-ASESORES CIRUGIA MEDELLIN SAS –

Company Name: ASESORES CIRUGIA MEDELLIN SAS

Tax ID (NIT): 901083634-3

Address: CARRERA 80 a 32 ee 29

City: Medellín

Phone: 314 893 1353

Email: facturacionvirtual.acm@gmail.com

Website: https://asesorescirugiasmedellin.com/

Below, in compliance with Law 1581 of 2012, ASESORES CIRUGIA MEDELLÍN SAS hereby discloses its personal data processing policy under the following terms:

FIRST: LEGAL REGULATIONS AND SCOPE OF APPLICATION: This Personal Data Processing Policy is prepared in accordance with the provisions of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013, and other complementary provisions, and will be applied by ASESORES CIRUGIA MEDELLÍN SAS regarding the collection, storage, use, circulation, deletion, and all activities that constitute the processing of personal data.

SECOND: DEFINITIONS: For the purposes of executing this policy and in accordance with legal regulations, the following definitions shall apply: a) Authorization: Prior, express, and informed consent of the Data Subject to carry out the Processing of personal data; b) Privacy Notice: Physical, electronic, or any other format document generated by the Data Controller that is made available to the Data Subject for the processing of their personal data. In the Privacy Notice, information regarding the existence of the information processing policies that will apply to them, how to access them, and the purpose of the intended processing of personal data is communicated to the Data Subject; c) Database: Organized set of personal data that is subject to Processing; d) Personal data: Any information linked or that can be associated with one or more specific or determinable natural persons; e) Public data: Data classified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private, or sensitive. Public data includes, among others, data relating to civil status, profession or trade, status as a merchant or public servant, and data that can be obtained without any restriction. By their nature, public data may be contained, among others, in public records, public documents, official gazettes, and bulletins; f) Private data: Data which, due to its intimate or confidential nature, is only relevant to the owner; g) Sensitive data: Sensitive data is understood as that which affects the privacy of the Data Subject or whose misuse may generate discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data; h) Data Processor: Natural or legal person, public or private, that by itself or in association with others, processes personal data on behalf of the Data Controller; i) Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Processing of data; j) Data Subject: Natural person whose personal data is subject to Processing; k) Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

THIRD: PURPOSE OF PERSONAL DATA COLLECTION AND PROCESSING: ASESORES CIRUGIA MEDELLÍN SAS may use personal data to: a) Execute the existing contractual relationship with its clients, suppliers, and employees, including the payment of contractual obligations; b) Provide the services required by its users; c) Inform about new products or services and/or changes to them; d) Evaluate service quality; e) Send commercial, advertising, or promotional information about products, events, and/or promotions (commercial or non-commercial) via physical mail, email, mobile phone, SMS/MMS, or any other analogous and/or digital communication channel created or to be created, in order to promote, invite, direct, execute, inform, and generally carry out commercial or advertising campaigns or promotions conducted by ASESORES CIRUGIA MEDELLÍN SAS and/or third parties; f) Conduct selection, evaluation, and hiring processes; g) Support internal or external audit processes; h) Register employee and/or pensioner information (active and inactive) in the databases of ASESORES CIRUGIA MEDELLÍN SAS; i) Those indicated in the authorization granted by the data subject or described in the respective privacy notice, as applicable; j) Supply, share, send, or deliver personal data to subsidiaries, affiliates, or subordinate companies of ASESORES CIRUGIA MEDELLÍN SAS located in Colombia or any other country in the event that such companies require the information for the purposes indicated herein.

Regarding data (i) collected directly at security or entrance checkpoints of ASESORES CIRUGIA MEDELLÍN SAS, (ii) taken from documents provided by individuals to security or entrance personnel, and (iii) obtained from video recordings made inside or outside the facilities of ASESORES CIRUGIA MEDELLÍN SAS, these will be used for the security of people, assets, and facilities of ASESORES CIRUGIA MEDELLÍN SAS and may be used as evidence in any type of proceeding.

If personal data is provided, such information will be used only for the purposes indicated herein; therefore, ASESORES CIRUGIA MEDELLÍN SAS will not sell, license, transmit, or disclose it, unless: (i) there is express authorization to do so; (ii) it is necessary to allow contractors or agents to perform entrusted services; (iii) it is necessary to provide our services and/or products; (iv) disclosure is necessary to entities providing marketing services on behalf of ASESORES CIRUGIA MEDELLÍN SAS or other entities with which joint marketing agreements exist; (v) the information relates to a merger, consolidation, acquisition, divestiture, or other corporate restructuring process; (vi) it is required or permitted by law.

ASESORES CIRUGIA MEDELLÍN SAS may subcontract third parties to process certain functions or information. When third-party processing of personal information is subcontracted or personal information is provided to third-party service providers, ASESORES CIRUGIA MEDELLÍN SAS advises such third parties of the need to protect personal information with appropriate security measures, prohibits the use of information for their own purposes, and requests that personal information not be disclosed to others.

FOURTH: PRINCIPLES APPLICABLE TO PERSONAL DATA PROCESSING: Personal data processing at ASESORES CIRUGIA MEDELLÍN SAS shall be governed by the following principles: a) Purpose Principle: The Processing of collected personal data must obey a legitimate purpose, which must be communicated to the Data Subject; b) Freedom Principle: Processing can only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent; c) Truthfulness or Quality Principle: The information subject to Processing must be truthful, complete, exact, updated, verifiable, and understandable. Processing of partial, incomplete, fragmented, or misleading data shall not be carried out; d) Transparency Principle: Processing must guarantee the right of the Data Subject to obtain information from ASESORES CIRUGIA MEDELLÍN SAS at any time and without restriction regarding the existence of data concerning them; e) Restricted Access and Circulation Principle: Derived from the nature of personal data, the provisions of Law 1581 of 2012, and the Constitution.

Personal data, except public information and as provided in the authorization granted by the data subject, may not be available on the Internet or other mass media, unless access is technically controllable to provide restricted access only to Data Subjects or authorized third parties; f) Security Principle: Information subject to Processing by ASESORES CIRUGIA MEDELLÍN SAS must be protected through technical, human, and administrative measures necessary to safeguard records against tampering, loss, unauthorized or fraudulent consultation, use, or access; g) Confidentiality Principle: All persons involved in Personal Data Processing are obligated to guarantee the confidentiality of information, even after their relationship with any of the processing tasks has ended. Note: In the event sensitive personal data is collected, the Data Subject may refuse to authorize its Processing.

FIFTH: RIGHTS OF PERSONAL DATA SUBJECTS SUBJECT TO PROCESSING BY ASESORES CIRUGIA MEDELLÍN SAS: Data subjects, directly or through their representative, attorney-in-fact, or legal successor, may exercise the following rights regarding personal data processed by ASESORES CIRUGIA MEDELLÍN SAS: a) Right of Access: By virtue of which they may access their personal data under the control of ASESORES CIRUGIA MEDELLÍN SAS, to consult it free of charge at least once per calendar month, and whenever there are substantial changes to the Information Processing Policies that prompt new inquiries; b) Right of Updating, Rectification, and Deletion: By virtue of which they may request the updating, rectification, and/or deletion of processed personal data so that the processing purposes are satisfied; c) Right to Request Proof of Authorization: Except in events where, under current legal norms, authorization is not required for processing; d) Right to be Informed regarding the use of personal data; e) Right to File Complaints with the Superintendency of Industry and Commerce: for violations of current personal data processing regulations; f) Right to Require Compliance with orders issued by the Superintendency of Industry and Commerce. FIRST PARAGRAPH: For the purpose of exercising the rights described above, both the subject and their representative must prove their identity and, if applicable, the capacity under which they represent the subject. SECOND PARAGRAPH: The rights of minors shall be exercised through persons authorized to represent them.

SIXTH: DUTIES OF ASESORES CIRUGIA MEDELLÍN SAS: All those obligated to comply with this policy must keep in mind that ASESORES CIRUGIA MEDELLÍN SAS is obligated to fulfill the duties imposed by law in this regard. Consequently, the following obligations must be met: A. Duties when acting as Data Controller: (i) Request and retain, under the conditions provided in this policy, a copy of the respective authorization granted by the data subject. (ii) Clearly and sufficiently inform the data subject about the purpose of collection and the rights assisting them by virtue of the granted authorization. (iii) Inform the data subject upon request about the use given to their personal data. (iv) Process inquiries and claims submitted under the terms set forth in this policy. (v) Ensure the principles of truthfulness, quality, security, and confidentiality under the terms established in the policy. (vi) Retain information under the security conditions necessary to prevent its tampering, loss, unauthorized or fraudulent consultation, use, or access. (vii) Update information when necessary. (viii) Rectify personal data when appropriate. B. Duties when acting as Data Processor. If processing data on behalf of another entity or organization (data controller), it must comply with the following duties: (i) Establish that the Data Controller is authorized to supply the personal data to be processed as Processor. (ii) Guarantee the data subject, at all times, full and effective exercise of the right to habeas data. (iii) Retain information under the necessary security conditions to prevent its tampering, loss, unauthorized or fraudulent consultation, use, or access. (iv) Timely perform the updating, rectification, or deletion of data. (v) Update information reported by data controllers within five (5) business days from receipt. (vi) Process inquiries and claims submitted by data subjects under the terms set forth in this policy. (vii) Register in the database the legend “claim in process” as established in this policy. (ix) Insert in the database the legend “information under judicial dispute” once notified by the competent authority regarding judicial proceedings related to personal data quality. (x) Refrain from circulating information being contested by the data subject and whose blocking has been ordered by the Superintendency of Industry and Commerce. (xi) Allow access to information only to persons authorized by the data subject or empowered by law for such purpose. (xii) Inform the Superintendency of Industry and Commerce when security code violations occur and risks exist in managing data subjects’ information. (xiii) Comply with instructions and requirements issued by the Superintendency of Industry and Commerce. C. Duties when processing through a Processor: (i) Supply to the Data Processor only personal data whose processing has been previously authorized. For national or international data transmission, a personal data transmission contract must be executed or contractual clauses agreed upon pursuant to Article 25 of Decree 1377 of 2013. (ii) Ensure that information provided to the Data Processor is truthful, complete, exact, updated, verifiable, and understandable. (iii) Timely communicate to the Data Processor all updates regarding previously supplied data and adopt all necessary measures to keep provided information updated. (iv) Timely inform the Data Processor of rectifications made to personal data so that the Processor may make relevant adjustments. (v) Require the Data Processor at all times to respect the security and privacy conditions of the data subject’s information. (vi) Inform the Data Processor when specific information is under dispute by the data subject once a claim has been filed and the procedure has not concluded. D. Duties regarding the Superintendency of Industry and Commerce: (i) Report eventual security code violations and the existence of risks in managing data subjects’ information. (ii) Comply with instructions and requirements issued by the Superintendency of Industry and Commerce.

SEVENTH: AUTHORIZATION REQUEST TO THE PERSONAL DATA SUBJECT: Prior to and/or at the time of personal data collection, ASESORES CIRUGIA MEDELLÍN SAS will request the data subject’s authorization for collection and processing, indicating the purpose for which the data is requested, using automated technical, written, or oral means that allow retaining proof of authorization and/or unambiguous conduct described in Article 7 of Decree 1377 of 2013. Said authorization will be requested for a period that is reasonable and necessary to satisfy the needs that gave rise to the data request, and in any case, observing applicable legal provisions.

EIGHTH: PRIVACY NOTICE: In the event that ASESORES CIRUGIA MEDELLÍN SAS cannot make this Information Processing Policy available to the data subject, it will publish the privacy notice attached to this document, the text of which it will retain for subsequent consultation by the data subject and/or the Superintendency of Industry and Commerce.

NINTH: TEMPORAL LIMITATIONS ON PERSONAL DATA PROCESSING. ASESORES CIRUGIA MEDELLÍN SAS may only collect, store, use, or circulate personal data for as long as is reasonable and necessary, according to the purposes that justified processing, adhering to applicable provisions and administrative, accounting, tax, legal, and historical aspects of information. Once processing purpose(s) are fulfilled, and without prejudice to legal norms dictating otherwise, it will proceed with deleting personal data in its possession. Notwithstanding the foregoing, personal data must be retained when required to comply with a legal or contractual obligation.

TENTH: RESPONSIBLE AREA AND PROCEDURE FOR EXERCISING THE RIGHTS OF PERSONAL DATA SUBJECTS: The Manager of ASESORES CIRUGIA MEDELLÍN SAS will be responsible for handling requests, complaints, and claims submitted by data subjects exercising their rights outlined in section 5 of this policy, except for item e). For these purposes, the data subject or their representative may send their request, complaint, or claim Monday through Friday from 8:00 a.m. to 5:00 p.m. to the email address facturacionvirtual.acm@gmail.com, call the telephone line of ASESORES CIRUGIA MEDELLÍN SAS, or submit it in person at CARRERA 80 a 32 ee 29 Medellín.

The request, complaint, or claim must contain the identification of the Data Subject, a description of the facts giving rise to the claim, address, and accompanying documents to be relied upon. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the flaws. After two (2) months from the date of request without the applicant presenting the required information, it will be understood that the claim has been abandoned. If the person receiving the claim is not competent to resolve it, they will transfer it to the appropriate party within a maximum period of two (2) business days and inform the interested party. Once the complete claim is received, a legend stating “claim in process” and the reason for it will be included in the database within no more than two (2) business days. This legend must be maintained until the claim is decided. The maximum timeframe to address the claim will be fifteen (15) business days counting from the day following receipt. When it is not possible to address the claim within said timeframe, the interested party will be informed of the reasons for delay and the date when their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

ELEVENTH: DATA COLLECTED PRIOR TO THE ISSUANCE OF DECREE 1377 OF 2013: In accordance with Article 10, paragraph 3 of Regulatory Decree 1377 of 2013, ASESORES CIRUGIA MEDELLÍN SAS will proceed to publish a notice on its official website https://asesorescirugiasmedellin.com/ addressed to personal data subjects in order to announce this information processing policy and how to exercise their rights as data subjects stored in the databases of ASESORES CIRUGIA MEDELLÍN SAS.

TWELVETH: SECURITY MEASURES: In development of the security principle established in Law 1581 of 2012, ASESORES CIRUGIA MEDELLÍN SAS will adopt technical, human, and administrative measures

THIRTEENTH: EFFECTIVE DATE: This Personal Data Policy was created on August 8, 2024. Any changes regarding this policy will be communicated through the website: https://asesorescirugiasmedellin.com/

Sincerely,

MIGUEL ANGEL BUILES QUINTERO

LEGAL REPRESENTATIVE

ASESORES CIRUGIA MEDELLÍN SAS

LOCATION: CARRERA 80 a 32 ee 29 Medellín.