordance with the provisions of Law 1581 of 2012, Decree 1377 of 2013, and the regulations that supplement or modify it, as well as the provisions of this Policy and the respective Personal Data Processing Authorizations.

In development of the aforementioned purposes, Arquitectura y Concreto collects and processes the following personal data, depending on the database in which the information subject is classified:

Business name or trade name, ID card or Tax ID, landline phone number, cell phone number, email, social networks, profession, art, trade or economic activity, financial references, commercial references, personal references, financial statements, tax returns, residential address, place and date of birth, socioeconomic information, marital status, gender, age, biometric data, judicial or disciplinary records, employment and academic information, health information, images and videos, sensitive data, family data, among others.

Special Category of Data - Sensitive Data

Sensitive data are those that affect the intimacy of the Data Subject or whose improper use may lead to discrimination, such as those revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.

Arquitectura y Concreto, for the collection and processing of sensitive data, will comply with the following requirements:

The Processing of sensitive data is prohibited, except when:

a) The Data Subject has given explicit authorization for such Processing, except in cases where such authorization is not required by law.

b) Processing is necessary to safeguard the vital interest of the Data Subject and they are physically or legally incapacitated. In these events, legal representatives must give their authorization.

c) Processing refers to data that are necessary for the recognition, exercise, or defense of a right in a judicial proceeding.

d) Processing has a historical, statistical, or scientific purpose. In this event, measures must be adopted to delete the identity of the Data Subjects.

Special Authorization

Arquitectura y Concreto will inform, through the various means of obtaining sensitive data, all data subjects, pursuant to Law 1581 of 2012 and regulatory standards, the following:

a) It will inform the Data Subject that, as sensitive data, they are not obligated to authorize their Processing.

b) It will inform the Data Subject expressly and previously, in addition to the general requirements of authorization for the collection of any type of personal data, which of the data to be processed are sensitive and the purpose of the processing, as well as obtain their express consent.

c) No activity may be conditioned on the provision of sensitive personal data.

Collection of Data from Children, Adolescents, and Minors

Arquitectura y Concreto is aware and attends to the fact that the Processing of personal data of children and adolescents is prohibited, except when they are public nature data, in accordance with the provisions of Article 7 of Law 1581 of 2012. Therefore, in the event that such data are collected, the following parameters and requirements will be taken into account:

a) That the processing responds to and respects the best interests of children and adolescents.

b) That the processing ensures respect for their fundamental rights.

Once the above requirements are met, the authorization of the legal representative of the child or adolescent will be obtained for the capture, storage, transfer to third parties, and use of the data, prior to the minor exercising their right to be heard, an opinion that will be assessed taking into account their maturity, autonomy, and capacity to understand the matter.

Transfer and Transmission of Personal Data

Arquitectura y Concreto S.A.S. may transfer and transmit personal data to third parties with whom it has an operational relationship that provides it with services necessary for its proper operation. In such cases, the necessary measures will be adopted to ensure that persons who have access to personal data comply with this Policy and the personal data protection principles and obligations established in the Law.

Taking the above into account, in cases where Arquitectura y Concreto transmits data to one or more processors located within or outside the territory of the Republic of Colombia, it will establish contractual clauses or enter into a personal data transmission contract in which it will indicate:

The scope of the processing.

The activities that the processor will carry out on behalf of the controller for the processing of personal data.

The obligations of the Data Processor toward the data subject and the controller.

Data processors must commit to applying the obligations of Arquitectura y Concreto as data controller under this Data Processing and Personal Data Protection Policy, in accordance with the purposes authorized by data subjects and with applicable current laws. In addition to the obligations imposed by applicable regulations within the said contract, the following obligations must be included on the part of the respective processor:

Process data on behalf of the controller in accordance with the principles established in this policy and current laws.

Safeguard the security of databases containing personal data.

Maintain confidentiality regarding the processing of personal data.

In the case of personal data transfers, the provisions of Law 1581 of 2012, its regulatory decree, and other regulations that modify and/or replace it must be observed.

Arquitectura y Concreto as Data Processor of Personal Data

Arquitectura y Concreto may receive, in its capacity as data processor, the personal data of data subjects provided by third parties with which it has a contractual link, subject in such cases to compliance with the obligations established in Article 18 of Law 1581 of 2012.

Rights of Data Subjects of Information Processed by Arquitectura y Concreto S.A.S.

Arquitectura y Concreto S.A.S., in the terms of the law, guarantees and informs data subjects of personal data of the following rights:

To know, update, and rectify their personal data. This right may be exercised, among others, with respect to partial, inaccurate, incomplete, fragmented, misleading data, or those whose processing is expressly prohibited or has not been authorized.

To request proof of the authorization granted to Arquitectura y Concreto S.A.S., except when it is exempt as a requirement for Processing in the terms of the law.

To be informed by Arquitectura y Concreto S.A.S. or the Data Processor, upon request, regarding the use given to their personal data.

To file complaints before the Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce) for violations of the protection and processing of personal information.

To revoke the authorization and/or request the deletion of data when the Processing does not respect the principles, rights, and constitutional and legal guarantees.

To access free of charge their personal data that have been subject to Processing.

Data Controller of Personal Information

The person responsible for the processing of personal data is:

Business Name: Arquitectura y Concreto S.A.S.

Tax ID (NIT): 800.093.117-3

ISIC Code (CIIU): 4111, 4112, 4290, 4210

Domicile: Medellín, Antioquia

Physical Address: Calle 3 sur Nro. 43ª-52, Office 1801

Email: protecciondedatos@arquitecturayconcreto.com

Landline Phone: (+574) 3123618

Duties of the Data Controller and Data Processor of Personal Information

In the terms of the law, the duties of Arquitectura y Concreto S.A.S. as controller, regarding personal data, are:

Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.

Request and keep a copy of the respective authorization granted by the Data Subject.

Properly inform the Data Subject about the purpose of collection and the rights they have by virtue of the authorization granted.

Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.

Guarantee that the information provided to the Data Processor, if applicable, is truthful, complete, accurate, up-to-date, verifiable, and understandable.

Update the information, timely communicating to the Data Processor all developments regarding data previously provided, and adopt the other necessary measures to ensure that the information provided is kept up-to-date.

Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.

Provide the Data Processor, as applicable, only data whose Processing is previously authorized in accordance with the provisions of this law.

Demand from the Data Processor, at all times, respect for the security and privacy conditions of the Data Subject's information.

Process inquiries and complaints formulated in the terms indicated in the law.

Adopt an internal manual of policies and procedures to ensure adequate compliance with data protection and, in particular, for handling inquiries and complaints.

Inform the Data Processor when certain information is being disputed by the Data Subject, once the complaint has been filed and the respective procedure has not been completed.

Inform, upon request of the Data Subject, about the use given to their data.

Inform the data protection authority when security codes are violated and there are risks in the administration of Data Subjects' information.

Comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce).

The duties of Arquitectura y Concreto S.A.S. as processor, regarding personal data, are:

Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.

Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.

Timely carry out the updating, rectification, or deletion of data in the terms of this law.

Update the information reported by Data Controllers within five (5) business days from receipt.

Process inquiries and complaints formulated by Data Subjects in the terms indicated in this law.

Adopt an internal manual of policies and procedures to ensure adequate compliance with this law and, in particular, for handling inquiries and complaints from Data Subjects.

Insert in the database the legend "information under judicial dispute" once notified by the competent authority of judicial proceedings related to the quality of the personal data.

Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce).

Allow access to information only to persons who may have access to it.

Inform the Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce) when security codes are violated and there are risks in the administration of Data Subjects' information.

Comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce).

Data Subject Service Channels

The means that Arquitectura y Concreto S.A.S. has made available to data subjects (Suppliers, Clients, Employees) for handling their inquiries, requests, and complaints are the following:

Website: www.arquitecturayconcreto.com

Email: protecciondedatos@arquitecturayconcreto.com

In-Person Service Point: Calle 3 sur Nro. 43ª-52, Office 1801, Edificio 43 Avenida, Medellín (Antioquia)

Phone: (604) 3123618

Procedure for Attending to Data Subjects of Personal Data Information for the Exercise of Their Rights

The Data Subject or their successor may only file a complaint with the Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce) once they have exhausted the inquiry or complaint procedure before the Data Controller or Data Processor.

For the filing and handling of the request, the Data Subject must provide the following information:

Full names and surnames

Identification number

Contact information (physical address and/or electronic address and contact phones)

Means to receive response to the request

Reason/Fact giving rise to the request with a brief description of the right they wish to exercise (Know, update, rectify, request proof of the authorization granted, revoke it, delete it, access the information)

Inquiries

Data Subjects or their successors may consult the personal information of the Data Subject contained in the databases of Arquitectura y Concreto S.A.S. The Data Controller or Data Processor must provide them with all information contained in the individual record or linked to the identification of the Data Subject.

The inquiry will be made through any of the channels previously indicated and evidence thereof must be created and maintained. The inquiry will be made through a request addressed to Arquitectura y Concreto S.A.S. or to the Data Processor, and must contain the information indicated above. The inquiry will be attended to within a maximum period of ten (10) business days from the date of receipt. When it is not possible to attend the inquiry within said period, the interested party will be informed, expressing the reasons for the delay and indicating the date on which the inquiry will be attended, which in no case may exceed five (5) business days following the expiration of the first period.

Complaints

Data Subjects or their successors who consider that the information contained in a database of Arquitectura y Concreto S.A.S. should be subject to correction, updating, or deletion, or when they detect the alleged non-compliance with any of the duties contained in the law, may file a complaint before the Data Controller or the Data Processor, which will be processed under the following rules:

The complaint will be formulated through a request addressed to Arquitectura y Concreto S.A.S. or to the Data Processor, and must contain the information indicated above and accompany the documents that the complainant wishes to submit.

If the complaint is incomplete, the interested party will be required within five (5) business days following receipt of the complaint to correct the deficiencies.

Two (2) months after the date of the requirement, if the applicant does not submit the required information, it will be understood that they have withdrawn the complaint.

In the event that the person receiving the complaint is not competent to resolve it, it will be forwarded to the appropriate party within a maximum period of two (2) business days and the interested party will be informed of the situation.

Once the complete complaint is received, the legend "complaint in process" and its reason will be included in the database within a period not exceeding two (2) business days. This legend must be maintained until the complaint is decided.

The maximum period for attending to the complaint will be fifteen (15) business days from the day following the date of receipt.

When it is not possible to attend to the complaint within said period, the interested party will be informed of the reasons for the delay and the date on which the complaint will be attended, which in no case may exceed eight (8) business days following the expiration of the first period.

Information Security Measures

The control measures implemented by Arquitectura y Concreto S.A.S. for the protection of information contained in databases include the assignment of responsibilities and authorizations regarding personal information processing, the implementation of confidentiality agreements with persons who handle or have access to personal information, data transmission agreements, and security control for human resources once the employment contract has ended, consisting of restricting access to personal information processed by Arquitectura y Concreto S.A.S.

These control and protection policies are emphasized:

Information processed by Arquitectura y Concreto S.A.S. is carried out only by its employees and for the purposes established herein.

Employees of Arquitectura y Concreto S.A.S. may not make copies of the personal information processed by Arquitectura y Concreto S.A.S.

Employees of Arquitectura y Concreto S.A.S. do not have remote access to the personal information processed by Arquitectura y Concreto S.A.S.

For the above, Arquitectura y Concreto has this policy and a series of procedures for the adequate compliance with data protection and its security.

Updating Information Contained in Databases

Arquitectura y Concreto S.A.S. will update the information contained in databases upon report by the data subjects themselves or verification by Arquitectura y Concreto S.A.S. and in the terms of the law.

Consumer Privacy Protection Measures Based on Law 2300 of 2023

Personal information of consumers linked to the databases of Arquitectura y Concreto S.A.S., that is, potential, former, and current clients who are contacted through the different means reported to the company, will always be processed in the terms provided by Law 2300 of 2023, for the purposes of sending commercial communications.

For collection activities, contact will be made through the channels that clients authorize for such purpose. Such authorization will be recorded in the client enrollment documents or subsequent or additional documents. Collection management may not be carried out through several channels within the same week or more than once during the same day, respecting the schedule from Monday to Friday from 7:00 am to 7:00 pm, and Saturdays from 8:00 am to 3:00 pm, excluding any type of contact for these purposes on Sundays and holidays. Modification of these conditions, if accepted by the client, will be recorded in an independent document and subsequent to the formalization of the commercial relationship.

Sending information with a commercial and advertising character for the promotion of products, campaigns, and other market activities, including text messages, web messages, emails, and calls, addressed to Data Subjects in the client database, may only be carried out from Monday to Friday from 7:00 am to 7:00 pm, and Saturdays from 8:00 am to 3:00 pm.

When a commercial relationship is formalized with clients or when entering the offices or facilities of Arquitectura y Concreto, the client may not be required to accept receipt of commercial advertising messages. The client will only be obligated to receive information strictly related to the good or service acquired. Therefore, clients must expressly accept the processing of their personal data for advertising purposes.

Effective Date of the Information Processing Policy and Database Validity Period

This is the text of the Internal Policies and Procedures Manual for the processing and protection of personal data (Law 1581 of 2012) of Arquitectura y Concreto S.A.S., which was prepared under the instruction and supervision of management, to take effect in the terms of the law; it became effective on 09/01/2016, and the validity period of the databases of Arquitectura y Concreto S.A.S. is during the validity of the contractual relationship and twenty (20) years more. In the case of data where there is no contractual relationship, the validity period of the data in the databases is twenty (20) years.

This Policy takes effect from its publication, the date of which is indicated at the beginning of this document. This Policy may be modified at any time, with the purpose of adapting it to legislative or jurisprudential developments, as well as best practices that develop regarding the protection of Personal Data.

In the event of substantial changes to the content of the Policy, related to the identification of the Data Controller and the purpose of the Processing of Personal Data, which may affect the content of the authorization, the Data Controller will communicate these changes to the Data Subject no later than the time of implementation, through the website www.arquitecturayconcreto.com, where the modified version of the Policy and its effective date will be made available to data subjects. For data subjects who do not have access to electronic media or those who cannot be contacted, notification will be made through notices posted at the company's main office.

Terms and conditions of use of the portal