COLOMBIA INDUSTRIAL & AUTOMOTRIZ S.A.S.

POLICY FOR THE PROCESSING OF PERSONAL DATA OF COLOMBIA INDUSTRIAL & AUTOMOTRIZ S.A.S

COLOMBIA INDUSTRIAL & AUTOMOTRIZ S.A.S. hereinafter CIALSA S.A.S., is a company committed to complying with the regulations regarding personal data. Therefore, it has established this document called PERSONAL DATA PROCESSING POLICY OF CIALSA S.A.S., which contains at a general level the rights that assist shareholders, customers, suppliers, employees, and any other natural person who has contact with CIALSA S.A.S., to guarantee the exercise of their rights as owners of private data, the treatment and the mechanisms to assert their rights in accordance with current regulations.

The objective of this document is to establish the necessary procedures for the handling of personal data contained in the databases of CIALSA S.A.S., whether digital or physical, which will be registered in the National Registry of Databases.

CIALSA S.A.S. guarantees the rights to privacy, intimacy, honor and good name, in the treatment of personal data that it collects, and consequently all its actions will be governed by the principles of legality, purpose, freedom, veracity or quality, transparency, access and restricted circulation, and security.

The Data Protection Policy of CIALSA S.A.S. It will be disclosed to all its employees, its appropriation will be ensured and it will be updated in accordance with organizational changes, legal provisions or other aspects that may affect what is described here. Likewise, it will be published in all the means of contact through which CIALSA S.A.S. collects personal data, guaranteeing that its stakeholders are clearly aware of the rights they have in relation to the processing of their information.

This policy details the following information:

1. Legal framework.

2. Guiding principles of personal data processing.

3. Scope of application.

4. Definitions of the personal data processing policy.

5. Consent for the processing of personal data.

6. Privacy notice.

7. Treatment of personal data.

8. Purpose for which the personal information of the holders is processed.

9. Rights of the holders.

10. Procedures for requests, complaints and/or claims.

11. Publication and validity of the policy.

12. Modifications of the Personal Data Protection Policy.

1. LEGAL FRAMEWORK
POLITICAL CONSTITUTION OF
COLOMBIA Art. 15 and Art. 20 that enshrines the Fundamental Right to Habeas data
LAW 1581 OF 2012 By which general provisions are issued for the
personal data protection
DECREE 1377 OF 2013
(See more) By which Law 1581 is partially regulated
of 2012
DECREE 886
OF 2014 By which article 25 of Law 1581N of 2012 is regulated, regarding the National Registry of Databases
2. GUIDING PRINCIPLES OF THE PROCESSING OF PERSONAL DATA

Within the legal and corporate commitment of CIALSA S.A.S. To guarantee the confidentiality of the personal information of its shareholders, clients, suppliers, employees, and any other natural person who has contact with CIALSA S.A.S., the following are established as general principles for the treatment of information, in development of those established in Law 1581 of 2012 and Regulatory Decree 1377 of 2013:

Principle of legality: There will be no processing of personal information without observing the rules established in the current regulations.

Principle of purpose: The incorporation of personal data into the physical or digital databases of CIALSA S.A.S. It must obey a legitimate purpose, which will be duly informed to the owner in the clause or format of authorization for treatment and in this policy.

Principle of freedom: CIALSA S.A.S. It will only process personal data when authorized to do so, under the terms of art. 3 literal a) of Law 1581 of 2012 and Chapter II of Decree 1377 of 2013.

Principle of veracity and quality: CIALSA S.A.S. It will tend because the information of the people is true and up-to-date, for which it will have efficient means for updating and rectifying personal data. Similarly, CIALSA S.A.S. will refrain from carrying out the treatment of the information when there are doubts about the quality or veracity of the same.

Principle of transparency: Within the mechanisms established for the exercise of the rights of the owners of personal information, the owner and his successors in title, as well as third parties authorized by him, will be guaranteed access to information on personal data that concerns him.

Principle of access and restricted circulation: CIALSA S.A.S. undertakes to guarantee that personal information can only be accessed by authorized persons, likewise its circulation will be limited to the exercise of the purposes authorized by the owner.

Security principle: CIALSA S.A.S. will advance all technical, administrative and human measures to guarantee that the personal information of the holders, stored in physical or digital databases, is not processed by unauthorized persons.

3. SCOPE OF APPLICATION

The principles and provisions contained in the PERSONAL DATA PROCESSING POLICY apply to the personal data registered in the databases on which CIALSA S.A.S. develop treatment or be responsible, under the terms of Law 1258 of 2012 and its regulatory decrees.

PERSONAL DATA PROCESSING POLICY apply to the personal data registered in the databases on which CIALSA S.A.S. develop treatment or be responsible, under the terms of Law 1258 of 2012 and its regulatory decrees.

4. DEFINITIONS OF THE PERSONAL DATA PROCESSING POLICY

For purposes of giving clarity and transparency to the reading of the PERSONAL DATA PROCESSING POLICY, the following definitions are developed:

a) Authorization: Prior, express and informed consent of the Owner to carry out the processing of personal data.

b) Database: Organized set of personal data that is subject to Treatment

c) Personal Data: Any information linked or that can be associated with one or several determined or determinable natural persons

d) Private Data: It is that which, due to its intimate or reserved nature, is only relevant to the owner.

e) Sensitive Data: This is information that affects the privacy of the Owner to carry out improper use and may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social or human rights organizations, or that promote the interests of any political party or that guarantee the rights and guarantees of parties, as well as data related to health, sexual life and biometric data. .

f) Data Processor: Natural or legal person, public or private, that by itself or in action with others, performs the processing of personal data on behalf of the Data Controller

g) Responsible for the Treatment: Natural or legal person, public or private that by itself or in association with others, decides on the database and/or Treatment of personal data.

h) Owner: Natural person whose personal data is processed

i) Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or suspension.

j) Privacy Notice: Physical, electronic document or in any other format generated by the Responsible, which is made available to the Holder for the processing of her personal data. In the Privacy Notice, the Owner is informed of the information regarding the existence of the personal data treatment policy that is applicable to him, the way to access them and the characteristics of the treatment that is intended to be given to personal data.

k) Public Data: It is the data that is not semi-private, private or sensitive, public data, among others, are considered those related to the marital status of people, their profession or trade and the quality of merchant or public servant. By nature, public data may be contained, among others, in public registries, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality.

l) Transmission: Treatment of personal data that implies the communication of the same inside or outside the territory of the Republic of Colombia when its purpose is to carry out a treatment by the person in charge, on behalf of the Responsible.

5. CONSENT AND/OR AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

The collection, storage, use, circulation or deletion of personal data by CIALSA S.A.S., requires the free, prior, express and informed consent of the owner thereof.

By virtue of this, the necessary mechanisms have been established to obtain the authorization of the owners, guaranteeing in any case that it is possible to verify the granting of said authorization.

For such purposes, CIALSA S.A.S., may use physical, electronic, audio, video or any other format that allows to guarantee the proof of said authorization, in accordance with the content of Law 1581 of 2012, and for those authorizations that cannot be obtained CIALSA S.A.S. will use the established

in article 10 of Decree 1377 of 2013, publishing these Personal Data Processing Policies in all its means of communication available to the public.

With the consented authorization procedure, it is guaranteed that the Owner of the personal data has been made aware of both the fact that their personal information will be collected and used for specific and known purposes, and that they have the option of knowing any alteration to them and the specific use that has been made of them. The foregoing in order for the Holder to make informed decisions in relation to his personal data and have control over the use made of his personal information.

In addition to the above, it must be taken into account that the consent of the owner of the information is a prerequisite for the constitutional legitimacy of the personal data administration processes, in the case of a qualified consent, since it must be prior, that is, the authorization must be provided at a stage prior to the treatment; express, to the extent that it must be unambiguous; and informed, since the owner must not only accept the processing of the data, but must also be fully aware of the effects of his authorization. In accordance with what has been indicated, to carry out the processing of personal data contained in CIALSA S.A.S. databases, the prior and express authorization of the owner of the information must be obtained. To guarantee the foregoing, when through any operation the data of natural persons is incorporated into the databases of CIALSA S.A.S., a clause or authorization form for the processing of personal data will be made available to the third party, which must contain at least the following:

a) The treatment to which the personal data will be submitted and the purpose thereof.

b) The indication that the answer to the questions is optional in the case of authorization for the processing of sensitive data or of children and adolescents.

c) The indication of the person responsible for the processing of the information, as well as his physical or electronic address.

d) The rights that assist the owner of the personal data.

When the prior and express authorization of the owner of the information is not available, CIALSA S.A.S. You must refrain from treating it, with the exception of the following events in which authorization will not be necessary:

a) Carry out the necessary measures for the execution of a contract that has been entered into with the owner.

b) Send information required by a public or administrative entity in the exercise of its legal functions or by court order.

c) Carry out information processing authorized by the Law for historical, statistical or scientific purposes.

d) Carry out data processing of a public nature, or those related to the civil registry of people.

6. PRIVACY NOTICE.

The privacy notice is the physical document, electronic or in any other format, which is made available to the Holder for the processing of her personal data. Through this document, the owner is informed of the information regarding the existence of the Information Treatment Policy that will be applicable to him, the way to access it and the characteristics of the treatment that is intended to be given to personal data.

The Privacy Notice must contain the following information:

a) The identity of the data controller

b) Address of the data controller

c) Contact details of the data controller

d) The type of treatment to which the data will be subjected and the purpose thereof

e) The general mechanisms arranged by the person in charge so that the owner is aware of the information treatment policy and the substantial changes that occur in it.

7. PROCESSING OF PERSONAL DATA.

CIALSA S.A.S., will carry out the Processing of personal data of its employees, employees of its contractors, suppliers, clients and any other natural person who has contact with CIALSA S.A.S. In development of the principles of purpose and freedom contemplated in the Law, the collection of personal data by CIALSA S.A.S. It will be limited to those personal data that are pertinent and adequate for the purpose for which they are collected or required in accordance with current regulations. Except in the cases expressly provided for in the Law, personal data may not be collected without the authorization of the Holder.

CIALSA S.A.S. has the obligation to maintain the confidentiality of the personal data subject to treatment and may only disclose them at the express request of the surveillance and control entities and authorities that have the legal power to request it and will allow at all times and free of charge to know, update and correct the personal information of the Holder.

Data processing includes collection, storage, administration, use, transfer, transmission and destruction, in the manner permitted by law and is carried out for the following specific purpose for each case:

a) PROCESSING OF PERSONAL DATA OF EMPLOYEES AND FORMER EMPLOYEES:

It is carried out to comply with the labor obligations in charge of CIALSA S.A.S., such as payroll payments, safety and health reports at work, payments and reports to the general social security system, granting benefits to the employee, attention to queries, requests, actions and claims, made by the owner of the information or by persons authorized by it or by Law, or by entities of the general social security system to which the owner is or has been linked. In the case of Former employees, the treatment is carried out in order to maintain contact for the requirement of a job performed, attending to contractual, legal or judicial needs.

b) PROCESSING OF PERSONAL DATA FOR ACCESS TO THE COMPANY FACILITIES:

The processing of this personal data is carried out for security purposes, control of entry and exit of visitors.

c) PROCESSING OF PERSONAL DATA OF EMPLOYEES OF CONTRACTORS PROVIDING SERVICES AT THE COMPANY’S FACILITIES:

The purpose of this treatment is to allow CIALSA S.A.S. comply with the contractual obligations under its responsibility, such as assignment and control of technological elements, materials and equipment in general, entrance and exit of the facilities, monitoring of compliance with obligations by contractors, attention to eventual emergencies, response to queries, petitions, requests, actions and claims, made by the owner of the information or legitimated persons.

d) TREATMENT OF PERSONAL DATA OF SUPPLIERS NATURAL PERSONS:

Allows the fulfillment of contractual obligations by CIALSA S.A.S., such as payment of fees, payment reports, reports or interactions that by law or internal policies have the obligation to carry out, attention to queries, petitions, requests, actions and claims, made by the owner of the information or its legitimaries.

e) TREATMENT OF PERSONAL DATA OF NATURAL PERSON CLIENTS:

The processing of personal data of clients who are natural persons, has the purpose that CIALSA S.A.S. can comply with the contractual obligations under its responsibility, such as billing, payment reports or interactions that by law or by internal policies it has the obligation to carry out, attention to queries, requests, requests, actions and claims, made by the owner of the information or its legitimate.

f) PROCESSING OF PERSONAL DATA OF SHAREHOLDERS, LEGAL REPRESENTATIVE, ADMINISTRATORS, NATURAL OR LEGAL PERSONS:

Its purpose is that CIALSA S.A.S. can comply with the contractual obligations under its responsibility, as well as comply with its asset laundering prevention system, identifying risk factors and financial health of the people who are part of the companies with which it has commercial relations.

8. PURPOSE FOR WHICH THE HOLDERS’ PERSONAL INFORMATION IS PROCESSED

CIALSA S.A.S. It will only collect the data that is necessary, pertinent and not excessive for the purposes authorized and informed to the owner and those indicated in this policy, provided that the treatment obeys a legitimate purpose and is proportional in accordance with the relationship maintained with the owner.

a) Treatment of personal data of shareholders.

The data and information of natural persons who have the status of shareholders (understood as holders of shares of the company CIALSA S.A.S.), will be considered confidential information, since it is registered in the trade books and is subject to special protection by legal provision. However, the information will be revealed in cases where the express authorization of the owner is obtained. The purposes for which the personal data of the shareholders will be used are the following: i. Allow the exercise of the rights derived from the quality of partner, making it easier for them to exercise the political and economic rights established in the Commercial Code, in Decree 2555 of 2010, and in the other regulations applicable to the matter; ii. Send information from CIALSA S.A.S., including invitations to events, newsletters (presentation of results), annual report, and those communications related to the activities carried out by CIALSA S.A.S.; iii. Issue certifications related to the relationship of the data owner with CIALSA S.A.S., such as certificates of income, participation, among others.

b) Treatment of personal data of employees.

The treatment of the personal data of the employees of CIALSA S.A.S., will be subject to the provisions of this policy, and may only be used in compliance with current labor regulations, for the correct development of the obligations derived from the labor contract entered into between the parties, or in events in which the express authorization of the owner is obtained. The purposes for which the personal data of employees will be used are the following: i. Allow the exercise of their rights as an employee, established in the Substantive Labor Code and in the other regulations applicable to the matter; ii. Send information from CIALSA S.A.S., including invitations to events, annual report, and those communications related to the activities carried out by CIALSA S.A.S.; iii. Issue certifications related to your status as an employee of CIALSA S.A.S., such as income and withholding certificates, labor records, among others; iv. Share information with providers with whom CIALSA S.A.S. develop activities in compliance with its corporate purpose, with the limitations and rules established by CIALSA S.A.S. The data supplied by those interested in vacancies at CIALSA S.A.S. and the personal information obtained from the selection process is limited to that related to your participation in it; therefore, its use for different purposes is prohibited.

9. RIGHTS OF HOLDERS.

The rights of the owners of the information are:

a) Know, update and rectify your personal data against CIALSA S.A.S. This right may be exercised, among others, against partial, inaccurate, incomplete, divided, misleading data, or those whose treatment is expressly prohibited or has not been authorized.

b) Request proof of authorization granted to CIALSA S.A.S. except when expressly excepted as a requirement for treatment.

c) Be informed by CIALSA S.A.S., upon request, regarding the use that has been given to your personal data

d) Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the treatment and there is no legal or contractual obligation.

e) Free access to your personal data that have been processed

f) Others indicated by current regulations.

10. PROCEDURES FOR REQUESTS, COMPLAINTS AND/OR CLAIMS

a) Petitions:

If the owner of the information wishes to know what type of information CIALSA S.A.S. Regarding his person, he must present the respective request, which must be resolved within a term of ten (10) business days from the date it was received. When it is not possible to comply with this time, the interested party must be informed, stating the reasons for the delay and the date on which the query will be addressed within a term of no more than five (5) business days following the expiration of the first term.

b) Claims and/or Complaints:

The owner who considers that the information contained in a database must be corrected, updated or deleted, or when he notices the alleged breach of any of the duties contained in the law or in this policy, may file a claim with CIALSA S.A.S. which will be processed under the following rules:

The Claim will be made by means of a written request addressed to CIALSA S.A.S., either to the website www.lubristone.com or to the email cial@internacional.lubristone.com.co or to the address Cra. 24 No. 13 – 93 – Municipality of Yumbo, Valle del Cauca, with the subject “CLAIM AND/OR COMPLAINT HABEAS DATA”. Said writing must contain: the name and identification of the holder, the description of the facts that give rise to the claim, the address and accompanying documents that he considers relevant.
If the claim is incomplete, CIALSA S.A.S. will require the interested party within five (5) business days following receipt thereof to correct the failures. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim.
Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database, within a term of no more than two (2) business days. Said legend must be maintained until the claim is decided.
The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.
11. PUBLICATION AND VALIDITY

12. MODIFICATIONS TO THE PERSONAL DATA PROTECTION POLICY

CIALSA S.A.S. reserves the right to modify the Personal Data Protection Policy in order to adapt it to new legal, jurisprudential, technical requirements, and in general, when necessary to provide a better service. Management is responsible for updating and disseminating the Personal Data Protection Policy. Any changes made to these must be approved by Management. On the other hand, each of the areas of CIALSA S.A.S. Anyone who has access to the personal data of third parties must be aware of this policy and is responsible for guaranteeing the exercise of the rights of the holders in relation to their information. The data controller is CIALSA S.A.S., a limited company, duly constituted in accordance with the Laws of the Republic of Colombia, domiciled in the city of Yumbo and headquarter located at Cra. 24 No. 13 – 93.

Email: cial@internacional.lubristone.com.co

COLOMBIA INDUSTRIAL & AUTOMOTRIZ S.A. DATABASE RESPONSIBLE S. – Legal Representative USERS: Leader of each process.
ADDRESS Cra. 24 No. 13 – 93
Yumbo – Valle del Cauca – Colombia
MAIL
EMAIL cial@internacional.lubristone.com.co

TELEPHONE 6024491470
PLATFORMS OF
PROCESSING OF PERSONAL DATA Microsoft office
Physical File

SYSTEM OF
SECURITY Antivirus
SECURITY MANAGER Manager

NOTICE ARTICLE 10 DECREE 1377 OF 2013

In order to comply with the provisions of Law 1581 of 2012 and article 10 of Decree 1377 of 2013, COLOMBIA INDUSTRIAL & AUTOMOTRIZS.A.S. hereinafter CIALSA S.A.S. domiciled at Carrera 24 No. 13 – 93 – Yumbo – Valle del Cauca – Colombia identified with Nit. 805011264-5; acting as Responsible for the Treatment of personal data, which have been collected through the different communication channels provided for the data of suppliers, employees and third parties with which CIALSA S.A.S. has or has had a commercial and/or employment relationship, informs all the people who are registered in our database, that:

Due to the impossibility of requesting individual consent, given that the data of the holders that rest in our files may be outdated or incomplete, or may be incorrect or inaccurate, we make use of the alternative mechanism enshrined in Article 10 of Decree 1377 of 2013 and stating that the personal data included in the CIALSA S.A.S. their purpose is the development of the corporate purpose of our company, the commercial relationship or the existing link.

Due to the above, CIALSA S.A.S. We cordially request your consent to give the appropriate treatment, with the purposes already described and explained explicitly in the Privacy Policy. If after thirty (30) days from the date of this communication you, as the owner of the personal data registered in our database, have not informed the email cial@internacional.lubristone.com.co of your desire for them to be deleted, CIALSA S.A.S. You can continue with its treatment and use in the terms of this notice. CIALSA S.A.S. respects the confidentiality and the right to habeas data of the people who, at any time, can access, know, modify, update, rectify or delete the information provided, as well as revoke the authorization granted for the treatment of the information. The exercise of your rights must be carried out in compliance with the requirements and formalities established in the current legal provisions, by filing a written communication at the Customer Service Office at Carrera 24 No. 13 – 93 – Yumbo – Valle del Cauca – Colombia.

For more information about our Privacy Policy, please visit the page www.lubristone.com and in the link of the Data Protection Law you will find the complete texts of the Policy for the Treatment of Personal Data, Authorization for the Treatment of Personal Data and the Privacy Notice.

Best regard,

COLOMBIA INDUSTRIAL & AUTOMOTRIZ S.A.S.

night 805011264-5