Privacy and Personal Data Protection Policy

1Purpose

This is an English translation of the Política de Privacidad y Protección de Datos Personales of MICELIO INC S.A.S., provided for convenience. The Spanish version is the one that governs.

The purpose of this Privacy and Personal Data Protection Policy (hereinafter “the Policy”) is to comply with Ley Estatutaria No. 1581 de 2012 (Colombia's statutory Personal Data Protection Law), Decreto Reglamentario 1377 de 2013 (its implementing decree), Decreto Reglamentario 1074 de 2015 (the Single Regulatory Decree of the Trade, Industry and Tourism Sector) and the other rules governing personal data protection, or those that supplement, replace, amend or repeal them, and, in particular, to guarantee the right of habeas data of personal data subjects.

2Scope

This Privacy Policy applies both to MICELIO INC S.A.S., as data controller, and to its direct and indirect employees, and to all third parties, whether natural persons or legal entities, to whom it transmits or transfers the personal data of the data subjects who make up the data controller's stakeholder groups, whenever they carry out any processing of such data.

3Legal framework

The processing of personal data carried out by MICELIO INC S.A.S. is based on the following legal grounds:

Constitución Política de Colombia (the Colombian Constitution), article 15.
Ley Estatutaria 1581 de 2012 (statutory Personal Data Protection Law).
Decreto Reglamentario 1377 de 2013 (implementing decree of Ley 1581 de 2012).
Decreto Único Reglamentario del Sector Comercio, Industria y Turismo (Single Regulatory Decree of the Trade, Industry and Tourism Sector).
Sentencia C-748 del 6 de octubre de 2011 de la Corte Constitucional (judgment of Colombia's Constitutional Court of October 6, 2011).
Circulars, opinions and other instructions on the matter issued by the Superintendencia de Industria y Comercio (SIC), in its capacity as Colombia's National Personal Data Protection Authority.

4Identification of the data controller

NAME	MICELIO INC S.A.S.
NIT (TAX ID NUMBER)	902.097.382-7
EMAIL	dmejia@micelioinc.com
PHONE	321 640 4797

5Definitions

For the purposes of this Policy, the following definitions apply:

AUTHORIZATION: Prior, express and informed consent of the data subject to the processing of their personal data, which may be obtained (i) in writing, (ii) orally or (iii) through unequivocal conduct from which it can reasonably be concluded that the data subject gave the authorization.
PRIVACY NOTICE: A physical, electronic or other document generated by the data controller and made available to the data subject in connection with the processing of their personal data. The Privacy Notice informs the data subject of the existence of the information processing policies that will apply to them, how to access them and the characteristics of the intended processing of the personal data.
DATABASE: An organized set of personal data, physical or electronic (digital), subject to manual or automated processing.
PERSONAL DATA: Any information linked or that may be associated with one or more identified or identifiable natural persons. Personal data may be public, semi-private, private or sensitive in nature.
PRIVATE DATA: Data that, because of its intimate or confidential nature, is relevant only to the data subject.
PUBLIC DATA: Data classified as such by law or by the Constitution, and any data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person's civil status, profession or trade, and status as a merchant or public servant, as well as data that can be obtained without any restriction. By its nature, public data may be contained in, among others, public registries, public documents, and official gazettes and bulletins that are not subject to confidentiality.
SENSITIVE DATA: Data that affects the data subject's privacy or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions, social or human rights organizations, or organizations that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health and sex life, and biometric data (fingerprints, iris, voice, palm or facial features, photographs, videos, among others). The personal data of children and adolescents is subject to the same rules and procedures as sensitive data, and shall not be processed in any way that may harm or threaten their physical, mental and emotional development.
CHILD: A person between 0 and 12 years of age (article 3 of the Código de la Infancia y de la Adolescencia, Colombia's Children and Adolescents Code).
ADOLESCENT: A person between 12 and 18 years of age (article 3 of the Código de la Infancia y de la Adolescencia).
SEMI-PRIVATE DATA: Data that is neither intimate, confidential nor public in nature and whose knowledge or disclosure may be of interest not only to its data subject but to a group of people or to society in general. Semi-private data includes, among others, information relating to social security and to financial and credit behavior.
RIGHT OF HABEAS DATA: Under article 15 of the Constitución Política de Colombia, the right of every person to know, update and correct the information collected about them in data banks and in the files of public and private entities.
DATA SUBJECT: For the purposes of Ley 1266 de 2008 (Colombia's financial and credit habeas data law), the natural person or legal entity to whom the information held in a data bank refers, and who holds the right of habeas data and the other rights and guarantees set out in that law and in the rules that supplement, amend, replace or repeal it. For the purposes of Ley 1581 de 2012, the natural person whose personal data is processed by or on behalf of the data controller or data processor.
DATA CONTROLLER: A natural person or legal entity, public or private, that, by itself or jointly with others, decides on the database and/or the processing of the data. For the purposes of this Policy, the data controller is MICELIO INC S.A.S.
DATA PROCESSOR: A natural person or legal entity, public or private, that, by itself or jointly with others, processes personal data on behalf of the data controller.
STAKEHOLDER GROUPS: For the purposes of this Privacy Policy, all groups of natural persons whose personal data is processed in any way by the data controller and/or the data processors.
PERSONAL DATA PROTECTION OFFICER: The person or area responsible for handling complaints and claims regarding personal data protection, designated in the Policy.
DATA PROTECTION: All technical, human and administrative measures necessary to secure records and prevent their tampering, loss, consultation, use or unauthorized or fraudulent access.
PROCESSING: Any operation or set of operations on personal data, such as collection, storage, updating, use, circulation, transfer, transmission or deletion.
TRANSFER: A transfer of data takes place when the data controller and/or data processor, located in Colombia, sends personal information or data to a recipient that is itself a data controller and is located inside or outside the country.
TRANSMISSION: Processing of personal data that involves communicating it inside or outside the territory of the Republic of Colombia for the purpose of processing by the data processor on behalf of the data controller.

The right of habeas data includes the following:

Rights	Definition
Right of access or inquiry	The data subject's right to be informed by the data controller or the data processors, upon request, of which personal data is held in the data controller's databases, and of its origin, use and purpose.
Claim for correction or update	The data subject's right to have partial, inaccurate, incomplete or fragmented data that may be misleading updated, corrected or amended.
Claim for deletion	The data subject's right to have deleted any data that is inadequate or excessive, that does not respect constitutional and legal principles, rights and guarantees, or whose processing is expressly prohibited or has not been authorized. A request for deletion shall not proceed when the data subject has a legal or contractual duty to remain in the database.
Claim for revocation of authorization	The data subject's right to withdraw the authorization previously given for the processing of their personal data. Revocation of the authorization shall not proceed when the data subject has a legal or contractual duty to remain in the database.
Infringement claim	The data subject's right to request that any breach of personal data protection rules be remedied.
Inquiry about the authorization	The data subject's right to request proof of the authorization given for the processing of their personal data.
Complaint to the SIC	The right to file complaints with the Superintendencia de Industria y Comercio for infringements of personal data protection rules, once the inquiry or claim procedure before the data controller or data processor has been exhausted

PQR´S (REQUESTS, COMPLAINTS AND CLAIMS): Inquiries and claims regarding personal data protection.

Types of PQR’S	Definition
Inquiry	A request for information submitted by the data subject, their successors in title or their attorney, through the channels established for that purpose, seeking to know the information about the data subject held in the databases managed by the data controller, and its origin, use and purpose.
Claim	A request submitted by the data subject, their successors in title or their attorney, through the channels established for that purpose, when they consider that the information contained in a database managed by the data controller should be corrected, updated, rectified or deleted, or when they seek to revoke the authorization.

6Classification of the types of data collected

Identification data: Public: First name, surname, type and number of identity document, date and place of issue, civil status, sex, among others. Semi-private: Signature, nationality, family members' data, electronic signature, identity documents, date of birth or death, age, among others. Sensitive: Fingerprints, DNA, iris, facial or body geometry, photographs, videos, dactyloscopic formula, voice, skin color, eye color, hair color and type, distinguishing marks, height, weight, build, among others.
Location data. Public: Address, phone number and email related to the data subject's commercial or professional activity. Private (confidential): Home address, phone number and email related to the data subject's private activity.
Sensitive data: Sensitive data means data that affects the data subject's privacy or whose misuse may lead to discrimination, including: i) data relating to the person's health or health status, including orders for and results of laboratory tests, diagnostic imaging, studies, general or specialist medical, psychological or psychiatric diagnoses, and medications and/or medical treatments of any kind; ii) data relating to membership of trade unions or of social, human rights, religious or political organizations; iii) data on sexual preference, identity and orientation, and on ethnic or racial origin; iv) data relating to vulnerable populations.
Socioeconomic data. Public: Data relating to the person's economic activity. Private (confidential): Socioeconomic stratum (estrato) and home ownership, among others. Semi-private: Financial, tax and credit data; employment history, experience, position, start and end dates, notes and disciplinary warnings; education level, training and academic record; enrollment in and contributions to the comprehensive social security system.
Other types of data. Public: Criminal and/or disciplinary records. Semi-private: Data on personal tastes and interests. Private: Personal data used to access information systems: usernames, passwords, IP addresses, profiles, among others.

7Guiding principles

The following are the guiding principles of personal data protection, and they apply to the processing carried out by the data controller, its employees and all third parties, whether natural persons or legal entities, to whom it transmits or transfers the personal data of the data subjects who make up its stakeholder groups, whenever they carry out any processing of such data:

PRINCIPLE OF LEGALITY: Personal data shall be processed in accordance with the legal requirements set out in Ley Estatutaria 1581 de 2012, its implementing decrees and other related rules.
PRINCIPLE OF PURPOSE: The processing of personal data must serve a legitimate purpose in accordance with the Constitution and the law, which must be disclosed to the data subject and is set out later in this Policy.
PRINCIPLE OF FREEDOM: Processing may only be carried out with the prior, express and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that dispenses with consent. Public data is exempt from this principle and may be processed without the data subject's authorization, in accordance with Ley 1581 de 2012 and Decreto Único Reglamentario 1074 de 2015.
PRINCIPLE OF ACCURACY OR QUALITY: Information subject to processing must be truthful, complete, accurate, up to date, verifiable and understandable. The processing of partial, incomplete, fragmented or misleading data is prohibited.
PRINCIPLE OF TRANSPARENCY: Processing must guarantee the data subject's right to obtain, at any time and without restriction, information about the existence of data concerning them.
PRINCIPLE OF RESTRICTED ACCESS AND CIRCULATION: Personal data, except public information, may not be made available on the Internet or other means of mass disclosure or communication, unless access is technically controllable so as to provide restricted knowledge only to data subjects or authorized third parties.
PRINCIPLE OF SECURITY: Information subject to processing shall be protected through the technical, human and administrative measures necessary to secure the records, preventing their tampering, loss, consultation, use or unauthorized or fraudulent access.
PRINCIPLE OF CONFIDENTIALITY: All persons involved in the processing of personal data are required to keep the information confidential, even after their relationship with any of the tasks involved in the processing has ended.

8Processing to which personal data will be subject and its purposes

For the purposes of this Policy, the data controller, directly or through data processors, may collect, store (manually or automatically), use, circulate, update, delete or otherwise process the personal data of its stakeholder groups, at all times in accordance with the rules in force and for the purposes described below.

MICELIO INC S.A.S. processes the personal data held in its databases in order to carry out its corporate purpose, whose main activity comprises the design, development, testing, deployment, administration, advisory, consulting, support and maintenance of information and communication technology systems in general; the development of software, platforms and mobile and web applications; the building and management of data lakes; the provision of data analysis and processing, hosting and artificial intelligence services; the technical coordination and leadership of technology teams; and the other complementary activities within its corporate purpose.

8.1General purposes of the processing of personal data of all stakeholder groups

Compliance with the rules in force.
Fulfillment of the obligations arising from contracts of any kind entered into between the data controller and the data subjects, or with their contracting parties or employers.
National and international transmission and transfer, and storage and custody of information and/or personal data in physical archives or on servers owned by the company and/or by third parties, located inside or outside the country, whenever required for the company's own activities.
Recording and control of incoming and outgoing documents.
Analysis and design of programs that create a social impact for the data controller's stakeholder groups.
Calling and running programs, meetings, training sessions and events, and keeping documentary records of them, such as attendance lists, photographs, voice recordings and/or videos, which may be used in internal and/or external publications.
Design and conduct of surveys and interviews.
Sending communications related to the purposes set out in this Privacy Policy, the activities of the data controller or its strategic partners, advertising, marketing, promotions, events, the sale and promotion of products and/or services, website content updates, partnerships and benefits, through the data subjects' professional, business and/or personal contact details, including but not limited to landline and/or mobile phone, postal mail and/or email, SMS and/or MMS text messages, social networks, electronic media and/or any other means of communication.
Personal data update campaigns
Internal controls, indicators, statistics and records of the relationships maintained with the data subjects of the different stakeholder groups.
Control of access to and entry into the data controller's premises through video surveillance and photographic records. Security of the premises and of the people who enter them, and emergency response.
Support for internal and/or external audits, statutory audits (revisoría fiscal), consulting and the implementation of improvement plans.
Reporting on, handling and following up on requests made by competent administrative and judicial authorities and oversight bodies, concerning non-sensitive, private and/or sensitive data.
Preparing and filing lawsuits and criminal complaints before the competent authorities, and exercising the right of defense in any administrative and/or judicial proceeding.
Internal or external communications.
Management of the company's administrative planning, organization, direction and control procedures.
Application for, processing and issuance of insurance policies and/or financial services.
Financial, tax, economic and accounting management, creation of third-party records and registration in the data controller's databases.
Administrative management for the design, preparation and implementation of strategies and goals to optimize financial and human resources, control, monitoring and planning, and other strategic aspects of the company.
For security purposes and the prevention of fraud, money laundering, terrorist financing, financing of the proliferation of weapons of mass destruction, corruption, transnational bribery and related predicate offenses.
Verification of data and references, screening against binding and non-binding restrictive lists, and background checks.
Implementation of management systems and instruments applicable to international trade and related sectors to promote secure trade.
Handling of requests, inquiries and claims submitted by data subjects or by those who prove they are entitled to do so.
Other purposes stated in the authorization given by the data subject and/or in the Privacy Notices, and those corresponding to each stakeholder group.
Film, photographic and/or voice recordings captured through video surveillance and monitoring systems: these will be used to meet physical security criteria for the premises, monitor the different areas through video surveillance, serve as evidence in judicial or out-of-court proceedings, in disciplinary proceedings and/or in investigations of workplace accidents/incidents conducted by the data controller, for the transmission and transfer of the data to public authorities in the exercise of their functions and/or to third parties where necessary to fulfill contractual or legal obligations, statistics, attendance records, time control, verifying the security of processes, ensuring the quality of the services provided, ensuring the traceability of operations, handling requests arising from the provision of services, and controlling access to the company's premises.

In addition to the general purposes described above, depending on the stakeholder group concerned, the personal data of each particular stakeholder group will be processed for the following purposes:

8.2Purposes of the processing of personal data of applicants, direct and indirect employees, interns and apprentices, current and former, and their families.

Fulfillment of the data controller's obligations under the legal rules in force.
Collection of résumés directly from the data subject or from third parties, natural persons or legal entities, that send them, whether independently or on behalf of the data controller.
Conducting the selection process, reviewing résumés, checking employment and/or personal references, verifying criminal and/or disciplinary records, interviews, pre-employment medical examinations, laboratory tests, and any psychometric, knowledge and competency tests required, carried out directly by the data controller or by a data processor.
Retention of résumés and selection process results for future hiring processes and/or to comply with the legal rules in force.
Request for and issuance of employment certificates and/or references.
Hiring, and signing of contracts and of amendments to employment, temporary work and apprenticeship contracts.
Onboarding and re-onboarding activities.
Issuance of ID badges to identify employees.
Photographic and audiovisual records of employees.
Fingerprint records.
Alcohol and psychoactive substance testing.
Assignment of duties, roles and profiles associated with the position held.
Home visits at hiring and for follow-up.
Recording information on direct and indirect employees, current and former, pensioners and their families, for enrollment in, transfer of and payment of social security and payroll contributions (parafiscales), allowances, payroll, statutory and other bonuses, overtime, severance pay (cesantías), vacations, recognition of pension rights and final settlements.
Workplace climate, organizational culture and well-being activities for direct and indirect employees and their families, including children and adolescents.
Management of paid and unpaid leave, permissions and authorizations.
Management of sanctions, reprimands, warnings, disciplinary hearings and dismissals with or without just cause.
Recording of disciplinary history.
Competency validation.
Training and development of direct and indirect staff.
Training in the Integrated Management System.
Competency and performance evaluations.
Time control.
Salary deductions permitted by the rules in force, and application and recording of garnishments ordered by a competent authority.
Provision of work clothing and personal protective equipment.
Compliance with the rules in force on occupational health and safety and the environment, including, among others, the collection and analysis of health information and of the sociodemographic profile of direct and indirect employees, current and former; investigation of and indicators for absenteeism and accidents; occupational medical evaluations; road safety; and the investigation, notification and reporting of workplace incidents and accidents.
Processing of employees' medical leave.
Hotel bookings, air or ground tickets, fuel and toll vouchers, travel allowances and vehicle requests, among others, when direct and indirect employees travel.
Provision of information to clients, contractors and suppliers for the performance of the contracts entered into between them and the data controller.
Creation and management of usernames and passwords for access to the various applications, technology and computer equipment, email accounts and websites that require them.
Creation and control of access to, and modification of, documents stored in shared folders.
Transfer of proof of payment of social security and payroll contributions and of records of training given to staff, sent to the data controller's contracting parties, when required for payment for goods and/or services provided by the data controller as contractor and/or supplier.
Exit medical examinations and management of separation clearance (paz y salvo).
Provision of their information to clients, contractors and suppliers, or to other stakeholder groups of the data controller, for the performance of the contracts entered into between them and the data controller.
For proper communication, the DATA CONTROLLER may use information and communication technologies such as text messages, WhatsApp messages (inclusion in WhatsApp groups or chats), email, virtual platforms, mobile telephony, social networks and applications, among others, in order to ensure effective communication and notification of announcements, circulars, warnings, advance notices of the expiration of the final term agreed in the employment contract, notices of the opening of disciplinary proceedings, summons to present a defense (descargos), communication and notification of the decisions of the responsible area on the findings of disciplinary investigations, and termination of the employment relationship, among others; as well as for virtual meetings, in which cameras must be turned on so that they are more fluid and personal, and for general information concerning the employment relationship.
Inclusion of their personal data, including photographs, together with their position and contact details (personal and/or corporate), in corporate email signatures, for proper communication, with a view to identification and building trust internally and externally.
Disclosure to the ARL (Administradora de Riesgos Laborales, the occupational risk insurer) to process accidents, illnesses, people leaving the country, monitoring of health conditions and laboratory tests.

Disclosure of information on direct and indirect workers to third-party entities with which MICELIO INC S.A.S. has a contractual relationship, including its clients, to the extent necessary for them to manage the control, coordination and monitoring of the personnel who actually provide the services arising from the contractual relationship, without this implying any employment subordination to the client, and to enable compliance with legal obligations in tax and social security matters.

8.3Purposes of the processing of personal data of clients and their staff.

Fulfillment of legal and contractual obligations.
Offering goods and/or services of the data controller and/or its strategic partners.
Signing, amendment, performance and settlement of contracts.
Conducting domestic sales and export processes.
Verification of data and references and of compliance with legal, technical and/or financial requirements.
Screening for criminal records against binding, non-binding and restrictive lists.
Consultation of information associated with the company's risk level.
Customer loyalty campaigns and strategies, and opinion and satisfaction surveys.
Request for and issuance of commercial references.
Assessment, granting and management of credit to clients.
Request for the documents required for credit management.
Completion of the forms of the Self-Control and Comprehensive Risk Management System for Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction, and of the Business Transparency and Ethics Program.
Shipment of products nationally and internationally.
Sending communications through the contact details provided by the data subject, related to the provision of the goods and/or services offered and/or contracted.
Transmission and transfer of contact details to data processors, contractors and suppliers and/or strategic partners, so that they may process the data subject's personal data for the purposes stated in this Privacy Policy.
Inquiries and positive and negative reporting of commercial, financial and credit information to legally established database operators or administrators, financial and credit institutions and credit bureaus.
Collection of receivables and invoicing for the goods and/or services contracted.
Recovery of receivables through persuasive, out-of-court and/or judicial collection, directly by the data controller or through a data processor.
Provision of their information to employees and suppliers, partners or other stakeholder groups of the data controller, for the performance of the contracts entered into between them and the data controller.
Knowing the client and its need for the product.
Market and price analyses and studies.
Preparation of logistics chains and compliance with minimum eligibility requirements for certain countries.
Accounts receivable control and credit assessment.
Bank reconciliations.
Recording of client invoices, recording of expenses from client and travel invoices, IFRS (NIIF) transfers, exchange differences, reconciliation of related parties, and recording of the company's indebtedness.
Ensuring the provision of the services of design, development, testing, deployment, administration, consulting, support and maintenance of information and communication technology systems, and of the platforms and other technology solutions contracted by the client.
Screening the client against restrictive and binding lists, such as the OFAC, UN, Interpol and Politically Exposed Persons (PEP) lists, for the purpose of preventing money laundering and terrorist financing.
Maintaining commercial contact with the client even after the contractual relationship ends, for loyalty purposes and to explore new business.
National and international transfer and transmission of personal data to third parties located inside or outside Colombia, as well as its storage, hosting and processing on servers, cloud computing platforms or data centers owned by the company or by third-party technology infrastructure providers, adopting for this purpose the contractual safeguards or other compliance mechanisms provided for in Decreto 1074 de 2015 and in the external circulars (Circulares Externas) of the Superintendencia de Industria y Comercio.

8.4Purposes of the processing of personal data of contractors, suppliers and their staff / partners.

Fulfillment of legal and contractual obligations.
Request, collection and analysis of quotations and/or offers.
Signing, amendment, performance and settlement of contracts.
Data analysis for contracting processes.
Issuance of purchase and/or service orders for the acquisition of goods and/or services.
Request for and validation of third-party references and certificates.
Issuance of certificates and references.
Verification of data and of compliance with legal, technical and/or financial requirements.
Completion of the forms of the Self-Control and Comprehensive Risk Management System for Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction, and of the Business Transparency and Ethics Program.
Screening for criminal records against binding, non-binding and restrictive lists.
Alcohol and psychoactive substance testing.
Evaluation of contractors and suppliers.
Photographic records for inspection activities, training, identification of the personnel providing the service, issuance of ID badges and audit processes, among others.
Warnings, sanctions or exclusions for breach of contract.
Contact with suppliers and contractors or their staff for the performance of the contracts entered into or of the service and/or purchase orders issued.
Training by contractors and/or suppliers in the use of their products.
Request for and review of product reports and technical data sheets.
Verification of social security enrollment and payment.
Verification of compliance with occupational health, safety and environment rules (SSTA), the road safety strategic plan (Plan Estratégico de Seguridad Vial) and/or the rules that supplement, amend, replace or repeal them.
Verification of compliance with quality systems, such as ISO certifications, among others.
Verification of compliance with the rules governing personal data protection and/or those that supplement, amend, replace or repeal them.
Invoicing and payment management for products and/or services.
Provision of their information to clients, suppliers, partners or other stakeholder groups of the data controller, for the performance of the contracts entered into between them and the data controller.
Audit, monitoring and traceability of operations.
Control of social security payments made by contractors.
Photographic records for audit purposes.
Issuance of ID badges.

8.5Purposes of the processing of personal data of shareholders

Compliance with the rules in force.
Ensuring the effective exercise of shareholders' rights.
Verification of data and of compliance with legal, technical and/or financial requirements.
Calling shareholders' meetings.
Sending information related to the data controller's activities.
Completion of the forms of the Self-Control and Comprehensive Risk Management System for Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons of Mass Destruction, and of the Business Transparency and Ethics Program.
Screening for criminal records against binding, non-binding and restrictive lists.
Records, amendments, additions and changes in general related to legal and shareholding matters.
Investments and recording of shares and obligations.
Management of the payment of dividends and profits to shareholders.
Credit applications and issuance of insurance policies.
Documenting the information on the shareholdings of legal entities that are shareholders of the organization.
Knowing to whom financial information on the results of the business's operations, or any other information significant to shareholders, must be reported.
Recording of shares and obligations.
Reporting information to authorities and/or third parties that must be aware of it by virtue of a legal or contractual obligation.

8.6Purposes of the processing of personal data of officials of government entities, certification bodies and trade associations, among others

Relationship-building and communication through business and professional contact details.

8.7Purposes of the processing of personal data of the community at large

Compliance with the rules in force.
Calling and participation in processes that have an impact on the community.
Collection of surveys.
Photographic records of activities.
Signing of commitment records
Recording the attendance of community members who take part in the meetings and activities carried out by the data controller.

8.8Visitors

Physical security of the premises.
Serving as evidence in judicial or out-of-court proceedings.
Serving as evidence and as internal records.
Statistical purposes.
Recording attendance and the entry and exit of people at the premises.
Emergency management within the premises.
Compliance with occupational health and safety obligations
Health and sanitary control management.
National or international transmission and transfer of the data to public authorities in the exercise of their functions and/or to third parties where necessary to fulfill contractual or legal obligations.

8.9Purposes of the processing of personal data of users of digital services open to the public

Provision, operation and maintenance of the platforms, applications and websites that the data controller makes available to the public, such as Atlas, Atlas, el juego (the Atlas game), Spora, Micelio Jurídico and the micelioinc.com website.
Creation and management of user accounts, subscriptions and payments, in the services that require them.
Identification of the user to other users by the name or nickname the user provides, when the feature so requires.
Information security, and prevention of fraud and of abusive use of the platforms.
Production of aggregate and anonymous statistics on the use of the platforms.
Handling of inquiries, requests, claims and requests from users and from authors or other data subjects whose data appears on the platforms.

9Inventory of databases containing personal information

MICELIO INC S.A.S. must know what personal data it stores and how it uses it in light of the purpose for which it was collected, since the data controller and the data processors may only collect, store, use or circulate personal data for as long as is reasonable and necessary in accordance with the purposes that justified the processing, taking into account the provisions applicable to the matter in question and the administrative, accounting, tax, legal and historical aspects of the information. However, personal data must be retained when required to fulfill a legal or contractual obligation.

10Authorization

The processing of personal data carried out by MICELIO INC S.A.S. must be based on the prior, express, informed and sufficient authorization obtained from the data subject through the various means provided for by law. Such authorization must be documented and made available to the data subject and to the Superintendencia de Industria y Comercio, as a general rule through a physical and/or digital form pre-established by the Company. When the purpose of the processing changes, the data subject must be informed and a new authorization obtained for those purposes. Cases in which authorization is not required: Information required by a public or administrative entity in the exercise of its legal functions or by court order; Data of a public nature; Cases of medical or health emergency; Processing of information authorized by law for historical, statistical or scientific purposes; Data relating to the civil registry of persons. The management of semi-private and private data requires the prior and express consent of the data subject, except for financial, credit, commercial and service data and data originating in third countries, which does not require the data subject's authorization under Ley 1266 de 2008.

The processing of sensitive data is prohibited, except in the cases expressly set out in article 6 of Ley 1581 de 2012. Where such processing is permitted, MICELIO INC S.A.S. must: (i) inform the data subject that they are not required to authorize its processing because it involves sensitive data; and (ii) inform them explicitly and in advance which of the data to be collected is sensitive and the purpose of the processing, obtaining their express consent. No activity may be made conditional on the data subject providing sensitive personal data. The mechanisms for obtaining authorization may be predetermined through technical means that allow the data subject to express it automatically, in writing, orally or through unequivocal conduct. MICELIO INC S.A.S. will keep proof of the authorization given by each data subject.

11Personal data management cycle

11.1Collection: purpose and necessity

The collection of personal data shall be limited to data that is relevant and adequate for the purpose for which it is collected, in accordance with the regulations in force and this Privacy Policy. No deceptive or fraudulent means shall be used to collect or process personal data.

When it is not possible to make the processing policies available to the data subject in full, the data subject will be informed through a Privacy Notice of the existence of those policies and of how to access them, no later than at the time the data is collected. In the case of sensitive data, the Privacy Notice will expressly state that answering questions about this type of data is optional.

11.2Information security and quality

Confidentiality: protection of information whose disclosure is not authorized. Integrity: information must be accurate, consistent and complete from its creation to its destruction. Availability: information must be available at the time and in the format required, together with the resources needed to use it. In addition, MICELIO INC S.A.S. will strive for the effectiveness, efficiency and reliability of the information it manages.

11.3Security measures

Knowledge of where personal data and information are stored, according to need, with access control over them.
Adoption of a specific security policy for sensitive data.
Mechanisms to protect the databases, including up-to-date firewall tools and antivirus software.
Backup strategies that include offline and off-site copies.
An up-to-date inventory of the databases.
Security controls when outsourcing services, through the signing of the corresponding confidentiality and personal data transmission agreements with data processors.
Adoption of measures that reliably secure the remote consultation, use or extraction of information.
Traceability or monitoring of the queries made on databases containing personal information.
Preparation of response protocols that anticipate security risks or vulnerabilities, with mechanisms for internal reporting and for reporting incidents to data subjects, to the Superintendencia de Industria y Comercio and to senior management.

11.4Retention and deletion

Once the purpose of the processing has been fulfilled, and without prejudice to legal provisions to the contrary, MICELIO INC S.A.S. will delete the personal data in its possession. However, in accordance with due diligence requirements regarding the risk of money laundering and terrorist financing, transaction records will be retained for a minimum of five (5) years from the end of the commercial relationship. Under article 28 of Ley 962 de 2005, commercial books and records must be retained for a minimum of ten (10) years.

11.5Revocation of authorization and/or deletion of data

Data subjects may at any time ask the data controller or data processor to delete their personal data and/or revoke the authorization given for its processing, through a request submitted in accordance with article 8 of Ley 1581 de 2012. Such a request shall not proceed when the data subject has a legal or contractual duty to remain in the database. If, once the legal term has expired, the data controller and/or data processor has not responded to the request, the data subject may turn to the Superintendencia de Industria y Comercio under the procedure set out in article 22 of Ley 1581 de 2012.

12Personal data security incidents

A personal data security incident is a breach of security codes, or the loss, theft and/or unauthorized access to personal data processed by the data controller or by the data processor.

12.1Causes of incidents

Internal fraud: an offense committed with the participation of employees or trusted persons of the data controller or data processor, directly or indirectly.
External fraud: an act by a third party outside the organization aimed at accessing, appropriating, tampering with or deleting personal data.
Damage to physical assets: loss, deterioration or impairment of personal data due to damage to equipment, physical files or other media.
Information technology failure: loss, unavailability or tampering of personal data due to failures in information systems, networks, transmission channels, VPNs or applications.
Failure in the execution or management of processes: a breach caused by the improper application or execution of a previously established procedure.
Failure due to negligence or involuntary acts of data subjects or third parties.

12.2Type of security incident

Incidents affecting the confidentiality of personal data.
Incidents affecting the availability of personal data.
Incidents affecting the integrity of personal data.
Incidents simultaneously affecting the confidentiality, availability and integrity of personal data.

12.3Measurement, evaluation and reporting

The Personal Data Protection Officer will be responsible for developing an annual supervision and review plan comprising the following phases: (i) diagnosis, through internal audits, identification of weaknesses in the handling of inquiries and claims, and review of the legal obligations in force; (ii) adjustment, to determine the actions to be implemented; (iii) implementation of the relevant changes; and (iv) periodic review of the Personal Data Management System, at least once a year.

MICELIO INC S.A.S. will communicate efficiently with the affected data subjects about the incident and its possible consequences, and will adopt the tools necessary to minimize the potential or actual harm. Every incident, regardless of its impact, must be reported to the Superintendencia de Industria y Comercio, stating at a minimum: the type of incident, the date on which it occurred, the date on which it became known, its cause, the type of personal data compromised and the number of data subjects affected.

12.4Monitoring and evaluation

Effective monitoring that enables the prompt detection and correction of deficiencies in the management of the identified risks.
Establishment of indicators that show the effectiveness of the risk management system adopted.
Verification that controls work in a timely, effective and efficient manner.
An incident log recording the database and the data compromised, the data subjects affected, the date of the incident and of its discovery, the corrective actions taken and those responsible.
Security audits that assess the efficiency and adequacy of the controls implemented.

13Data of children and adolescents

The processing of personal data of children and adolescents is prohibited, except for data of a public nature, in accordance with article 7 of Ley 1581 de 2012 and provided that the requirements set out therein are met.

Should MICELIO INC S.A.S., in the course of its corporate purpose, process personal data of children and adolescents, it will apply special security measures to ensure the proper processing of that information, undertaking not to put their fundamental rights at risk and to use the data only when doing so serves the best interests of the minors. The prior, express and informed authorization for the processing of this data will be given by the minor's legal representative.

14Rights of data subjects

Data subjects have the following rights:

To know, update and correct their personal data with data controllers or data processors. This right may be exercised, among other cases, with respect to partial, inaccurate, incomplete or fragmented data, data that is misleading, or data whose processing is expressly prohibited or has not been authorized.
To request proof of the authorization given to the data controller, except where it is expressly exempted as a requirement for processing, in accordance with article 10 of Ley 1581 de 2012.
To be informed by the data controller or the data processor, upon request, of the use made of their personal data.
To file complaints with the Superintendencia de Industria y Comercio for infringements of Ley 1581 de 2012 and the other rules that amend, add to or supplement it.
To revoke the authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights and guarantees. Revocation and/or deletion will proceed when the Superintendencia de Industria y Comercio has determined that, in the processing, the data controller or data processor has engaged in conduct contrary to Ley 1581 de 2012 and the Constitution.
To access, free of charge, the personal data that has been processed: (i) at least once every calendar month, and (ii) whenever there are substantial changes to the information processing policies that give rise to new inquiries.

Requests for the deletion of information and the revocation of authorization shall not proceed when the data subject has a legal or contractual duty to remain in the database.

15Duties of the data controller

The data controller has the following duties:

To guarantee the data subject, at all times, the full and effective exercise of the right of habeas data.
To request and keep, by any means and under the conditions provided for in Ley 1581 de 2012, a copy of the authorization given by the data subject.
To duly inform the data subject of the purpose of the collection and of the rights they have by virtue of the authorization given.
To keep the information under the security conditions necessary to prevent its tampering, loss, consultation, use or unauthorized or fraudulent access.
To ensure that the information provided to the data processor is truthful, complete, accurate, up to date, verifiable and understandable.
To update the information, promptly communicating to the data processor all changes regarding the data previously provided to it, and to adopt the other measures necessary to keep the information provided to it up to date.
To correct the information when it is incorrect and notify the data processor accordingly.
To provide the data processor, as the case may be, only with data whose processing has been previously authorized in accordance with Ley 1581 de 2012.
To require the data processor, at all times, to respect the security and privacy conditions of the data subject's information.
To handle inquiries and claims within the terms set out in Ley 1581 de 2012.
To adopt an internal manual of policies and procedures to ensure proper compliance with Ley 1581 and, in particular, for handling inquiries and claims.
To inform the data processor when certain information is being disputed by the data subject, once the claim has been filed and the corresponding procedure has not been completed.
To inform the data subject, upon request, of the use made of their data.
To inform the data protection authority of any breach of security codes and of risks in the management of data subjects' information.
To comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio

16Duties of data processors

The data processor has the following duties:

In carrying out the contracted activities, to comply with the Privacy and Personal Data Protection Policy and with all procedures, guidelines and/or directives issued by the data controller regarding personal data protection.
To adopt, following the data controller's instructions, all technical, human and administrative measures necessary to secure the records, preventing their tampering, loss, consultation, use or unauthorized or fraudulent access.
To implement a personal data protection policy consistent with the rules governing the matter.
To process personal data in accordance with the instructions expressly received from the data controller, refraining from using it for purposes other than those contracted.
To refrain from providing, assigning or selling personal data to third parties, whether natural persons or legal entities, public or private, unless the data is of a public nature and not subject to confidentiality, or is required by a competent authority in the exercise of its legal functions.
To keep strictly confidential the personal data to which it has access in the course of the contracted activities, and to diligently fulfill the duty of safekeeping and custody of such data throughout the term of the contract and even after its termination.
To access or consult the information or personal data held in the data controller's databases only when strictly necessary to carry out the contracted activities.
To report to the data controller, immediately upon its occurrence or upon becoming aware of it, through the channels and means established by the data controller, any incident or threatened incident that affects or may directly or indirectly affect the protection of personal data.
To guarantee at all times the full and effective exercise of data subjects' right of habeas data, as well as due process when PQR´s regarding personal data protection are submitted.
To update, correct or delete data in a timely manner under the terms of Ley 1581 de 2012.
To update the information reported by the data controller within five (5) business days of its receipt.
To adopt an internal manual of policies and procedures to ensure proper compliance with Ley 1581 de 2012 and, in particular, for handling inquiries and claims from data subjects.
To refrain from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendencia de Industria y Comercio.
To allow access to the information only to persons who are entitled to access it.
To comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio.
When collecting data on behalf of the data controller, to obtain the data subjects' authorization where required, in accordance with Ley 1581 de 2012 and the other rules that supplement, replace, amend or repeal it.

Where MICELIO INC S.A.S. acts as both data controller and data processor with respect to the same set of personal data, or where, in the course of its contractual relationships with clients, it is not possible to clearly determine the capacity in which it acts in relation to a particular processing activity, the duties set out in Ley 1581 de 2012 and in this Privacy Policy for each of those capacities will apply to it concurrently.

17Person or area responsible for handling requests, inquiries and claims

The person responsible for handling requests, inquiries and claims, before whom data subjects may exercise their rights to know, update, correct and delete their data and to revoke the authorization, will be Daniel Alejandro Mejía Ochoa, CTO of Micelio Inc S.A.S. or whoever takes over those functions, who will also act, among other functions, as Personal Data Protection Officer.

18Procedure for data subjects to exercise their rights

Data subjects, or persons entitled to do so under the rules in force, may submit requests, inquiries and claims through the following channels, established by the data controller for handling PQR’s:

ADDRESS	Carrera 32 No. 6 Sur-45, Torre 2, Apto. 208, Medellín, Antioquia
EMAIL	dmejia@micelioinc.com
PHONE	321 640 4797

The following persons are entitled to submit PQR´s, in accordance with article 2.2.2.25.4.1. of Decreto 1074 de 2015:

The data subject, who must sufficiently prove their identity.
The data subject's successors in title, who must prove that status.
The data subject's representative and/or attorney, upon proof of the representation or power of attorney.
By stipulation in favor of or on behalf of another, provided the data subject has accepted it, proof of which must be submitted with the request.

The rights of children and adolescents will be exercised by the persons authorized to represent them.

Inquiries

Data subjects or their successors in title may consult the data subject's personal information held in the Company's database, after validation and proof of their identity. The inquiry must contain at least: i) the full identification of the data subject, ii) the personal data to be consulted, iii) address, iv) email, and v) in the case of successors in title, the corresponding supporting document.

The Company will respond to the inquiry within a maximum of ten (10) business days from the date of its receipt. When it is not possible to respond within that term, the interested party will be informed of the reasons for the delay and of the date on which the request will be answered, which may not exceed five (5) business days after the first term expires.

Claims.

Data subjects or their successors in title who consider that information contained in a database should be corrected, updated or deleted, or who notice an alleged breach of any of the duties set out in the law, may file a claim with MICELIO INC S.A.S., through the service channels set out in this Policy, which will be processed according to the following rules:

The claim shall be made by a request addressed to the channels indicated above, which must contain at least the identification of the data subject, a description of the facts giving rise to the claim and the address, accompanied by any documents to be relied on. If the claim is incomplete, the interested party will be asked, within five (5) days of receipt of the claim, to remedy the deficiencies. If two (2) months elapse from the date of that request without the claimant submitting the required information, the claim will be deemed withdrawn.

If the person receiving the claim is not competent to resolve it, they will forward it to the appropriate party within a maximum of two (2) business days and inform the interested party accordingly.

Once the complete claim has been received, a note reading “claim in progress” and the reason for it will be added to the database within no more than two (2) business days. That note must remain until the claim is decided.

The maximum term for resolving the claim will be fifteen (15) business days from the day following its receipt. When it is not possible to resolve the claim within that term, the interested party will be informed of the reasons for the delay and of the date on which the claim will be resolved, which in no case may exceed eight (8) business days after the first term expires.

Deletion of data

If deletion of the data subject's personal data from the database is appropriate following the claim filed, the deletion will be carried out operationally so that the information cannot be recovered. However, the data subject should bear in mind that in some cases certain information must remain in historical records to comply with the organization's legal duties, in accordance with our data retention and disposal policy; accordingly, deletion will apply to the active processing of the data where possible, and in each case according to the data subject's request.

19Effective date

This Privacy Policy is effective from the effective date shown with its version number. The databases subject to processing by the data controller will remain in force for as long as the purposes for which the data was collected persist and/or for the term established by law.

The data controller reserves the right to amend this Privacy Policy at any time. In the event of substantial changes to its content relating to the identification of the data controller and the purpose of the processing of personal data that may affect the content of the authorization, the data controller will communicate these changes to the data subject before or, at the latest, at the time the new policies are implemented, and will require a new authorization when the change concerns the purpose of the processing.