Customer Data Processing

OBJECTIVE:

Establish the criteria for the collection, storage, use, circulation and deletion in compliance with the provisions of Law 1581 of 2012 and Decree 1377 of 2013, provisions that set forth and describe the mechanisms by which proper and lawful handling of personal data processed by Montachem International S.A., which are in its databases, must be guaranteed, in order to ensure that data subjects can adequately exercise their Habeas Data right.

SCOPE:

This policy applies to all personal information recorded in the databases of Montachem International S.A., which acts as the data controller.

OBLIGATIONS:

This policy is mandatory and strictly enforceable for Montachem International S.A.

DATA CONTROLLER:

Montachem International S.A., legally constituted commercial company 900.213.910-7, with main office at Calle 103 No 14 a 53, Bogotá, Republic of Colombia. Website www.montachem.com Phone 6210566 in the city of Bogotá.

PROCESSING AND PURPOSE:

The processing that Montachem International S.A. will carry out with personal information is as follows:

The information contained in the databases of Montachem International S.A. is subject to various forms of processing, such as: collection, exchange, updating, processing, reproduction, correction, use, organization, storage, circulation or deletion, among others, to send event invitations and offer new products and services.

Manage procedures (solutions, complaints and claims), Contact the data subject by telephone to conduct surveys, studies and/or confirmation of personal data necessary for the execution of a contractual relationship, Conduct satisfaction surveys regarding goods and services offered by Montachem International S.A., Provide contact information to the sales force and/or distribution network, telemarketing, market research and any third party with which Montachem International S.A. has a contractual link for the development of such activities (market research and telemarketing, etc.) for their execution, Transfer personal data abroad to third parties with which Montachem International S.A. has entered into a data processing contract and it is necessary to deliver it to them for compliance with the contractual object, provide the services by Montachem International S.A. accepted in the subscribed contract, Provide information to third parties with which Montachem International S.A. has a contractual relationship and that it is necessary to deliver it to them for compliance with the contracted object, Contact the data subject via electronic means – SMS or chat to send news related to loyalty campaigns or service improvement, Contact the data subject via email for the sending of statements, account statements or invoices in relation to the obligations arising from the contract entered into between the parties, Transfer personal data abroad to the parent company of Montachem International S.A. to comply with the anti–money laundering regulations that apply to it, Provide the services offered by Montachem International and accepted in the subscribed contract (quotation).

The referenced information may be delivered, transmitted or transferred to public entities, business partners, contractors, employees, affiliates, and/or parent, subsidiary or related companies solely and exclusively to fulfill the purposes of the corresponding database.

It may also be transmitted or transferred to data subjects, their heirs and legal representatives. In any case, delivery, transmission or transfer will be made after signing the necessary commitments to safeguard the confidentiality and privacy of the information authorized for processing. Likewise, in compliance with legal duties, Montachem International S.A. may provide personal information to judicial or administrative entities.

Montachem International S.A. will ensure the proper use of minors’ personal data, guaranteeing compliance with applicable legal requirements and that all processing is previously authorized and justified in the best interests of the minors.

SENSITIVE DATA PROCESSING:

No sensitive information is collected.

DATA SUBJECTS’ RIGHTS:

As the owner of your personal data you have the right to:

• Access free of charge to the provided data that have been processed.
• Know, update and rectify your information regarding partial, inaccurate, incomplete, fragmented data, misleading, or those whose processing is prohibited or has not been authorized.
• Request proof of the granted authorization.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the current regulations.
• Revoke authorization and/or request data deletion, provided there is no legal or contractual duty that prevents their elimination.
• Refrain from answering questions about sensitive data. Responses regarding sensitive data or data of children and adolescents will be optional.

HANDLING OF REQUESTS, INQUIRIES AND CLAIMS

The Administrative area is responsible for processing data subject requests to exercise their rights.

By phone at 6210566 and by email at contactenos@corporativosweb120.sg-host.com

Inquiries:

Data subjects or their heirs and legal representatives may consult the data. All requests for consultation, correction, update or deletion must be submitted in writing or by email. Inquiries will be answered within ten (10) business days from receipt of the request. If it is not possible to answer within that period, the data subject will be informed of the reasons for the delay and the date on which the inquiry will be addressed, which in no case may exceed five (5) additional business days.

Claims:

Claims must be made in writing or by email, containing at least: data subject identification, description of the facts giving rise to the claim, address and supporting documents. If incomplete, the data subject will be requested to correct within five (5) days. After two (2) months from the request without response, the claim will be considered withdrawn.

If the recipient of the claim is not competent, it will be forwarded within two (2) business days and the data subject will be informed. Once the complete claim is received, a note “claim in process” and its reason will be included in the database within two (2) business days. The maximum term to address the claim is fifteen (15) business days from the day after receipt. If it is not possible to resolve within that term, the data subject will be informed of the reasons for the delay and the new date for resolution, which may not exceed eight (8) business days after the first term.

PROCEDURE TO EXERCISE THE HABEAS DATA RIGHT

In compliance with personal data protection regulations, Montachem International S.A. presents the procedure and minimum requirements to exercise your rights:

To file your request, please provide the following information:

• Full name and surnames
• Contact details (physical and/or electronic address and phone numbers)
• Means to receive a response to your request
• Reason(s)/fact(s) giving rise to the claim with a brief description of the right you wish to exercise (access, update, rectify, request proof of granted authorization, revoke it, delete, etc.)
• Signature (if applicable) and identification number.

The maximum term provided by law to resolve your claim is fifteen (15) business days from the day after receipt. If it is not possible to resolve within that term, Montachem International S.A. will inform you of the reasons for the delay and the date on which your claim will be addressed, which in no case may exceed eight (8) business days after the first term.

Once the terms set by Law 1581 of 2012 and its regulatory or complementary norms have been met, the data subject who is denied, in whole or in part, the exercise of access, update, rectification, deletion and revocation rights may bring their case before the Superintendence of Industry and Commerce – Delegation for Personal Data Protection.

EFFECTIVENESS:

This Personal Data Processing Policy is effective as of January 1, 2021.

The databases in which personal data are recorded will remain in force as long as the information is maintained and used for the purposes described in this policy. Once those purposes have been fulfilled and provided there is no legal or contractual duty to retain your information, your data will be deleted from our databases.

MONTACHEM INTERNATIONAL S.A.