PERSONAL DATA PROCESSING POLICY

INTRODUCTION

All individuals have the right to know, update, and rectify the information that has been collected about them in databases or files, and to exercise the other rights, freedoms, and constitutional guarantees referred to in Article 15 of the Political Constitution of Colombia; as well as the right to information enshrined in Article 20 of the same.

The National Government issued Statutory Law 1581 of 2012 and Regulatory Decree 1377 of 2013, which regulate the handling of personal databases and the fundamental right to habeas data.

DECLARATION OF THE PERSONAL DATA PROCESSING POLICY

INVERSIONES AGROAMBIENTALES H&R SAS

The company INVERSIONES AGROAMBIENTALES H&R S.A.S., committed to the privacy of the personal information of its clients, consumers, allies, suppliers, contractors, users, employees, and shareholders, and in compliance with the law, adopts this Personal Data Processing Policy (hereinafter the “Policy”).

  1. DEFINITIONS

  • Authorization: Prior, express, and informed consent from the Data Subject to carry out the processing of personal data.
  • Data Subject: Natural person whose personal data is subject to processing.
  • Privacy Notice: A verbal or written communication method provided by law to inform data subjects about the existence of the data processing policy, how to access it, and the purpose of collecting and using their data.
  • Database: An organized set of personal data subject to processing.
  • Personal Data: Any information linked to or that may be associated with one or more identified or identifiable natural persons.
  • Private Data: Data that, by its intimate or reserved nature, is only relevant to the data subject. For example, a person’s tastes or preferences are private data.
  • Public Data: A type of personal data considered public includes, among others, an individual’s marital status, profession or occupation, and their status as a merchant or public servant. Due to its nature, public data may appear in public records, public documents, official gazettes and bulletins, and judicial decisions duly executed and not subject to confidentiality.
  • Sensitive Data: Data that affects the data subject’s privacy or may lead to discrimination. This includes data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, union membership, membership in social or human rights organizations, health-related data, sexual life, and biometric data, among others.
  • Data Processor: A natural or legal person, public or private, who, alone or in association with others, carries out the processing of personal data on behalf of the Data Controller.
  • Data Controller: A natural or legal person, public or private, who, alone or in association with others, decides on the database and/or the processing of the data.
  • Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
  • Data Subject: The natural person whose personal data are subject to processing.
  • Natural Person: A human being who exercises rights and fulfills duties in a personal capacity.

  1. OBJECTIVE

The objective of this Policy is to define and establish the mandatory guidelines applicable to the processing of personal data collected, stored, and used by INVERSIONES AGROAMBIENTALES H&R S.A.S., in the development of its corporate purpose, in its capacity as the data controller and processor.

All the provisions contained in this Policy are established with the aim of guaranteeing each and every one of the rights of the Data Subjects and, in this way, preventing their rights and/or guarantees from being violated.

  1. SCOPE

This Policy applies to the processing of all Personal Data recorded in all Databases of INVERSIONES AGROAMBIENTALES H&R S.A.S., in all locations where the Company operates, and to any database created by the Company in the course of its activities.

All organizational processes of INVERSIONES AGROAMBIENTALES H&R S.A.S. that involve the processing of personal data must comply with the provisions of this Policy.

  1. OBLIGATIONS

This Policy is mandatory for INVERSIONES AGROAMBIENTALES H&R S.A.S., its management, employees, contractors, and third parties who work for or have a direct relationship with the Company.

  1. PERSONAL DATA PROCESSING POLICY OF INVERSIONES AGROAMBIENTALES H&R S.A.S.

 5.1 DATA CONTROLLER:

Company Name: INVERSIONES AGROAMBIENTALES H&R S.A.S.

Tax ID (NIT): 900.096.154 – 2

Legal Representative: Manager

Address: Calle 25G 74B – 50 – Tower 9, Apt. 944 – Bogotá

Email: gerencia@inversioneshr.com

Phone: 3133338244

5.2 PROCESSING OF PERSONAL DATA

In the exercise of its corporate purpose, INVERSIONES AGROAMBIENTALES H&R S.A.S. is the Data Controller of the personal data of its employees, suppliers, clients, and other service users.

In accordance with applicable legislation, INVERSIONES AGROAMBIENTALES H&R S.A.S. may be required to transmit or transfer data to platforms and/or security systems implemented by the Company, while complying with the principles of legality, purpose, and relevance.

5.3 Authorization for the Processing of Personal Data

Authorization for the processing of personal data is the consent granted by any individual allowing companies or persons responsible for processing to use their personal data.

INVERSIONES AGROAMBIENTALES H&R S.A.S., as the Data Controller, has adopted the necessary internal procedures to inform the Data Subject about the use of their data and to request proper authorization for its management.

The Personal Data included in the databases of INVERSIONES AGROAMBIENTALES H&R S.A.S. comes from information collected due to commercial, contractual, employment, or other relationships generated in the development of its corporate purpose.

The Personal Data collected by INVERSIONES AGROAMBIENTALES H&R S.A.S. is stored in physical and digital formats, either owned or contracted with specialized providers, ensuring the confidentiality and security of the Data Subjects’ personal information.

At the time of collecting Personal Data, INVERSIONES AGROAMBIENTALES H&R S.A.S. will request prior and express Authorization from the Data Subjects, informing them about:

    • The processing activities that INVERSIONES AGROAMBIENTALES H&R S.A.S. will carry out and their specific purposes.
    • The freedom to respond to questions directed at minors or concerning Sensitive Data.
    • The rights held by Data Subjects with respect to INVERSIONES AGROAMBIENTALES H&R S.A.S. and other data controllers or processors, and the means to exercise those rights.
    • The location of this Policy.

Authorization may also be granted through unequivocal conduct by the Data Subject that reasonably implies their consent to the processing of their information. Such conduct must clearly demonstrate the intention to authorize the processing. Consent may be obtained through any medium that allows for subsequent consultation, such as written, verbal, or digital communication.

INVERSIONES AGROAMBIENTALES H&R S.A.S. will retain adequate proof of such authorizations while safeguarding and respecting the principles of privacy and confidentiality.

When there is no prior and express authorization from the Data Subject, INVERSIONES AGROAMBIENTALES H&R S.A.S. must refrain from processing any Personal Data, except in the following cases, where authorization is not required:

    • Adoption of measures for the execution of a contract signed with the Data Subject.
    • Submission of information required by a judicial or administrative authority while exercising its duties.
    • Processing for historical, statistical, or scientific purposes.
    • Processing of Public Personal Data or data related to the civil registry of persons.

5.4 Privacy Notice

INVERSIONES AGROAMBIENTALES H&R S.A.S. has made the Privacy Notice available on the website https://www.agroambientales-hr.com, where Data Subjects can learn about the existence of this Personal Data Processing Policy and how to access it, as well as the purpose of data collection and usage.

This Privacy Notice will contain the following information:

    • The name or corporate name and contact details of the Data Controller.
    • The purpose of the data collection and the type of processing to which the data will be subjected.
    • The rights held by the Data Subject.
    • The mechanisms provided by the Data Controller so that the Data Subject can access the policy and any changes made to it or to the corresponding privacy notice.
    • An explanation of the sensitive nature of certain data such as racial or ethnic origin, sexual orientation, political or religious affiliation, etc., and the option to choose whether or not to provide such information.

  1. PURPOSE OF PERSONAL DATA PROCESSING
    6.1 Processing of Personal Data of Applicants and Employees (Payroll)

The Company will process the personal data of its workers as well as of those who apply for job openings, in three stages: before the start of the contractual relationship, during the execution of the contract, and after the employment relationship has ended.

6.1.1 Processing of Data Before Starting the Contractual Relationship

INVERSIONES AGROAMBIENTALES H&R S.A.S. will inform, clearly and in advance, individuals interested in participating in a selection process conducted by the company about the rules applicable to the processing of personal data they provide, as well as any data obtained during the selection process.

Once the selection process is concluded, the company will return to non-selected individuals the data provided and will delete from its databases the results of any tests and interviews, in compliance with the principle of purpose limitation.

When the selection process is outsourced to external companies or individuals, the contract signed must clearly specify how the third party is to handle the data and for what purposes the personal information of the Data Subjects is being provided.

6.1.2 Processing During the Execution of the Contract

INVERSIONES AGROAMBIENTALES H&R S.A.S. undertakes to store the personal data and information obtained through the selection process in a file labeled with the name of each worker.

These files, whether physical or digital, will be managed by the Human Resources department with the specific purpose of enabling the labor relationship.

Employee information will only be disclosed to third parties under the order of a competent authority; in any other case, disclosure of such personal data is prohibited.

6.1.3 After the Employment Relationship Ends

Once the employment relationship ends, regardless of the cause, INVERSIONES AGROAMBIENTALES H&R S.A.S. will archive the personal data obtained during the selection process and the documentation generated during the employment relationship in a secure file.

The collection, storage, use, circulation, and/or deletion of all personal data recorded in the databases of INVERSIONES AGROAMBIENTALES H&R S.A.S. may be used for activities inherent to the normal development of its business operations and to comply with current legislation regarding the retention of employment information.

6.1.4 Processing of Sensitive Data

INVERSIONES AGROAMBIENTALES H&R S.A.S. will strictly observe the legal limitations for the processing of sensitive data and will ensure that:

    1. The Data Subject has given explicit authorization for such processing, except in cases where such authorization is not legally required.
    2. The Processing is necessary to safeguard the vital interest of the Data Subject and the Data Subject is physically or legally incapacitated. In these cases, legal representatives must provide authorization.
    3. The Processing refers to data necessary for the recognition, exercise, or defense of a right in a judicial proceeding.
    4. The Processing has a historical, statistical, or scientific purpose. In such cases, measures must be taken to suppress the identity of the Data Subjects.

    5. INVERSIONES AGROAMBIENTALES H&R S.A.S. will not collect personal data related to:
      a) the employee’s sexual life;
      b) the employee’s political, religious, or other beliefs;
      c) the employee’s criminal record.

    6. The company will collect medical data in accordance with national legislation, medical confidentiality, and general principles of health and safety at work, and only when necessary to:
      a) determine whether the employee can perform a specific job;
      b) comply with occupational health and safety requirements;
      c) determine entitlement to and use of social benefits.

6.1.5 Video Surveillance

INVERSIONES AGROAMBIENTALES H&R S.A.S. uses a CCTV system in its offices to record and document activities related to its business operations. Under no circumstance will surveillance equipment be installed in areas related to personal privacy, such as restrooms or any other area where such installation would be an illegitimate intrusion that violates dignity and the right to privacy.

The information collected will be used for the safety of individuals, property, and facilities and may be used as evidence in any type of proceeding before any authority or organization.

Purposes of the Processing of Personal Data Collected and Managed by INVERSIONES AGROAMBIENTALES H&R S.A.S.:

6.2 Clients and Contractors

6.2.1 Carry out the necessary procedures for the development of the company’s corporate purpose in regard to the fulfillment of the contract signed with the Data Subject.

6.2.2 Send invitations to events and offer new products and/or services of INVERSIONES AGROAMBIENTALES H&R S.A.S.

6.2.3 Manage processes (requests, complaints, claims).

6.2.4 Contact the Data Subject through telephone, electronic, SMS, or chat channels to confirm the personal data needed to fulfill a contractual relationship.

6.2.5 Transfer personal data to comply with applicable anti-money laundering regulations.

6.2.6 Transmit personal data to third parties with whom INVERSIONES AGROAMBIENTALES H&R S.A.S. has signed a data processing agreement and where it is necessary for the fulfillment of the contractual purpose.

6.2.7 Carry out all necessary steps to confirm and update client or supplier information.

6.2.8 Establish, maintain, and terminate a contractual relationship.

6.2.9 Prevent money laundering, terrorism financing, and detect fraud, corruption, and other illegal activities.

6.2.10 Conduct, validate, authorize, or verify transactions, including, when required, the consultation and reproduction of Sensitive Data such as fingerprints, images, or voice, among others.

6.2.11 Respond to requests from judicial or administrative authorities, always ensuring that only the necessary and relevant information is disclosed to address the specific request.

6.2.12 Maintain constant communication with the Data Subject regarding the activities, programs, and events carried out or to be carried out by INVERSIONES AGROAMBIENTALES H&R S.A.S.

6.2.13 Manage inquiries, complaints, and claims submitted by Data Subjects in relation to the services offered by INVERSIONES AGROAMBIENTALES H&R S.A.S.

6.2.14 Process their Personal Data, including biometric data, which is classified as Sensitive Data, with or without the use of cloud computing or technological platforms, for the purposes described herein.

6.2.15 Conduct the process of selection and onboarding of suppliers, contractors, or partners of INVERSIONES AGROAMBIENTALES H&R S.A.S., by implementing internal procedures related to relationship management, accounting, finance, commercial, logistics, among others.

6.2.16 Manage and verify commercial and reputational background checks, and assess risks related to money laundering, terrorism financing, and proliferation of weapons of mass destruction, as well as to detect and/or prevent fraud, corruption, national and transnational bribery, and other illegal activities by the supplier, contractor, partners, or their employees in relation to the Company’s operations.

6.2.17 Comply with obligations arising from the commercial relationship, such as completing all necessary procedures with authorities, including: procedures related to the Integral Social Security System, the National Tax and Customs Directorate (DIAN), or any other activity required by applicable law.

6.2.18 Respond to inquiries, complaints, requests for updating, rectification or deletion of data, and revocation of authorization.

6.2.19 Facilitate the implementation of programs in compliance with legal mandates.

.6.2.20 Publish, document, and report, through photographic records, video or audio recordings, the programs, events, and training carried out by Inversiones Agroambientales H&R S.A.S. in fulfillment of its objectives and functions.

6.2.21 Ensure the safety and protection of company assets and employees.

  1. RIGHTS OF DATA SUBJECTS

In accordance with Article 8 of Law 1581 of 2012 and Decree 1377 of 2013, the Data Subject has the following rights:

7.1 Access free of charge the data provided and processed.

7.2 Know, update, and correct their information regarding partial, inaccurate, incomplete, fragmented data, or data that leads to error, or that is being processed without authorization or against the law.

7.3 Request proof of the authorization granted.

7.4 File complaints before the Superintendence of Industry and Commerce (SIC) for violations of current regulations.

7.5 Revoke the authorization and/or request the deletion of the data, provided there is no legal or contractual obligation that prevents their removal.

7.6 Refrain from answering questions regarding sensitive data. Responses to questions about sensitive data or about children and adolescents will be considered optional.

  1. HANDLING OF REQUESTS, INQUIRIES, AND CLAIMS

8.1 Office for Handling Inquiries, Requests, and Claims

The Administrative Management area is the department responsible for processing requests from Data Subjects to exercise their rights.

      • Company Name: Inversiones Agroambientales H&R S.A.S.
      • NIT (Tax ID): 900.096.154 – 2
      • Address: Calle 25G 74B – 50 – Torre 9 Apt. 944 – Bogotá
      • Email: gerencia@inversioneshr.com; administracion@agroambientales-hr.com
      • Phone: +57 313 333 8244 / +57 300 367 1198

8.2 Channels for Handling Inquiries, Requests, and Claims

Email: administracion@agroambientales-hr.com

8.3 Procedure for Handling Inquiries

The Data Subject may submit inquiries to the Company for the purpose of:

8.3.1 Knowing how their Personal Data is being used.

8.3.2 Requesting proof of the authorization granted to the Company.

8.3.3 Accessing their Personal Data stored in the Company’s systems.

    • Inquiries must be submitted with the subject line: “Exercise of the Right of Access or Inquiry.”
    • Submitted inquiries will be resolved by INVERSIONES AGROAMBIENTALES H&R S.A.S. within ten (10) business days from the date of receipt.
    • If the inquiry is incomplete, INVERSIONES AGROAMBIENTALES H&R S.A.S. will request that the Data Subject provide the missing information or documentation within five (5) business days of the communication.
    • If two (2) months pass from the date of the Company’s request without the Data Subject responding, it will be understood that they have withdrawn their inquiry.
    • The response time for inquiries may be extended by five (5) additional business days if the inquiry cannot be addressed within the initial period. In such case, the Company will notify the Data Subject of the delay.

8.4 Procedure for Handling Requests and Claims

The Data Subject may submit requests and claims to the Company for the purpose of:

8.4.1 Reporting improper processing of their Personal Data.

8.4.2 Correcting, updating, or requesting the deletion of their Personal Data.

8.4.3 Revoking the Authorization for the Processing of their Personal Data.

    • INVERSIONES AGROAMBIENTALES H&R S.A.S. will respond to requests and claims within fifteen (15) business days following receipt.
    • If the claim is incomplete, the Company will request the Data Subject to provide the missing information or documentation within five (5) business days following the communication.
    • If two (2) months pass from the date of the request without the Data Subject responding, the claim will be considered withdrawn.
    • The response time may be extended by eight (8) additional business days if the claim cannot be addressed within the initial period. The Company will notify the Data Subject of this delay.
    • If the Company is not competent to resolve the claim, it will forward it to the appropriate party within two (2) business days and inform the Data Subject of this.
    • It is important to note that the request to delete information and revoke the Authorization will not be valid when the Data Subject has a legal or contractual obligation with the Company.

 

  1. DATA RETENTION PERIOD

The Databases will be retained for the period necessary to fulfill the purpose for which processing was authorized, in accordance with applicable special regulations and laws governing the execution of the legal functions assigned to INVERSIONES AGROAMBIENTALES H&R S.A.S.

  1. VALIDITY AND MODIFICATION OF THE PERSONAL DATA PROCESSING POLICY

This Policy is effective as of its publication date, stated at the end of this document. This Policy may be modified at any time in order to adapt to legislative or jurisprudential developments, as well as to best practices concerning personal data protection.

If substantial changes are made to the Policy, such as those relating to the identity of the Data Controller or the purpose of processing, which could affect the contents of the authorization, the Data Controller will notify the Data Subject before or at the time of implementation through the website, where the updated version of the Policy and its effective date will be made available. Additionally, the Data Controller must obtain new authorization when the change relates to the purpose of processing.