PERSONAL DATA PROCESSING POLICY

In compliance with Law 1581 of 2012, which establishes provisions for the protection of personal data, La Tercera Mirada S.A.S. BIC, in its capacity as data controller, informs the general guidelines on this matter:

The entity responsible for the processing of your personal data is La Tercera Mirada S.A.S., NIT 900.430.351-1, with its main office located in Bogotá at Kr 4ª No. 26B 77, office 401, telephone 322 347 2168, website www.la3mirada.com. Through these channels, information may be registered, updated, or deleted.

Purpose and Use of Information

La Tercera Mirada S.A.S. will use the personal data collected in the course of its business activities for: sending news and relevant information about our brands that may be of interest to you, such as offers, promotions of our services and products, event information, surveys, advertising and marketing activities, handling complaints, claims, suggestions and comments, and, in general, for all activities carried out by the company.

La Tercera Mirada S.A.S. will inform its clients, suppliers, collaborators, and other individuals about this Privacy and Information Management Policy, with the purpose of complying with the law and guaranteeing the rights of the data subject.

La Tercera Mirada S.A.S. may manage the collection, processing, administration, and updating of data through third parties, who, in all cases, must follow this policy to ensure the security and proper management of all information.

La Tercera Mirada S.A.S. guarantees that it will use the data in accordance with the provisions established in the Personal Data Protection Law.

Principles for the Processing of Personal Data

In accordance with Article 4 of Law 1581 of 2012, the principles governing the processing of personal data are:

Principle of legality in data processing: The processing referred to in Law 1581 of 2012 is a regulated activity that must comply with the provisions established therein and with any other regulations that develop it.

Principle of purpose: Processing must respond to a legitimate purpose in accordance with the Constitution and the Law, which must be communicated to the data subject.

Principle of freedom: Processing may only be carried out with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives the need for consent.

Principle of truthfulness or quality: Information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.

Principle of transparency: During processing, the data subject’s right to obtain information from the data controller or data processor, at any time and without restrictions, regarding the existence of data concerning them must be guaranteed.

Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of personal data. In this regard, processing may only be carried out by persons authorized by the data subject and/or by the persons provided for under this law.

Principle of security: Information subject to processing by the data controller or data processor referred to in this law must be handled with the technical, human, and administrative measures necessary to provide security to the records, preventing their alteration, loss, consultation, use, or unauthorized or fraudulent access.

Principle of confidentiality: All persons involved in the processing of personal data that is not public in nature are required to guarantee the confidentiality of the information, even after their relationship with any of the activities related to the processing has ended. They may only provide or communicate personal data when this corresponds to the development of the activities authorized under this law and under its terms.

Transfer of Personal Data

La Tercera Mirada S.A.S. may share all or part of your personal data with authorized companies, in accordance with Colombian legislation, for the exercise of its activities.

Likewise, if the data is required through the corresponding legal, administrative, or judicial channels, La Tercera Mirada S.A.S. will be obliged to disclose it to the requesting authority.