PRIVACY POLICY AND PROTECTION OF PERSONAL DATA

(Procedural Manual Version 2.0 Published 08 Nov 2016)

INDUHERZIG S.A.S., company domiciled in Medellin, identified with the NIT 811.009.178-5 located at Carrera address 50 # 6-41 , It is a committed and responsible company with privacy and security of personal data of its employees, shareholders, providers, customers, dealers, trading partners, related companies, users, contractors, consultants, advisers, subscribers, former employees, former contractors and others, information that has been collected by this company under the development of its corporate purpose, by administrative relations, commercial, civilians, labor, among other; under the terms of Law 1581 from 2012 and Decree 1377 from 2013, It has adopted the following "PRIVACY POLICY AND PERSONAL DATA PROTECTION", in which, all persons directly or indirectly related to this company and of whom Personal Data information is currently included in our database or those data that are entered in the future by any of the information collection means that the company INDUHERZIG S.A.S. has, may make the collection procedure, conservation and processing of Personal Data, and the rights, guarantees and procedures to make them effective:

DEFINITIONS OF INTEREST:

personal data: Any information that can be associated or linked to several natural persons determined or determinable.

Database: Organized set of personal data for further processing systematized.

Authorization: approval, prior and informed consent of the holder of personal data, to carry out a treatment.

Treatment: Operations or activities that can be performed with personal data, Among which are: The recollection, use, copy, transfer, transmission or suppression.

sensitive data: Means those affecting sensitive data privacy Holder or the abuse of which can generate its discrimination, such as those revealing racial or ethnic origin, political orientation, religious beliefs or philosophical, trade union membership, Social Organizations, human rights or promote interests of any political party or to guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data.

PURPOSE OF THE PROCESSING OF PERSONAL DATA

The information provided by the holder will be included in our database and will be used:

shareholder:

Should be a shareholder of the company you call notice will be given to the Ordinary and Extraordinary Assemblies of the company, or other types of communications by the administration of INDUHERZIG S.A.S.

Notification of the decree and profit sharing company, as well as the corresponding dividend payment to shareholders of the company.

for suppliers:

Perform activities purchases of goods and services.

Notification of cancellation of obligations to suppliers of the company, among other types of communications by INDUHERZIG S.A.S.

Assess the quality of the products and services provided by this company.

for customers:

Provide our services and products.

Use the information in order to promote our products, services and offers, by physical means or through our website, or other means used to effect.

Send commercial information about products and services offered by the company, through different media, previously authorized by the owner.

Sending communications regarding our products, services, offers, promotions, partnerships, studies, contests, among others.

Report on new products or services directly related to the contracts or services purchased by the owner.

Assess the quality of the products and services provided by this company.

Perform collection activities regarding obligations of the holder.

Conduct internal studies on marketing and consumer behavior of users.

employee:

Store contact information and profile of all direct employees of the company.

Sending communications related to labor issues and interests of the company.

In general:

Send information related to INDUHERZIG S.A.S., in relation to their customers, providers, shareholders, employees, under the existing contractual relationship.

To comply with the obligations of the holder of the authorization, as the relationship with the company.

Notification that payment obligations both employees, suppliers or third parties.

To fulfill the duties of information that the company must meet legally mandated, by a court or competent authority.

We may be in contact with the owner of Personal Data if any risk against the protection of personal data.

Other activities that are subject to the development of the corporate purpose of the company and which necessarily must use the personal data of the holder.

The information and data provided may be subject to transmission and / or transfer to third countries, for implementation of activities related to the company and / or treatment previously described.

TREATMENT OF PERSONAL DATA

INDUHERZIG S.A.S. It is responsible for processing the personal data of its employees, shareholders, providers, customers, dealers, trading partners, related companies, users, contractors, consultants, advisers, subscribers, former employees, former contractors and others, for this reason it will work in compliance with the obligations arising from this condition. So things this treatment may be extended to its subsidiaries and may be charged in addition to representing the company or who it can hire for the exercise of their representation or development of its objects, which shall act in accordance with the procedures and policies to protect personal data, which for this purpose were designed and implemented by the company INDUHERZIG S.A.S..

Treatment of Personal Data, It should be made in the terms and scope of the authorization issued by the Holder of Personal Data or in the terms established in the legislation for this purpose.

TREATMENT RESPONSIBLE FOR PERSONAL DATA

INDUHERZIG S.A.S. society identified with the NIT 811.009.178-5 constituted by public deed No. 1010 Notary of the Medellin 1st 10 March 1997, registered at the Chamber of Commerce of Medellin 10 April 1997, in the book 9th, folio 401, under the No. 2805, Resident Medellin, and the following communication channels located at Carrera 50 # 6-41.

Phone: (604)5605050

Electronic address: [email protected].

Page: Web: www.Induherzig.com.co

In charge: Administrative area.

WHICH WAY GET PERSONAL DATA

Collection activities and storage of personal data can be performed through the physical mail, electronic, mobile devices, web pages or through any known digital or similar communication mechanism or through the voluntary and direct supply that the owner of the Personal Data delivers to the company INDUHERZIG S.A.S., by different mechanisms aforementioned.

PERSONAL DATA THAT ARE STORED BY INDUHERZIG S.A.S.

The personal data stored by the company INDUHERZIG S.A.S. They rely on the direct or indirect relationship the owner has with the company, for which it may be necessary to obtain from the owner his name, address, phone number, residence address, email, date of birth, professional activity, cargo, employer including, information that will be used for the purpose described in this privacy policy and personal data protection.

DUTIES OF RESPONSIBLE FOR PERSONAL DATA

Dar effectively guarantee the Holder of Personal Data for exercising their rights under the Act 1581 from 2012 Decree 1377 from 2013.

Request and retain proof of the respective authorization issued by the Holder of Personal Data for processing of data.

Inform the Holder of Personal Data in order for the processing of data and protection policies they have been adopted for these.

Retain Personal Data in accordance with the purpose for which they were collected and under appropriate security conditions, which is intended to prevent adulteration, lost, query, use or unauthorized access by outsiders to information.

Updating your personal information in accordance with the instructions or requests that are required by the owner of the information.

Rectifying personal data when they are supplied or described incorrectly.

To process and respond to inquiries and complaints in the terms indicated by Law 1581 from 2012 and Decree 1377 from 2013.

Adopt an internal manual of policies and procedures to ensure proper treatment of Personal Data.

Keeping Your Personal Data status when certain information is in a state of discussion by the Contractor.

Implement security measures of personal data, addressing the instructions given by the Superintendency of Industry and Commerce in the field.

And requirements comply with the instructions given by the Superintendency of Industry and Commerce.

And in general to processing of personal data in accordance with the authorization given by the owners attending the purposes and objectives established in the Law 1581 from 2012 and Regulatory Decree 1377 from 2013.

RIGHTS THAT ASSIST YOU TO THE HOLDER OF THE PERSONAL DATA AND IN THE EVENT OF ITS ABSOLUTE FAILURE, Her successors and assigns.

Under the terms of the Act 1581 from 2012 and Decree 1377 from 2013, the rights holder assists the Personal Data and to his utter lack, their assignees, They are as follows:

Right to consult your personal data for free and to know whether they are being subjected to any treatment by society responsible.

The right to request at any time updating, rectification and deletion of personal data.

Right to revoke the authorization given to the person responsible for the processing of personal data at any time.

The right to request at any time evidence proving the existence of the authorization given to the person responsible for the processing of personal data.

Right to submit to the Superintendency of Industry and Commerce complaints for violations of the provisions of the Law 1581 from 2012 and other rules that modify, add to or complement.

Right to be informed by INDUHERZIG S.A.S. on the use of personal data.

The other his rights in national legislation.

MEANS BY WHICH THE HOLDER AUTHORIZES THE PROCESSING OF HIS PERSONAL DATA

Holders of personal data must authorize the person responsible for treating them, by completing the AUTHORIZATION FORM that is published on the website of the company INDUHERZIG S.A.S.. and / or through the communication channels used by the Company to refer the format.

For data collected prior to the issuance of Decree 1377 from 2013, should not receive demonstration by the holder, society understand who is authorized to continue the processing of personal data, until the owner of the data is not expressly stated in contrary, under Article 10 numeral 4 Decree 1377 from 2013.

FORM IN WHICH THE HOLDER OF PERSONAL DATA MAY USE YOUR RIGHTS

The holder of the information, who hereby issued authorization for use of your Personal Data, may at any time access the data supplied, and request correction thereof, update, delete or request revocation of this authorization, under the terms of Law 1581 from 2012 and Decree 1377 from 2013; The interested party may contact the offices of INDUHERZIG S.A.S.. located in Cra 50 # 6-41 in Medellin, Colombia or direct mail to the e-mail address [email protected] .

The application must contain, at least, the information identified below:

Identification of the holder

Description of the facts giving rise to the consultation, suggestion, claim or complaint

Terms of application

Address for notification

TRANSFER AND INTERNATIONAL PERSONAL DATA TRANSMISSION

The information and data provided may be subject to transmission and / or transfer to third countries, for implementation of activities related to the company and / or treatment described in these Policies.

For transfer and international transfer of personal data schedule will be observed in Article 26 of the law 1581 from 2012 and Article 24 Decree 1377 of the 2013.

This 'PRIVACY AND PROTECTION OF PERSONAL DATA' is published as of August 28 from 2013 and begins to take effect from the day of its publication.

XI. RESOLUTION inquiries and complaints filed by data subjects.

The Owners or their successors in title make inquiries or complaints about the personal information of the Owner that resides in the databases of INDUHERZIG S.AS.. through the following mechanisms:

Email [email protected]

physical mail at Cra 50 # 6-41

Phone (604) 5605050.

PROCESS.

INDUHERZIG S.A.S. will attend to the holders or their assignees consultations of personal information Holder to rest in their databases. The query will be received exclusively through the channels of INDUHERZIG S.A.S.. previously mentioned.

The inquiry will be answered within a maximum period of ten (10) working days from the date of receipt thereof. When it is not possible to attend the inquiry within the term, It will inform the person concerned, specifying the grounds for the delay and indicating the date your inquiry will be addressed, which in no case shall exceed five (5) working days following the expiry of the first term.

In the case of claims, the Contractor or its assignees to consider the information contained in a database should be subject to correction, update, or delete, or when the alleged failure to warn of any of the duties under this Act, You may file a claim through the channels offered by INDUHERZIG S.A.S.. and will be resolved under the following terms and conditions:

1. The claim will be made through a request addressed to INDUHERZIG S.A.S.. the identification of the holder, the description of the facts giving rise to the claim, the direction, and accompanying documents want to assert. If the complaint is incomplete, the interested party will be required within five (5) after receipt of the complaint days to remedy failures. after two (2) months from the date of the request, without the present applicant information required, It is deemed to have waived the claim.

If the recipient of the claim is not competent to solve, shall transmit to the appropriate within a maximum period of two (2) business days and shall report the situation to the person concerned.

2. Upon receipt of the completed claim, will be included in the database is a legend that says “pending claim” and the reason for it, within no more than two (2) business days. The legend should be maintained until the claim is decided.

3. The term to address the claim will be fifteen (15) working days from the day following the date of receipt. When it is not possible to meet the demand within that period, se INDUHERZIG S.A.S., shall inform the person concerned the reasons for the delay and the date on which your claim will be addressed, which may not exceed eight (8) working days following the expiry of the first term.

Procedural requirement. The holder or assignee may only raise complaint with the Superintendent of Industry and Commerce once you have exhausted the process of inquiry or complaint to the data controller or processor.