Intro

ARIAFINA S.A.S., in its capacity as Data Controller, has the right to draft the present text in order to comply with the current regulation and to define the framework for the attention of requests and complaints regarding the treatment of personal data collected and processed in accordance with the Organic Law 1581 of 2012. The Right to Habeas Data, according to the law, is the right of every person to know, update and rectify the information that has been collected about him in files and databases of public or private nature and it guarantees to all citizens the power of decision and control over their personal information, in this sense, ARIAFINA S.A.S. proceeds to define this policy taking into account that for the development of its object, it continuously collects and processes personal data. By means of this policy, we commit ourselves to make the use of the data based on a policy of privacy and treatment of personal data, in which we express our responsibility for the collection, storage and development of any activity in which we involve personal data. In this policy we also express the rights that each user has to know, update, rectify and cancel their personal data in the ARIAFINA S.A.S. databases. In this way, we comply with Law 1581 of 2012.

Definitions

a) Consent: The data subject's prior, express and informed consent to the processing of personal data.

b) Database: Organized set of personal data subject to processing.

c) Personal Data: Any information that is associated or may be associated with one or more identified or identifiable natural persons.

d) Data Processor: The natural or legal, public or private person who, alone or in association with others, carries out the processing of personal data on behalf of the Data Controller.

e) Data Controller: Natural or legal person, public or private, who, alone or in association with others, decides on the database and/or on the processing of the data.

f) Data Subject: The natural person whose personal data are the subject of the processing.

g) Processing: Any operation or set of operations on personal data, such as collection, storage, use, disclosure or deletion.

Purpose

In this policy, ARIAFINA S.A.S. establishes the necessary guidelines for the protection of the personal data of the holders, as well as the purposes for which the information is collected, the rights of the holders, the entity responsible for dealing with complaints and claims, and the procedures to be followed by the holders to access, update, rectify and cancel the information.

Scope of application

This policy applies to all the personal data bases held by ARIAFINA S.A.S. and by the data processors acting on behalf of the company, and is applicable to the personal data recorded in all the databases that make them susceptible to processing by ARIAFINA S.A.S. and by the data processors acting on behalf of the company, with the limitations and restrictions established by the law itself and as long as they are not public information.

Purpose of the database

By agreeing to provide and process your data under this policy, you expressly authorize ARIAFINA S.A. S (which in the development of its object and its relationships with third parties, understood by these users, employees, suppliers, creditors, among others; constantly collects data to carry out various purposes and uses) to use the data provided (among the information we keep is your name, telephone, mobile phone, address, neighborhood, citizenship card, email address, date of birth, profession, among others) and that are requested during the processes and various activities that we develop, for the following purposes:

● Maintain contact to inform you about events, services, promotions, programs, contests, campaigns, loyalty programs, prize shipping logistics, and content related to activities developed for your different audiences, in order to maintain a close and trustworthy relationship with each one.
●Send information, news, technology, innovation, entrepreneurship, and generally share information of interest in the field of technology and innovation.
● For administrative, commercial, promotional, informational, marketing, and sales purposes.
● Offer all kinds of commercial services; as well as carry out promotional campaigns, marketing, advertising, and contests.
● Information about events, services, and logistics for prize shipping.
● Seek closer knowledge of all your users, suppliers, employees, and related third parties.
● Advance commercial agreements, events, or institutional programs directly or in partnership with third parties.
● Verify data through consultation of public databases or credit risk centers.
● Send information about activities carried out by the company or provide information deemed of interest through various means.
● Comply with legal obligations to provide information to administrative entities, as well as to the competent authorities that require it.
● Consult and report obligations to credit risk centers when appropriate.
● Develop selection and hiring processes for the company.
● Prevent fraud and other illegal activities or activities prohibited by the laws of the Republic of Colombia and/or international laws.

ARIAFINA S.A.S collects information for statistical, measurement, control, and performance improvement purposes regarding actions performed by its users. This includes, but is not limited to, visits to our websites, including page visits, time spent on them, selected links, search terms entered, and any other actions taken to connect to the ARIAFINA S.A.S website; Internet Protocol (IP) address, browser type and language, access times, Uniform Resource Identifier (URI) of the website from which you accessed our site, and the URL you navigate outside of our site if you select a link to our site.

When receiving newsletters or promotions via email from ARIAFINA S.A.S, we store statistical information using personalized links or similar technologies to determine whether the email was opened and which links were selected. This data is used to help assess the usage and effectiveness of our communications and to continuously improve them to provide information that suits your preferences and needs. In relation to the above, ARIAFINA S.A.S and the Data Processors acting on behalf of the company may, in addition to those already indicated, perform the following actions:

● Obtain, store, compile, exchange, update, collect, process, copy, fix, reproduce, and/or dispose of data or partial or total information from those holders who grant the appropriate authorization as required by law and in formats deemed appropriate for each case, understanding that this authorization is granted upon registering on the portal and accepting the collection and processing of the data.
● Classify, order, and separate the information provided by the data holder. Conduct investigations, compare, verify, and validate the data obtained in due form with credit risk centers with which we have business relations.
● Extend the information obtained in accordance with data protection laws to the companies with which we contract services for capturing, storing, and managing your databases, prior to obtaining the necessary authorizations in that regard, understanding that this authorization is granted upon registering on the portal and accepting the collection and processing of the data.
● Transfer partial or total data or information to our commercial establishments, companies, and/or affiliated entities.

Processing of Personal Data

In accordance with Law 1581 of 2012 and in compliance with the authorizations granted by the information holders, ARIAFINA S.A.S will perform operations that include data collection, storage, use, circulation, and/or deletion. This data processing will be carried out exclusively for the purposes authorized and outlined in this Policy. Personal Data Processing will also be carried out when there is a legal or contractual obligation to do so.

Rights Related to the Processing of Personal Data

Any process involving the processing of personal data by any area of the company, including users, suppliers, employees, and generally any third party with whom ARIAFINA S.A.S has commercial and labor relations, must consider the rights granted to the data holder, which are listed below: a) Know, update, rectify, and consult your personal data at any time in relation to ARIAFINA S.A.S or the Data Processors. This right can be exercised, among others, regarding partial, inaccurate, incomplete, fragmented data that may lead to error, or data whose processing is expressly prohibited or unauthorized. b) Request proof of the authorization granted to ARIAFINA S.A.S, or any other that the holder of the Personal Data subscribes to for this purpose, unless expressly exempted as a requirement for Data Processing in accordance with the law. c) Be informed by ARIAFINA S.A.S or the Data Processor, at the request of the data holder, about the use given to their data. d) Submit complaints to the Competent Authority for violations of the provisions of the law and other regulations that amend, add, or complement it, to assert their right to habeas data against the company. e) Revoke authorization and/or request the deletion of data when the processing does not respect the principles, rights, and constitutional and legal guarantees. Revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the Processor or Data Processor has engaged in conduct contrary to Law 1581 of 2012 and the Constitution. f) Access free of charge to the Personal Data that has been processed, for which the company ensures the secure and reliable conservation and archiving of the authorization formats duly granted by each data holder.

Area Responsible for Handling Requests, Inquiries, and Complaints

If you wish for ARIAFINA S.A.S to remove you from its databases, you must express this directly, clearly, unequivocally, and in writing, to the email: asistente@ariafina.co, or you can request a phone call by sending your contact number to the same email. If you do not express your interest in being removed from the databases, ARIAFINA will be authorized to continue processing them in accordance with Article 10 of Decree 1377 of 2013. Requests, inquiries, and complaints submitted by holders of Personal Data under the processing of ARIAFINA S.A.S to exercise their rights to know, update, rectify, and delete data, or revoke authorization must be directed to the aforementioned email. All requests or complaints must be submitted in electronic text or physical communication, excluding the possibility of making a request or complaint verbally or by phone. Upon receipt of the request or complaint by ARIAFINA S.A.S, it will be recorded with the date, day, and time of receipt, and the response terms and procedures stipulated by Law 1581 of 2012 will apply.

Whom ARIAFINA S.A.S Can Provide Information to Without Authorization from the Data Holders

● To the data holders, their heirs, or representatives at any time and through any means when requested from ARIAFINA S.A.S.
● To judicial or administrative entities exercising functions that make any request of the company to provide information.
● To third parties authorized by any law of the Republic of Colombia.
● o third parties expressly authorized by the Data Holder to provide the information, and whose authorization is delivered to ARIAFINA S.A.S.

Authorization

For the processing of personal data by ARIAFINA, prior, informed, and express authorization from the Data Holder is required, which must be obtained by any written means, whether physical or electronic, that can be consulted later; without prejudice to the exceptions provided for in the law, understanding that this authorization is granted upon registering on the portal and accepting the collection and processing of the data. At the time of requesting authorization from the Holder and allowing access to this policy, ARIAFINA S.A.S has clearly and expressly informed the purpose for which the personal data is collected, the processing to which the personal data will be subjected, the rights of the holder, and the means through which they can exercise them.

ARIAFINA S.A.S will maintain evidence of such authorizations adequately, respecting the principles of confidentiality and privacy of the information. In the event that ARIAFINA S.A.S significantly changes the declaration presented here or the manner in which it uses your personal information, this will be published through a notice before the application of the new conditions. All modified terms will automatically take effect five (5) days after the appearance of a notice on our website.

Procedures for Exercising the Rights of the Data Holders

Data Holders, regardless of their type of connection with ARIAFINA S.A.S, can exercise their rights to know, update, rectify, and delete information and/or revoke the authorization granted according to the following procedures:

a) Procedure to Request Proof of Granted Authorization: The request will be filed through the contact details mentioned here, indicating at least the full name of the data holder and their identification number, the physical or electronic address to which a response will be provided. Upon receiving the request, a copy of the authorization will be sent within fifteen (15) business days from the day following the receipt of the request. When it is not possible to respond within that period, the interested party will be informed of the reasons for the delay and the date on which it will be addressed; in no case may it exceed eight (8) business days following the expiration of the first term.

b) Procedure to Update Information: The Data Holder interested in updating the information provided and under processing by ARIAFINA S.A.S or the Data Processor may send the updated information through one of the established channels for this purpose, such as the website or email of the area responsible for Data Processing.

c) Procedure to Rectify and Delete Information and/or Revoke Authorizations: When the data holder wishes to rectify, delete, and/or revoke authorizations for the Processing of Personal Data, they must submit a request according to the following:

● The request must be submitted through the contact details mentioned here, including the identification of the Holder, a description of the facts giving rise to the request, the address, and, if applicable, accompanying supporting documents. If the request is incomplete, the interested party will be required within five (5) days following its receipt to rectify the deficiencies. If two (2) months have passed from the date of the request without the applicant providing the requested information, it will be understood that they have withdrawn the request.
● If the person receiving the request is not competent to resolve it, they will forward it to the appropriate authority within a maximum of two (2) business days and inform the interested party of the situation.
● Once the complete request is received, a note will be added to the database stating "Claim in process" along with the reason, within no more than five (5) business days. This note must be maintained until the request is resolved.
● The maximum term to address the request will be ten (10) business days from the day following the date of receipt. If it is not possible to respond within this term, the interested party will be informed of the reasons for the delay and the date on which their request will be addressed, which may not exceed eight (8) business days following the expiration of the initial term.
● It is essential to note that the request for deletion of information and the revocation of authorization will not proceed when the Holder has a legal or contractual obligation with ARIAFINA S.A.S.

Data Retention Period

The databases of ARIAFINA S.A.S will have a retention period corresponding to the purpose for which their processing was authorized or, failing that, ten (10) years.

Mechanism for Protection and Privacy of Your Personal Information

ARIAFINA S.A.S is committed to keeping the information and its contents strictly confidential and stored on servers that meet the necessary security standards to prevent alteration, loss, consultation, unauthorized or fraudulent use, thereby guaranteeing the exercise of the right to habeas data. As a user or supplier of ARIAFINA S.A.S, you will always have the rights to information, rectification, and cancellation of your personal data. While we strive to protect your personal information, ARIAFINA S.A.S cannot guarantee that the personal information or private communications you transmit to us will always remain confidential. All information stored by ARIAFINA S.A.S is managed with absolute confidentiality and in accordance with current legislation in Colombia and the company’s internal ethical code, implementing all security measures as outlined below. Nonetheless, if you are registered, it is your responsibility to keep your password confidential.

Usage Policy

By accessing this site, the user accepts the following conditions and usage policies. ARIAFINA S.A.S is not responsible for the understanding, interpretation, and/or use by users of the content presented on the site https://www.ariafina.co. The content is developed by ARIAFINA S.A.S or an authorized third party, without compromising the views or opinions of its advertisers or linked sites. ARIAFINA S.A.S reserves the right to modify the content, presentation, configuration, and/or the services offered—whether by itself or through an authorized third party—without prior notification to the user. The user acknowledges that no third party is liable for any damages arising directly or indirectly from the existence, use, access, inability to use, or impossibility of accessing this page or any of its links.

ARIAFINA S.A.S and/or its providers do not guarantee the accuracy and completeness of the information, software, products, and services presented on this site. Consequently, the user agrees that they are solely responsible for the decisions made based on the information or materials from this page or its links. For more information, consult with an ARIAFINA advisor.

The user will be liable for any damages of any kind that ARIAFINA S.A.S may suffer, directly or indirectly, as a result of non-compliance with any obligations arising from the Terms of Use or the law regarding the use of this website.

ARIAFINA S.A.S assumes no responsibility for any damages of any nature that may arise from the use of the services and content by the user or that may result from the lack of truthfulness, validity, completeness, and/or authenticity of the information that the user provides to other users about themselves, and in particular, but not exclusively, for damages of any nature that may arise from the impersonation of a third party by a user in any communication made through this website.

The inclusion of links to other sites via https://www.ariafina.co does not imply any relationship other than the “link” itself. All transactions made on such links are the sole responsibility of the user and the related entity.

The user recognizes that the content (including, but not limited to, text, software, music, sound, photographs, video, graphics, or other material) located either in the advertising of advertisers or in commercially produced information distributed electronically and presented to the user by ARIAFINA S.A.S either by itself or through an authorized third party, is protected by copyrights, trademarks, patents, or other commercial rights or forms of property rights.

The user may copy this content solely for personal, non-commercial use, as long as all copyright notices remain intact and the source is cited. The user may not modify, copy, reproduce, republish, upload, display, transmit, or distribute in any form the content available through ARIAFINA S.A.S and the linked sites, including the source code and software, under penalty of incurring civil and criminal liability, according to current regulations.