SHURA

1. IDENTIFICATION OF THE DATA CONTROLLER

In compliance with Law 1581 of 2012, Decree 1377 of 2013, and other applicable provisions concerning personal data protection, please be advised that the entity responsible for processing personal data is:

• Legal Name: SOLDEXEL S.A.S.
• Tax ID. 900.106.777-5
• Registered Office: Bogotá D.C, Colombia.
• Address: Avenida 1.ª de Mayo No. 27-50, Barrio Santander
• Website: www.soldexel.com
• PBX: (57-1) 756 1886
• Contact Emails by Stakeholder Group:
➢ Clients: ventas@soldexel.com
➢ Suppliers: compras@soldexel.com
➢ Employees: rhumanos@soldexel.com

2. INTRODUCTION

The purpose of this policy is to delineate the guidelines and directives governing the processing of personal data collected, stored, utilized, processed, transmitted, or erased by SOLDEXEL S.A.S., within the scope of its commercial, contractual, labor, and legal operations.
SOLDEXEL S.A.S., acting as the data controller, ensures the protection of data subjects' rights, in strict adherence to the principles stipulated in Colombian habeas data legislation. This policy is applicable to the personal data of:

• Current and potential clients
• Suppliers and contractors
• Employees and former employees
• Shareholders and partners
• Candidates for selection processes
• Website users
• Any third party who has provided personal information to the company

3. PRINCIPLES APPLICABLE TO DATA PROCESSING

The processing of personal data at SOLDEXEL S.A.S. is carried out in accordance with the
following principles:
• Legality: Data processing complies with current legislation.
• Purpose: Data is collected for legitimate, specific, explicit,
and informed purposes.
• Freedom: Data processing is only conducted with the prior, express, and
informed consent of the data subject.
• Accuracy or Quality: Information must be accurate, complete, updated,
verifiable, and understandable.
• Transparency: The data subject's right to know how their data is used is guaranteed at
any time.
• Restricted Access and Circulation: Only authorized personnel access data, adhering to
principles of necessity and confidentiality.
• Security: Administrative, technical, and human measures are implemented to protect
data.
• Confidentiality: All individuals involved in data processing are obligated to
ensure the privacy of the information.

4. PURPOSE OF DATA PROCESSING

Personal data will be processed solely for legitimate, contractual, employment,
commercial, administrative, and legal purposes, as applicable, including:
• Management of contractual, commercial, and employment relationships.
• Compliance with legal, regulatory, and contractual obligations.
• Recruitment, hiring, and human talent management processes.
• Institutional communication and dissemination of relevant information.
• Accounting, fiscal, and tax administration.
• Compliance with the provisions of the Business Transparency and Ethics Program,
and other corporate management systems.

Data processing activities include, among others, the collection, storage,
updating, use, circulation, transmission, and deletion of data.

4. SCOPE OF APPLICATION.

This policy applies to the processing of personal data carried out by SOLDEXEL S.A.S.,
regardless of the collection method (physical or digital), and pertains to all data subjects
with whom it maintains a contractual, commercial, employment, or any other type of relationship,
whose data is contained in its databases.

5. DATA SUBJECT AUTHORIZATION

SOLDEXEL S.A.S. may obtain authorization for the processing of personal data
through written, digital, or oral means, or through unequivocal actions by the data subject,
provided that these methods allow verification of consent and ensure it is prior, express, and
informed.
In all cases, the organization will ensure the traceability, preservation, and custody of
records evidencing consent, in accordance with the principles of transparency,
demonstrated accountability, and respect for the data subject's rights.

6. DATA TRANSMISSION AND TRANSFER TO THIRD PARTIES

Stored personal data may be shared with third parties, only
when:
• There is prior and express authorization from the data subject.
• It is necessary for the fulfillment of legal or contractual obligations.
• Processing is delegated to a third party under a contract that ensures adequate
conditions of security, confidentiality, and adherence to ethical principles.
In all cases, it will be verified that recipients comply with standards compatible with
this policy and the company's Business Transparency and Ethics Program.

7. CHANNELS FOR INQUIRIES AND COMPLAINTS

Data subjects may exercise their rights of access, updating, rectification, deletion, or
revocation of authorization through the following channels:

• Email: servicioalcliente@soldexel.com
• Phone: (57-1) 756 1886
• Address: Av. 1.º de Mayo No. 27-50, Bogotá D.C.

All requests will be addressed within the legal timeframes established by Law
1581 of 2012.

8. POLICY VALIDITY

This policy comes into effect on December 1, 2021, and will remain valid
as long as a legal or contractual relationship exists with the data subjects or as long as it is
necessary for the fulfillment of the described purposes. Any modifications will be
published promptly and communicated to interested parties.