Privacy and Personal Data

General Privacy and Personal Data Processing Policy of OCESA COLOMBIA S.A.S.

This policy establishes the guidelines under which OCESA COLOMBIA S.A.S. will process the personal data contained in its databases, ensuring appropriate measures for the security, confidentiality, and protection of such information.

1. Identification of the Data Controller

Company Name: OCESA COLOMBIA S.A.S. ("Ocesa")

Registered Address: Bogotá

Email: notificaciones-col@ocesa.co

Phone: +57 1 6605006

2. Purpose

This Privacy and Personal Data Processing Policy, hereinafter the "Policy," is intended to establish the guidelines under which Ocesa will process Personal Data contained in its databases, always seeking to prevent improper use or handling and ensuring appropriate security and confidentiality measures.

This Policy establishes the rights and responsibilities of Data Subjects, as well as Ocesa's duties and commitments regarding the use of such information.

This Policy also contains the general principles and parameters that must be observed when processing Personal Data and Sensitive Personal Data by Ocesa, its officers, employees, or third parties appointed as Data Processors.

Data Subjects should review this Policy or the corresponding Privacy Notice before providing personal information. The provisions herein apply to data provided physically or through remote channels, including websites, information systems, and Ocesa email communications.

3. Scope

This Policy applies to the processing of data belonging to website Users, suppliers, contractors, employees, customers, and/or third parties whose Personal Data has been collected by Ocesa through its website, email, or any other in-person or remote channel.

All Ocesa employees and collaborators must comply with this Policy in the performance of their duties. Pursuant to Articles 17 and 18 of Law 1581 of 2012, this document also constitutes the internal policies and procedures manual and the information processing policy.

4. Glossary

Authorization: Prior, express, and informed consent granted by the Data Subject for the processing of Personal Data.

Privacy Notice: The notice made available to Data Subjects when it is not possible to provide this Privacy Policy in full.

Database: An organized collection of Personal Data subject to Processing by Ocesa or a third party appointed by Ocesa.

Data Processor: A natural or legal person, public or private, who independently or jointly with others processes Personal Data on behalf of Ocesa.

Information / Personal Data: Any information processed by Ocesa or a designated third party that identifies or may reasonably be used to identify a person, either directly or indirectly.

Such data may include identification information, contact details, financial and/or credit information, and other information generally used to identify individuals.

Sensitive Personal Data: Personal Data that, if improperly used, could result in discrimination against the Data Subject, including information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, sexual life, or biometric data.

Data Controller: Ocesa, as the entity that determines the purposes and means of the database and/or Processing of Personal Data.

SIC: Superintendence of Industry and Commerce of Colombia.

Ocesa Website: www.ocesa.co

Third Party: Any natural or legal person, domestic or foreign, other than the Data Subject or Ocesa.

Data Subject: The natural person whose Personal Data is subject to Processing.

Transfer: The disclosure or transfer of Personal Data to a third party acting as a Data Controller, either within or outside Colombia.

Transmission: The Processing of Personal Data involving its communication within or outside Colombia so that a Data Processor may process it on behalf of the Data Controller.

Processing: Any operation or set of operations performed on Personal Data, including collection, storage, use, circulation, or deletion.

User: Any natural person who accesses the Ocesa Website and/or subscribes to it.

5. Purposes of Personal Information Processing by Ocesa

Ocesa collects information from Data Subjects for various general purposes. When requesting the Data Subject's prior and express Authorization, Ocesa will inform them of the specific purposes for which their information is being collected.

5.1. Personal Data Subject to Processing

To properly conduct its activities and fulfill its corporate purpose, Ocesa may collect Personal Data directly from Data Subjects through commercial, employment, or other relationships.

Personal Data may be collected through job applications, website subscriptions, supplier onboarding, websites, and other channels or forms.

The main categories of Personal Data that may be collected include name, address and contact information, date of birth, financial information, consumer preferences, and information used to provide better services.

5.2. Purposes of Personal Data Processing

Personal Data may be used, among other purposes, to:

• Keep Users informed about events, shows, news, promotions, offers, and campaigns.

• Provide a personalized experience in connection with services offered by Ocesa.

• Send information, news, promotions, offers, invitations, welcome messages, surveys, and notifications.

• Promote events, generate statistical records, and improve Ocesa's services.

• Analyze customer preferences, consumption habits, interests, and profiles.

6. Security Measures

Ocesa implements administrative, technical, and physical measures designed to protect Personal Data against damage, loss, alteration, destruction, unauthorized use, access, or Processing.

Online services use SSL (Secure Sockets Layer) encryption on pages where Personal Information is requested in order to protect the confidentiality of such information during transmission over the Internet.

7. Transfer and/or Transmission of Personal Information

Ocesa may Transfer or Transmit Personal Data to third parties, including sponsors, advertisers, contractors, business partners, affiliated companies, subsidiaries, related entities, or its parent company.

Recipient companies may be located within or outside Colombia. In all cases, the applicable Privacy Notices or Authorizations will inform the Data Subject of any Transfer or Transmission of their Personal Data.

8. Use of Cookies and Web Beacons

The Ocesa Website uses tools such as cookies and web beacons to passively collect information from Users and record certain browsing behaviors.

These tools may be used to remember subscription and contact information, recognize new or returning customers, improve the browsing experience, display relevant advertising content, and analyze website traffic and visitor interests.

9. Policy Updates

This Policy will serve as the means through which changes or updates are communicated and will be available at: https://ocesa.co/politica-de-tratamiento-de-datos-personales/

10. Rights of Data Subjects

• Know, update, and correct their Personal Data.

• Request proof of the Authorization granted.

• Be informed about the use made of their Personal Data.

• File complaints with the SIC regarding violations of applicable regulations.

• Revoke Authorization and/or request deletion of their data when applicable.

• Access their Personal Data that has been subject to Processing free of charge.

11. Mechanisms for Exercising Data Protection Rights

Data Subjects may exercise their rights through the channels made available by Ocesa. The department responsible for handling inquiries and complaints related to Personal Data may be contacted at: notificacionesocesacolombia@cie.com.mx

11.1. Inquiries

The Data Subject or their representative may request access to the Personal Information provided to Ocesa by submitting a request through the channels made available by Ocesa.

Ocesa must respond to the inquiry within a maximum of ten (10) business days from the date it is received. If it is not possible to respond within that period, Ocesa will inform the interested party of the reasons for the delay and provide a new response date, which may not exceed five (5) additional business days.

11.2. Complaints

The Data Subject or their representative may request the correction, updating, or deletion of information by submitting a written complaint containing:

• Identification of the Data Subject.

• A description of the facts giving rise to the complaint.

• The Data Subject's correspondence address.

• Supporting documentation.

Ocesa will respond to complaints within fifteen (15) business days following receipt. If it is not possible to respond within that period, Ocesa will inform the interested party of the reasons for the delay and will provide a response within a maximum of eight (8) additional business days.

12. Retention Period for Collected Personal Information

When the Personal Information collected is no longer necessary to fulfill the purposes established in this Policy, the applicable Privacy Notice, the Authorization, or applicable legal provisions, the Personal Data will be deleted from Ocesa's Database.

13. Changes to Ocesa's Data Processing Policy

Ocesa reserves the right to modify this Policy. When substantial changes are made regarding the identification of the Data Controller or the purposes of Processing and such changes affect the content of the Authorization, those changes will be communicated to the Data Subject.

14. Information Concerning Children and/or Adolescents Under 18

Ocesa does not collect Information from Users under the age of 18. However, when Personal Data belonging to children or adolescents is obtained, Authorization from the minor's parents or legal guardian will be required.

If a printed copy of this document is used, its version number should be checked against the current version available on the Ocesa Web Portal.

This Policy was reviewed in July 2020 and is currently in effect.