Personal data processing policy

PERSONAL DATA PROCESSING AND PRIVACY POLICY SINMENTE CO. S.A.S.

In compliance with the provisions of Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, Regulatory Decrees 1727 of 2009, 2952 of 2010 and 1377 of 2013 e) Judgments of the Constitutional Court C-1018 of 2008 and C-748 of 2011; SINMENTE CO S.A.S., adopts this Policy for the Processing of Personal Data (hereinafter “The Policy”), which will be informed to all owners of the data collected or that may be obtained in the future.

In this way, SINMENTE CO S.A.S., states that it guarantees the rights of privacy, intimacy and good name in the processing of personal data, and consequently all its actions will be governed by the principles of legality, purpose, freedom, veracity or quality, transparency, access and restricted circulation, security and confidentiality.

All persons who provide personal data to SINMENTE CO S.A.S., may know, update, rectify, delete or revoke the authorization previously granted.

DEFINITIONS

• Database: organized set of personal data that is subject to Processing.
• Personal data: any information linked to or that may be associated with one or more determined or determinable natural persons.
• Data Processor: natural or legal person, public or private, who by itself or in association with others, carries out the Processing of personal data on behalf of the Data Controller.
• Data Controller: natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the Processing of the data, in this case SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator.

• Authorization: prior, express and informed consent of the Owner to carry out the Processing of personal data.
• Owner: natural person whose personal data is subject to Processing.
• Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
• Natural Person: human person who exercises rights and fulfills duties in a personal capacity.
• Third party: any legal or natural person other than the persons who belong directly to SINMENTE CO S.A.S.
• Sensitive data: those that affect the privacy of the Owner or whose improper use may generate discrimination.
• Public data: is the data that is not semi-private, private or sensitive and may be contained, among others, in public records and documents, official gazettes and bulletins and judicial decisions.
• Private data: is the data that due to its intimate or reserved nature is only relevant to the owner.
• Semi-private data: are data that do not have an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to the owner but to a certain sector or society in general.

OBJECTIVE

The purpose of this policy is to define the general guidelines for compliance with Law 1581 of 2012 and Decree 1377 of 2013 in Colombia, which regulates the management of personal databases. By virtue of the same, the criteria for the collection, storage, use, circulation and deletion of personal data processed by SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator, will be established.

SCOPE

This policy applies to all personal information registered in the databases of SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator; who will act as responsible for the Processing of personal data.

OBLIGATION

This policy is mandatory for SINMENTE CO S.A.S. and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator.

PURPOSE

The personal data of the owners with which SINMENTE CO S.A.S. has, will be collected, used, transmitted, transferred, stored and processed for the following purposes:

1. Respond to requests for suggestions, petitions, complaints, claims and congratulations made by the owners.
2. Transmit the personal data of the owners to the control bodies and other authorities

if required by law.

3. Carry out marketing and/or promotion of products and commercial campaigns generated by SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator.
4. Carry out marketing and/or promotion of services of third parties with whom SINMENTE SO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator, has entered into commercial alliances.
5. Send information about new products and services.
6. Send advertising campaign information.
7. Conduct demand definition studies and analysis of services provided by SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator.
8. Strengthen relationships with consumers and customers, by sending relevant information and evaluating the quality of service.
9. Improve, promote and develop the products and services of SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator.
10. Update of data and identification documents.
11. Billing for services or products acquired.
12. Determine pending obligations, consult financial information and credit history and report to information centers of unfulfilled obligations, with respect to its debtors.
13. Register the personal data of the owners in the information systems of SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator and in its commercial and operational databases.
14. Develop activities of the Human Talent area (or whoever takes its place) such as selection, hiring, evaluation of participants in selection processes, verification of labor and personal references, conducting security studies; as well as payroll management, affiliations to entities of the general social security system, welfare, health and safety activities at work.
15. Any other activity of a similar nature to those described above that are necessary to develop the corporate purpose of SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator.

GENERAL CONDITIONS

To comply with Law 1581 of 2012 on personal data protection, the following considerations must be taken into account:

1. SINMENTE CO S.A.S.; is responsible for the Processing of its own personal databases and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator.
2. Third parties who have access to the databases will be in charge of the Processing and therefore must comply with the provisions of Law 1581 of 2012, Decree 1377 of 2013, the regulations that complement or modify them and this Policy.
3. The Law is mandatory throughout the Colombian territory and to transmit personal data to other countries, the legislation of these must contemplate security measures, equal to or higher than those contained in the Law in question.
4. Personal databases in SINMENTE CO S.A.S. are considered to be all those from natural persons, whether suppliers, customers, consumers, volunteers or linked by any means, employees, or any other natural person whose information is subject to processing. The application of the policy is not necessary, by legal exception, when:
5. The purpose of the databases and files is national security and defense, as well as the prevention, detection, monitoring and control of money laundering and terrorist financing.
6. The purpose of the databases is and contains intelligence and counterintelligence information.
7. The databases and files are of journalistic information and other editorial content.

SPECIFIC CONDITIONS AND PRIVACY

The following specific conditions must be taken into consideration:

1. Every employee who starts a labor relationship with SINMENTE CO S.A.S., must have in their employment contract a clause that expresses the commitment to comply with Law 1581 of 2012 and Decree 1377 of 2013. 5. A text will be included in the internal labor regulations regarding the obligation to comply with Law 1581 of 2012 and Decree 1377 of 2013.
2. Any third party that, due to its relationship with areas of SINMENTE CO S.A.S., requires personal databases must be asked for a contractual clause where the knowledge of the regulations and the responsibility in complying with them is expressed, and likewise, prior authorization from the Owner will be required to process their personal data.
3. All suppliers, customers, consumers, linked by any means, employees, or any other person whose information is subject to Processing by SINMENTE CO S.A.S., and its commercial establishments, or its commercial allies in which it has a link as a partner, investor, advisor, administrator, must be asked in writing for authorization so that their data can be processed without restrictions. This should extend to all effects that occur in our exercise.
4. In the authorization cited in the previous paragraph, the responsibility of the Owners to keep the information updated and truthful must also be made clear, promptly communicating to SINMENTE CO S.A.S., any modification in this regard.
5. All personal databases that SINMENTE CO S.A.S. process must have a recovery guarantee (Back up).
6. Limited access to personal databases must be available. When these are sent by mass media, they must contain keys so that access to them is restricted.
7. Databases should not be published in internal emails or on the internet without restricting access to them.
8. Periodically SINMENTE CO S.A.S. will promote campaigns to update its personal databases.
9. For the Processing of personal databases, all areas that require it must have a written procedure that guarantees compliance with the policy and that of Law 1581 of 2012 and Decree 1377 of 2013 14.

SINMENTE CO S.A.S. must have a procedure for handling queries and claims, guaranteeing compliance with the law regarding this issue.

RESPONSIBLE FOR THE TREATMENT

The following is the information on the processing of personal data, currently in SINMENTE CO S.A.S.:

· SINMENTE CO S.A.S. identified with NIT 901.239.915-1, with main address at carrera 34 #7 – 114 of the city of Medellín, Republic of Colombia. Website www.sinmenteco.com

TREATMENT AND PURPOSE

The treatment carried out by those responsible for the databases will be carried out in accordance with the provisions of Law 1581 of 2012, Decree 1377 of 2013 and the regulations that add to or modify it, as well as with the provisions of this Policy. The personal data collected will only be used for the purposes established in the respective privacy notices or data processing authorizations that are made available to the owners in order for them to authorize the processing thereof. However, the foregoing, the databases may also be used for the following purposes:

• Carry out the pertinent steps for the development of the company’s corporate purpose in what has to do with compliance with the object of the contract concluded with the owner of the information.
• Make invitations to events and offer new products or services.
• Manage procedures for requests, complaints or claims.

SENSITIVE DATA PROCESSING

In the event that those responsible carry out the Processing of Sensitive Data, it is guaranteed that authorization will be obtained for the processing of said data in a prior and express manner, complying with the following obligations:

· The Data Subject will be informed that, since it is Sensitive Data, they are not obliged to authorize its Processing.

· The Owner will be informed in advance and expressly which are the sensitive data and what will be the purpose of the Treatment that will be given to them.

· No activity will be conditioned to the Owner providing Sensitive Data.

RIGHTS OF THE HOLDERS

As owners of personal data, they will have the following rights:

· Access free of charge to the data provided that has been subject to processing.

· Know, update and rectify your information against partial, inaccurate, incomplete, fragmented data, that induce error, or those whose treatment is prohibited or has not been authorized.

· Request proof of the authorization granted.

· Submit complaints to the Superintendence of Industry and Commerce for infractions of the provisions of current regulations.

· Revoke the authorization or request the deletion of the data, provided that there is no legal or contractual duty that prevents eliminating them.

· Refrain from answering questions about sensitive data. Responses that relate to sensitive data or data of minors will be optional.

ATTENTION OF PETITIONS, CONSULTATIONS AND CLAIMS

To submit queries, claims, expand information, or to consult your personal data, ask for them to be modified, updated, rectified or deleted, or to revoke the authorization for their treatment, you can contact the telephone lines and internet pages cited here. The area in charge of handling the requests described above is the Customer Service area for consumers and customers, and for suppliers, the purchasing area.

Said attention, for customers and suppliers, will be attended directly by them. People linked by any means to SINMENTE CO S.A.S.; can go to these entities to attend to their requests.

PROCEDURE FOR THE EXERCISE OF THE RIGHT OF HABEAS DATA

In compliance with the regulations on personal data protection, SINMENTE CO S.A.S., who acts as responsible for the databases, establish this procedure and minimum requirements for the exercise of their rights. To attend to the petition, complaint or claim, the following information must be requested:

· Full name and surnames of the owner of the personal data.

· Contact information of the owner of the personal data: or physical address and/or email, or contact telephones.

· Reasons or facts that give rise to the claim, petition or consultation with a brief description of the right you wish to exercise (know, update, rectify, request proof of authorization granted, revoke it, delete, access information, among others).

· Signature (if possible).

· Identification number. Once this information is received, the controller will have a maximum term of fifteen (15) business days, counted from the day following the date of your request, query, or claim, to address it. When it is not possible to address the request, query, or claim within the aforementioned term, the controller will inform the owner or interested party of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. Once the terms indicated by Law 1581 of 2012 and other regulations that regulate or complement it have been met, the owner who is totally or partially denied the exercise of the rights of access, updating, rectification, deletion, and revocation, may bring their case to the attention of the Superintendence of Industry and Commerce – Office for the Protection of Personal Data.

INTERNATIONAL TRANSFER OR TRANSMISSION OF PERSONAL DATA

SINMENTE CO S.A.S., may carry out the transfer and transmission, including internationally, of the personal data it has in its databases, as long as the applicable legal requirements are met; and consequently, the owners of the personal data expressly authorize the transfer and transmission, including at an international level. For the transfer of personal data of the owners, SINMENTE CO S.A.S., will take the necessary measures so that third parties know and commit to observe this policy, under the understanding that the personal information they receive may only be used for matters directly related to SINMENTE CO S.A.S., or the purposes authorized by the owner expressly, and only while this authorization is in effect. It may not be used or intended for a different purpose or end.

DATA PROCESSING OF MINORS

The processing of personal data of children and adolescents is prohibited, except when it comes to data that is of a public nature and when the processing complies with the following parameters and requirements:

• That it responds to and respects the best interests of children and adolescents.
• That respect for their fundamental rights is ensured.

Once the above requirements are met, the legal representative of the child or adolescent will grant the authorization after the minor exercises their right to be heard, an opinion that will be valued taking into account the maturity, autonomy, and capacity to understand the matter.

VALIDITY

This Policy for the Processing of Personal Data is effective from the date of its publication.

The databases in which personal data will be registered will be kept while the contractual relationship with the owner with the information is maintained or when its deletion is not requested by the interested party and provided that there is no legal duty to keep them.

EXTENSION OF THE DATA PROCESSING POLICY

SINMENTE CO S.A.S., acts as an associate, investor, administrator, producer of other brands, commercial establishments, through those who represent them; consequently, the regulation agreed here will be applied in the same terms and conditions to:

BURDO PROVENZA S.A.S., and its brand and/or commercial establishment BURDO, BURDO TRAGOS Y COMIDA; CORANTES S.A.S., and its brand and/or commercial establishment RESTAURANTE CORANTES and/or ENSO; CRIMINAL ENVIGADO S.A.S.; CRIMINAL LEMON S.A.S.; CRIMINAL MANILA S.A.S.; CRIMINAL PROVENZA S.A.S.; CRIMINAL SUPERIOR S.A.S.; CRIMINAL TESORO S.A.S.; EGEO INVERSIONES S.A.S., and its brand and/or commercial establishment EGEO; EL BOTANICO MEDELLIN S.A.S., and its brand and/or commercial establishment EL BOTANICO; LA CRUDA S.A.S., and its brands and/or commercial establishments LA CRUDA and EL AGITE; GENERAL CAFÉ & BAR S.A.S., and its brands and/or commercial establishments GENERAL CAFÉ & BAR and CIERTO; IAM SCI S.A.S., and its brand and/or commercial establishment IAM SCI; MERO S.A.S., and its brand and/or commercial establishment MERO; ONI MEDELLIN S.A.S. and its brand and/or commercial establishment ONI; POSADA LEON S.A.S.,

MAL DE OJO S.A.S. and its brand and/or commercial establishment MAL DE OJO; MALA MUSIC ROOM and its brand and/or commercial establishment MAL DE OJO; CASA BARRANCO MEDELLIN and its brand and/or commercial establishment CASA BARRANCO.