POLICY ON INFORMATION PROCESSING

Business Name: ADVANCE SCIENTIFIC DE COLOMBIA S.A.S
City: Cali, Valle – Colombia
Street: CLL 18 # 10 63 Barrio Bretaña
Email: servicioalcliente@advancescientificgroup.com
Phones: 601-7033107 – 601-7033109

Based on:
• Law 1581 of 2012, which establishes general provisions for the protection of personal data.
• Decree 1074 of May 26, 2015. External Circular No. 02 of November 3, 2015.

1. LEGAL NORMS AND SCOPE OF APPLICATION.

This Personal Data Processing Policy is carried out in accordance with the political constitution of Colombia, Law 1581 of 2012, Regulatory Decree 1377 of 2013, Decree 1074 of May 26, 2015, Circular 02 of November 3, 2015, and other complementary provisions. It will be applied by ADVANCE SCIENTIFIC DE COLOMBIA S.A.S., regarding the collection, storage, use, circulation, deletion, and all activities constituting the processing of personal data.

2. DEFINITIONS.

In compliance with the following policy based on Law 1581 of 2012, the following definitions will apply:

a) Authorization: Prior, express, and informed consent of the Owner to carry out the Processing of personal data.
b) Owner: Natural person whose personal data is the subject of Processing
c) Data handling format: Document generated by the Data Controller, issued to the owner informing them of the treatment of their personal data. This document communicates to the Owner the information concerning the data processing policy, information that will apply to them, and the purpose of the processing intended for personal data.
d) Database: Organized set of personal data subject to Processing.
e) Personal data: Any information linked or that can be associated with one or more natural persons, determined or determinable.
f) Processor: Natural or legal person, public or private, who, by themselves or in association with others, carries out the Processing of personal data on behalf of the Data Controller.
g) Data Controller: Natural or legal person, public or private, who, by themselves or in association with others, decides on the database and/or the Processing of the data.
h) Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

3. PURPOSE OF PROCESSING AND DATA COLLECTION.

Following the guidelines of Law 1581 of 2012, ADVANCE SCIENTIFIC DE COLOMBIA S.A.S. is allowed to collect, transfer, store, use, circulate, delete, share, update, and transmit personal data in accordance with the Procedure for the processing of personal data in order to comply with the following purposes:

• To validate information in compliance with the applicable legal customer knowledge requirement.
• To undertake collection and debt recovery actions using contact data in case such data applies to customers.
• To provide personal data to collection companies that require the necessary information to carry out debt collection management.
• For the processing of personal data protected by our legal system,
• For the processing and protection of contact data (physical address, email, social networks, and phone),
• To request and receive personal or legal information and social security information from health institutions and public and/or private companies that is stored in their databases.
• To conduct studies on purchasing habits
• To conduct necessary studies and consultations for employment linkage
• To make inquiries in credit bureaus, with the prior authorization of the owner in case credit is required for the sale of medicines or if necessary for legal processes.
• To support both external and internal audit processes
• To offer company products
• To provide, share, send, or deliver personal data to affiliated companies of ADVANCE SCIENTIFIC DE COLOMBIA S.A.S. located in Colombian territory or another country if these companies request information for the purposes mentioned in this document.
• To be provided to government entities requesting personal information from the owners.

4. RIGHTS OF OWNERS OF PERSONAL DATA SUBJECT TO PROCESSING BY ADVANCE SCIENTIFIC DE COLOMBIA S.A.S.

Owners of personal data may exercise the following rights regarding the personal data that is subject to processing:

a. Right to be informed about the use of personal data: The owner will be informed about the use of their information, and the authorization for the handling of personal data will contain the purpose of the use.
b. Right to know, update, rectify, and delete: The owner may exercise their right to update, rectify, and delete their personal data. Using the formal channels for the request of these processes.
c. In the event that sensitive personal data is collected, the Owner may refuse to authorize its Processing.
d. Right to request proof of authorization.
e. Right of access: The owner may access their information through formal channels.
f. Right to file complaints with the governmental entity for non-compliance with Law 1581.
g. Right to revoke authorization or request the deletion of the data when the principles, constitutional and legal rights, and guarantees are not respected in the processing. This revocation will occur when the Superintendence of Industry and Commerce has determined that the data controller has engaged in conduct contrary to Law 1581 of 2012.
h. Authorization will not be necessary when: 1) the information is required by a public entity. 2) they are data of a public nature. 3) the processing authorized by law for historical, statistical, or scientific purposes. 4) they are data related to the civil registration of individuals.

5. DUTIES OF ADVANCE SCIENTIFIC DE COLOMBIA S.A.S.

It is obliged to comply with the duties imposed by law:

• Ensure the owner at all times the exercise of the right to habeas data.
• Request and keep a copy of the authorization granted by the owner for the handling of personal data.
• Keep the information under necessary security conditions to prevent unauthorized access.
• Properly inform the owner about the purpose of the collection and the rights granted to them by virtue of the authorization granted.
• Ensure that the information is truthful, complete, accurate, up-to-date, verifiable, and understandable.
• Update the information, promptly communicating to the data processor, all the news regarding the data that it has previously provided and take other necessary measures for the information provided to remain updated.
• Process queries and claims made in the terms indicated in Law 1581 of 2012.
• Inform, at the request of the owner, about the use given to their data.
• Comply with the instructions and requirements imposed by the Superintendence of Industry and Commerce.

6. DUTIES OF ADVANCE SCIENTIFIC DE COLOMBIA S.A.S.

When acting as the data processor:

• Ensure the owner, at all times, the full and effective exercise of the right to habeas data.
• Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
• Promptly carry out the update, rectification, or deletion of the data in the terms of Law 1581 of 2012.
• Update the information within 5 business days from its receipt.
• Process the queries and claims made by the owners within the terms indicated in this Law 1581.
• Register in the database the legend “claim in process” in the manner regulated by Law 1581 of 2012
• Refrain from circulating information that is being disputed by the Owner and whose blocking has been ordered by the SIC. • Allow access to information only to authorized persons.
• Inform the SIC when there are violations of security codes and there are risks in the administration of the information of the Owners.
• Comply with the instructions and requirements imposed by the SIC.

7. RESPONSIBLE AREA AND PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF THE OWNERS OF THE PERSONAL DATA: THE HUMAN RESOURCES AREA AND THE PORTFOLIO AREA OF ADVANCE SCIENTIFIC DE COLOMBIA

will be responsible for addressing the requests, complaints, and claims made by the owner of personal data in compliance with what is contemplated in numeral 4 of this policy, except for what is mentioned in letter G.

• The owner may exercise their complaint, query, or claim from Monday to Friday from 8:00 a.m. to 5:00 p.m. at the email servicioalcliente@advancescientificgroup.com or call the telephone line in Bogotá 7033107, 7031907. Or submit it to the address Calle 127 No. 16 A-76, Office 303 Barrio Santa Barbara.
• The complaint or claim must contain the identification of the owner, document number, the facts that generate the request, and the necessary documents for the attention of the requirement.
• If the request requires additional information, the owner will be notified within 5 business days following the receipt of the request.
• If, after two months, the applicant does not provide the required information, it will be understood that they have withdrawn the claim.
• Once the claim is received in full, the legend “in process” and the reason for the claim’s origin will be included in the database. This legend must be maintained until the claim is decided. The claim must be addressed within a maximum of 15 business days after receiving the complete request for data or documents necessary to initiate the solution.
• If it is not possible to address the owner’s claim, they will be informed of the solution date. This new deadline may not exceed 8 business days after the first term.

8. EFFECTIVE DATE.

This policy was created on September 1, 2016, and will enter into force on November 1, 2016.

9. SECURITY MEASURES: ADVANCE SCIENTIFIC DE COLOMBIA S.A.S.

Will adopt the Administrative, technological, and human measures that are necessary to provide security to the personal information of the owners, avoiding its alteration, loss, consultation, use, or unauthorized or fraudulent access. Personnel processing personal data will execute the established protocols to guarantee the security of the information.