TREATMENT POLICY  OF PERSONAL DATA

INTRODUCTION
The protection of Personal Data in Colombia se  is regulated by Law 1581 of 2012, Decree
Regulation 1377 of 2013, Decree 886 of 2014. This regulation establishes the principles and guarantees that must be applied to safeguard the information contained in databases.

By constitutional mandate, all persons have the right to their personal and family privacy and to
protection of your good name; therefore, the State must respect them and make them respect them. Similarly,
have the right to know, update, rectify and delete the information that has been collected about
them in data banks and in files of public and private entities. In the collection, treatment and
circulation of data, freedom and other guarantees enshrined in the Constitution must be respected.

Therefore, for the treatment and protection of the information contained in its databases,
ENTERPRISE BUSINESS SOLUTIONS EBS SAS has established this policy that contemplates, the
general guidelines for the collection, storage, use, circulation and suppression of information,
as well as the description of the purposes for which the information is collected.

1. OBJECTIVE
Guarantee all people the constitutional right they have to know, update, rectify, and
delete all the personal information that is about them in the databases or files that
ENTERPRISE BUSINESS SOLUTIONS EBS SAS has collected, processed, stored, transmitted,
etc., who for this policy of treatment and protection of personal data will be considered as
responsible and/or in charge of the information, as appropriate.

2. REACH
This policy will be applied in all administrative, organizational, functional and control aspects
that must be fulfilled by directors, employees and/or workers, contractors and third parties who work
or have a direct relationship with ENTERPRISE BUSINESS SOLUTIONS EBS SA

3. DEFINITIONS
Authorization: It is the process by which someone can take a specific action.
• Database: It is the collection of a determined amount of accumulations of information
which are related to each other.
• Personal data: It is any numerical, alphabetical, photographic, acoustic or any other information
other type concerning identified or identifiable natural persons, both that relating to their
identity and that related to their existence and occupations.
• Responsible: Natural or legal person, public or private, who is aware of their obligations
and acts in accordance with them and decides on the processing of personal data.
• Treatment: Any operation on personal data such as the collection, storage,
use or circulation.
• Privacy Notice: Verbal or written communication generated by the Responsible, addressed to the
Holder for the Treatment of your personal data, through which you are informed about the
existence of the information treatment policies that will be applicable, the form of
access them and the purposes of the Treatment that is intended to be given to personal data.
• Public Data: It is the data that is not semi-private, private or sensitive. are considered data
public, among others, the data related to the marital status of people, their profession or trade and
his capacity as merchant or public servant. By its nature, public data may be
contained, among others, in public records, public documents, official gazettes and bulletins and

duly executed judicial sentences that are not subject to reservation.
• Sensitive data: Sensitive data is understood as those that affect the privacy of the Holder or
whose improper use can generate discrimination, such as those that reveal racial origin
or ethnicity, political orientation, religious or philosophical convictions, trade union membership,
social, human rights organizations or that promotes the interests of any party
or that guarantee the rights and guarantees of opposition political parties, as well as the
data related to health, sexual life, and biometric data.
• Transfer: The transfer of data takes place when the Responsible and/or Person in Charge of the
Treatment of personal data, located in Colombia, sends the information or data
to a recipient, who in turn is Responsible for the Treatment and is within or
out of the country.
• Transmission: Treatment of personal data that implies the communication of the same within
or outside the territory of the Republic of Colombia when its purpose is to carry out a
Treatment by the Processor on behalf of the Responsible.

4. REFERENCE DOCUMENTS
https://www.mintic.gov.co/portal/604/articles-4274_documento.pdf
http://wsp.presidencia.gov.co/Normativa/Leyes/Documents/LEY%201581%20DEL%2017%20DE%20OCT
UDDER%20DE%202012.pdf

5. TREATMENT AND PURPOSES OF PERSONAL DATA TO INTERNAL PERSONNEL OF THE
ORGANIZATION
For the Treatment of personal data. ENTERPRISE BUSINESS SOLUTIONS EBS SAS In the
development, interpretation and application of this law, will apply, in a harmonious and comprehensive manner, the
following principles:
• Principle of legality regarding data processing: The processing of personal data
It is a regulated activity that must be subject to the provisions of the law.
• Principle of purpose: The treatment must obey a legitimate purpose according to the
constitution and the law, which must be informed to the owner.
• Principle of freedom: The treatment can only be executed with the prior consent of the owner,
personal data may not be disclosed without prior authorization.
• Previous truthfulness or quality: The information that is going to be subject to treatment must be: truthful,
complete, accurate and up-to-date. The processing of personal data that is incomplete or that
mislead.
• Principle of Transparency: In the processing, the holder's right to obtain information must be guaranteed.
of the data controller at any time and without restrictions information of
the existence of data concerning you.
• Principle of access and restricted circulation: Personal data, except for public
They may not be available on the internet or other means of disclosure.
• Security principle: The information subject to Treatment by the company that is
refers to this law, it must be handled with the technical, human and administrative measures

that are necessary to provide security to the records avoiding their adulteration, loss,
unauthorized or fraudulent consultation, use or access.
• Principle of confidentiality: All persons involved in data processing
personal that do not have the nature of public are obliged to guarantee the reservation of the
information, even after the end of their relationship with any of the tasks that comprise
Treatment, being able to only supply or communicate personal data when it
corresponds to the development of the activities authorized in this law and in the terms of the
same.

6. RIGHTS OF THE DATA HOLDER:
The owner of the data is informed of the rights that the laws offer on data protection
personal:
• Know, rectify and update your personal data against the company.
• Be informed by the company regarding the use that has been given to your personal data.
• Submit to the Superintendence of Industry and Commerce complaints for violations of the provisions
in this law and the other regulations that modify, add or complement it.
• Revoke the authorization of the data when the principles are not respected in the Treatment,
constitutional and legal rights and guarantees. The revocation will proceed when the
Superintendence of Industry and Commerce has determined that in the Treatment the Company has
incurred in conduct contrary to this law and the Constitution.
• Free access to your personal data that has been processed:
• To make a request for correction, update or deletion of data, you must address it in a manner
personnel to the area of Human Management. This request will be attended to immediately. When do not
If it is possible to serve it within said term, the interested party will be informed of the reasons for the delay.
and the date on which your request will be addressed, which in no case may exceed eight (8) days
working days following the expiration of the first term.
• Request proof of data processing authorization from ENTERPRISE BUSINESS
SOLUTIONS EBS SAS

7. INFORMATION SECURITY
ENTERPRISE BUSINESS SOLUTIONS EBS SAS
undertakes to make proper use and
treatment of the personal data contained in its Databases avoiding its adulteration, loss,
unauthorized or fraudulent consultation, use or access to the information contained therein.
To grant security to these records, we have:
• Security policies implemented in the computer system, it cannot be modified, copied and/or
print information related to personal data.
• Confidentiality agreements are signed in which officials undertake to guarantee
the reservation of the information, even after the end of their employment relationship. are made
training, awareness raising regarding information security.
• Execution of disciplinary sanctions for breaches of safety regulations, commitment to
information security needs.
8. PURPOSES OF THE USE OF THE INFORMATION

INTERNAL USE
The purposes for ENTERPRISE BUSINESS SOLUTIONS EBS SAS in
each interest group:

8.1. Employees, workers and collaborators in general.
Recruitment and selection phase
• Carry out confirmation of personal, family and work references.
• Carry out background checks when required according to the position request.
• Send personal information of the employee, worker, or contractor to client companies for
their specific purposes when required by them.
• Apply psychotechnical and specific knowledge tests for the position or positions that apply.
the profile when applicable.
Recruitment phase and during the term of the employment relationship
• Carry out confirmation in health providers -EPS-, pension funds and
severance pay, family compensation funds and financial entities.
• Manage the corresponding payroll payments in accordance with the conditions stipulated in the
work contract.
• Submit reports related to labor supply and demand to the Ministry of the Interior.
Labor and Social Protection when required relating personal information,
age, sex and educational level.
• Manage the reception, recording and transcription of disabilities due to illness, accidents
labor, maternity and paternity leaves or others.
• Create forms for the liquidation of social benefits.
• Investigate accidents at work.
• Prepare and apply competency evaluations, job performance and others related to
the quality and timeliness of the work performed by employees, workers or
collaborators.
• Verify the attendance of employees, workers, collaborators, suppliers and visitors to
trainings or meetings.
• Carry out epidemiological surveillance activities framed in the program of the System of
Occupational Health and Safety Management, training and activities for brigade members.
• Send information to the occupational risk insurer for affiliation and accident reporting.
of work.
• Issue the application order for discharge medical examinations at the end of the employment relationship.
and/or periodically when necessary.
• Send information to the financial area to manage transactions related to payments.
• Consult, obtain and send payroll detachments, liquidation of social benefits,
labor certifications, withholding at source certifications and, income certification and
retentions.
• The other necessary ones that arise in the environment and during the contractual relationship
regardless of its modality.

8.2. Physical and environmental security
• Perform video surveillance management for the safety of people who work, remain
or visit the facilities of ENTERPRISE BUSINESS SOLUTIONS EBS SAS through the
observation and recording of the activities carried out by people inside the
installations.
• Report and deliver videos or audio recordings to the competent authorities upon request
and verification of the existence of a judicial process.
8.3. Telephone service systems
Manage requests, complaints, requirements, claims and requests from users who communicate by
middle of the hotline.
8.4. Registration of information on the website of ENTERPRISE BUSINESS SOLUTIONS EBS SA
In the case of PQR requests and attention, it is applied for the management of these related to the
service provided ENTERPRISE BUSINESS SOLUTIONS EBS SAS and its clients.

9. PROCESSING OF PERSONAL DATA
For purposes of this policy and in accordance with current regulations, for ENTERPRISE
BUSINESS SOLUTIONS EBS SAS are sensitive data all those that affect the privacy of the owner
or those that due to their use may generate discrimination, among others:
• Racial or ethnic information.
• Political orientation.
• Sexual inclination or preference.
• Religious or philosophical convictions.
• Participation or membership in trade unions or social organizations.
• Information related to the state of health and sexual life.
• Biometric data such as fingerprint, photograph and voice, as long as they are for purposes
other than internal security control at ENTERPRISE BUSINESS SOLUTIONS EBS SAS
9.1. Treatment of sensitive data
The processing of sensitive data is prohibited except in the cases specified below,
situation in which the following parameters must be followed and addressed:
1. That the holder has given his explicit authorization to said treatment with the completion and signature of the
Authorization form for registration and storage of personal data, which is provided in
the employment contract.
The cases in which the granting of such authorization is not required by law are excepted.
2. In the case of holders who are physically or legally incapable (Civil Code, Art., 1503
and 1504) and the treatment is necessary to safeguard vital interests, there must be authorization from
your Legal Representative.
3. In the case of a judicial process in which the treatment is necessary to guarantee the
recognition, exercise or right of defense.
Version: 01

9.2. Obligations in the treatment of sensitive data
For the treatment of sensitive data in ENTERPRISE BUSINESS SOLUTIONS EBS SAS is subject to
the following obligations:
1. Inform the holder that because it is sensitive data, he is not obliged to authorize its treatment; bliss
authorization must be prior through the form "authorization of registration and storage of data
personal”, and may be consulted later, for which use must be made of the channels of
communication defined in this policy.
2. Inform the owner explicitly and in advance, in addition to the general requirements of the authorization
for the collection of any type of personal data, which of the data that will be subject to
treatment are sensitive and the purpose of the treatment, as well as obtaining your express consent.

10. STORAGE OF YOUR PERSONAL DATA
Once you provide your personal data, voluntarily and freely, they are stored
in the relevant database. The databases are located behind a firewall for greater
security and the servers on which the databases rest are physically protected in a place
sure. Only authorized personnel who have signed information confidentiality agreements can
access it and therefore the personal data of our customers and/or users.

11. MODIFICATIONS TO THE PERSONAL DATA PROCESSING POLICIES
ENTERPRISE BUSINESS SOLUTIONS EBS SAS reserves the right to modify, in any
time, unilaterally, its personal data processing policies and procedures.
Any changes will be published and announced. In addition, previous versions of the
present personal data processing policies.

12. Change Control