1. DATA CONTROLLER

The website (http://www.rocasalvatella.com/) is an internet domain which contains a portal or website whose ownership, in compliance with the provisions of Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce, is disclosed as: ROCA SALVATELLA S.L

ROCA SALVATELLA S.L
C.I.F: B-64927304
Registered address: Av. Alcalde Barnils 64-68, edifici C, 4ª planta, 08174  Sant Cugat del Vallès, Barcelona
Telephone: (+ 34) 93.544.24.02
Registry details: Barcelona Mercantile Registry, volume 40962, folio 1, sheet 370264, 1st entry

The website of ROCA SALVATELLA S.L. aims to provide users and interested parties with information regarding the activities and services of the entity. With this website, the intention is to provide a useful service, and therefore suggestions from users are welcome. However, if you do not agree with any of the conditions contained in this notice, you must stop using the website of ROCA SALVATELLA S.L. Access to the website is subject to the express acceptance of these conditions. The use of certain services offered on this site shall, furthermore, be governed by the specific conditions provided in each case.

The conditions set out below govern the permitted use of the website http://www.rocasalvatella.com/.

2. WEBSITE MODIFICATIONS AND INTERRUPTIONS OR ERRORS IN ACCESS

ROCA SALVATELLA S.L. reserves the right to make modifications and updates to the information contained on the website, its configuration and presentation, and the conditions of access at any time and without prior notice.

ROCA SALVATELLA S.L. is not responsible for any communications failures, and does not guarantee the availability and continuous operation of the portal and services; therefore, ROCA SALVATELLA S.L. does not guarantee the absence of interruptions or errors in accessing the website or its content.

ROCA SALVATELLA will carry out, provided that there are no causes that make it impossible or difficult to execute, and as soon as it becomes aware of the errors, disconnections or lack of updated content, all those tasks aimed at rectifying the errors, re-establishing communication and updating the content.

3. INTELLECTUAL PROPERTY

Unless expressly indicated otherwise, the content of the website, images, texts and data are the property of ROCA SALVATELLA S.L. Likewise, the source code, design and navigation structure are the property of ROCA SALVATELLA S.L. ROCA SALVATELLA S.L. holds the exclusive exercise of the exploitation rights of the same in any form, and especially the rights of reproduction, distribution, public communication and transformation. All this material is protected by intellectual property legislation and its misuse may be subject to sanctions, including criminal penalties.

Viewing or downloading content from the page or any software does not imply the transfer of any intellectual or industrial property rights over them. The viewing, printing and partial downloading of the content of the website is authorised solely and exclusively if the following conditions are met:

a) That it is compatible with the purposes of the website.

b) That it is not carried out for commercial purposes or for distribution, public communication or transformation.

c) That none of the content of the website is modified.

d) That no graphic, icon or image available on the website is used, copied or distributed separately from the text or other accompanying images.

e) That the source is cited.

All information received on these pages, such as comments, suggestions or ideas, will be considered as transferred free of charge. Do not send information that cannot be treated in this manner.

4. SECURITY

ROCA SALVATELLA S.L., aware of the risks arising from facing the new challenges involved in extending its services via the internet, has established demanding security measures to reduce these risks.

Nevertheless, ROCA SALVATELLA S.L. excludes any liability for damages of any kind that may be due to the presence of viruses or other elements that may cause alterations in the computer system (software and hardware), electronic documents and files of the user or any third party, including those produced in the services provided by third parties through this portal.

Users are informed that the use of electronic data transmission systems and email does not offer absolute security guarantees. The user and ROCA SALVATELLA S.L. mutually exempt each other from any liability arising from events such as non-receipt or delay in receipt, error or interception of communications.

5. CONTENTS AND LINKED PAGES

The information contained on this website is of a purely informative nature; and, under no circumstances, does it constitute any form of contractual obligation. The purpose of the links appearing on this page is exclusively to inform the user about the existence of other sources of information on the subject on the internet, where they may expand or complete the data offered on this page.

ROCA SALVATELLA S.L. shall not be responsible for the results obtained through these links. In any case, ROCA SALVATELLA S.L. assumes no responsibility for any content linked from its website, nor does it guarantee the absence of viruses or other elements in them that may cause alterations in the computer system (hardware and software), in documents or files of the user, excluding any liability for damages of any kind caused to the user for this reason.

Although links are regularly monitored to prevent this from happening, in the event that any user or third party considers that the content or services provided by the linked pages are unlawful, violate constitutional values or principles, or damage assets or rights of the user themselves or of a third party, they are requested to inform ROCA SALVATELLA S.L. immediately of this circumstance, especially if the links consist of:
a) Activities or content that may be considered criminal under Spanish criminal law.
b) Activities or content that violate intellectual or industrial property rights.
c) Activities or content that endanger public order, criminal investigation, public safety and national defence.
d) Activities or content that endanger the protection of public health, respect for human dignity, the principle of non-discrimination, the protection of health and children, or any other constitutional value or principle.

6. PERSONAL DATA PROTECTION

The personal data linked to this website complies with the requirements of current legislation on personal data protection. ROCA SALVATELLA S.L. will process the personal data collected through this website in compliance with current regulations on data protection.
a) Inclusion in files is entirely voluntary and is duly announced.
b) The files to which personal data are added shall be protected by the security measures required by legislation.
c) The data will only be used for the purpose for which they were collected.
d) All individuals added to the created file may exercise the rights of access, rectification, objection, restriction of processing, erasure and portability of data.

7. THIRD-PARTY LINKS TO THE WEBSITE

Any third-party link to the website must be to its homepage, with deep links, framing and any other exploitation of the website's contents in favour of unauthorised third parties being expressly prohibited.

8. MINOR PROTECTION POLICY

Access to and use of this website is prohibited for minors under 13 years of age who are not duly authorised. ROCA SALVATELLA S.L. understands that from the moment a minor accesses this website, they have the permission of their parents, tutor or legal representative.

ROCA SALVATELLA S.L. reminds adults who are in charge of minors that it will be their exclusive responsibility if any minor submits their details to request a service.

9. DATA PROTECTION POLICY

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and its implementing regulations, you are informed that the personal data provided by Users will be added to an automated database owned by and under the responsibility of ROCA SALVATELLA, S.L.

The processing of personal data affects all those personal details provided by the User to ROCA SALVATELLA S.L. at the time of their registration on the web portal, as well as all those provided for access to any of the services on other pages or services of the said company.

ROCA SALVATELLA S.L. is subject to the compliance of its obligation of secrecy regarding personal data and its duty to treat them confidentially, and assumes, for these purposes, the necessary technical, organisational and security measures to prevent their alteration, loss, unauthorised processing or access, in accordance with the provisions of the aforementioned regulation and other applicable legislation.

The collection and processing of personal data have the following purposes: provision of services requested by the user; management of potential incidents; checking and verification of the quality of the services offered; sending general information about the development and operation of the service or product requested or contracted by the user. The user of these services is aware that, for the provision of the service, it is required that the management, maintenance and interconnection services with mobile operators of the technical platform used for the storage and processing of personal data and the provision of the service, as well as the creation and preservation of backup copies, be provided by ROCA SALVATELLA S.L.

During the registration process, the User shall grant their express authorisation and consent to ROCA SALVATELLA S.L. for the processing of their data in accordance with current applicable legislation on personal data protection. Providing certain data (telephone number or email address), required for registration as a CONTACT on the websites of ROCA SALVATELLA S.L. is mandatory, and ROCA SALVATELLA S.L. may deny registration to any interested party who does not provide such data.

Under no circumstances will ROCA SALVATELLA S.L. use the personal data of the interested parties for purposes other than those mentioned above, nor will it disclose them to third parties without the prior and express consent of the affected party, and it undertakes to maintain appropriate professional secrecy and to establish the necessary technical and organisational measures to safeguard the information in accordance with the requirements set out in the aforementioned Regulation.

Personal data will be stored in our records for a period of one year after the termination of the commercial relationship, with ROCA SALVATELLA S.L. likewise maintaining during that period of time its duty of secrecy and confidentiality over the data.

The user may access their data at any time and exercise the rights established by law and listed below: of access, rectification, erasure and data portability, and those of restriction or objection to the processing of the same, being able to exercise any of these actions in writing by post or email to the following address:

ROCA SALVATELLA, S.L. Avda Alcalde Barnils 64-68, 08174 Sant Cugat del Valles. Customer Service Telephone: 93 544 24 02 email: info@rocasalvatella.com

In the request, you must attach the following information:

- Name, surname and National ID (DNI) or the company you belong to, if applicable.
- Right you wish to request and the content of your request.
- Telephone number / email on which you wish to exercise that right.
- Address for notification purposes.

Furthermore, we inform you that, if you consider that your rights are not being respected in the processing of your data, you can file a complaint with the Spanish Data Protection Agency (AEPD).

10. JURISDICTION

ROCA SALVATELLA S.L. and the user, expressly waiving any other jurisdiction, submit for any dispute that may arise from access or use of the website to the Courts and Tribunals of the city of Sant Cugat del Vallés.

—————

COOKIES POLICY

This Website uses first and third-party cookies to offer you a better experience and service. By browsing or using our services, the user accepts our use of cookies.

1. WHAT ARE COOKIES?

Cookies are small text files that are installed on the browser of the User's computer, sending an anonymous identifier stored therein, allowing a website, among other things, to store and retrieve information about the browsing habits of a user or their device, furthermore, they improve their browsing process, as they allow the website to offer the user information that may be of interest to them based on the use they make of its content.

ROCA SALVATELLA S.L. shall endeavour at all times to establish appropriate mechanisms to obtain the consent of the User for the installation of cookies that require it. Notwithstanding the above, it should be noted that, in accordance with the Law, it shall be understood that (i) the User has given their consent if they modify the browser configuration by disabling the restrictions that prevent the entry of cookies and (ii) that said consent shall not be required for the installation of those cookies that are strictly necessary for the provision of a service expressly requested by the User (via prior registration).

2. THE COOKIES WE USE

Depending on the purpose for which the data obtained through the cookies are processed, the Website may use:

- First-party cookies:

Are those that are sent to the user's terminal equipment from a computer or domain managed by the editor itself and from which the service requested by the user is provided.

- Third-party cookies:

Are those that are sent to the user's terminal equipment from a computer or domain that is not managed by the editor, but by another entity that processes the data obtained through the cookies.

- Technical cookies:

Are those that allow the user to navigate through the website or application and use the different options or services that exist in it. For example, controlling traffic and data communication, identifying the session, accessing restricted web pages, remembering elements that make up an order, making the request for registration or participation in an event, using security elements during navigation and storing content for the broadcasting of videos or sound.

- Personalisation cookies:

Are those that allow the user to access the service with some predefined general characteristics on their terminal or defined by the user themselves. For example, the language, the type of browser through which they access the service, the selected content design, geolocation of the terminal and the regional configuration from where the service is accessed.

- Analysis cookies:

Are those that allow the tracking and analysis of the behaviour of users on websites. The information collected through this type of cookies is used to measure the activity of websites, applications or platforms and to create browsing profiles of the users of said sites, in order to introduce improvements to the service based on the usage data of users.

- Advertising cookies:

Are those that allow the effective management of the advertising spaces included on the website or application from which the service is provided. They allow the content of the advertisement to be adapted so that it is relevant to the user and to avoid displaying ads that the user has already seen.

- Behavioural advertising cookies:

Are those that allow the management, in the most effective way possible, of the advertising spaces that, where applicable, the editor has included on a website, application or platform from which the requested service is provided. These cookies store information on user behaviour obtained through continuous observation of their browsing habits, allowing a specific profile to be developed to display advertising based on it.

(The cookies we use do not store any personal data or any type of information that can identify you, unless you wish to register voluntarily in order to use the services we make available to you or to receive information about promotions and content of interest to you.)

Below is a list of the main cookies used by this Website:

a) Cookie Name

b) Source

c) Purpose

3. HOW TO MANAGE COOKIES?

The user has the option to allow, block or delete cookies installed on their equipment by configuring the browser options:

-  If using Microsoft Internet Explorer, in the Tools menu option, selecting Internet Options and accessing Privacy.

-  If using Firefox, for Mac in the Preferences menu option, selecting Privacy, accessing the Show Cookies section, and for Windows in the Tools menu option, selecting Options, accessing Privacy and then Use custom settings for history.

-  If using Safari, in the Preferences menu option, selecting Privacy.

-  If using Google Chrome, in the Tools menu option, selecting Options (Preferences on Mac), accessing Advanced and then the Content Settings option of the Privacy section, and finally checking Cookies in the Content settings dialogue.

However, disabling them could alter the functioning of the website. Please consult your browser's instructions and manuals for further information.

If you block the use of cookies on your browser, it is possible that some services or functionalities of the Website may not be available.

4. UPDATE OF THE COOKIES POLICY

It is possible that, due to new interpretations made by the competent regulatory body, judges or Courts, this cookies policy may undergo some modification, so the user is requested to check its content regularly.

Last review: 25 May 2018

 

POLICIES AND PROCEDURES MANUAL FOR THE PROCESSING OF INFORMATION OF ROCA SALVATELLA BOGOTA SAS

ROCA SALVATELLA BOGOTA SAS, domiciled at Calle 93 A No 14-17, office 704, of the city of Bogotá and telephone (+57-1) 3473612 (hereinafter "RS BOGOTA"), informs the Personal Data Owners whose data are processed in any way by RS BOGOTA, about this Policies and Procedures Manual for the Processing of Information (the "Policy"), thereby complying with Law 1581 of 2012 and Decree 1377 of 2013.

The main objective and purpose of this Policy is to inform Personal Data Owners of their rights, as well as the procedures and mechanisms provided by RS BOGOTA to make these rights effective, and to inform them of the scope and purpose of the Processing to which the Personal Data will be subjected in the event that the Owner grants prior, express and informed authorisation.

1. KEY DEFINITIONS

The following expressions used in this Policy shall have the definition granted to them here, or the meaning given by the applicable law or jurisprudence, as such law or jurisprudence is amended from time to time.

a) "Authorisation": Is the prior, explicit and informed consent of the Owner to carry out the Processing of their Personal Data.

b) "Database": Is the organised set of Personal Data subject to Processing, electronic or otherwise, whatever the modality of its creation, storage, organisation and access.

c) "Financial Data": Is any Personal Data referring to the birth, execution and extinction of monetary obligations, regardless of the nature of the contract that gives rise to them, whose Processing is governed by Law 1266 of 2008 or the norms that complement, modify or add to it.

d) "Personal Data": Is any information of any kind, linked or that can be associated with one or more specific or determinable natural or legal persons.

e) "Public Data": Is Personal Data qualified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Examples of public data include, among others, data relating to the civil status of persons, to profession or trade, to their status as a merchant or public servant, and those that can be obtained without any restriction.

f) "Sensitive Data": Is Personal Data that affects the privacy of the Owner or whose misuse may generate discrimination, such as those revealing trade union affiliations, racial or ethnic origin, political orientation, religious, moral or philosophical convictions, membership of trade unions, social organisations, human rights groups or promoting the interests of any political party or guaranteeing the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.

g) "Data Processor": Is the natural or legal person, public or private, who by themselves or in association with others, performs the Processing of Personal Data on behalf of the Data Controller.

h) "Authorised": Is RS BOGOTA and all persons under the responsibility of RS BOGOTA, who by virtue of the Authorisation and of this Policy have legitimacy to Process the Personal Data of the Owner. The Authorised includes the category of Enabled parties.

i) "Enablement": Is the legitimacy that expressly and in writing by means of a contract or equivalent document, RS BOGOTA grants to third parties, in compliance with the applicable law, for the Processing of Personal Data, converting such third parties into Data Processors of the Personal Data delivered or made available.

j) "Data Controller": Is the natural or legal person, public or private, who by themselves or in association with others, decides on the Database and/or the Processing of Personal Data.

k) "Owner" of Personal Data: Is the natural or legal person to whom the information resting in a Database refers, and who is the subject of the right of habeas data.

l) "Transfer": Is the Processing of Personal Data that implies the communication of the same within or outside the territory of the Republic of Colombia when its purpose is the performance of Processing by the Processor on behalf of the Controller.

m) "Transmission": Is the activity of Processing Personal Data by which they are communicated, internally or to third parties, within or outside the territory of the Republic of Colombia, when said communication has as its purpose the performance of any Treatment activity by the recipient of the Personal Data.

n) "Processing of Personal Data": Is any systematic operation and procedure, electronic or otherwise, that allows the collection, conservation, sorting, storage, modification, linking, use, circulation, evaluation, blocking, destruction and, in general, the processing of Personal Data, as well as its transfer to third parties through communications, consultations, interconnections, assignments, data messages.
o) "Habeas Data": Fundamental right of any person to know, update, rectify and/or cancel the personal information and data collected about them and/or processed in public or private databases, in accordance with the provisions of the law and other applicable regulations.

2. PRINCIPLES

RS BOGOTA, in the development of its commercial activities, will collect, use, store, transmit and perform various operations on the personal data of the Owners. In any Processing of Personal Data carried out by RS BOGOTA, the Controllers, Processors and/or third parties with whom Personal Data are shared must comply with the principles and rules established in law and in this Policy, in order to guarantee the right to Habeas Data of the Owners and thus comply with the legal obligations of RS BOGOTA.

These principles are:

a) Prior Authorisation: All Processing of Personal Data will be carried out once the prior, express and informed Authorisation of the Owner has been obtained, unless the Law establishes an exception to this rule. In the event that the Personal Data were obtained prior to the Law, RS BOGOTA will seek the appropriate ordinary and alternative means to contact the Owners and obtain their retroactive authorisation, following the provisions of Decree 1377 of 2013 and concordant regulations.

b) Authorized Purpose: Any Personal Data Processing action will be carried out with the purposes mentioned in this Policy or in the Authorisation granted by the Owner of the Personal Data, or in the specific documents where each type or process of Personal Data Processing is regulated. The purpose of the particular Processing of Personal Data must be informed to the Owner of the Data at the time of obtaining their Authorisation. Personal Data may not be processed outside the purposes informed and consented to by the Data Owners.

c) Data Quality: The Personal Data subjected to Processing must be true, complete, accurate, updated, verifiable and understandable. When in possession of partial, incomplete, fractioned or misleading Personal Data, RS BOGOTA must refrain from Processing them, or request its owner to complete or correct the information.

d) Delivery of information to the Owner: When requested by the Owner, RS BOGOTA must supply information about the existence of Personal Data concerning the applicant. This delivery of information will be carried out by the RS BOGOTA department in charge of personal data protection.

e) Restricted Circulation: Personal Data may only be Processed by those RS BOGOTA personnel who count on authorisation to do so, or by those whose functions include carrying out such activities. Personal Data may not be delivered to those who do not have Authorisation or have not been Enabled by RS BOGOTA to carry out the Processing.

f) Temporality: RS BOGOTA will not use the owner's information beyond the reasonable period required by the purpose that was informed to the Owner of the Personal Data.

g) Confidenciality: RS BOGOTA must always perform the Processing by taking the technical, human and administrative measures necessary to maintain the confidentiality of the data and to prevent it from being altered, modified, consulted, used, accessed, deleted, or known by unauthorised persons or by authorised and unauthorised persons in a fraudulent manner, or from the Personal Data being lost. Any new project involving the Processing of Personal Data must consult this Processing Policy to ensure compliance with this rule.

i) Confidentiality and Subsequent Processing: Any Personal Data that is not Public Data must be treated by the Controllers as confidential, even when the contractual relationship or the connection between the Personal Data Owner and RS BOGOTA has terminated. Upon termination of said connection, such Personal Data must continue to be processed in accordance with this Policy and with the law.

j) Individuality: RS BOGOTA will maintain separately the databases in which it acts as Processor from the databases in which it is the Controller.

k) Necessity: Personal Data may only be Processed during the time and to the extent that the purpose of its Processing justifies it.

3. PROCESSING AND PURPOSES

The Personal Data collected and processed by RS BOGOTA must be subject strictly and solely to the purposes outlined below. Likewise, Processors or third parties who have access to Personal Data by virtue of law or contract, shall maintain the Processing within the following purposes:

a) Manage all necessary information for compliance with tax obligations and commercial, corporate and accounting records of RS BOGOTA.

b) Comply with the internal processes of RS BOGOTA regarding the administration of suppliers and contractors.

c) Addition to automated databases or files of personal data of which RS BOGOTA is owner and controller. For this purpose, the Personal Data Owner will be provided with appropriate technical resources so that, prior to this, they can access the Privacy Notice, this Policy or any other relevant information, and can give their consent, in order to proceed with the automated processing of their Personal Data.

d) Use Personal Data for marketing and/or commercialisation of new services or products.

e) Other purposes determined by the Controllers in processes of obtaining Personal Data for its Processing and which are communicated to the Owners at the time of collecting the personal data.

f) Control and prevention of fraud and money laundering, including, but not limited to, checking restrictive lists, and all necessary information required for SARLAFT.

g) The archiving process, updating of systems, protection and custody of information and databases of RS BOGOTA.

h) Internal processes within RS BOGOTA, for development or operational purposes and/or systems administration.

i) Public transmission of data to third parties with whom contracts have been entered into for this purpose, for commercial, administrative, marketing and/or operational purposes, including, but not limited to, the issuing of cards, personalised certificates and certifications to third parties, in accordance with current legal provisions.

j) Maintain and process by computer or other means, any type of information related to the client's business in order to provide the relevant services and products.

k) Other purposes determined by the Controllers in processes of obtaining Personal Data for its Processing, in order to comply with legal and regulatory obligations, as well as RS BOGOTA policies.

4. RIGHTS OF THE PERSONAL DATA OWNER

In accordance with the law, Personal Data Owners have the following rights:

a) Know, update and rectify their Personal Data before RS BOGOTA or the Processors of the same. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned data, that induce error, or those whose Processing is expressly prohibited or has not been authorised.

b) Request proof of the Authorisation granted to RS BOGOTA, except when the law indicates that such Authorisation is not necessary.

c) Submit inquiries to RS BOGOTA or the Data Processor regarding the use given to their Personal Data, and for them to provide such information.

d) Submit complaints for violations of the law before the Superintendence of Industry and Commerce.

e) Revoke their Authorisation and/or request the erasure of their Personal Data from the databases of RS BOGOTA, when the Superintendence of Industry and Commerce has determined by means of a definitive administrative act that in the Processing, RS BOGOTA or the Processor has engaged in conduct contrary to the Law or when there is no legal or contractual obligation to maintain the Personal Data in the Controller's database.

f) Request access and access free of charge to their Personal Data that have been processed in accordance with Article 21 of Decree 1377 of 2013.

g) Know modifications to the terms of this Policy in a prior and efficient manner before the implementation of the new modifications or, failing that, of the new information treatment policy.

h) Have easy access to the text of this Policy and its modifications.

i) Access in an easy and simple manner the Personal Data registered in RS BOGOTA to effectively exercise the rights that the Law grants to the Owners.

j) Know the department or person empowered by RS BOGOTA before whom they may submit complaints, inquiries, claims and any other request regarding their Personal Data.

Owners may exercise the rights granted to them by law and carry out the procedures established in this Policy, by presenting their citizenship card or original identification document. Minors may exercise their rights personally, or through their parents or adults who hold parental authority, who must prove it through the relevant documentation. Likewise, the successors in title who prove such quality, the representative and/or attorney-in-fact of the owner with the corresponding accreditation and those who have made a stipulation in favour of another or for another, may exercise the rights of the Owner.

5. AREA RESPONSIBLE FOR HANDLING REQUESTS, INQUIRIES AND CLAIMS

RS BOGOTA has designated the Management Area as responsible for receiving and handling requests, complaints, claims and inquiries of all kinds related to Personal Data. The person or department in charge will process inquiries and claims in personal data matters in accordance with the law and this policy.

Some of the particular functions of this area in relation to Personal Data are:

a) Receive requests from Personal Data Owners, process and respond to those that are grounded in the Law or these Policies, such as: requests to update Personal Data; requests to know Personal Data; requests for erasure of Personal Data when the Owner submits a copy of the decision of the Superintendence of Industry and Commerce in accordance with what is established in the Law, requests for information on the use given to their Personal Data, requests to update Personal Data, requests for proof of the Authorisation granted, when it would have proceeded according to the Law.

b) Respond to Personal Data Owners on those requests that do not proceed in accordance with the Law.

The Customer Service contact details are:

Physical Address: Calle 93 A No 14-17, office 704

Email Address: carolsanchez@rocasalvatella.com

Telephone: (+57-1) 3473612

6. PROCEDURES TO EXERCISE THE RIGHTS OF THE PERSONAL DATA OWNERS

6.1. INQUIRIES

RS BOGOTA will provide mechanisms so that the Owner, their successors in title, representatives and/or attorneys-in-fact, those who have stipulated in favour of another or for another, and/or representatives of minor Owners, can make inquiries regarding the Personal Data of the Owner resting in the Databases of RS BOGOTA.

These mechanisms may be physical, electronic, through the email of the department in charge Carol Sánchez, or by telephone, on the service line (+57-1) 3473612.

Whichever the medium, RS BOGOTA will keep proof of the inquiry and its response.

a) If the applicant is capable of making the inquiry, in accordance with the accreditation criteria established in Law 1581 of 2012 and Decree 1377 of 2013, RS BOGOTA will compile all the information on the Owner contained in the individual record of that person or linked to the identification of the Owner within the databases of RS BOGOTA, and make it known to the applicant.

b) RS BOGOTA will respond to the applicant as long as they have the right to it by being the Personal Data Owner, their successor in title, attorney-in-fact, representative, it has been stipulated by another or for another, or they are the legal guardian in the case of minors. This response will be sent within ten (10) business days following the date on which the request was received by RS BOGOTA.

c) In the event that the request cannot be handled within the period established in the previous clause, the applicant will be contacted to communicate the reasons why their request is in process. For this, the same or a similar medium to that used by the applicant to communicate their request will be used.

d) The final reply to all requests will not take more than fifteen (15) business days from the date on which the initial request was received by RS BOGOTA.

6.2. REQUESTS AND CLAIMS

RS BOGOTA has mechanisms so that the Owner, their successors in title, representative and/or attorneys-in-fact, those who stipulated for another or to another, and/or representatives of minor Owners, can make requests or claims regarding (i) Personal Data processed by RS BOGOTA that should be corrected, updated or erased, or (ii) the alleged breach of duties imposed by law on RS BOGOTA.

These mechanisms may be physical, electronic, through the email of the department in charge carolsanchez@rocasalvatella.com, or by telephone, on the helpline (+57-1) 3473612.

a) The request or claim must be presented by the Owner, their successors in title or representatives or accredited persons in accordance with Law 1581 of 2012 and Decree 1377 of 2013, as follows:

- It must be addressed to RS BOGOTA electronically to the email address carolsanchez@rocasalvatella.com; physically to the address Calle 93 A No 14-17, office 704 of Bogotá; or by telephone, on the helpline (+57-1) 3473612.

- It must contain the name and identification document of the Owner.

- It must contain a description of the facts giving rise to the request or claim and the objective pursued (update, correction or erasure, or compliance with duties).

- It must indicate the address and contact and identification details of the claimant.

- It must be accompanied by all the documentation that the claimant wishes to assert.

- Before handling the request or claim, RS BOGOTA will verify the identity of the Personal Data Owner, their representative and/or attorney-in-fact, or the accreditation that there was a stipulation by another or for another. For this, it may require the citizenship card or original identification document of the Owner, and the special, general powers or documents necessary as the case may be.

b) If the request, claim or additional documentation is incomplete, RS BOGOTA will require the applicant only once within five (5) days following receipt of the claim to remedy the faults. If the applicant does not submit the required documentation and information within two (2) months following the date of the initial request, it will be understood that they have withdrawn it.

c) If for any reason the person who receives the request or claim within RS BOGOTA is not competent to resolve it, they will transfer it to the competent area within two (2) business days following receipt of the claim, and inform the applicant of said referral.

d) Once the request or claim has been received with the complete documentation, a legend stating "request in process" or "claim in process" and the reason for it will be included in the RS BOGOTA Database where the Owner's Data subject to the claim reside, in a term of no more than two (2) business days. This legend must be maintained until the request is decided.

e) The maximum term to address the request or claim will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to address the request within said term, the interested party will be informed of the reasons for the delay and the date on which their request will be handled, which in no case may exceed eight (8) business days following the expiration of the first term.

6. Security measures for the protection of Personal Data

We have adopted the necessary security levels for the protection of Personal Data provided to us as a client and installed all technical means and measures to prevent the loss, misuse, alteration, unauthorised access and theft of the registered information.

7. TERM

This Policy shall apply from 1 August 2019. The Personal Data stored, used or transmitted will remain in our Database, based on the criteria of temporality and necessity, for as long as necessary for the purposes mentioned in this Policy, for which they were collected.