Personal data processing policy

1. Legal framework and principles

In compliance with Article 15 of the Political Constitution; Law 1266 of 2008; Law 1581 of 2012; Regulatory Decrees 1727 of 2009 and 2952 of 2010; Partial Regulatory Decree 1377 of 2013; and Constitutional Court Decisions C-1011 of 2008 and C-748 of 2011, ZMR Colombia S.A.S. adopts this personal data processing policy. It will be made known to all data subjects whose data is collected now or in the future in the course of commercial or employment activities.

ZMR Colombia S.A.S. guarantees the rights to privacy, personal intimacy and reputation in the processing of personal data. Accordingly, all its actions will be governed by the principles of lawfulness, purpose limitation, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality.

Any person who, in the course of contractual, commercial, employment or other activities, whether permanent or occasional, provides ZMR Colombia S.A.S. with personal information or data may access, update, correct or request its deletion, provided no legal or contractual obligation prevents its removal from the company’s databases.

2. Processing and purposes

ZMR Colombia S.A.S. may collect, store, process, use, transmit or transfer personal data, as applicable, in strict compliance with the security and confidentiality duties established by Law 1581 of 2012 and Decree 1377 of 2013, for the following purposes:

1. Record personal data in the databases of ZMR Colombia S.A.S. to analyze, evaluate and generate statistics and indicators that support the proper development of the company and the maintenance of employment, commercial and civil relationships.
2. Support external and internal audit processes.
3. Respond to requests, complaints and appeals, including technical support, quotations, formal petitions and requests from oversight authorities.
4. Obtain information about the data subject held by credit reporting agencies or operators of financial, credit and commercial databases, including information from third countries referred to in Law 1266 of 2008.
5. Access and consult information about the data subject held in databases or files of any private or public entity, whether domestic, international or foreign.
6. Send information about programs, activities, news, content by area of interest, products and other goods or services offered by ZMR Colombia S.A.S.
7. Comply with rules applicable to suppliers and contractors, including tax and commercial regulations.
8. Manage human resources in compliance with Colombian law regarding employment, social security, payroll, employee benefits and occupational risk prevention, among other obligations applicable to former employees, current employees and job candidates.
9. Fulfill all contractual commitments.
10. Carry out accounting, tax and administrative management related to clients, collections, payments, invoicing and suppliers.
11. Record information related to the education, training and instruction of internal and external clients.
12. Perform commercial management for customer loyalty, marketing, opinion surveys and market segmentation.

3. Rights of the data subject

Under current data protection regulations, personal data subjects have the following rights:

1. Access, review, update and correct their personal data held by ZMR Colombia S.A.S. This right may be exercised, among other cases, in relation to partial, inaccurate, incomplete, fragmented or misleading data, or data whose processing is expressly prohibited or has not been authorized.
2. Request proof of the authorization granted to ZMR Colombia S.A.S. for the processing of their data.
3. Upon request, be informed by ZMR Colombia S.A.S. about how their personal data has been used.
4. File complaints with the Superintendence of Industry and Commerce, or the competent authority, for violations of Law 1581 of 2012 and any rules amending, supplementing or extending it, after completing the consultation or request procedure with ZMR Colombia S.A.S.
5. Revoke authorization or request deletion of data when processing does not respect constitutional and legal principles, rights and safeguards.
6. Access their processed personal data free of charge.

4. Authorization and consent of the data subject

ZMR Colombia S.A.S. will obtain authorization through different means, including physical or electronic documents, data messages, the Internet, websites or any other format that makes it possible to obtain consent from the data subject or a person legally authorized to provide it. Without authorization, the data will not be stored or captured in the databases. Authorization will be requested before personal data is processed.

ZMR Colombia S.A.S. will retain proof of the authorization granted by data subjects. It may maintain physical files or electronic repositories, managed directly or by third parties engaged for that purpose.

5. Data controller and processor

The communications department is responsible for processing personal data on behalf of ZMR Colombia S.A.S. To exercise your rights or submit a request, you may use the following channels:

• Contact person: Ligia Hernández
• Company name: ZMR Colombia S.A.S.
• Email: [email protected]
• Customer service: 01 8005 184350

Legal representative: Ernesto L. Cassab S.