Policy for the Treatment and Management of Personal Data

1. Regulatory Compliance and Purpose of the Data Processing Policy

This personal data processing policy (hereinafter, the “Policy”) establishes the guidelines governing GRANSORI S.A.S. (hereinafter, “GRANSORI” or the “Company”) and any other companies or entities that belong or may come to belong to the same controlling group and/or financial group as GRANSORI S.A.S., whether domiciled in Colombia or abroad, with respect to the collection, storage, use, circulation, transfer, deletion, and any other activities constituting the Processing of Personal Data, in accordance with Law 1581 of 2012, Regulatory Decree 1377 of 2013, and all other applicable personal data protection provisions.

This Policy sets out the general corporate guidelines adopted to protect the Personal Data of Data Subjects, including the purposes for which information is collected, Data Subjects’ rights, the department responsible for handling complaints and claims, and the procedures to be followed to access, update, rectify, and delete information.

In compliance with the constitutional right of habeas data, GRANSORI S.A.S. collects Personal Data only when previously authorized by the Data Subject and implements clear measures to safeguard the confidentiality and privacy of such Personal Data.

2. Scope

GRANSORI S.A.S., Tax Identification Number (NIT) 800027977-1, with its principal place of business in Funza, Cundinamarca, hereinafter referred to as GRANSORI S.A.S., acting as the Data Controller, recognizes the importance of the security, privacy, and confidentiality of the Personal Data of its employees, customers, suppliers, beneficiaries, and, in general, all stakeholders whose Personal Data it Processes. Accordingly, and in compliance with constitutional and legal requirements, the Company issues this document containing its policies for the Processing and protection of Personal Data in all activities involving the Processing of personal information in Colombia, as well as the international Processing of Personal Data in accordance with applicable laws, agreements, and international treaties.

3. Identification of the Personal Data Controller

Legal name: GRANSORI S.A.S.

Tax Identification Number (NIT): 800027977-1

Address: KM 7 VÍA LA VEGA–SIBERIA, PARQUE INDUSTRIAL CELTA TRADE PARK, WAREHOUSE 89-1

Email: info@gransori.com

Website: http://www.gransori.com/

Contact telephone: 3188041624

4. Definitions

Authorization: The Data Subject’s prior, express, and informed consent to the Processing of Personal Data.

Privacy Notice: A verbal or written communication issued by the Data Controller and addressed to the Data Subject concerning the Processing of Personal Data. It informs the Data Subject of the existence of the applicable data processing policies, how to access them, and the purposes for which the Personal Data will be Processed.

File: A set of data recorded as a single storage unit that contains Personal Data.

Database: An organized set of Personal Data subject to Processing.

Material Changes: Changes relating to the purpose of a Database, the Data Processor, Data Subject service channels, the categories or types of Personal Data stored in each Database, the implemented information-security measures, the data processing policy, and the transfer or transmission of a Personal Data Database, pursuant to Section 2.3 of Circular 002 of November 2015.

Customer: A natural person or legal entity that purchases GRANSORI S.A.S. products and/or services.

Personal Data: Any information linked or capable of being associated with one or more identified or identifiable natural persons.

Public Data: Data that are not semi-private, private, or sensitive. Public Data include, among others, information relating to a person’s marital status, profession or occupation, and status as a merchant or public servant. By their nature, Public Data may be contained in public records, public documents, official gazettes and bulletins, and final court judgments not subject to confidentiality restrictions.

Sensitive Data: Data that affect the Data Subject’s privacy or whose improper use may result in discrimination, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions, social or human-rights organizations, organizations promoting the interests of a political party, or organizations safeguarding the rights and guarantees of opposition political parties, as well as data concerning health, sex life, and biometric information.

Employee: A natural person employed by GRANSORI S.A.S.

Data Processor: A natural person or legal entity, whether public or private, that, alone or jointly with others, Processes Personal Data on behalf of the Data Controller. Where the Data Controller does not act as the Database’s Data Processor, the identity of the Data Processor shall be expressly stated.

Supplier: Any natural person or legal entity that supplies goods or services required by GRANSORI S.A.S. for its operations.

Data Controller: A natural person or legal entity, whether public or private, that, alone or jointly with others, makes decisions concerning a Database and/or the Processing of data.

Deletion: The action requested by the Data Subject from the Data Controller and/or Data Processor in the exercise of the Data Subject’s rights concerning freedom and purpose in relation to their information.

Data Subject: The natural person whose Personal Data are subject to Processing.

Processing: Any operation or set of operations performed on Personal Data, including collection, storage, use, circulation, or deletion.

Transfer: A data Transfer occurs when a Data Controller and/or Data Processor located in Colombia sends information or Personal Data to a recipient that is also a Data Controller and is located within or outside Colombia.

Transmission: The Processing of Personal Data involving their communication within or outside the territory of the Republic of Colombia for the purpose of Processing by a Data Processor on behalf of the Data Controller.

Visitor: Any person who enters GRANSORI S.A.S. facilities and has no employment or contractual relationship with the Company.

5. Processing

Acting as the Data Controller, GRANSORI S.A.S. collects, stores, uses, and circulates Personal Data for the proper conduct of its corporate purpose and the strengthening of its stakeholder relationships. Such Personal Data relate to natural persons with whom the Company has or has had a relationship, including employees, shareholders, customers, suppliers, creditors, and debtors.

6. Categories of Data Subjects

In carrying out its core activities, GRANSORI S.A.S. recognizes that it Processes the Personal Data of different categories of Data Subjects, understood as the natural persons to whom the Personal Data subject to Processing relate. These categories have been identified based on the activities that define GRANSORI S.A.S.’s operations, as follows:

a) Customers

Natural persons or legal entities that have a commercial relationship with GRANSORI S.A.S. or direct access to the services it provides in furtherance of its corporate purpose. The categories of data Processed include:

Identification data, including biometric data.

Private and business location data.

Financial and tax identification data.

b) Strategic Partners

Natural persons and/or legal entities whose particular business and interpersonal relationships help GRANSORI S.A.S. effectively reach its target audience and/or prospective customers. The categories of data Processed include:

Identification data, including biometric data.

Private and business location data.

Financial and tax identification data.

c) Suppliers

Natural persons or legal entities that provide personal or professional services in accordance with their capabilities and the needs of GRANSORI S.A.S. The categories of data Processed include:

Identification data, including biometric data.

Business location data.

Financial and tax identification data.

Socioeconomic data, including academic, employment, and professional background; information concerning affiliation with Colombia’s Comprehensive Social Security System; and tax identification data.

Other data, including criminal or disciplinary records.

d) Employees

Natural persons who enter into a formal contractual employment relationship and make their work capabilities available to GRANSORI S.A.S. These individuals actively participate in the Company’s core and support processes. The categories of data Processed include:

Identification data, including biometric information.

Private location data.

Socioeconomic data, including financial information, tax information, asset information, employment information, education level, and information relating to Colombia’s Comprehensive Social Security System.

Other data, including criminal or disciplinary records.

7. Purposes and Uses of Information

GRANSORI S.A.S. Processes Personal Data for the following purposes:

To send information to its customers, employees, suppliers, and strategic partners.

In the case of employees, to send information to pension funds, Health Promotion Entities (EPS), Family Compensation Funds, Occupational Risk Administrators (ARL), and other stakeholders that promote employee well-being and occupational health within the Company.

To recognize, protect, and enable the exercise of the rights of the Company’s shareholders.

To strengthen customer relationships by sending relevant information, invoices, and documentation relating to the provision of services, and by inviting customers to Company events, among other activities.

To ensure timely, high-quality supply relationships with suppliers by assessing their performance of their obligations and inviting them to Company events, among other activities.

To verify creditor balances.

To determine outstanding obligations, review financial information and credit history, and report defaulted obligations to credit-reporting agencies in relation to debtors.

To conduct marketing activities and pursue other commercial purposes that do not contravene applicable Colombian law.

To respond to judicial or administrative requests and comply with judicial or legal orders.

To conduct advertising and marketing campaigns.

To implement loyalty programs.

To conduct credit, collection, or credit-risk assessments.

To enter into commercial agreements and conduct events or institutional programs, either directly or jointly with third parties.

To verify data by consulting public Databases or credit bureaus.

To retain and manage the information provided.

To share information with related, controlled, or affiliated entities, or entities with which the Company has any type of relationship, for the delivery of commercial, advertising, or informational communications concerning the entity or any other product or service.

To share Database information with suppliers, financial institutions, and contractors generally.

To fulfill obligations arising from contractual relationships established with the Data Subject.

To issue invitations to events and offer new products and services.

To provide contact information to the sales force and/or distribution network, telemarketing teams, market-research providers, and any third party with which GRANSORI S.A.S. has a contractual relationship for activities of this nature, so that such activities may be performed.

To share and directly or indirectly carry out national or international Transmissions and/or Transfers of data to third countries when essential to the proper operation of the organization, the performance of collection activities, or the verification of commercial and financial information.

To use Personal Data collected through security checkpoints, security personnel, and video recordings made inside or outside GRANSORI S.A.S. facilities for commercial, security, and surveillance purposes; as evidence in judicial or administrative proceedings; and to support internal and external audit processes.

To contact, where appropriate, by email, WhatsApp, or any other electronic means or application, natural persons with whom the Company has or has had a relationship—including, without limitation, employees and their family members, shareholders, customers, suppliers, creditors, and debtors—for the purposes described above.

8. Rights of Personal Data Subjects

Natural persons whose Personal Data are Processed by the Company have the following rights, which may be exercised at any time:

a) To know which Personal Data the Company is Processing. The Data Subject may also request at any time that their Personal Data be updated or rectified, for example, when such data are partial, inaccurate, incomplete, fragmented, misleading, expressly prohibited from being Processed, or Processed without authorization.

b) To request proof of the authorization granted to the Company for the Processing of their Personal Data.

c) Upon request, to be informed by the Company of the use made of their Personal Data.

d) To file complaints with the Superintendence of Industry and Commerce concerning violations of the Personal Data Protection Law.

e) To request that the Company delete their Personal Data and/or revoke the authorization granted for their Processing by filing a claim in accordance with the procedures established in Section 12 of this Policy. However, deletion and revocation shall not apply when the Data Subject is under a legal or contractual obligation to remain in the Database and/or records, or while the relationship under which the Personal Data were collected remains in force.

f) To access, free of charge, their Personal Data subject to Processing.

In accordance with Article 20 of Decree 1377 of 2013, the foregoing rights may be exercised by:

The Data Subject, who must sufficiently prove their identity through the means made available by the Data Controller.

The Data Subject’s successors or heirs, who must prove their status as such.

The Data Subject’s representative and/or attorney-in-fact, upon proof of such representation or power of attorney.

A person acting under a stipulation for the benefit of another.

The rights of children and adolescents shall be exercised by the persons legally authorized to represent them.

9. Department Responsible for Implementing and Ensuring Compliance with this Policy

The Administrative Department is responsible for developing, implementing, providing training on, and ensuring compliance with this Policy. All employees or officers who Process Personal Data in the Company’s various departments must report such Databases to Operations Management and process any petition, complaint, or claim received from Personal Data Subjects.

The Company has also designated the Administrative Department as the area responsible for handling petitions, inquiries, complaints, and claims. Data Subjects may contact this department to exercise their rights to access, update, rectify, and delete their Personal Data and to revoke authorization.

In accordance with Article 17 of Law 1581 of 2012, the Data Controller shall have the following duties:

a) Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.

b) Request and retain, under the conditions established by law, a copy of the authorization granted by the Data Subject.

c) Properly inform the Data Subject of the purpose of the collection and the rights arising from the authorization granted.

d) Store information under the security conditions necessary to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.

e) Ensure that information provided to the Data Processor is truthful, complete, accurate, current, verifiable, and understandable.

f) Update the information by promptly informing the Data Processor of all changes to the data previously supplied and take any other measures necessary to keep the information current.

g) Rectify inaccurate information and notify the Data Processor accordingly.

h) Provide the Data Processor, as applicable, only with data whose Processing has been previously authorized in accordance with the law.

i) Require the Data Processor to respect the security and privacy conditions applicable to the Data Subject’s information at all times.

j) Process inquiries and claims within the time limits established by law.

l) Upon the Data Subject’s request, provide information regarding the use made of their Personal Data.

m) Notify the data-protection authority of breaches of security protocols and risks in the management of Data Subjects’ information.

n) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

10. Authorization

The Company must obtain prior, express, and informed authorization from Data Subjects before Processing their Personal Data.

a) Prior authorization

Consent must be granted by the Data Subject no later than the time at which the Personal Data are collected.

b) Express authorization

The Data Subject’s consent must be explicit and specific; open-ended or nonspecific authorizations are not valid. The Data Subject must express their intention to authorize the Company to Process their Personal Data.

The Data Subject may express this intention through various mechanisms made available by the Company, including:

In writing, for example, by completing an authorization form such as the one included in the appendix.

Orally, for example, during a telephone conversation or videoconference.

Through unequivocal conduct from which authorization may reasonably be inferred, for example, by expressly accepting the terms and conditions of an activity that require participants to authorize the Processing of their Personal Data.

IMPORTANT: Under no circumstances shall the Company interpret the Data Subject’s silence as unequivocal conduct.

Regardless of the mechanism used, the Company must retain the authorization so that it can be consulted at a later date.

c) Informed authorization

When requesting the Data Subject’s consent, the Company must clearly inform them of:

The Personal Data to be collected.

The identity and contact details of the Data Controller and the Data Processor.

The specific purposes of the proposed Processing—that is, how and why the Personal Data will be collected, used, and circulated.

Their rights as a Personal Data Subject; for this purpose, see Section 6 of this Policy.

The optional nature of answers to questions concerning Sensitive Data or the Personal Data of children and adolescents.

11. Special Provisions for the Processing of Sensitive Personal Data

Under the Personal Data Protection Law, Sensitive Data are data that affect privacy or whose improper use may result in discrimination, including data concerning:

a) Racial or ethnic origin.

b) Political opinions.

c) Religious or philosophical beliefs.

d) Membership in trade unions, social organizations, human-rights organizations, or political parties.

e) Health.

f) Sex life.

g) Biometric data, such as fingerprints, signatures, and photographs.

The Processing of Sensitive Personal Data is prohibited by law unless the Data Subject has given prior, express, and informed authorization, in accordance with Article 6 of Law 1581 of 2012 and Article 7 of Decree 1377 of 2013.

In such cases, in addition to satisfying the authorization requirements, the Company must:

Inform the Data Subject that, because the information is Sensitive Data, they are not required to authorize its Processing.

Inform the Data Subject which data to be Processed are sensitive and explain the purpose of the Processing.

IMPORTANT: Participation in or access to any activity may not be conditioned upon the Data Subject providing Sensitive Personal Data.

12. Special Provisions for the Processing of Personal Data of Children and Adolescents

In accordance with Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, the Company shall Process—that is, collect, store, use, circulate, and/or delete—the Personal Data of children and adolescents only when such Processing serves and respects their best interests and safeguards their fundamental rights.

Once these requirements have been met, the Company must obtain authorization from the child’s or adolescent’s legal representative, after allowing the minor to exercise their right to be heard. The minor’s opinion shall be assessed in light of their maturity, autonomy, and ability to understand the matter.

13. Procedure for Handling and Responding to Petitions, Inquiries, Complaints, and Claims from Personal Data Subjects

Data Subjects whose Personal Data are collected, stored, used, or circulated by the Company may exercise at any time their rights to access, update, rectify, and delete their information and to revoke their authorization.

The following procedure shall apply in accordance with the Personal Data Protection Law:

13.1 Handling and Responding to Petitions and Inquiries

What does the procedure involve?

The Data Subject or their successors or heirs may request from the Company, through the channels indicated below:

a) Information concerning the Data Subject’s Personal Data that are subject to Processing.

b) Proof of the authorization granted to the Company to Process their Personal Data.

c) Information concerning the Company’s use of their Personal Data.

Available channels for submitting petitions and inquiries:

The Company has established the following channels for receiving and handling petitions and inquiries, all of which allow the Company to retain evidence of the submission:

a) A communication addressed to the Administrative and Financial Process Department.

b) A request submitted by email to info@gransori.com.

Handling and response by the Company:

Petitions and inquiries shall be answered within no more than ten (10) business days from the date of receipt. If the petition or inquiry cannot be answered within this period, the interested party shall be informed of the reasons for the delay and the date on which it will be answered. This additional period may not exceed five (5) business days following the expiration of the initial period.

13.2 Handling and Responding to Complaints and Claims

What does the procedure involve?

The Data Subject or their successors or heirs may request the following from the Company by filing a complaint or claim through the channels indicated below:

a) Correction or updating of information.

b) Deletion of Personal Data or revocation of the authorization granted for their Processing. Deletion or revocation shall not apply when the Data Subject has a legal or contractual obligation toward GRANSORI S.A.S.

c) Remedy or correction of an alleged breach of any duty established by the Personal Data Protection Law.

The request must describe the facts giving rise to the complaint or claim, provide the requester’s address and contact information, and include any supporting documents on which the requester intends to rely.

Available channels for submitting complaints and claims:

The Company has established the following channels for receiving and handling complaints and claims, all of which allow the Company to retain evidence of their submission:

a) A communication addressed to the Administrative Department of GRANSORI S.A.S.

b) A request submitted by email to info@gransori.com.

Handling and response by the Company:

If a complaint or claim is incomplete, the Company shall request that the interested party remedy the deficiencies within five (5) days following receipt. If two (2) months elapse from the date of the request without the applicant submitting the required information, the complaint or claim shall be deemed withdrawn.

If the person receiving the complaint or claim is not competent to decide it, the matter shall be forwarded to GRANSORI S.A.S. Management within no more than two (2) business days, and the interested party shall be informed accordingly.

Once a complete complaint or claim has been received, the Database shall be marked “claim in process,” together with the reason for the claim, within no more than two (2) business days. This notation shall remain until the complaint or claim is decided.

The maximum period for responding to a complaint or claim shall be fifteen (15) business days, counted from the day following its receipt. If it cannot be addressed within that period, the interested party shall be informed of the reasons for the delay and the date on which it will be answered. This additional period may not exceed eight (8) business days following the expiration of the initial period.

14. Passively Collected Information

When users access or use services offered through the Company’s websites, the Company may passively collect information through information-management technologies such as cookies. Such technologies may collect information regarding the device’s hardware and software, IP address, browser type, operating system, domain name, access time, and referring website addresses. These tools do not directly collect users’ Personal Data. The Company may also collect information about the pages most frequently visited on its websites to understand browsing habits. However, users may configure cookie settings using the options available in their internet browser.

15. Personal Data Security

In strict application of the security principle governing the Processing of Personal Data, the Company shall implement the technical, human, and administrative measures necessary to safeguard records and prevent their alteration, loss, unauthorized or fraudulent consultation, use, or access. The Company’s obligation and responsibility are limited to providing suitable means for this purpose. The Company does not guarantee the absolute security of information and shall not be liable for consequences arising from technical failures or unauthorized access by third parties to any Database or file containing Personal Data Processed by the Company or its Data Processors. The Company shall require contracted service providers to adopt and comply with appropriate technical, human, and administrative measures to protect Personal Data in relation to which they act as Data Processors.

16. Transfer, Transmission, and Disclosure of Personal Data

The Company may disclose Personal Data to unrelated third parties when: a) such third parties are contractors performing agreements related to the Company’s activities; or b) the information is transferred, under any legal basis, as part of the transfer of a business line to which the information relates.

In all cases, agreements for the Transmission of Personal Data entered into between the Company and Data Processors shall require the information to be Processed in accordance with this Policy and shall impose the following obligations on the relevant Data Processor:

a) To Process Personal Data on behalf of the Company in accordance with the principles governing such data.

b) To safeguard the security of Databases containing Personal Data.

c) To maintain the confidentiality of the Processing of Personal Data.

17. Relevant Aspects of the Data Processing Policy

Whenever Personal Data are provided by a third party, that third party must have the Data Subject’s authorization to share the information with the Company or otherwise be legally authorized to do so.

When a Data Subject requests information—through a petition, inquiry, or claim—concerning how their Personal Data are used, the Company shall provide such information.

The policies established by the Company and any other companies or entities that belong or may come to belong to the same controlling group and/or financial group, whether domiciled in Colombia or abroad, shall take effect upon publication. They may be amended at any time to reflect future legislative or judicial developments and industry practices. All amendments shall comply with applicable law and shall take effect upon publication through the mechanisms established by the Company to enable Data Subjects to review the Policy and any changes made to it.

The Company shall apply its data Processing policies with greater rigor when Processing the Personal Data of children and adolescents, ensuring the protection of their fundamental rights. Their best interests and the precedence of their rights shall also be taken into consideration.

The Company shall exchange Personal Data with government or public authorities—including tax authorities, investigative bodies, and judicial authorities—when requested in the exercise of their official functions.

Personal Data subject to Processing shall be handled using all necessary human and technical safeguards to protect them and ensure that they cannot be copied, altered, deleted, accessed, or otherwise used without authorization or for fraudulent purposes.