PERSONAL DATA PROCESSING POLICY OF AG COLOMBIA INCORP S.A.S.
I. PURPOSE
AG COLOMBIA INCORP S.A.S. (hereinafter AG INCORP) has adopted this Personal Data Processing Policy applicable to employees, partners, candidates, and third-party natural persons (hereinafter the “DATA SUBJECT”), for the purpose of defining the scope of any operation performed on personal data, such as the collection, storage, use, circulation, or deletion of information linked to, or capable of being linked to, one or more identified natural persons (hereinafter “PERSONAL INFORMATION”).
AG INCORP shall process Personal Information for the Purpose of Processing, as defined below, and in accordance with the principles and provisions set forth in the applicable legislation.
II. DEFINITIONS
FIRST. AUTHORIZATION. The prior, express, and informed consent granted by the DATA SUBJECT to AG INCORP to collect, store, use, and process their information for specific purposes.
SECOND. DATABASE. An organized set of Personal Data subject to Processing.
THIRD. PERSONAL DATA. Any information linked to, or capable of being associated with, one or more identified or identifiable natural persons.
FOURTH. PRIVATE DATA. Data that, due to its intimate or confidential nature, is relevant only to the DATA SUBJECT.
FIFTH. PUBLIC DATA. Data that is not semi-private, private, or sensitive. Public data includes information concerning a person’s civil status, profession or occupation, and their status as a merchant or public servant. Public data may be contained in public registries, public documents, official gazettes and bulletins, and final judicial rulings not subject to confidentiality restrictions.
SIXTH. SENSITIVE PERSONAL DATA. Data affecting the privacy of the DATA SUBJECT or whose improper use may give rise to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, or human rights organizations, or data promoting the interests of any political party or securing the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.
SEVENTH. DATA SUBJECT. The natural person whose personal data is subject to Processing.
EIGHTH. DATA PROCESSOR. The natural or legal person who processes personal data on behalf of the Data Controller.
NINTH. DATA CONTROLLER. The natural or legal person who, alone or jointly with others, decides on the database and/or the processing of the data.
TENTH. TRANSFER. A transfer of data occurs when the Data Controller and/or Data Processor, located in Colombia, sends the information or Personal Data to a recipient who, in turn, acts as a Data Controller and is located inside or outside the country.
ELEVENTH. TRANSMISSION. Processing of personal data involving the communication of such data within or outside the territory of the Republic of Colombia, where the purpose is for Processing to be carried out by the Data Processor on behalf of the Data Controller.
TWELFTH. PROCESSING. Operations performed on personal data, such as collection, storage, use, circulation, or deletion.
THIRTEENTH. PURPOSE OF DATA PROCESSING. The processing of collected data must serve a legitimate purpose, which must be disclosed to the DATA SUBJECT.
III. PRINCIPLES
AG INCORP shall process Personal Information in accordance with the following principles:
FIRST. PRINCIPLE OF AUTHORIZATION. Personal data may only be processed with the prior, express, and informed consent of the DATA SUBJECT.
SECOND. PRINCIPLE OF QUALITY. Recorded information must be truthful, complete, accurate, up to date, verifiable, and comprehensible. AG INCORP prohibits the use of partial, incomplete, or erroneous data that may be misleading or affect the privacy of the DATA SUBJECT.
THIRD. PRINCIPLE OF SECURITY. Information subject to Processing by AG INCORP shall be protected through such technical, human, and administrative measures as are necessary to secure the records, preventing their alteration, loss, or unauthorized or fraudulent consultation, use, or access.
FOURTH. PRINCIPLE OF TRANSPARENCY. Processing must guarantee the Data Subject’s right to obtain from AG INCORP, at any time and without restriction, information regarding the existence of data concerning them.
FIFTH. PRINCIPLE OF CONFIDENTIALITY. All persons involved in the Processing of Personal Data are obliged to maintain the confidentiality of the information, including after their relationship with any of the activities comprising the Processing has ended.
IV. COLLECTION OF PERSONAL INFORMATION
AG INCORP may collect the following categories of Personal Information:
FIRST. Employees and partners.
A) PERSONAL INFORMATION. Name (including any former name); photograph; contact information (address, telephone number, and email address); date and place of birth; gender; national ID (cédula de ciudadanía) number, professional license number (where applicable), and other government identification numbers; bank account number and other financial data; marital and family status; criminal record; personal and professional references; academic certificates; and the name, address, and telephone number of an emergency contact.
B) EMPLOYMENT INFORMATION. Information on previous employment; position or role; location; work address and telephone number; employment start and end dates; nature of employment (full-time or part-time); job performance; and information on professional training, certifications, and occupational competencies.
C) SENSITIVE INFORMATION. Medical and occupational health information; membership in trade unions or social organizations; socioeconomic status; racial or ethnic origin; information relating to work-related disabilities for benefits management purposes; and information relating to health status.
SECOND. Suppliers who are natural persons and/or their representatives who are natural persons
A) PERSONAL INFORMATION. Name; contact information (address, telephone number, and email address); national ID number; tax registration number (RUT); taxpayer identification number; bank account number and other banking and financial data; criminal record; and position held within the company where they work.
THIRD. Clients who are natural persons and/or their representatives who are natural persons
A) PERSONAL INFORMATION. Name; contact information (address, telephone number, and email address); national ID number; tax registration number (RUT); taxpayer identification number; bank account number and other banking and financial data; and criminal record.
V. PURPOSES OF PERSONAL INFORMATION PROCESSING
AG INCORP may use the Personal Information described above for the following purposes:
FIRST. Employees and partners
• Actions relating to the contractual relationship.
• Payroll and/or compensation management.
• Budget preparation.
• Management of social benefits and enrollment in the Occupational Health and Safety Management System (SST).
• Providing information to the competent judicial authorities upon their request.
• Verifying information contained in risk lists, whether restrictive or non-restrictive.
• Social welfare and recreational activities.
• Management, review, and assessment of performance and productivity, where applicable, and all other activities compatible with these purposes.
SECOND. Suppliers who are natural persons and/or their representatives who are natural persons
• Administration, management, performance, and execution of the contractual relationship with the supplier.
• Supplier account management, including compliance with legal requirements relating to commercial and accounting books, handling of invoicing and payment transactions, financial closings, management reporting, and, in general, internal account monitoring.
• Providing information to the competent authorities where such authorities so require in the exercise of their functions and legal powers, in compliance with a legal duty, or to protect the rights of AG INCORP.
• Management of invoicing, receivables, collections, and payments for services rendered.
• Verifying information contained in risk lists, whether restrictive or non-restrictive, and all other activities compatible with these purposes.
THIRD. Clients who are natural persons and/or their representatives who are natural persons
• Providing our services through the management and execution of the commercial relationship.
• Maintaining efficient communication regarding our services.
• Informing clients of changes to our products or services.
• Client account management, including compliance with legal requirements relating to commercial and accounting books, handling of invoicing and payment transactions, financial closings, management reporting, and, in general, internal account monitoring.
• Providing information to the competent authorities where such authorities so require in the exercise of their functions and legal powers.
• Verifying information contained in risk lists, whether restrictive or non-restrictive, and all other activities compatible with these purposes.
VI. SCREENING AGAINST RISK LISTS (RESTRICTIVE AND NON-RESTRICTIVE, BINDING AND NON-BINDING IN COLOMBIA)
Among the obligations established by law, AG INCORP must determine whether its employees, partners, their family members, or close associates qualify as Politically Exposed Persons (hereinafter “PEPs”).
Accordingly, AG INCORP is required to verify, request, and/or consult the Personal Information of Data Subjects against risk lists — restrictive and non-restrictive, binding and non-binding in Colombia — through any search resource, including but not limited to the platforms of the entities administering the Comprehensive Social Security System, the Judicial Authorities and the National Police, the Office of the Attorney General of the Nation (Procuraduría General de la Nación), the Office of the Comptroller General of the Republic (Contraloría General de la República), or any other lawfully established source of information, as well as through other search tools designed to verify current employment status, academic qualifications, and other information relevant to the purposes described above. AG INCORP shall carry out these activities directly or through its affiliates or strategic partners with whom it agrees to perform them. Likewise, AG INCORP may initiate the consultation process on the basis of the Data Subject’s Personal Information.
Additionally, and in accordance with the law, the Data Subject is hereby informed that, should any family member or close associate hold or subsequently acquire PEP status, the Data Subject must notify AG INCORP of such circumstance, providing the identifying details of that family member or close associate, including their full name, their relationship to the Data Subject, and the position they currently hold or held within the preceding two (2) years. Where the Firm must process Personal Data of third parties provided by the Data Subject, the Data Subject must have obtained the authorization of those persons for their Personal Information to be disclosed to AG INCORP and processed in accordance with this Processing Policy.
VII. ACCESS TO PERSONAL INFORMATION
Within AG INCORP, access to personal information is restricted to designated personnel and shall be used only in strictly necessary and legally permitted cases, or where required by the competent judicial authorities.
VIII. TRANSMISSION OF PERSONAL INFORMATION
AG INCORP may transmit Personal Data and Sensitive Personal Data to third parties, who shall carry out the processing on behalf of AG INCORP and in accordance with the Purpose of Processing set forth in this Policy. Such third parties shall act as Data Processors of the Personal Information, and the relationship shall be documented in a transmission agreement.
AG INCORP shall take the necessary measures to ensure that such recipients meet appropriate information security and protection requirements, and shall ensure that the Personal Information is duly protected in accordance with this Processing Policy and applicable legal provisions.
IX. RIGHTS OF DATA SUBJECTS
In accordance with Article 8 of Law 1581 of 2012, Data Subjects of Personal Data and Sensitive Personal Data have the following rights:
• To access, update, and rectify their Personal Data and Sensitive Personal Data held by Data Controllers or Data Processors. This right may be exercised, among other cases, with respect to data that is partial, inaccurate, incomplete, or fragmented, that is misleading, or whose Processing is expressly prohibited or has not been authorized.
• To request proof of the authorization granted to the Data Controller, except where such authorization is expressly exempted as a requirement for Processing.
• To be informed by the Data Controller or Data Processor, upon request, of the use made of their Personal Data and Sensitive Personal Data.
• To file complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) for breaches of the law governing the Processing of information.
• To revoke their authorization and/or request the deletion of their data where the Processing fails to respect constitutional and legal principles, rights, and guarantees. Such revocation and/or deletion shall proceed where the Superintendence of Industry and Commerce has determined that the Data Controller or Data Processor has engaged in conduct contrary to the law or the Constitution.
• To access, free of charge, the Personal Data and Sensitive Personal Data that has been subject to Processing.
X. PROCEDURE FOR EXERCISING RIGHTS
AG INCORP shall respond to any inquiry and/or complaint relating to personal information collected in its databases. To this end, the DATA SUBJECT must submit their petition, complaint, or claim in writing to the following address for legal notices: abogado@ag-incorp.com. Such submissions shall be answered within the time periods established by law.