CARIBBEAN FREE TRADE ZONE S.A.S. U.O.Z.F. as an entity that has the function of being a user operator of one or more free zones for its management, administration, supervision and development, sets out below its Policy for the Treatment of Personal Data as responsible for the management of such information indicating the scope and purpose of the use it gives to the data it collects and obtains in the event that the Holder grants its express, prior and informed authorization. The same will be made known to customers, users, suppliers, employees and any third party that has a relationship with the company through its web portal, publication of this policy in the company's facilities, emails addressed to third parties, as well as any other suitable means to publicize this document.

1. APPLICABLE LEGAL FRAMEWORK

 

This Personal Data Processing Policy document (hereinafter referred to as the "Privacy Policy") is a document that sets out PDT) takes into account the following legal framework in force in Colombia regarding personal data protection:

15. Constitution, Article 15.
16. Law 1266 of 2008
17. Law 1581 of 2012
18. Regulatory Decrees 1727 of 2009 and 2952 of 2010, and Decree

Regulation 1377 of 2013

1. Constitutional Court Rulings C - 1011 of 2008, and C - 748 of 2008.

2011

1. Other laws, regulations, decrees and rulings that come into force on this subject.
2. GENERAL INFORMATION ABOUT OUR DATA PROCESSING POLICY PERSONNEL

 

Our policies and procedures are based on the aforementioned legal framework whose main objective is the protection of personal data entrusted to the companies by third parties as a result of the relationships arising from the economic activity they carry out. CAYENA in Colombia. In particular, information that has been voluntarily provided by our Customers, Suppliers, Employees, Former Employees, Visitors, among others.

This information can be obtained by CAYENA through any of the following ways or means of obtaining information such as i) the commercial or professional relationship with the respective Client, Supplier, or other third parties; ii) labor relationship with Employees and Former Employees, as well as other third parties that have provided services to the company in any modality; iii) Application to selection processes; iv) Attendance to trainings, seminars or courses; v) Sending e-mails requesting information; vi) Marketing events, fairs, product promotion forums, among others; and vii) Information of public knowledge such as telephone directories, newspapers, internet pages or publications, magazines, brochures, commercial references and referrals of users of our services.

CAYENA seeks through its Personal Data Processing Policy to guarantee the fundamental right of habeas data of the owners who have given us their information, especially with respect to the rights granted to citizens by Law 1581 of 2012 with regard to know the legality in the process of collecting their data, update, rectify, issue, delete an express authorization, the conditions of privacy and security under which we will treat their personal data, its proper handling, and especially the conditions under which we advance its collection, use, storage, circulation, means of access, access, and the conditions under which we will process its collection, use, storage, circulation, means of access, and access, suppress an express authorization, the privacy and security conditions under which we will treat your personal data, its proper handling, and, in particular, the conditions under which we advance its collection, use, storage, circulation, means of access, filing of complaints or requests related to your data and other activities involved for such purposes.

We must point out that, when providing, delivering or sending any type of personal information to CAYENA, the Data Subject accepts that such information will be used in accordance with this Policy for the Processing of Personal Data. It should be clarified that CAYENA will not use the data provided for activities or purposes other than those provided herein. In any case, in the event that such personal information is used for other purposes, its use must be covered by any of the exceptions provided for in the regulations or have the express authorization of the Holder.

3. APPLICATION AND RETENTION OF DATA BY ZOFRACAR

 

The present PDT shall apply solely and exclusively to the processing of personal data currently in its possession. CAYENA, and those that it subsequently collects in compliance with legal requirements for the collection of personal data from third parties.

Third party data will be retained by CAYENA taking into account the purposes set forth in this document. PDT and the applicable legal provisions in force for the treatment and conservation of personal data for which the companies are responsible. In any case, the aforementioned companies will remove the data from the corresponding database at the request of the owner, for which the corresponding attention channel has been designated to the following e-mail address pqrs@zofracar.comThe foregoing, provided that there is no legal or contractual obligation on the part of ZOFRACAR to preserve the records in the database.

4. DEFINITIONS

 

It is important for us that third parties understand our Personal Data Processing Policy in a clear and simple manner, for which reason we present below some definitions that should be taken into account as follows:

TERM	DEFINITION	TERM	DEFINITION
Authorization	It is the express manifestation of your part, consenting that CAYENA your personal data, in accordance with the principles and purposes described in this document. PTD.	Privacy Notice	Verbal or written communication generated by the responsible party, addressed to the holder for the processing of his personal data, by means of which he is informed about the existence of the Information Processing Policies that will be applicable to him. on the part of CAYENA how to access them and the purposes of the intended processing of such personal data.
Data Holder	It is you, when you authorize us to process your data. That is, any customer, supplier, direct or indirect employee and any third party who provides your data to us. CAYENA in accordance with the provisions of this PTD and the purposes established by the company for its treatment.	Customer	Natural or legal person to whom CAYENA provides its services under a pre-existing business relationship.
Supplier	Natural or legal person that provides goods and/or services to CAYENA by virtue of a pre-existing business relationship.	Employee	Natural person who provides personal services to CAYENA under an employment contract.
Contractor or Worker on Mission	Natural person who provides services to CAYENA under a contract for the provision of services.	Former employee - Former Contractor or Former Worker on Mission	Natural person who rendered personal services to CAYENA through an employment contract or a service contract that was terminated for any reason.
Visitor	Any natural person who is on the premises of CAYENA and that it does not have the quality Employee, Contractor or Worker on Mission.	Person with whom you have a business or training relationship	Natural persons with whom CAYENA has a commercial or training relationship in the development of its corporate purpose.

Treatment	Any operation or set of operations that CAYENA carried out with your data. The treatment can range from the collection, storage, use, circulation, transfer or deletion of your data taking into account the purposes of each of the databases for which it is responsible. CAYENA.	Transmission	Processing of personal data that involves the communication of such data within Colombia (national transmission) or outside Colombia (international transmission), and whose purpose is to be processed by the processor, by account or on behalf of the responsible party.
Personal Data	Any information that Identifies you or, in the aggregate, can cause you to be identified. Data is classified as public, private, semi-private and sensitive.	Data Specials	They refer to the treatment of information on children and adolescents, and the treatment of sensitive data.
Data Staff Private	It is the information that only concerns you as the Data Subject, and that has an intimate and reserved nature. Your private data are, among others, your home address and telephone number, information obtained during the inspection of your home, among others.	Data Staff Semi-private	This is private data, which in certain situations could be of interest to a certain group of people. Semi-private is, among others, information regarding the fulfillment and non-fulfillment of financial obligations.
Data Staff Sensible	Information that affects privacy and whose improper use could generate discrimination, such as information that reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data. (fingerprints, photographs, DNA, among others).	Data Staff Public	They are all those that concern a general interest, and that as a general rule are contained in public documents, public records, and duly executed court judgments that are not subject to confidentiality. Your public data may include, among others, your name, identification, marital status.
Responsible for Treatment	Person who decides on, among others, the collection and purposes of the treatment. CAYENA is responsible for the information contained in its databases, in particular, the data of its associates, customers, employees, suppliers, commercial advisors, and any third party providing information.	In charge of Treatment	Person who carries out the data processing on behalf of the data controller. The data processor corresponds to an external agent of Cayenne.

		PERSONAL DATA PROCESSING POLICY				Code	SGC-POL-041
						Version	2
						Date of Approval	08/04/2025
						Approved	MHL
	Database		Organized set of personal data subject to processing. This meaning applies to our physical files as well as to electronic files.

5. PRINCIPLES

 

CAYENA presents to you the principles to be taken into account at the time of processing your personal data, in accordance with current regulations in this area and our Personal Data Processing Policies.

TERM	DEFINITION
Collaboration with the Authority	CAYENA cooperate with the competent data protection authorities to ensure compliance with data protection laws.
Legality of Treatment	In the use, capture, collection and processing of personal data, the current and applicable provisions governing the processing of personal data and other related fundamental rights shall be applied.
Purpose	We will never treat your information outside the purposes stated in the law and as authorized by you, as framed in the economic and social activity deployed by CAYENA.
Freedom	The processing may only be carried out in accordance with the prior, express and informed consent of the holder in the case of new customers, suppliers, beneficiaries or employees. In the specific case of third parties whose personal data were in the care of the companies before the entry into force of Regulatory Decree 1377 of June 27, 2013, CAYENA are subject to the provisions of Article 10 of the same decree, deploying all the necessary mechanisms to continue with the processing of data collected prior to June 27, 2013.
Transparency	You can always ask us for information about your personal data. In this way CAYENA will make available to the owners all the suitable mechanisms in order to guarantee the information about the personal data contained in its databases, at any time and without restrictions.
Truthfulness	At all times the information contained in the databases will be truthful and unequivocal, complete, accurate and updated. Incomplete or fractioned data that may mislead will not be used.
Privacy	CAYENA guarantees that your personal data will not be available in any means of public or mass disclosure in respect of your right to privacy.
Restricted access and circulation	Your data may only be consulted, modified and processed by persons directly linked to CAYENA or by those third parties that have established as data processors in any of its stages, we will never expose them in public media or easily accessible to unauthorized third parties.
Security	CAYENA deploy all means and implement all useful and relevant tools to secure the records contained in the databases to avoid any leakage or erroneous treatment of the information. In the same way CAYENA shall be responsible for establishing the responsibilities of the persons in charge of the processing of personal data in relation to the security measures for the protection of the personal data under their processing on account of the assignment given to them by CAYENA.
Confidentiality	CAYENA will guarantee that all persons involved in the processing of the information will be subject to controls at all times, including after the end of their relationship with the tasks that comprise the processing. In order to comply with the above, confidentiality agreements will be signed as necessary to ensure the correct treatment of your personal data.

6

Solidarity	In the event that the information is stolen in violation of the security protocols and is exposed to the public against the will of the owner of the information, the owner agrees to take legal action against the person(s) who has (have) committed the offence.
Good Faith	The use, capture, collection and processing of personal data will be linked to the fulfillment of the Corporate Purpose of the company. CAYENA with the main purpose of offering goods and services to individuals and legal entities that need them to carry out their activities.

6. AUTHORIZATIONS

 

The use, collection, and storage of personal data by CAYENA will have the authorization of the owner in which his prior, express and informed consent is expressed for those cases in which it is required by law. In this way, the processing of data may be carried out without requiring express authorization in the following cases:

1. Information required by a Public or Administrative Entity in the exercise of its legal functions or by court order.
2. Data of a public nature (in accordance with the legal definition of the term).
3. Cases of medical or sanitary emergency.
4. Processing of information authorized by law for historical, statistical or scientific purposes.
5. Data related to the Civil Registry of Persons.

With the exceptions mentioned above, and within the legitimate purposes inherent to the corporate purpose of CAYENA, in no case will the company supply, distribute, commercialize, share, exchange with third parties and, in general, carry out any activity in which the confidentiality and protection of the information collected is compromised.

Respecting the rights of the owners, CAYENA will allow the holders access to the means of evidence leading to verify the authorization issued for the processing of their personal data.

                                                                                                                         6

7. PURPOSE OF THE PROCESSING OF PERSONAL DATA

 

It is important for third parties to be aware of the purpose for which CAYENA will process your personal data. Thus, in this Personal Data Processing Policy, we present the purposes for each of the third parties from whom we obtain personal data and we give them some kind of treatment.

7.1.    Purpose of Processing Customer and Prospective Customer Data

 

CAYENA may carry out the Processing of Personal Information about its Clients and Prospective Clients for the purposes of providing the professional services contracted by them, in accordance with the respective corporate purpose. For this reason, the contracts entered into with Clients shall be governed by the provisions of this Policy, or shall include a clause regulating the Processing of the Information accessed by virtue thereof.

Likewise, the information will be used for the development of commercial work and thus achieve the approach with new customers or prospective customers for the presentation of the portfolio of services, initiation of the negotiation process, remission of quotations and other activities aimed at establishing a business relationship.

CAYENA may process the personal information of its current or prospective Customers and of those Customers with whom it has terminated its commercial relationship, in order to send them commercial information that, in the opinion of the Company, may be of interest to it. CAYENA may be of interest to them; as well as, among others, to invite them to events that are organized, send newsletters, sectorial reports or publications and, in general, use the data for the development of the activities included in its corporate purpose, already described.

Likewise, CAYENA In order to preserve the security of customers in its facilities, it may take recordings through video surveillance systems, which will remain in the company for a period of up to one month. Finally, CAYENA will use the personal data of its clients to carry out the filing process, update systems, keep accounting and/or statistical records, submit reports to the control authorities, as well as any other purpose determined by the responsible party and duly communicated to the owners.

               7.2.    Purpose of the Processing of Employee - Contractor Data.

CAYENA will carry out the processing of personal information of its employees and/or contractors and their families in order to comply with the obligations arising from the respective labor relations. Such obligations include, among others, payroll payments, granting of benefits, performance evaluations, issuance of certifications, reports to the control authorities, among others. Likewise, they may obtain some biometric data to control access to the facilities, account for hours worked and overtime, as well as control the employees' time records.

Likewise, CAYENA may collect personal information of applicants who apply for selection processes in order to be able to advance the respective recruitment processes. Additionally, CAYENA may temporarily store the information of those who apply for these processes and use it in future personnel selection processes. Therefore, it is understood that whoever submits his or her resume to the company for consideration, by any means, understands and authorizes the processing of his or her personal data by the company. CAYENA.

 

On the other hand, CAYENA In order to preserve the safety of its employees, contractors in its facilities may take recordings through video surveillance systems, which will remain in the company for a period of up to one month. In this sense, CAYENA will use the personal data of its employees and/or contractors to carry out the filing process, update systems, keep accounting and/or statistical records, submit reports to the control authorities, as well as any other purpose determined by the responsible party and duly communicated to the owners.

Additionally and on the occasion of events, training or other activities carried out by them, they may record and take audios, videos or photos of employees and the development of their activities. These audios, videos or photos may be used by CAYENA in newsletters, publications, and in general in any activity of the company for labor welfare purposes, even after the employee retires from working with the company.

Likewise, CAYENA will use the personal data of its employees and/or contractors to carry out the filing process, update systems, keep accounting and/or statistical records, submit reports to the control authorities, as well as any other purpose determined by the responsible party and duly communicated to the owners.

                7.3.           Purpose of the Processing of Data of Former Employees and

Former contractors.

 

CAYENA shall have a file in which the personal data of all Employees and/or Contractors who have terminated their employment relationship with the Company shall be stored indefinitely. The purpose of this file will be: (i) To serve as a basis for the issuance of the labor certificates referred to in Article 57, paragraph 7 of the Substantive Labor Code, at the request of the former Employee or his successors; (ii) To serve as a basis for the granting of labor references to potential employers of the former Employee, when the latter so authorizes at the time of his separation from the Company; (iii) To serve as a basis for the granting of labor references to potential employers of the former Employee, when the former Employee so authorizes at the time of his separation from the Company. CAYENAand/or iii) the information stored in this file may be studied, analyzed and used by the company for the purpose of considering the Former Employee in the recruitment processes that may occur in the future.

Likewise, CAYENA will use the personal data of its former employees and contractors to carry out the filing process, update systems, keep accounting and/or statistical records, submit reports to the control authorities, as well as any other purpose determined by the Controller and duly communicated to the owners.

7.4. Purpose of Processing Data of Suppliers or persons with whom we have a business relationship.

 

The companies will carry out the Processing of Personal Information of their Suppliers or of the persons with whom they have a commercial or training relationship with the purpose of complying with the obligations acquired by virtue of the respective relationship.

In relation to Suppliers, such obligations include, among others, evaluating their performance; establishing, managing or terminating commercial relationships or verifying references; providing business metrics, and any others established in the agreements or contracts entered into with the respective Supplier.

The processing of data collected pursuant to the provisions of this paragraph shall be carried out and shall remain in force as long as the purpose for which the respective data were collected is maintained.

Likewise, CAYENA will use the personal data of its suppliers to carry out the filing process, update systems, keep accounting and/or statistical records, submit reports to the control authorities, as well as any other purpose determined by the responsible party and duly communicated to the owners.

7.5 Purpose of the Processing of Sensitive Data

Sensitive data are understood as those that affect the privacy of the holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in social organizations of any kind, or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data, still or moving image capture, fingerprints, photographs, iris, voice, facial or palm print recognition, among others.

Data classified as sensitive may be captured, used and processed when:

1. The Data Subject has given his or her explicit authorization to such processing, except in those cases where by law the granting of such authorization is not required.

1. The processing is necessary to safeguard the vital interest of the holder and he/she is physically or legally incapacitated. In these events,

the legal representatives must give their authorization.

1. The processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided that they refer exclusively to its members or to persons who maintain regular contacts by reason of their purpose. In these events, the data may not be provided to third parties without the owner's authorization.
2. The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.
3. The processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted.

8. RIGHTS OF THE OWNERS
   •  

The Data Controllers or their successors in title duly accredited in accordance with the Law, may consult, upon written request, free of charge and in accordance with the Law, their data contained in any database for which it is responsible. CAYENA.

 

• Rectification and updating of data.

CAYENA shall have the obligation to rectify and update, at the request of the Data Subject, any information about him/her that proves to be incomplete or inaccurate, for which the Data Subject shall follow the procedure set forth in this Personal Data Processing Policy. CAYENA take measures to ensure that the personal data in its databases are accurate and sufficient.

• Proof of Authorization.

Provided that it does not concern those cases in which the Law exempts the following CAYENA to obtain the Authorization of the Data Subject in those cases in which the data collection took place prior to June 27, 2013, the Data Subject may request from the company proof of the Acceptance given for the Processing of his or her data.

• Utilization.

 

At all times, the Registrant shall have the right to have CAYENA inform you, upon request, the use that has been made of your personal data, for which you must follow the procedure outlined in this Personal Data Processing Policy.

•  

When the Data Subject believes that this Policy or the current regulations on the protection of personal data have been breached, he/she may file a complaint in that sense before the Superintendence of Industry and Commerce.

• Deletion.

The Holder may, at any time, request to CAYENA the deletion of their personal data and/or revoke the authorization granted for the Processing of one, some or all of the personal data provided or collected by the company, by submitting a request on the matter through the procedure described in this Policy. The foregoing unless the Data Subject has a legal or contractual duty to remain in the databases of the company. CAYENA.

 

9. DUTIES OF THE PERSON RESPONSIBLE AND IN CHARGE

 

• Responsible for the Processing of Personal Data.

CAYENAwhen acting as the party responsible for the processing of personal data, shall comply with the following duties:

1. Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data.

1. Request and keep a copy of the respective authorization granted by the holder or by the person(s) authorized by him/her under his/her responsibility.

1. Duly inform the owner or the person(s) to whom he/she has authorized under his/her responsibility about the purpose of the collection and the rights he/she has by virtue of the authorization granted.

1. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
2. To process the information provided by the third party or the person(s) designated by the third party under its responsibility to the data processor and to assume it as true, complete, accurate, updated, verifiable, understandable and available.
3. Update the information provided by the third party or the person(s) designated by the third party under its responsibility, communicating in a timely manner to the data processor, all developments with respect to the data previously provided.

1. Rectify the information when it is incorrect and communicate the pertinent to the person in charge of the treatment.

1. To provide to the Data Processor, as the case may be, only data whose Processing is previously authorized.

1. To require the Data Processor at all times to respect the security and privacy conditions of the Data Subject's information.

1. Handle inquiries and claims formulated.

1. Inform the Data Processor when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not been completed.

1. Inform upon request of the Data Subject about the use given to his/her data.

1. Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the Data Holders.

1. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

                     9.2.    Responsible for the Processing of Personal Data.

CAYENAas Data Processor shall comply with the following duties, without prejudice to the other provisions set forth in the law and in others governing its activity:

1. Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data;
2. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access;

1. Timely update, rectification or deletion of data in accordance with the terms of the law;

1. Update the information reported by those responsible for treatment

within five (5) business days of receipt;

1. To process the consultations and claims formulated by the Holders under the terms set forth in the law;

1. Register in the database the legend "claim in process" in the manner regulated by law;

1. Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of the personal data.

1. Refrain from circulating information that is being disputed by the Holder and whose blocking has been ordered by the Superintendence of Industry and Commerce;

1. Allow access to information only to those who can access it;

1. Inform the Superintendence of Industry and Commerce when there are violations to the security codes and there are risks in the administration of the information of the Holders;

1. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

1. Other necessary in order to comply with the provisions of the law regulating the matter.

CAYENAwill keep in mind at all times that personal data are the property of the persons to whom they refer and that only they can decide on them. In this sense, it will use them only for the following purposes

those purposes for which it is duly empowered, and respecting in any case the current regulations on personal data protection.

10. CHANNEL TO DEAL WITH DOUBTS, REQUESTS, COMPLAINTS OR COMPLAINTS ABOUT THE CLAIMS

 

11. PROCEDURE FOR THE EXERCISE OF THE HOLDER'S RIGHTS

 

The owners of the information have procedures for the protection of their personal data with respect to the processing carried out by the company. CAYENA of these. In this way, the methodology is defined to guarantee the effective treatment of requests, complaints, claims, suggestions and comments presented by the owners of the information in the daily operation of the management carried out by the company. CAYENA that have to do with the processing cycle of your personal data.

11.1. Inquiries.

The Data Subjects or their successors in title may consult the personal information of the Data Subject contained in any database for which the companies are responsible. CAYENA shall provide them with all the information contained in the individual registry or that is linked to the identification of the Holder.

The consultation shall be formulated through the means enabled by CAYENA and will be answered within a maximum term of ten (10) business days from the date of receipt of the request.

When it is not possible to attend the consultation within said term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term.

Paragraph. The provisions contained in special laws or regulations issued by the National Government may establish shorter terms, depending on the nature of the personal data.

11.2. Claims.

In the event that the Data Subject or his/her assignees consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the Law, they may file a claim with CAYENA which will be processed under the following rules:

The claim shall be formulated by means of a request addressed to CAYENAIf the claim is incomplete, the interested party will be required within five (5) days of receipt of the claim to correct the deficiencies. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults.

After two (2) months from the date of the request, if the applicant does not submit the required information, it will be understood that the claim has been abandoned.

In the event that the person who receives the claim is not competent to resolve it, he/she will transfer it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation.

Once the complete claim has been received, a legend will be included in the database stating "claim in process" and the reason for the claim, within a term no longer than two (2) business days. Such legend shall be maintained until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

It is important that CAYENA to be in charge of archiving all the claims handled regarding personal data, keeping a clear record of them.

12. USE AND INTERNATIONAL TRANSFER OF PERSONAL DATA.

 

Depending on the nature of the permanent or occasional relationship that any data subject may have with the company, the following may apply CAYENA the totality of your information may be transferred abroad taking into account the legal requirements and authorizing in a previous, express and informed manner such transfer. The information will be transferred, for the development of the relations that may be established with CAYENA.

Without prejudice to the obligation to observe and maintain the confidentiality of the information, CAYENAwill take the necessary measures to ensure that these third parties are aware of and agree to abide by this Policy, with the understanding that the personal information they receive may only be used for matters directly related to CAYENA and only while it lasts, and may not be used or destined for a different purpose or end.

CAYENAWe may also share Personal Information with governmental or other public authorities (including, without limitation, judicial or administrative authorities, tax authorities and criminal, civil, administrative, disciplinary and fiscal investigative bodies) and third parties involved in civil legal proceedings and their accountants, auditors, attorneys and other advisors and representatives, because it is necessary or appropriate: (a) to comply with applicable laws, including laws other than those of your country of residence;

• to comply with legal processes;
• to respond to law enforcement and governmental requests, and to respond to requests from public and governmental authorities other than those in your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, yours or others; and (g) to obtain any applicable indemnification or limit any damages that may be incurred.
  
  13. SECURITY

 

Pursuant to the provisions of Article 19 of Decree 1377 of 2013, CAYENA undertakes to adopt the instructions given by the Superintendence of Industry and Commerce to that effect. Notwithstanding the foregoing, the aforementioned companies declare that they have information security policies and a technological infrastructure that reasonably protects the personal information collected, limiting access to third parties as far as possible. However, CAYENA will make continuous efforts to improve the security standards that protect the personal information collected.

14. VALIDITY AND CHANGES TO THE PRESENT PERSONAL DATA PROCESSING POLICY

 

CAYENA may modify this Policy for the Processing of Personal Data at any time it deems necessary. For this reason, CAYENA respectfully invites you to periodically review this Policy, in order to stay informed about the protection mechanisms implemented by the company for the protection of personal information.

If there is a change in the purpose of the Personal Data Processing, CAYENA will request a new authorization from the Holders affected by the change.

This Policy is effective as of the date of its publication.

CHANGE CONTROL
Change Made / Requirement	Version	Date
Creation of the policy	01	07/12/2017
Policy update	02	08/04/2025