PERSONAL DATA PROCESSING POLICY

ALTURES ASESORES S.A.S.

I. INTRODUCTION

This Personal Data Processing Policy (the “Policy”) of Altures Asesores S.A.S., identified by Tax ID No. 901-917-636 and with its principal place of business in Bogotá, D.C. (“Altures”) establishes the guidelines, principles, purposes, rights, procedures, and security measures applicable to the processing of personal data collected and/or managed by Altures, in compliance with the Political Constitution of Colombia, Law 1581 of 2012, Decree 1074 of 2015, and other complementary regulations; as well as any laws that may amend or replace them.
This Policy applies to the personal data of individuals processed by Altures in the course of its business activities, including, but not limited to, customers, prospective customers, business partners, suppliers, affiliates, employees, former employees, job applicants, and visitors, with respect to whom Altures acts as the data controller or data processor.
By providing personal data to Altures, the data subject declares that he or she has read and accepted this Policy and gives prior, express, and informed consent to the processing of such data in accordance with the terms set forth herein.
For all purposes, Altures acts as the Data Controller, in accordance with Article 3 of Law 1581 of 2012.

II. DEFINITIONS

For the purposes of this Policy, the definitions set forth in Law 1581 of 2012 and Decree 1074 of 2015, among others, are adopted, including the following:

Authorization. Prior, express, and informed consent from the Data Subject for the processing of their personal data.
Database. An organized set of personal data that is subject to processing.
Personal Information. Any information that is linked to or can be associated with one or more specific or identifiable individuals.
Sensitive Data. Information that affects the data subject’s privacy or whose misuse could lead to discrimination, including health data, biometric data, political views, religious beliefs, sexual life, and gender identity, among others.
Data Controller. A natural or legal person who processes personal data on behalf of the Data Controller.
Data Controller. Altures, as the legal entity that makes decisions regarding the database and/or the processing of personal data.
Headline: A natural person whose personal data is being processed.
Treatment. Any operation involving personal data, such as collection, storage, use, dissemination, deletion, transmission, or transfer.

III. CONFIDENTIALITY

Every member of the Altures team who is involved in the processing of personal data is required to maintain confidentiality regarding such information, even after their employment with Altures has ended.
Confidentiality will be strictly enforced, given the confidential, sensitive, and strategic nature of the information handled by a law firm.

IV. RIGHTS OF DATA SUBJECTS

In accordance with the provisions of Article 8 of Law 1581 of 2012, the Data Subject has the following rights:

To access, review, update, and correct your personal data held by Altures when it is partial, inaccurate, incomplete, or misleading.
To be informed, upon request, of how Altures has used your personal data.
To revoke consent and/or request the deletion of personal data when the applicable constitutional and legal principles, rights, and safeguards are not respected.
Access, free of charge, the personal data that has been processed.

V. PURPOSES OF PERSONAL DATA COLLECTION

Altures will process the personal data of individuals who contact it through its website, email, events, meetings, professional networks, or other similar channels for the following purposes:

1. Prospects and potential customers.

Manage the registry and respond to requests for information about the legal services offered by Altures.
Establish contacts and conduct pre-contractual follow-up, including coordinating meetings, calls, and video conferences, and sending service proposals.
Assess the feasibility of potentially providing legal services, including conflict-of-interest reviews, identity verification, and compliance analysis.
Send informational or institutional communications related to Altures' services, practice areas, publications, or academic or professional events.
Handle requests, complaints, claims, and inquiries related to personal data protection.
To comply with legal, regulatory, and reporting obligations to the relevant authorities.
When necessary, personal data may be shared with third parties that provide professional or administrative support services to Altures, exclusively for the purposes described and subject to confidentiality obligations.

2. Customers.

With respect to Data Subjects who enter into a contractual relationship with Altures, personal data will be processed for the following purposes:

To formalize, execute, and manage the contractual relationship for the provision of legal services.
Draft, review, negotiate, and maintain legal documents, legal opinions, legal memoranda, contracts, studies, briefs, and other materials typical of professional practice.
Represent and assist the client in judicial, administrative, contractual, or out-of-court proceedings.
Manage fees, billing, payments, certifications, and accounting records.
To respond to requests, inquiries, instructions, and communications arising from the attorney–client relationship.
To comply with the legal, accounting, tax, regulatory, and professional obligations applicable to Altures.

3. Counterparties, third parties, and professional partners.

Altures will process the personal data of counterparties, third parties, and partners for the following purposes:

Handle legal, contractual, negotiation, and representation matters in connection with the cases entrusted to them by their clients.
Verify identity, authority, capacity, and legal representation.
To comply with legal, regulatory, and professional obligations arising from the practice of law.
Comply with requests from competent judicial or administrative authorities.

4. Suppliers, contractors, and external consultants.

The personal data of suppliers, contractors, and consultants will be processed for the following purposes:

Manage the selection, evaluation, and award processes, as well as the execution of contracts for services, supplies, or similar arrangements.
Verify identity, professional qualifications, and compliance with legal and contractual requirements.
Process payments, invoicing, tax reports, and certifications.
To comply with legal obligations, internal control requirements, audit requirements, and requests from authorities.

5. Job applicants, employees, and former employees.

Altures will process the personal data of candidates, employees, and former employees for the following purposes:

Manage recruitment, evaluation, and onboarding processes.
Establish and administer the employment relationship, including payroll administration, employee benefits, social security, and other benefits.
Manage occupational safety and health.
Manage processes related to performance, training, professional development, discipline, and termination of employment.
Manage physical and logical access to facilities and information systems.
Respond to requests from authorities and comply with legal, labor, tax, and record-keeping obligations.
Issue employment certificates and maintain contact with former employees when appropriate.

VI. PROCESSING OF PERSONAL DATA

1. Authorization.

Altures will process only the Personal Data that the Data Subject voluntarily provides. Personal Data may be used by Altures, its employees, consultants, advisors, business partners, and strategic allies who require access to this information.
In any case, upon request by the Data Subject, Altures will provide complete information regarding the individuals who process the Data Subject’s Personal Data.
The data subject’s consent will not be required in the following cases: (i) data of a public nature; (ii) medical or health emergencies; (iii) processing of information authorized by law for historical, statistical, or scientific purposes; or (iv) data related to individuals’ civil registration records.

2. Processing of Sensitive Data.

Altures may collect and process Sensitive Data in the following cases:

When the Data Subject has given his or her explicit and voluntary consent for specific purposes;
If the processing is necessary to comply with legal obligations;
If the processing is necessary to protect the vital interests of the data subject or those of another natural person;
If the processing is necessary for the establishment, exercise, or defense of legal claims, or when judges or courts are acting in the exercise of their judicial functions; or
If the processing is required by law.
Sensitive Data will be handled with the utmost care and in accordance with the highest security standards.
Limited access to Sensitive Data will be a guiding principle for safeguarding the privacy of such data; therefore, only authorized personnel will be granted access to this type of information.

VII. TRANSFER AND ASSIGNMENT

Personal Data for which Altures acts as the Data Controller may be transferred or transmitted both within and outside the territory of the Republic of Colombia.
In the event that your data is transferred or transmitted outside the territory of the Republic of Colombia, such transfers will only be made to countries that provide an adequate level of protection for personal data, in accordance with the provisions of the Superintendency of Industry and Commerce.
Transfer transactions will be conducted in accordance with the provisions of Article 26 of Law 1581 of 2012 and Title V of the Single Circular of the Superintendency of Industry and Commerce.
Transfers and Disclosures will be carried out by Altures for the purpose of providing Personal Data to partners, third parties authorized by the Data Subject, and contractors.
Transfers or disclosures, as applicable, will be made for the same purposes described in this Policy, or when required by law or ordered by a competent authority.
To protect Personal Data that is subject to transfers or transmissions, Altures takes reasonable measures to ensure that third parties to whom it transfers or transmits Personal Data operate under policies and procedures that protect the personal data of Data Subjects.

VIII. PROCEDURE FOR ENFORCING RIGHTS

1. Inquiries.

The Data Subject may at any time submit inquiries regarding the Personal Data stored in Altures’ databases; such inquiries will be addressed within a maximum of ten (10) business days from the date of receipt. If it is not possible to respond to the inquiry within that timeframe, the data subject will be notified, stating the reasons for the delay and specifying the date by which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial timeframe.

2. Complaints.

The Data Subject has the right to submit requests when he or she believes that his or her data should be corrected, updated, or deleted, or when he or she becomes aware of an alleged breach of any of the obligations of the Data Controllers.
All requests will be addressed within a maximum of fifteen (15) business days, starting from the day following the date of receipt. If it is not possible to address the complaint within that timeframe, Altures will inform the interested party of the reasons for the delay and the date by which the complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial timeframe.
To file and follow up on your inquiries or complaints, please contact us by email at: administración@altures.co .

IX. CHANGES TO THE DATA PROCESSING POLICY

Altures reserves the right to modify this Data Processing Policy in order to adapt it to new legal, jurisprudential, or technical requirements, and, in general, whenever necessary to provide better service.