1. LEGAL STANDARDS AND SCOPE OF APPLICATION:

   This personal data processing policy is prepared in accordance with the provisions of the Political Constitution, Law 1581 of October 17, 2012, Regulatory Decree 1377 of 2013 and other complementary provisions and will be applied by GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS regarding the collection, storage, use, circulation, deletion and all those activities that constitute personal data processing.

2. DEFINITIONS:

   For purposes of executing this policy and in accordance with legal regulations, the following definitions will apply: a) Authorization: Consent prior, express and informed of the Holder to carry out the Processing of personal data; b) Privacy notice: Physical, electronic document or in any other format generated by the person in charge that is made available to the Owner for the treatment of her personal data. In the Privacy Notice, the Holder is informed of the information regarding the existence of the information processing policies that will be applicable, the way to access them and the purpose of the treatment that is intended to be given to personal data; c) Database: Organized set of personal data that is subject to Processing; d) Personal data: Any information linked to or that can be associated with one or several specific or determinable natural persons; e) Public data: It is the data classified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Data relating to the marital status of individuals, their profession or trade, their status as a merchant or public servant and those that may be obtained without reservation are public, among others. By its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins; f) Private data: It is the data that due to its intimate or reserved nature is only relevant for the owner; g) Sensitive data: Sensitive data is understood to be that which affects the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social or human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data; h) Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller; i) Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or data processing; j) Holder: Natural person whose personal data is subject to Treatment; k) Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion of the same.

3. PURPOSE FOR WHICH PERSONAL DATA IS COLLECTED AND PROCESSED: GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS.

   may use personal data for: a) Execute the existing contractual relationship with its clients, suppliers and workers, including the payment of contractual obligations; b) Provide the services and/or products required by its users; c) Inform about new products or services and/or about changes in them; d) Evaluate the quality of the service; e) Carry out internal studies on consumption habits; f) Send to physical mail, email, cell phone or mobile device, via text messages (SMS and/or MMS) or through any other analog and/or digital means of communication created or to be created, commercial, advertising or promotional information about the products and/or services, events and/or promotions of a commercial or non-commercial nature, in order to promote, invite, direct, execute, inform and, in general, carry out campaigns, promotions or contests of a commercial or advertising nature, advanced by GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS and/or by third parties; g) Develop the selection, evaluation, and employment process; h) Support internal or external audit processes; i) Register the information of employees and/or pensioners (active and inactive) in the databases of GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS: i) Those indicated in the authorization granted by the owner of the data or described in the respective privacy notice, as the case may be; j) Regarding the data (i) collected directly by the company (ii) taken from the documents provided by people to the personnel in charge of the company. If a personal data is provided, said information will be used only for the purposes indicated here, and therefore, GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS will not proceed to sell, license, transmit, or disclose it, unless: (i) there is express authorization to do so; (ii) is necessary to allow contractors or agents to provide the services entrusted; (iii) is necessary in order to provide our services and/or products; (iv) it is necessary to disclose it to the entities that provide marketing services on behalf of GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS or to other entities with which they have joint market agreements; (v) that is required or permitted by law. GRUPO ÉLITE GESTIÓN GESTIÓN CONTABLE & FINANCIERA SAS may subcontract third parties for the processing of certain functions or information. When the processing of personal information is effectively subcontracted to third parties or personal information is provided to third party service providers, GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS warns said third parties about the need to protect said personal information with appropriate security measures, the use of use of the information for their own purposes and it is requested that personal information is not disclosed to others.

4. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA:

   The processing of personal data at GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS will be governed by the following principles: a) Principle of purpose: The treatment of personal data collected must obey a legitimate purpose, which must be informed to the Holder; b) Principle of freedom: Processing can only be carried out with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent; c) Principle of veracity or quality: The information subject to Processing must be truthful, complete, exact, up-to-date, verifiable and understandable. The Treatment of partial, incomplete, divided or misleading data will not be carried out; d)Principle of transparency: In the Treatment, the Holder's right to obtain from GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS at any time and without restrictions, information about the existence of data that concerns him must be guaranteed; e)Principle of access and restricted circulation: Treatment is subject to the limits derived from the nature of personal data, the provisions of this law and the Constitution. Personal data, except public information, and the provisions of the authorization granted by the owner of the data, may not be available on the Internet or other means of disclosure or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties; f) Principle of security: The information subject to Treatment by GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS must be protected through the use of technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access; g) Principle of confidentiality: All persons involved in the Processing of personal data are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks included in the Processing has ended. FIRST PARAGRAPH: In the event that sensitive personal data is collected, the Holder may refuse to authorize its Treatment.

5. RIGHTS OF HOLDERS OF PERSONAL DATA PROCESSED BY GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS .:

   The holders of personal data by themselves or through their representative and/or or agent or successor in title may exercise the following rights, with respect to the personal data that is subject to treatment by GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS: a) Right of access: By virtue of which you may access the personal data that is under the control of GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS, for the purpose of consulting them free of charge, the owners may consult the personal information that resides in the GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS database, who will provide them with all the information contained in the individual record or that is linked to the identification of the Holder. The query will be made by email to sac@grupoelitecontable.com, file in writing from Monday to Friday from 8:00 a.m. to 4:00 p.m. to the address Calle 53 # 83 C 61 Ofc 503 A, or call the telephone line of GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS, (57) 3205371531.

   The request, complaint or claim must contain the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to assert. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim. In the event that the person receiving the claim is not competent to resolve it, it will be transferred to the appropriate person within a maximum term of two (2) business days and the interested party will be informed of the situation. Once the complete claim is received, a legend will be included in the database that says "claim in process" and the reason for it, in a term not exceeding two (2) business days. Said legend must be kept until the claim is decided. The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished. b) Right of updating, rectification and deletion: By virtue of which you can request the updating, rectification and/or deletion of the personal data subject to treatment, in such a way that the purposes of the treatment are satisfied; c) Right to request proof of authorization: except in those events in which, according to current legal regulations, authorization is not required to carry out the treatment; d) Right to be informed regarding the use of personal data; e) Right to file complaints with the Superintendency of Industry and Commerce: for violations of the provisions of current regulations on the processing of personal data; f) Right to require compliance with the orders issued by the Superintendence of Industry and Commerce.

FIRST PARAGRAPH: For purposes of exercising the rights described above, both the owner and the person who represents him must prove his identity and, if applicable, the capacity by virtue of which he represents to the owner. SECOND PARAGRAPH: The rights of minors will be exercised through the persons who are empowered to represent them.

6. DUTY OF GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS:

   All those required to comply with this policy must bear in mind that GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS. is obliged to fulfill the duties that the law imposes in this regard. Consequently, the following obligations must be met: A. Duties when acting as controller: (i) Request and keep, under the conditions provided in this policy, a copy of the respective authorization granted by the owner. (ii) Clearly and sufficiently inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted. (iii) Inform at the request of the owner about the use given to their personal data (iv) Process queries and claims made in the terms indicated in this policy (v) Ensure that the principles of veracity, quality, security and confidentiality in the terms established in the following policy (vi) Keep the information under the necessary security conditions to prevent its adulteration , loss, consultation, use or unauthorized or fraudulent access. (vii) Update the information when necessary. (viii) Rectify personal data when appropriate. B. Duties when processing through a Processor. (i) Provide the person in charge of processing only the personal data whose processing is previously authorized. For purposes of the national or international transmission of data, a personal data transmission contract must be signed or contractual clauses agreed upon as established in article 25 of Decree 1377 of 2013. (ii) Guarantee that the information provided to the person in charge of the treatment is true, complete, accurate, updated, verifiable and understandable. (iii) Communicate in a timely manner to the Person in Charge of the treatment all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it is kept up to date. (iv) Inform the Person in Charge of the treatment in a timely manner of the rectifications made to the personal data so that he can proceed to make the pertinent adjustments. (v) Require the Data Processor, at all times, to respect the security and privacy conditions of the owner's information. (vi) Inform the Person in Charge of the treatment when certain information is under discussion by the owner, once the claim has been submitted and the respective procedure has not been completed. C. Duties with respect to the Superintendency of Industry and Commerce (i) Inform you of possible violations of security codes and the existence of risks in the administration of the information of the holders. (ii) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

7. REQUEST FOR AUTHORIZATION FROM THE HOLDER OF THE PERSONAL DATA:

   In advance and/or at the time of collecting the personal data, GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS will request the owner of the data authorization to carry out its collection and treatment, indicating the purpose for which the data is requested, using for these purposes automated, written or oral technical means, which allow proof of the authorization and/or the unequivocal conduct described in article 7 to be preserved. of Decree 1377 of 2013. Said authorization will be requested for the time that is reasonable and necessary to satisfy the needs that gave rise to the data request and, in any case, with observance of the legal provisions that govern the matter.

8. PRIVACY NOTICE:

   In the event that GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS cannot make this information treatment policy available to the owner of the personal data, it will publish the privacy notice that is attached to this document, the text of which will be kept for later consultation by the owner of the data and/or the Superintendency of Industry and Commerce.

9. TEMPORARY LIMITATIONS ON THE PROCESSING OF PERSONAL DATA. GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS

   may only collect, store, use or circulate personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the treatment, in accordance with the applicable provisions. to the matter in question and to the administrative, accounting, fiscal, legal and historical aspects of the information. Once the purpose or purposes of the treatment have been fulfilled and without prejudice to legal regulations that provide otherwise, it will proceed to the deletion of the personal data in its possession. Notwithstanding the foregoing, personal data must be kept when required to comply with a legal or contractual obligation.

10. RESPONSIBLE AREA AND PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF PERSONAL DATA HOLDERS: The ADMINISTRATIVE MANAGEMENT AREA of GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS

    will be responsible for handling requests , complaints and claims formulated by the owner of the data in exercise of the rights contemplated in numeral 5 of this policy, except for the one described in its literal e). For such purposes, the owner of the personal data or whoever exercises their representation may send their request, complaint or claim from Monday to Friday from 8:00 a.m. to 5:00 p.m. to the email sac@grupoelitecontable.com, call the telephone line of GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS, Cali telephone (57) 3205371531, or file it at the following address corresponding to our offices OFFICE ADDRESS Cali Calle 53 # 83 C61 Ofc 503 A. The request, complaint or claim must contain the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to assert. If the claim is incomplete, the interested party will be required within eight (8) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim. In the event that the person receiving the claim is not competent to resolve it, he or she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation. Once the complete claim is received, a legend will be included in the database that says "claim in process" and the reason for it, in a term not exceeding two (2) business days. Said legend must be kept until the claim is decided. The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

11. DATA COLLECTED BEFORE THE ISSUANCE OF DECREE 1377 OF 2013:

    In accordance with the provisions of number 3 of article 10 of Regulatory Decree 1377 of 2013 GRUPO ÉLITE GESTIÓN GESTIÓN CONTABLE & FINANCIERA SAS will proceed to publish a notice on its official website www.grupoelitecontable.com addressed to the holders of personal data for the purpose of publicizing this information treatment policy and the way to exercise their rights as holders of personal data housed in the GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS databases

12. SECURITY MEASURES:

    In development of the security principle established in Law 1581 of 2012, GRUPO ÉLITE GESTIÓN CONTABLE & FINANCIERA SAS will adopt the necessary technical, human and administrative measures to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. The personnel who carry out the processing of personal data will execute the established protocols in order to guarantee the security of the information.

13. DATE OF ENTRY INTO EFFECT:

    This Personal Data Policy was created on January 6, 2021 and is effective as of January 6, 2021 Any change that is presented regarding this policy, it will be reported through the email address: sac@grupoelitecontable.com