Personal Data Processing Policy 

This Personal Data Processing Policy is prepared in accordance with the provisions of the Political Constitution of Colombia, Law 1581 of 2012, and Regulatory Decree 1377 of 2013 and will be applied by INVERSIONES SILCE S.A.S. concerning the collection, storage, use, circulation, suppression, transfer, and all activities that constitute the processing of personal data provided to this company.

The right to HÁBEAS DATA is the right of every person to know, update, and correct the information collected about them in public or private data files and databases, and guarantees all citizens the power of decision and control over their personal information. Therefore, INVERSIONES SILCE S.A.S. adheres to such provisions, considering that, for the development of its corporate purpose, it is continually collecting and processing various databases of customers, shareholders, suppliers, business partners, and employees.

DEFINITIONS

Authorization: consent that, prior, explicit, and informed, is given by the data subject to allow the company to carry out the processing of their personal data.

Data Subject: natural person whose data is being processed by the company.

Database: set of personal data.

Personal Data: information linked to a person. It is any piece of information linked to one or several specific or determinable persons or that can be associated with a natural or legal person. Personal data can be public, semi-private, or private.

Processing: any operation or set of operations on personal data, which may include its collection, storage, use, circulation, or suppression.

Processor: natural or legal person, public or private, who, either alone or in association with others, carries out any processing of personal data on behalf of the data controller.

Data Controller: natural or legal person, public or private, who, either alone or in association with others, decides on the database and/or the processing of data.

Public Data: Data classified as such according to the mandates of the law or the Political Constitution. Public data includes, among others, data contained in public documents, enforceable judicial sentences that are not subject to confidentiality, and those related to a person’s civil status.

Semi-private Data: Data that is not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to the data subject but also to a certain sector or group of people or to society in general, such as financial and credit data related to commercial activity.

Private Data: Data that, due to its intimate or reserved nature, is only relevant to the data subject.

Sensitive Data: data related to racial or ethnic origin, membership in unions, social or human rights organizations, political or religious convictions, sexual life, biometric data, or health data. This information may not be provided by the data subject.

Privacy Notice: physical or electronic document generated by the data controller that is made available to the data subject with information about the existence of the data processing policies that will be applicable, how to access them, and the characteristics of the Processing intended for personal data.

IDENTIFICATION OF THE DATA CONTROLLER AND PROCESSOR

DUTIES OF INVERSIONES SILCE S.A.S. REGARDING THE DATA SUBJECTS

INVERSIONES SILCE S.A.S. acknowledges that personal data is owned by the data subjects and that only such persons can decide on them. In this sense, it will use the data exclusively for the purposes for which it is authorized under the terms of the law and therefore is required to inform of the duties it assumes as a data controller:

The company must seek a means to obtain the express authorization from the data subject to carry out any type of processing.

The company must clearly and explicitly inform its clients, employees, suppliers, and third parties in general from whom databases are obtained about the processing to which they will be subjected and the purpose of such processing. To this end, the company must design a strategy through which, for each event, mechanism, or data request made, it will inform them of the respective processing involved. Some of these means can be sending text messages, completing physical forms.

The company must inform data subjects for each case, the optional nature of responding and providing the requested information.

In all cases where data is collected, the rights of all data subjects regarding their data must be informed.

The company must inform the identification, physical or electronic address, and phone number of the person or area responsible for processing.

The company must ensure at all times that the data subject has the full and effective exercise of the right to habeas data and to petition, meaning the ability to know the information about them that exists or is held in the database, request the update or correction of data, and process inquiries, all of which will be done through the consultation or claim mechanisms provided in this policy.

The company must securely store personal data records to prevent deterioration, loss, alteration, unauthorized or fraudulent use, and periodically and timely update and correct data whenever data subjects report changes or requests.

PURPOSES OF PERSONAL DATA COLLECTION

The personal data you provide to INVERSIONES SILCE S.A.S. will be stored in our databases and used for one of the following purposes:

Send information via physical mail, email, mobile phone, or other communication means, including text messages (SMS and/or MMS), about commercial, advertising, or promotional content related to products, events, and/or commercial promotions, with the aim of promoting, inviting, directing, executing, informing, and generally carrying out campaigns, promotions, or contests of a commercial or advertising nature, carried out by INVERSIONES SILCE S.A.S. and/or third parties.

Attend to internal or external audit processes.

TO WHOM INFORMATION CAN BE DISCLOSED BY INVERSIONES SILCE S.A.S. WITHOUT THE NEED FOR DATA SUBJECT AUTHORIZATION:

• To the data subjects, their heirs, or representatives at any time and through any means when requested from INVERSIONES SILCE S.A.S.
• To judicial or administrative entities exercising functions that make any request to the company for the information to be provided.
• To third parties authorized by any law of the Republic of Colombia.

INFORMATION SECURITY

INVERSIONES SILCE S.A.S. has human, administrative, and technical security measures to protect the data subjects’ information and prevent unauthorized access to their data or any unauthorized modification, disclosure, or destruction of it. Access to personal data is restricted to employees, contractors, representatives, and agents of INVERSIONES SILCE S.A.S. responsible for processing personal data and/or who need to know the data to perform their functions and carry out the company’s purpose.

DATA BASE VALIDITY

Personal data incorporated into INVERSIONES SILCE S.A.S.’s Database will remain valid for the time necessary to fulfill its purposes and to comply with its legal and contractual obligations. Once these periods expire, and in accordance with Article 28 of Law 962 of 2005, the data will be kept for a period of ten (10) years from the end of the relationship with INVERSIONES SILCE S.A.S. Subsequently, physical and/or magnetic files containing personal information, as well as personal data in databases, will be deleted.

If you do not want your personal data to be used by INVERSIONES SILCE S.A.S., you can partially or fully revoke such authorization expressly and unequivocally, directly, explicitly and in writing, either in physical or electronic form; or orally, or by any means or conduct that reasonably allows concluding that such authorization or consent is revoked.

If you have any observations and/or comments about the handling and use of your personal data, or if you believe that the company has used it contrary to the authorized and applicable laws; or if you no longer wish to receive information related to the company as per this document, you may contact us at

INVERSIONES SILCE S.A.S. customer service line 57 318 350 4196, email info@inversionessilce.com, address Carrera 56 No. 46-49 Bodega 1107 Medellín – Colombia.