Personal data processing policy

Overview

// 1.1

Considerations

Through Law 1581 of 2012, the Colombian National Government issued the General Regime for the Protection of Personal Data, establishing that every institution must guarantee the full exercise of the right to habeas data.

As data controller of personal data, NGDS S.A.S. guarantees to data subjects that their processing will be subject to this data protection policy, developed in harmony with the regulations established for that purpose.

Overview

// 1.2

Purpose

The purpose of this PTD (Personal Data Processing Policy) is to fully comply with what is set out in section k) of article 17 of Law 1581 of 2012, which refers to the adoption of an internal manual of policies and procedures to guarantee proper handling of complaints or inquiries and the appropriate processing of information in accordance with the purposes established for it, as set out in this PTD.

Likewise, NGDS S.A.S. developed this PTD with the purpose of ensuring the preservation and confidentiality of information belonging to data subjects subject to special levels of protection or care, in accordance with article 15 of the National Constitution, Law 23 of 1981, Decree 1377 of 2013, and Decree 1995 of 1999, and following the guidelines of Law 23 of 1981 and other applicable regulations.

Our information processing policy defines, among other things, the principles we will follow when collecting, storing, and using data subjects' personal data, which translates into acting responsibly when collecting personal information and protecting privacy, and guaranteeing the confidentiality of sensitive information as established by law.

Overview

// 1.3

Scope

This PTD applies solely and exclusively to the processing of personal data currently held by NGDS S.A.S. and to data subsequently collected in compliance with the legal requirements set out by law for obtaining personal data from third parties.

This PTD applies to all databases and files that contain personal data and that are processed by NGDS S.A.S., acting as data controller or data processor.

Overview

// 1.4

Definitions

For a complete understanding of this PTD, below are the definitions included in article 3 of Law 1581 of 2012 and its implementing Decree 1377 of 2013, which must be taken into account both by data subjects and by NGDS S.A.S.:

Authorization

The express manifestation by which you consent to NGDS S.A.S. processing your data, in accordance with the principles and purposes described in this data processing policy.

Data subject

The natural person who authorizes us to process their data.

Processing

Any operation or set of operations we carry out with your data. Processing can range from the collection, storage, use, circulation, or deletion of your data.

Database

An organized set of personal data subject to processing. This term also applies to our physical and electronic files.

Personal data

Any information that identifies you or that, combined with other information, could allow you to be identified. Data is classified as public, private, semi-private, and sensitive.

Public personal data

Data of general interest that, as a rule, is contained in public documents, public records, and duly executed court rulings not subject to restriction. Your public data may include, among others, your name, ID, marital status, and profession or occupation.

Private personal data

Information that concerns only you as the data subject, and that is of an intimate, reserved nature.

Semi-private personal data

Private data that, in certain situations, could be of interest to a specific group of people. Information regarding compliance or non-compliance with financial obligations is, among others, semi-private.

Sensitive personal data

Information that affects privacy and whose misuse could lead to discrimination, such as information revealing racial or ethnic origin, political affiliation, religious or philosophical beliefs, membership in unions, social or human-rights organizations, or organizations that promote the interests of any political party or that guarantee the rights of opposition political parties, as well as data related to health, sexual life, and biometric data (fingerprints, photographs, DNA, among others).

Special data

Refers to the processing of information of children and adolescents, and to the processing of sensitive data.

Data controller

The person who decides on, among other things, the collection and purposes of processing. NGDS S.A.S. is the data controller for the information held in its databases, in particular the data of its clients, employees, and suppliers.

Data processor

The person who processes data on behalf of the data controller.

Transmission

Processing of personal data that involves communicating it within Colombia (domestic transmission) or outside Colombia (international transmission), for the purpose of its processing by the data processor, on behalf of the data controller.

Transfer

Sending of personal data by the data controller or data processor from Colombia to a data controller located within Colombia (domestic transfer) or outside the country (international transfer).

Overview

// 1.5

Data processing principles

The principles listed below are the basic parameters to be followed and fully respected by NGDS S.A.S. in its data processing activities, particularly regarding the storage, use, and processing of such data.

Legality

We will always process your data in accordance with legal provisions.

Purpose

We will never process your information beyond the purposes set out by law and those you have authorized.

Freedom

We will always request your consent before processing your information.

Accuracy / quality

Information subject to processing must be truthful, complete, accurate, up to date, verifiable, and understandable. Processing of partial, incomplete, fragmented, or misleading data is prohibited.

Transparency

You may always request information about your personal data from us.

Restricted access and circulation

Your data may only be processed in accordance with your authorization, whether by people directly linked to our company or by authorized third parties. Except for public information, your personal data will not be available on the Internet or other mass communication channels, unless access can be technically restricted to you or authorized third parties only.

Security

Our company handles your data with the technical, human, and administrative measures necessary to provide security to records, preventing their alteration, loss, unauthorized or fraudulent consultation, use, or access.

Confidentiality

Everyone involved in processing your personal data that is not public in nature guarantees the confidentiality of your information, even after their relationship with any activity involved in the processing has ended.

Overview

// 1.6

Personal data we collect

The personal data of data subjects collected across our different services may include, but is not limited to:

• Full first and last names.
• Type and number of identification document (birth certificate, ID card, citizenship card, passport, foreign ID card, and diplomatic ID).
• Place and date of birth, nationality.
• Age, sex, marital status, languages spoken, and religious beliefs.
• Education level, profession, and occupation.
• Home address, email address, landline, mobile, and fax numbers.
• Employer, its location, and its contact details.
• Patient clinical information, including personal, family, and epidemiological history, diagnostic test results, consultations, medications received, diagnoses, medical assessments, healthcare team notes, surgical procedures, etc.
• Contact details of family members, guardians, or legal representatives.
• Personal habits.
• Your health-benefit plan administrator (EPS, ARL, supplementary care plans, prepaid medicine, health insurance policy, etc.).
• Use of our services.
• Personal information obtained while handling your requests or complaints.
• Personal information provided through surveys or other institutional instruments.

Data processing

// 2

General purposes of processing

The information provided by the data subject to NGDS S.A.S. is required to collect, gather, store, use, circulate, delete, process, compile, exchange, update, and make available — with or without the aid of information technology — within the limits and for the purposes set out in this Policy, and in general to:

• Properly provide the services offered by NGDS S.A.S.
• Be contacted for renewals, product and service offerings, and to be informed of and invited to different benefits or events.
• Send commercial, promotional information, invitations, or courtesies from NGDS S.A.S. and its partner companies.
• Conduct surveys and/or opinion polls about products and content.
• Carry out market segmentation and consumption and preference analysis.
• Evaluate the quality of products and services.
• Respond to, manage, and follow up on improvement requests, petitions, and suggestions.

Data processing

// 2

Specific purposes according to your relationship with NGDS

In addition to the general purposes, there are specific purposes depending on the type of relationship each person has with NGDS S.A.S.

Authorizations

// 3

Prior, express, and informed authorization

In accordance with Law 1581 of 2012 and its implementing Decree 1377 of 2013, the use, collection, and storage of personal data by NGDS S.A.S. must be backed by the data subject's authorization, expressing their prior, express, and informed consent for NGDS S.A.S. to process their personal data. However, NGDS S.A.S. will apply what is set out in article 10 of Decree 1377 of 2013, which refers to data collected before June 27, 2013.

When requesting authorization from the Data Subject, NGDS S.A.S. clearly and expressly informs them of the following:

• The processing to which the personal data will be subject and its purpose.
• The optional nature of the answers to questions asked, when these relate to sensitive data or to the data of children and adolescents.
• The rights available to them as Data Subject.
• The identification, email address, and phone number of the Data Controller.
• How to revoke the authorization and/or request deletion of the data.

Authorizations

// 3.1

Cases where authorization is not required

NGDS S.A.S. requires the data subject's prior, express, and informed authorization to process personal data, except in the following cases authorized by Law 1581 of 2012:

1. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
2. Data of a public nature.
3. Processing of information authorized by law for historical, statistical, or scientific purposes.
4. Data related to the Civil Registry.

Authorizations

// 3.2

Authorization to process sensitive data

Regarding the authorization required to process sensitive personal data, when such processing is permitted, NGDS S.A.S. must comply with the following obligations:

• Inform the data subject that, because the data is sensitive, they are not obligated to authorize its processing.
• Inform the data subject explicitly and in advance — in addition to the general authorization requirements for collecting any type of personal data — which of the data to be processed is sensitive and the purpose of the processing, and obtain their express consent.
• No activity may be made conditional on the data subject providing sensitive personal data.

In compliance with current personal data protection regulations, the processing of sensitive data is prohibited within the Institution, except when:

• The Data Subject has given their explicit authorization for such processing, except in cases where the law does not require such authorization.
• Processing is necessary to safeguard the vital interest of the Data Subject and the Data Subject is physically or legally incapacitated. In these cases, legal representatives must provide the authorization.
• Processing is carried out in the course of the legitimate activities and with the appropriate safeguards of a foundation, NGO, association, or any other non-profit organization, whose purpose is political, philosophical, religious, or union-related, provided that it refers exclusively to its members or to persons who maintain regular contact for reasons related to its purpose. In these cases, the data may not be provided to third parties without the Data Subject's authorization.
• The processing relates to data necessary for the recognition, exercise, or defense of a right in judicial proceedings.
• Processing has a historical, statistical, or scientific purpose. In this case, measures must be adopted to suppress the identity of the Data Subjects.

Authorizations

// 3.3 – 3.5

Means, evidence, and privacy notice

Means for obtaining and granting authorization. In order to comply with Law 1581 of 2012, NGDS S.A.S. will obtain, prior to processing personal data, the authorization of data subjects or those legally entitled to grant it, through different mechanisms such as: an authorization form for the collection and processing of personal data, email, website, data message, Intranet, or any other mechanism that unequivocally shows that authorization was granted.

Proof of authorization. Respecting the rights of data subjects, NGDS S.A.S. will implement all suitable mechanisms to allow data subjects access to evidence confirming the authorization granted for the processing of their personal data.

Privacy notice. The privacy notice is the physical or electronic document made available to the data subject, informing them of the existence of the information processing policies that will apply to their personal data, how to access them, and the type of processing that will be carried out.

Rights

// 4

Rights of data subjects

In accordance with this PTD and the regulatory framework that supports it, the data subjects whose data NGDS S.A.S. processes have the following rights:

1. Know the information subject to protection.
2. Update and correct information whenever its inaccuracy could lead to error.
3. Request from NGDS S.A.S. proof of authorization for processing personal data, except when expressly exempted as a requirement for Processing, in accordance with article 10 of Statutory Law 1581 of 2012.
4. Be informed by NGDS S.A.S., upon request, about the use given to their personal data.
5. File complaints with the Superintendency of Industry and Commerce for possible violations by NGDS S.A.S. of the legal provisions protecting the processing of personal data.
6. Request the revocation of such authorization if the Superintendency of Industry and Commerce determines that the entity does not meet the requirements for processing data.
7. Request the deletion of their information should they no longer wish it to remain in NGDS S.A.S.'s databases.
8. Access their personal data that has been processed, free of charge.
9. Have easy access to the data processing policy.
10. Know who at the entity is in charge, to whom they may address matters regarding the information processed.

Rights

// 4.1

Rights of children and adolescents

In processing personal data, NGDS S.A.S. will ensure respect for the prevailing rights of children and adolescents. Therefore, the processing of personal data of children and adolescents is prohibited, except for data that is public in nature, authorized by current legal regulations, and when such processing meets the following parameters and requirements:

• That it responds to and respects the best interests of children and adolescents.
• That respect for their fundamental rights is ensured.
• That the minor's opinion is taken into account according to their maturity, which is not directly related to their age but to their degree of judgment.
• That the legal requirements for processing personal data are met, such as authorization, purpose, and the explanation of the duties and rights of data subjects.

Duties

// 5

Duties of data controllers

NGDS S.A.S., in its capacity as data controller, is at all times aware of the importance of observing the policies and protocols aimed at protecting data subjects' personal data, given that such data belongs to the individuals it refers to and that only they may decide how it is used. Strictly speaking, NGDS S.A.S. will only use personal data for the purposes it has communicated to and been authorized for by the data subject, guaranteeing at all times compliance with the legal provisions concerning the protection of personal data.

1. Guarantee data subjects, indefinitely and permanently, the full and effective respect of their rights regarding their personal data.
2. Request and retain, under the conditions set out in this law, a copy of the corresponding authorization granted by the Data Subject.
3. Duly inform the Data Subject about the purpose of the collection and the rights afforded to them by virtue of the authorization granted.
4. Keep information under the security conditions necessary to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
5. Ensure that the information provided to the Data Processor is truthful, complete, accurate, up to date, verifiable, and understandable.
6. Update information, promptly informing the Data Processor of any changes to previously supplied data, and take any other measures necessary to keep information provided to it up to date.
7. Correct information when it is incorrect and inform the Data Processor accordingly.
8. Provide the Data Processor, as applicable, only with data whose processing has been previously authorized in accordance with this law.
9. Require the Data Processor, at all times, to respect the security and privacy conditions of the Data Subject's information.
10. Handle inquiries and complaints filed within the terms set out by data-processing law.
11. Adopt an internal manual of policies and procedures to ensure proper compliance with data processing, especially regarding inquiries and complaints.
12. Inform the Data Processor when specific information is under dispute by the Data Subject, once a complaint has been filed and the relevant process has not concluded.
13. Inform the Data Subject, upon request, about the use given to their data.
14. Report to the Superintendency of Industry and Commerce whenever there are security breaches and risks in managing Data Subjects' information.
15. Strictly comply with Law 1581 of 2012, its implementing decrees, and all requirements issued by the Superintendency of Industry and Commerce.

Inquiries and complaints

// 6

Support channel

The person or department responsible for handling petitions, inquiries, and complaints — before which the data subject may exercise their rights to know, update, correct, delete data, and revoke authorization — is NGDS S.A.S.'s Talent Department.

In order to access such information, NGDS S.A.S. will first verify the requester's identity by confirming certain personal data held in the database. Once the data subject's identity has been verified, they will be provided with all information about their personal data, and any related procedure may be carried out.

Inquiries and complaints

// 6.2

What your request must include

An inquiry/complaint submitted by a data subject must, in every case, be made in writing and must include, at a minimum, the following:

1. Full identification (name, notification address, ID document).
2. Description of the facts giving rise to the inquiry/complaint.
3. Supporting documents for the facts.
4. The channel through which you wish to receive the response to your inquiry/complaint.

Inquiries and complaints

// 6.3

Inquiries: response timeframes

Data Subjects or their successors may consult the Data Subject's personal information held in any database, whether public or private sector. The Data Controller or Data Processor must provide them with all the information contained in the individual record or linked to the Data Subject's identification.

The inquiry will be handled within a maximum term of ten (10) business days counted from the date of receipt. When it is not possible to handle the inquiry within that term, the interested party will be informed, stating the reasons for the delay and the date on which their inquiry will be handled, which in no case may exceed the five (5) business days following expiration of the first term.

Inquiries and complaints

// 6.3

Complaints: processing rules

A Data Subject or their successors who believe that information contained in a database should be corrected, updated, or deleted, or who become aware of a possible failure to comply with any of the duties set out in this law, may file a complaint with the Data Controller or the Data Processor, which will be handled under the following rules:

• The complaint is filed through a request addressed to the data controller, including identification of the Data Subject, a description of the facts giving rise to the complaint, the address, and any supporting documents to be relied on. If the complaint is incomplete, the requester will be asked, within five (5) days of receiving the complaint, to correct the deficiencies. If two (2) months pass from the date of the request without the requester providing the required information, the complaint will be considered withdrawn.
• If whoever receives the complaint is not competent to resolve it or is not the person responsible for doing so, they will refer it to the appropriate party within a maximum term of two (2) business days and will inform the interested party of the situation.
• Once the complete complaint is received, a notice reading "complaint in process" and its reason will be added to the database, within a term of no more than two (2) business days. This notice must remain in place until the complaint is resolved.
• The maximum term to handle the complaint will be fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to handle the complaint within that term, the interested party will be informed of the reasons for the delay and the date on which their complaint will be handled, which in no case may exceed the eight (8) business days following expiration of the first term.

Inquiries and complaints

// 6.2 – 6.4

Updates, revocation, and deletion

Request for update and/or correction. NGDS S.A.S. will correct and update, at the data subject's request, information that is inaccurate or incomplete, following the procedure and terms outlined above, for which the Data Subject must submit the request through the channels made available by the company, indicating the data to be updated or corrected, and must also provide documentation supporting the request.

Revocation of authorization and/or deletion of data. The Data Subject may revoke, at any time, the consent or authorization given for the processing of their personal data, provided there is no impediment established by legal or contractual provisions. The Data Subject also has the right to request, at any time, that NGDS S.A.S. delete or remove their personal data when:

• They believe the data is not being processed in accordance with the principles, duties, and obligations set out in current regulations.
• The data is no longer necessary or relevant for the purpose for which it was obtained.
• The time necessary to fulfill the purposes for which the data was obtained has elapsed.

Such deletion involves the total or partial removal of personal information, as requested by the data subject, from the records, files, databases, or processing carried out by NGDS S.A.S. The right of cancellation is not absolute, and therefore NGDS S.A.S. may deny the revocation of authorization or deletion of personal data in the following cases:

• The data subject has a legal or contractual duty to remain in the database.
• Deleting the data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the enforcement of administrative sanctions.
• The data is necessary to protect the data subject's legally protected interests, to carry out an action in the public interest, or to fulfill an obligation legally acquired by the data subject.

Prerequisite for filing. The Data Subject, their successors, their representative and/or attorney-in-fact, or whoever is designated under a stipulation in favor of another, may only file a complaint with the Superintendency of Industry and Commerce regarding the exercise of their rights once they have exhausted the Inquiry or Complaint process directly with the company.

Effective term

// 7.1

Amendments to the policies

NGDS S.A.S. reserves the right to amend the Personal Data Processing and Protection Policy at any time. However, any amendment will be communicated to data subjects in a timely manner through the usual contact channels, at least ten (10) business days before it takes effect.

Should a data subject disagree with the new General or specific Policy, and have valid reasons that constitute just cause not to continue authorizing the processing of their personal data, the Data Subject may request that the company withdraw their information through the channels indicated. However, Data Subjects may not request the withdrawal of their personal data when the company has a legal or contractual duty to process the data.

Effective term

// 7.2 – 7.3

Effective term and changes

This policy will take effect upon publication on NGDS S.A.S.'s website. NGDS S.A.S.'s databases will be retained for as long as necessary to ensure compliance with its corporate purpose, legal requirements, and any other applicable document-retention regulations.

Any substantial change to the processing policies will be communicated in a timely manner to the data subjects in our databases through mass communication sent to the email addresses provided to our company.