This Personal Data Processing policy is prepared in accordance with the provisions of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other complementary provisions and will be applied by ATRAVEX S.A.S. for the collection, storage, use, circulation, deletion and all those activities that constitute the processing of personal data.

The application of this policy has as treatment all the personal data of the holder of the information and even in sensitive data of his family group at the time of employment contracts and requirements in the ordinary course of business.

For the purposes of the execution of this policy and in accordance with legal regulations, the following definitions shall apply:

1. Authorization: Prior, express and informed consent of the Holder to carry out the Processing of personal data.
2. Privacy notice: Physical document, electronic or in any other format generated by the Responsible that is made available to the Holder for the processing of their personal data. In the Privacy Notice, the Holder is informed of the information related to the existence of the information processing policies that will be applicable, how to access them and the purpose of the treatment that is intended to give personal data.
3. Database: Organized set of personal data that is the object of Treatment.
4. Personal data: Any information linked or that may be associated with one or more specific or determinable natural persons.
5. Public data: It is the data classified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Public data, among others, are the data related to the marital status of people, their profession or trade, their status as merchant or public servant and those that can be obtained without reservation. By their nature, public data may be contained, among others, in public records, public documents, gazettes and official newsletters.
6. Private data: It is the data that due to its intimate or reserved nature is only relevant for the holder.
7. Sensitive data: Sensitive data means those that affect the privacy of the Holder or whose improper use can generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social, human rights organizations or those that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data.
8. Person in charge of the Treatment: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Person Responsible for the Treatment.
9. Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the basis of data and / or the Treatment of the data.
10. Owner: Natural person whose personal data is subject to Treatment.
11. Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion thereof.

The processing of personal data in ATRAVEX S.A.S. It will be governed by the following principles:

1. Principle of purpose: The Processing of personal data collected must comply with a legitimate purpose, which must be informed to the Holder.
2. Principle of freedom: The Treatment can only be carried out with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.
3. Principle of truthfulness or quality: The information subject to Treatment must be truthful, complete, accurate, updated, verifiable and understandable. Treatment of partial, incomplete, fractional or error-inducing data will not be carried out.
4. Principle of transparency: In the Treatment, the right of the Holder to obtain from ATRAVEX S.A.S. at any time and without restrictions, information about the existence of data concerning you
5. Principle of access and restricted circulation: The Treatment is subject to the limits derived from the nature of personal data, the provisions of this law and the Constitution. Personal data, except for public information, and the provisions of the authorization granted by the owner of the data, may not be available on the Internet or other means of disclosure or mass communication, unless access is technically controllable to provide restricted knowledge only to holders or authorized third parties
6. Security principle: Information subject to treatment by ATRAVEX S.A.S. it must be protected through the use of the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access;
7. Principle of confidentiality: All persons involved in the Processing of personal data are obliged to guarantee the reservation of the information, even after the end of their relationship with any of the tasks included in the Treatment.
8. Principle of legality regarding data processing: the treatment referred to in this law is a regulated activity, which must be subject to what is established in it and in the other provisions that develop it

FIRST PARAGRAPH: In the event that sensitive personal data is collected, the Holder may refuse to authorize its Treatment.

ATRAVEX S.A.S. You can use personal data to:

1. Execute the existing contractual relationship with its customers, suppliers, contractors, employees, former employees, among others, including the payment of contractual obligations.
2. Provide the services and / or products required by customers.
3. Inform about new products or services and / or changes in them.
4. Maintain constant communication with the owners of personal data, related to the development of the company’s own activities according to the profiles of each type of database that the company possesses.
5. Evaluate the quality of service.
6. Perform marketing tasks and efforts to improve the services provided by the company and improve customer knowledge.
7. Send to physical, electronic, cellular or mobile device, via text messages (SMS and / or MMS) or through any other analogue and / or digital means of communication created or to be created, commercial, advertising or promotional information about the products and / or services, events and / or promotions of a commercial nature or not, in order to promote, invite, direct, execute, inform and in general, carry out campaigns, promotions or contests of a commercial or advertising nature, advanced by ATRAVEX SAS and / or by third parties
8. Develop the process of selection, evaluation, and employment relationship.
9. Comply with the provisions of the Colombian legal system in labor and social security matters, among others, applicable to employees, former employees, mission employees, temporary employees, current employees and candidates for future employment.
10. Support internal or external audit processes.
11. Register the information of employees and / or pensioners (active and inactive) in the databases of ATRAVEX S.A.S.
12. Those indicated in the authorization granted by the owner of the data or described in the respective privacy notice, as the case may be.

(I) there is express authorization to do so; (II) is necessary to allow contractors or agents to provide the entrusted services; (III) is necessary in order to provide our services and / or products; (IV) it is necessary to disclose it to the entities that provide marketing services on behalf of ATRAVEX S.A.S. or to other entities with which they have joint market agreements; (V) the information is related to a merger, consolidation, acquisition, investment, or other restructuring process of the company; (VI) that is required or permitted by law.

ATRAVEX S.A.S. may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is outsourced with third parties or personal information is provided to third party service providers, ATRAVEX S.A.S. warns said third parties of the need to protect such personal information with appropriate security measures, the use of the information for their own purposes is prohibited and it is requested that the personal information not be disclosed to others.

The holders of personal data by themselves or through their representative and / or agent or their successor may exercise the following rights, with respect to personal data that are subject to processing by ATRAVEX S.A.S .:

1. Right of access: By virtue of which you will be able to access personal data that is under the control of ATRAVEX SAS, for the purpose of consulting them for free at least once every calendar month, and whenever there are substantial modifications to the Treatment Policies of the information that motivate new consultations.
2. Right to update, rectification and deletion: By virtue of which you may request the update, rectification and / or deletion of the personal data subject to processing, so that the purposes of the processing are satisfied.
3. Right to request proof of authorization: except in the events in which, according to current legal regulations, authorization is not required to carry out the treatment
4. Right to be informed regarding the use of personal data.
5. Right to file complaints with the Superintendence of Industry and Commerce: for violations of the provisions of current regulations on the processing of personal data
6. Right to require compliance with orders issued by the Superintendence of Industry and Commerce.

FIRST PARAGRAPH: For the purposes of exercising the rights described above, both the holder and the person representing him must prove his identity and, if applicable, the quality by virtue of which he represents the holder. SECOND PARAGRAPH: The rights of minors will be exercised through the persons who are empowered to represent them.

All those obliged to comply with this policy must keep in mind that ATRAVEX S.A.S. It is obliged to fulfill the duties that the law imposes in this regard. Consequently, the following obligations must be met:

1. Duties when acting as responsible: (I) Request and keep, under the conditions provided in this policy, a copy of the respective authorization granted by the holder. (II) Inform the holder clearly and sufficiently about the purpose of the collection and the rights that assist him by virtue of the authorization granted. (III) Inform at the request of the owner about the use given to their personal data (IV) Process the queries and claims made in the terms indicated in this policy (V) Ensure that the principles of truthfulness, quality, security and confidentiality in the terms established in the following policy (VI) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (VII) Update the information when necessary. (VIII) Rectify personal data when appropriate.
2. Duties when you work as the person in charge of the processing of personal data. If you perform the data processing on behalf of another entity or organization (Responsible for the processing) you must fulfill the following duties: (I) Establish that the Data Controller is authorized to provide the personal data that will be treated as Manager (II) Guarantee the holder , at all times, the full and effective exercise of the right of habeas data. (III) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (IV) Timely update, rectify or delete the data. (V) Update the information reported by those responsible for the treatment within five (5) business days from the date of receipt. (VI) To process the consultations and claims made by the owners in the terms indicated in this policy. (VII) Record in the database the legend “claim in process” in the manner established in this policy. (IX) Insert in the database the legend “information in judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data. (X) Refrain from circulating information that is being controversial by the holder and whose blockade has been ordered by the Superintendence of Industry and Commerce. (XI) Allow access to information only to persons authorized by the owner or authorized by law for that purpose. (XII) Inform the Superintendence of Industry and Commerce when there are violations of security codes and there are risks in the administration of the information of the owners. (XIII) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
3. Duties when carrying out the processing through a Manager (I) Provide the person in charge of the processing only with personal data whose processing is previously authorized. For the purposes of national or international data transmission, a contract for the transmission of personal data must be signed or contractual clauses agreed in accordance with article 25 of decree 1377 of 2013. (II) Ensure that the information provided to the Manager The treatment is truthful, complete, accurate, updated, verifiable and understandable. (III) Communicate in a timely manner to the person in charge of the treatment all the news regarding the data that he has previously provided and take the other necessary measures so that the information provided to him is kept updated. (IV) Inform in a timely manner to the person in charge of the treatment the rectifications made on the personal data so that he / she proceeds to make the pertinent adjustments. (V) Require the person in charge of the treatment, at all times, to respect the security and privacy conditions of the owner’s information. (VI) Inform the person in charge of the treatment when certain information is under discussion by the owner, once the claim has been submitted and the respective procedure has not been completed.
4. Duties regarding the Superintendence of Industry and Commerce (I) Inform you of possible violations of security codes and the existence of risks in the administration of the information of the owners. (II) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

In advance and / or at the time of collecting personal data, ATRAVEX S.A.S. it will request the holder of the data its authorization to carry out its collection and treatment, indicating the purpose for which the data is requested, using for that purpose automated technical means, written or oral, that allow to keep proof of the authorization and / or conduct unequivocally described in article 7 of Decree 1377 of 2013. Said authorization will be requested for the time that is reasonable and necessary to meet the needs that gave rise to the request for the data and, in any case, in compliance with the legal provisions that govern on the subject

Authorization will not be required in the following cases:

• When required by a public or administrative entity in compliance with its legal functions, or by court order.
• In the case of public data.
• In cases of medical or health emergencies.
• When processing information authorized by law for historical, statistical and / or scientific purposes.
• In the case of personal data related to the civil registry of people.

In the event in which ATRAVEX S.A.S. cannot make this information treatment policy available to the owner of the personal data, it will publish the privacy notice attached to this document, the text of which will be kept for later consultation by the owner of the data and / or the Superintendency of Industry and Commerce.

You may only collect, store, use or circulate personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the treatment, in accordance with the provisions applicable to the subject matter and administrative, accounting, Fiscal, legal and historical information. Once the purpose or purposes of the treatment have been fulfilled and without prejudice to legal regulations that provide otherwise, it will proceed to the deletion of personal data in its possession. Notwithstanding the foregoing, personal data must be kept when required to comply with a legal or contractual obligation.

The Legal representative of ATRAVEX S.A.S. will be responsible for responding to the requests, complaints and claims made by the holder of the data in exercise of the rights contemplated in numeral 7 of this policy, except for that described in subparagraph e). For such purposes, the holder of the personal data or whoever exercises his representation may send his request, complaint or claim from Monday to Friday from 8:00 a.m. at 6:00 p.m. To the email nicolas.arbelaez@atravex.net, call the telephone line in Medellín (4) 3430473 or file it at the following address corresponding to our office Carrera 70 B 9 A 34.

The petition, complaint or claim must contain the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents to be asserted. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the failures. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has given up the claim. In the event that the person receiving the claim is not competent to resolve it, they will transfer it to the corresponding party within a maximum period of two (2) business days and inform the interested party of the situation. Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database, in a term not exceeding two (2) business days. This legend must be maintained until the claim is decided. The maximum term to handle the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

in accordance with the provisions of section 3 of article 10 of Regulatory Decree 1377 of 2013 ATRAVEX S.A.S. will proceed to publish a notice by email addressed to the owners of personal data for the purpose of publicizing this information processing policy and how to exercise their rights as holders of personal data housed in the databases of ATRAVEX S.A.S.

In development of the security principle established in Law 1581 of 2012, ATRAVEX S.A.S. will adopt the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. The personnel who carry out the processing of personal data will execute the established protocols in order to guarantee the security of the information.

The databases will have a validity of twenty (20) years, counted from the obtaining of the respective data.

This Personal Data Policy was created on November 2, 2016 and is effective as of November 03, 2016. Any changes that are presented regarding this policy will be informed by email: to email nicolas.arbelaez@atravex.net and website www.atravex.net

Atentamente,

NICOLÁS ESTEBAN ARBELÁEZ RAMÍREZ

Legal representative