AGENCIA HERO CONSULTING & DEVELOPMENT SAS, represented by Kevin Leonardo Arenas Vargas with NIT 900.908.088-0, in accordance with the laws of the Republic of Colombia, whose judicial notification address is Carrera 53 No. 141 – 69 Barrio Prado Pinzón from the city of Bogotá D.C, cell phone +57 318 4732253, mail comercial@agenciahero.com, complying with literal k of article 17 of Law 1581 of 2012, adopts the Policies and Procedures for the Management and Protection of Data hereinafter the "Policies", in order to guarantee and protect the fundamental right of habeas data of its clients , collaborators and suppliers within the framework of what is established in the Constitution and the Law.

In this sense, the guidelines that guide the processes of data collection, storage, use and deletion are established, ensuring the veracity, confidentiality and integrity of the information.

1. AREA OF APPLICATION

The Manual applies to all data records carried out in person, by telephone and/or virtually regarding clients, collaborators, suppliers and any third party in the exercise of commercial activities.

English AGENCIAHERO.COM se encargará directamente del tratamiento de la información; sin embargo, se reserva el derecho de delegar en un tercero esta labor, siempre que el encargado, siga los lineamientos contenidos en estas Políticas y adopte los procedimientos para la protección de los datos personales y la estricta confidencialidad de los mismos. AGENCIAHERO.COM will be directly in charge of the treatment of the information; however, it reserves the right to delegate this task to a third party, provided that the person in charge follows the guidelines contained in these Policies and adopts the procedures for the protection of personal data and the strict confidentiality thereof.

2. DEFINITIONS

For the purposes of this Manual, the following definitions shall be taken into account:

2.1. Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data. (Law 1581 of 2012, Art 3)

2.2. Privacy Notice: Verbal or written communication generated by the person in charge, addressed to the Owner for the Treatment of their personal data, by which they are informed about the existence of the information Treatment policies that will be applicable to them, the way to access to them and the purposes of the Treatment that is intended to be given to personal data. (Decree 1377 of 2013, Art 3)

2.3. Database: Organized set of personal data that is subject to Treatment. (Law 1581 of 2012, Art 3)

2.4. Personal data: Any information linked or that can be associated with one or several determined or determinable natural persons. (Law 1581 of 2012, Art 3)

2.5. Public data: It is the data that is not semi-private, private or sensitive. Public data is considered, among others, data related to the marital status of people, their profession or trade and their status as merchants or public servants. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality. (Decree 1377 of 2013, Art 3)

2.6. Semi-private data: Semi-private data is not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to its owner but to a certain sector or group of people or to society in general, such as financial and credit data of commercial or service activity referred to in Title IV of this law. (Law 1266 of 2008, Art 3)

2.7. Private data: It is the data that, due to its intimate or reserved nature, is only relevant to the owner. (Law 1266 of 2008, Art 3)

2.8. Sensitive data: Sensitive data is understood to be those that affect the Owner's privacy or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, union membership, social, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data. (Decree 1377 of 2013, Art 3)

2.9. Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller. (Law 1581 of 2012, Art 3)

2.10. Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Treatment of the data. (Law 1581 of 2012, Art 3)

2.11. Owner: Natural person whose personal data is subject to Treatment. (Law 1581 of 2012, Art 3)

2.12. Transfer: The transfer of data takes place when the person in charge and/or in charge of the Processing of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is Responsible for the Treatment and is located inside or outside from the country. (Decree 1377 of 2013, Art 3)

2.13. Transmission: Treatment of personal data that implies the communication of the same inside or outside the territory of the Republic of Colombia when its purpose is to carry out a Treatment by the Manager on behalf of the person in charge. (Decree 1377 of 2013, Art 3)

2.14. Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion. (Law 1581 of 2012, Art 3)

3. BEGINNING

AGENCIAHERO.COM will apply the guidelines contained in the following principles in the processing of personal data:

3.1. Principle of access and restricted circulation. – The Treatment is subject to the limits that derive from the nature of the personal data, the provisions of current regulations and the provisions of these Policies. In this sense, the Treatment can only be done by personnel authorized by AGENCIAHERO.COM.

Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties in accordance with current laws and the present Policies.

3.2. Principle of confidentiality.- All persons involved in the Processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks included in the Treatment, and may only make provision or communication of personal data when it corresponds to the development of the activities of AGENCIAHERO.COM, in accordance with current regulations and the provisions contained in these Policies.

3.3. Principle of purpose. – The Treatment obeys a legitimate purpose in accordance with the Constitution and the Law, which is informed to the Holder. In this sense, AGENCIAHERO.COM collects, stores and uses personal data for the correct development of its commercial activity. Likewise, it informs this purpose to the holders of the information through the Privacy Notice.

3.4. Principle of legality in matters of data processing. – The Processing of personal data is a regulated activity that must be subject to the provisions of the Law and other regulations that regulate the matter. In view of the foregoing, the person in charge and responsible for the treatment, as well as any collaborator who may have access to the databases, must observe and comply with the regulations governing the matter.

3.5. Principle of freedom. – The Treatment can only be exercised with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent. In development of this principle, AGENCIAHERO.COM will refrain from obtaining and using databases through illegal, fraudulent means or without the authorization of their owners, likewise, it will refrain from transferring or transmitting the personal data for which it is responsible without the authorization of their owners.

3.6. Safety principle. – The information subject to Treatment will be managed by AGENCIAHERO.COM with the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

3.7. Principle of temporality. – The information subject to Treatment will be kept in the AGENCIAHERO.COM databases for the time necessary to achieve the purpose for which it was collected, after which it will be deleted, of which the Holder will be informed in the Notice of Privacy.

3.8. Principle of transparency. – The Holder is guaranteed the right to obtain, at any time and without restrictions, information about the existence of data that concerns him. For the above, AGENCIAHERO.COM establishes a procedure for the exercise of rights and claims, which will be fulfilled in the terms and conditions established in these Policies.

3.9. Principle of veracity or quality. – The information subject to Treatment must be true, complete, exact, updated, verifiable and understandable. The Processing of partial, incomplete, fractional or misleading data is prohibited. In application of this principle, AGENCIAHERO.COM will adopt the pertinent measures to collect true and real information, as well as to avoid its modification, alteration or variation. However, the foregoing, in application of the principle of Good Faith, AGENCIAHERO.COM will take as true and accurate the information provided by the Holder of the same, under the understanding that the verification and verification is not part of AGENCIAHERO.COM's obligations. verification of data, without the company being able to be held responsible for any inaccuracies or falsehoods deliberately incurred by the Holder at the time of collection.

4. PURPOSE

AGENCIAHERO.COM, in the development of its commercial activity, collects, stores and uses data for the following purposes:

4.1. Offer all kinds of commercial services, make invitations to events, inform about the improvement of current or future products and services, as well as carry out promotional, marketing and advertising campaigns, directly or through third parties hired for this purpose.

4.2. Properly manage the commercial and contractual process, from its formation phase to the subsequent control stage.

4.3. Comply with the information obligations arising from contractual relationships and current regulations.

4.4. Carry out marketing studies and other analyzes that allow a greater knowledge of current and potential clients, interest groups and different segments of the population.

4.5. Generate parallel databases in which personal data is deleted in order to prepare statistics, studies and analysis of marketing or consumption that may be used by Authorized Entities and/or third parties, who may dispose of all the information at their discretion.

4.6. Identify, collect and associate to the data, information on the owner's browsing preferences on the AGENCIAHERO.COM web portals as well as georeferencing and/or specific location data generated by mobile devices, to improve the user experience, know their profile navigation, deliver information and/or segmented advertising on own products and/or services and qualify the propensity and/or affinity for AGENCIAHERO.COM products or services.

4.7. Respond in due form to requests, complaints and claims.

4.8. Carry out satisfaction surveys and in general collect opinion on the services of AGENCIAHERO.COM and the different interactions in which it is a part.

4.9. Deliver the information when required by order of the competent administrative or judicial authority.

4.10. Share information with strategic allies, affiliates or subordinates, who will commit to comply with the guidelines contained in these Policies.

Regarding its labor relations and the provision of professional services, AGENCIAHERO.COM collects, stores and uses data from candidates, employees and former employees for the following purposes:

4.11. Advance all stages of the selection and hiring processes.

4.12. Have up-to-date and truthful information from collaborators for the proper development of the professional and employment relationship.

4.13. Inform employees of the activities organized by the company.

5. RIGHTS OF HOLDERS

The holders of personal data collected and stored by AGENCIAHERO.COM have the following rights:

5.1. Know, update and rectify your personal data against AGENCIAHERO.COM. This right may be exercised, among others, against data that is partial, inaccurate, incomplete, divided, misleading, or whose Treatment is expressly prohibited or has not been authorized.

5.2. Request proof of the authorization granted to AGENCIAHERO.COM except when expressly excepted as a requirement for Treatment.

5.3. To be informed by AGENCIAHERO.COM, upon request, regarding the use that has been given to your personal data.

5.4. Submit to the Superintendence of Industry and Commerce complaints for violations of your right to Habeas Data or current regulations.

5.5. Revoke the authorization and/or request the deletion of the data when the Treatment does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Treatment AGENCIAHERO.COM has incurred in conduct contrary to the law and the Constitution;

5.6. Free access to your personal data that have been processed.

6. DUTIES OF AGENCIAHERO.COM

AGENCIAHERO.COM will make use of the personal data collected and stored for the purposes for which it is duly empowered and faithfully complying with these Policies. Likewise, it will attend to the following duties provided for those responsible and in charge of the Treatment:

6.1. Guarantee the Owner, at all times, the full and effective exercise of the right of habeas data.

6.2. Request and keep, under the conditions provided in these Policies, a copy of the respective authorization granted by the Owner.

6.3. Duly inform the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.

6.4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

6.5. Guarantee that the information is true, complete, exact, updated, verifiable and understandable.

6.6. Update the information, including all the news regarding the data that it has previously collected and adopt the other necessary measures so that the information is kept up to date.

6.7. Rectify the information when it is incorrect.

6.8. Collect, store and use only data whose Treatment is previously authorized in accordance with the provisions of these Policies and the Law.

6.9. Respect at all times the security and privacy conditions of the Owner's information.

6.10. Process the queries and claims formulated in the terms indicated in these Policies and in the Law.

6.11. Register in the database the legend "claim in process" when certain information is under discussion by the Holder, once the claim has been filed and the respective process has not been completed.

6.12. Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of personal data.

6.13. Refrain from circulating information that is being controversial by the Holder and whose blocking has been ordered by the Superintendence of Industry and Commerce.

6.14. Inform at the request of the Owner about the use given to their data.

6.15. Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.

6.16. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

7. AUTHORIZATION

AGENCIAHERO.COM will request the Owner of the information prior authorization for the processing of personal data. It may appear in any physical or electronic document or in any format that guarantees its subsequent consultation through technological tools. The authorization can be part of larger documents such as forms, contracts, other documents, etc.

7.1. Contents

The authorization granted to AGENCIAHERO.COM by the Holder includes:

The Treatment to which your personal data will be submitted and the purpose thereof.

The optional nature of the answer to the questions that are asked, when these are about sensitive data or about the data of girls, boys and adolescents.

The rights that assist you as Owner.

The identification, physical or electronic address of AGENCIAHERO.COM

7.2. Cases in which Authorization is not required

The authorization of the Holder will not be necessary for the treatment of the information by AGENCIAHERO.COM in the following cases:

Information required by a public or administrative entity in the exercise of its legal functions or by court order.

Data of a public nature.

Cases of medical or health urgency.

Tratamiento de información autorizado por la ley para fines históricos, estadísticos o científicos.

Data related to the Civil Registry of People

8. PROCEDURE FOR THE EXERCISE OF RIGHTS

The Owner of the information may submit queries and claims regarding their information, which will be resolved by AGENCIAHERO.COM in the following terms:

8.1. inquiries

The Holders of the information or their successors in title may consult the personal information of the Holder that rests in any database of AGENCIAHERO.COM.

The respective query must be submitted by writing filed at the AGENCIAHERO.COM offices or via email comercial@agenciahero.com The request must contain at least the full name of the Holder and the applicant, the indication of the information to be consulted, the date of the request, a photocopy of the identification document of the Holder and the applicant, as well as the address, email and telephone for notification purposes. In the event that the applicant is a third party, they must attach an authenticated document that proves the representation.

Once the previous requirements have been met, AGENCIAHERO.COM will provide the Holders, successors in title or authorized third parties, all the requested information that rests in their databases.

Regardless of the mechanism implemented for the attention of consultation requests, they will be attended to within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend to the query within said term, the situation will be reported to the interested party before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which the query will be addressed, which in no case may exceed five (5) business days following the expiration of the first installment.

8.2. Claims

When the Holder or his successors consider that the information contained in a database must be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in these Policies or in current regulations, they may present a complaint addressed to AGENCIAHERO.COM.

The request must be submitted in writing filed at the AGENCIAHERO.COM offices or via email comercial@agenciahero.com indicating the identification of the Holder, the clear and precise description of the facts that give rise to the claim and the information that is intended to be corrected, updated or deleted, the address and email of notifications, all of the above, attaching the documents that are they claim to assert. In the event that the applicant is a third party, they must attach an authenticated document that proves the representation.

If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the failures. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

In the event that the person receiving the claim is not competent to resolve it, they will transfer it to the appropriate person within a maximum term of two (2) business days and inform the interested party of the situation.

Once the complete claim is received, a legend that says "claim in process" and the reason for it will be included in the database, within a term of no more than two (2) business days. Said legend must be maintained until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

8.3. Revocatoria de la autorización

The Holders may revoke the Authorization granted for the Treatment of their personal data at any time, as long as it does not contravene legal or conventional provision.

The Authorization can be revoked in whole or in part, in the second case the Holder revokes the Authorization for one or more purposes, keeping intact the other purposes of the Treatment that AGENCIAHERO.COM, in accordance with the authorization granted, may carry out. carried out and with which the Holder agrees.

The Holder must expressly indicate in the revocation request, if it is total or partial. If it is partial, it must be indicated for which purpose or purposes it operates. The requests for revocation of the Authorization in which it is not indicated whether they are total or partial, will be processed by AGENCIAHERO.COM as total.

8.4. Responsible

Queries, claims and revocations of the Authorization related to the treatment and management of personal data, will be attended to within AGENCIAHERO.COM by the Legal Department, in strict observance of what is established by these Policies and by the regulations applicable to the matter.

Queries, claims and requests for revocation of the Authorization will be received at the offices of AGENCIAHERO.COM located in the Carrera 53 No. 141 – 69 Barrio Prado Pinzón or in the email comercial@agenciahero.com

9. VALIDITY

This MANUAL is effective as of August 1, 2020.