2NV S.A.S., hereinafter 2NV, a company with address at Cr 58 No. 128-18 Bogotá D.C.,
identified with NIT 901016909-8, acting in its capacity as Data Controller
of Personal Data, and complying with the provisions contained in Law 1581 of
2012, in regulatory decrees 1377 of 2013, 886 of 2014, 1074 of 2015 and in the others
and the regulations that modify, add or complement them, (hereinafter the APPLICABLE LAW),
It is permitted to communicate the following policies for the processing of Personal Data.

1. GLOSSARY

• Authorization: Prior express and informed consent of the Owner to carry out the
Processing of personal data.

• Privacy Notice: Verbal or written communication generated by the person responsible, directed
to the Owner for the Processing of his personal data, through which he is informed
about the existence of the information processing policies that will be
applicable, the way to access them and the purposes of the Treatment that is
intends to give personal data.

• Database: Organized set of personal data that is subject to Processing.

• Personal Data: Any information linked or that can be associated with one or more
determined or determinable natural persons.

• Public Data: This is data that is not semi-private, private or sensitive. They are considered
public data, among others, data relating to the marital status of people, their
profession or trade and as a merchant or public servant. By its nature,
Public data may be contained, among others, in public records,
public documents, official gazettes and bulletins and court rulings duly
executed that are not subject to reservation.

• Sensitive data: Sensitive data is understood to be data that affects the privacy of the user.
Owner or whose improper use may generate discrimination against it, such as those who
reveal racial or ethnic origin, political orientation, religious beliefs or
philosophical, membership in unions, social organizations, human rights or
that promotes the interests of any political party or that guarantees the rights and
guarantees from opposition political parties, as well as data relating to health,
sexual life, and biometric data.

• Person in charge of Treatment: Natural or legal person, public or private, who in and of themselves
itself or in association with others carries out the Processing of Personal Data on behalf of the
responsible.

• Responsible for the Treatment: Natural or legal person, public or private, who in and of themselves
itself or in association with others decides on the Database and/or Data Processing.

• Owner: Person whose personal data is the subject of Treatment.

• Transfer: The transfer of data takes place when the person responsible and/or Processor
of the Processing of personal data, located in Colombia, sends the information or the
personal data to a recipient, who in turn is Responsible for the Treatment and is
located inside or outside the country.

• Transmission: Processing of personal data that involves their communication
inside or outside the territory of the Republic of Colombia when its purpose is the
carrying out a Treatment by the Processor on behalf of the person responsible.

• Treatment: Any operation or set of operations on personal data,
such as collection, storage, use, circulation or deletion.

2. RIGHTS OF THE OWNERS

The Owner of the personal data will have the following rights:

a) Know, update and rectify your personal data with those responsible for the
Treatment or Treatment Managers. This right may be exercised, among others
against partial, inaccurate, incomplete, fragmented, misleading data, or
those whose Treatment is expressly prohibited or has not been authorized;

b) Request proof of the authorization granted to the person responsible for the Treatment except when
expressly excepted as a requirement for Treatment, in accordance with the
provided for in article 10 of this law;

c) Be informed by the person responsible for the Treatment or the Person in Charge of Treatment, prior
request, regarding the use you have given to your personal data;

d) Present complaints to the Superintendency of Industry and Commerce for violations of the
provided in this law and the other regulations that modify, add or
complement;

e) Revoke the authorization and/or request the deletion of the data when the Treatment does not include
respect constitutional and legal principles, rights and guarantees. The revocation and/or
suppression will proceed when the Superintendency of Industry and Commerce has
determined that in the Treatment the person responsible or Processor has incurred
conduct contrary to this law and the Constitution;

f) Access free of charge to your personal data that has been processed.

3. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

a) Principle of legality in matters of data processing: The processing to which
This law refers to a regulated activity that must be subject to what is established therein.
and in the other provisions that develop it;

b) Principle of purpose: The Treatment must obey a legitimate purpose in accordance
with the Constitution and the Law, which must be informed to the Owner;

c) Principle of freedom: Treatment can only be carried out with prior consent.
express and informed of the Owner. Personal data may not be obtained or
disclosed without prior authorization, or in the absence of a legal or judicial mandate that reveals the
consent;

d) Principle of truthfulness or quality: The information subject to Treatment must be truthful,
complete, accurate, up-to-date, verifiable and understandable. Treatment of
partial, incomplete, fragmented or misleading data;

e) Principle of transparency: In the Treatment, the Owner’s right to
obtain from the person responsible for the Treatment or the Person in Charge of the Treatment, in any
moment and without restrictions, information about the existence of data that
concern;

f) Principle of restricted access and circulation: Treatment is subject to the limits established.
derive from the nature of the personal data, the provisions of this law and
the Constitution. In this sense, the Treatment can only be done by people
authorized by the Owner and/or by the persons provided for in this law;
Personal data, except public information, may not be available in
Internet or other means of dissemination or mass communication, unless access is
technically controllable to provide knowledge restricted only to the Owners or
authorized third parties in accordance with this law;

g) Security principle: The information subject to Treatment by the person responsible for the
Treatment or Treatment Manager referred to in this law, the
manage with the technical, human and administrative measures that are necessary to
provide security to the records by preventing their adulteration, loss, consultation, use or access
unauthorized or fraudulent;

h) Principle of confidentiality: All people involved in the Treatment of
personal data that are not public in nature are required to guarantee the
reservation of information, even after the end of your relationship with any of the
tasks that include the Treatment, and can only carry out supply or communication
of personal data when this corresponds to the development of authorized activities
in this law and in the terms thereof.

A. USER DATABASE

Headlines
Under users are the personal data of those who have subscribed. I would understand that
First you download and then you register.
Data
In Users you will find the name, telephone number and address of the users.
Treatment
The information collected in Users allows you to provide and/or acquire the goods and services that are
reserved or purchased through the solution.
Additionally, the information may be used to:
Contact the owner to evaluate the solution.
Channel for the exercise of rights
2NV has established the email [email protected] for the reception and attention of
queries or claims made by the data owners or their users. Furthermore, the
holders of personal data or their users may send written communications to the Cr
58 No. 128-18 Bogotá D.C. to the attention of Customer Service or call 6015371762.

B. DATABASE

Headlines
The personal data of users who have additionally authorized the
sending promotions.
Treatment
The information collected in the solution is used to inform users in a timely manner.
users about promotions, products and services offered through the solution.
Channel for the exercise of rights
2NV has established the email [email protected] for the reception and attention of
queries or claims made by the data owners or their users. Furthermore, the
holders of personal data or their users may send written communications to the Cr
58 No. 128-18 Bogotá D.C. to the attention of Customer Service or call 6015371762.

C. EMPLOYEES AND BENEFICIARIES 2NV

Headlines
In 2NV Employees and Beneficiaries, you will find the personal data of the employees of
2NV and that of their family units.
Treatment
The information collected in 2NV Employees and Beneficiaries is used to fulfill obligations
labor (collective agreement and legislation), tax, social security and parafiscal; for the
employee training and development; for the provision of services to personnel; and for him
sending communications related to the company.
Channel for the exercise of rights
2NV has established the email [email protected] for the reception and attention of
queries or claims made by the data owners or their users. Furthermore, the
holders of personal data or their users may send written communications to the Cr
58 No. 128-18 Bogotá D.C. to the attention of Customer Service or call 6015371762.

D. SUPPLIERS DATABASE

Headlines
In Suppliers you will find the personal data of suppliers, clients and employees with
who 2NV maintains commercial relations.
Treatment
The information collected from Suppliers is used to make payments and collections for the company.
Channel for the exercise of rights
2NV has established the email [email protected] for the reception and attention of
queries or claims made by the data owners or their users. Furthermore, the
holders of personal data may send written communications to Cr 58 No. 128-18
Bogotá D.C. to the attention of Customer Service or call 6015371762.

5. PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF THE OWNERS

In the event that the owner of the information contained in any of the databases above
stated, its users or representatives, want to exercise any of the rights
stated in Law 1581 of 2012 and other regulations that complement, replace or
repeal, you must follow the following procedure:

A. INQUIRIES

When the Owners, their users or representatives intend to consult personal information
of the Owner that resides in any database, must submit the request through
any of the channels enabled for this purpose, which are listed in the previous section. In
The reference must state the meaning of the query and the possible databases in
where the information rests.
The query will be answered within a maximum term of ten (10) business days from
the date of receipt thereof. When it is not possible to attend to the query within said
term, the interested party will be informed, expressing the reasons for the delay and indicating the date
in which your query will be attended to, which in no case may exceed five (5) business days
following the expiration of the first term.

B. CLAIMS

When the owners, their users or representatives consider that the information contained in
a database must be corrected, updated or deleted, or when
notice the alleged breach of any of the duties contained in the law, they may
file a claim, which will be processed under the following rules:
1. The claim will be made through a request addressed to 2NV S.A.S., identifying the Owner (with
name and identification document), the description of the facts that give rise to the claim,
the address for sending the corresponding response, attaching the documents that are
they want to assert. If the claim is incomplete, the interested party will be required within the
five (5) days following receipt of the claim to correct the defects. Elapsed
two (2) months from the date of the request, without the applicant presenting the information
requested, it will be understood that you have withdrawn the claim.
In the event that 2NV is not competent to resolve it, it will be transferred to the appropriate person in
a maximum period of two (2) business days and will inform the interested party of the situation.
2. Once the complete claim is received, a copy of the claim will be included in the corresponding database.
legend that says “claim in process” and the reason for it, in a term not greater than two
(2) business days. Said legend must be maintained until the claim is decided.
3. The maximum term to address the claim will be fifteen (15) business days counted from
from the day following the date of receipt. When it is not possible to attend to the claim
Within said term, the interested party will be informed of the reasons for the delay and the date on which
His claim will be attended to, which in no case may exceed eight (8) business days.
following the expiration of the first term.

6. ENTRY INTO EFFECT

These policies are effective as of April 1, 2021, however, 2NV reserves the right to
make modifications to these, which will be promptly communicated by this
means to the owners of the personal data.