POLICY FOR THE MANAGEMENT AND PROCESSING OF DATA BY JM ESTRADA S.A

FIRST: OBJECTIVE AND SCOPE

1.1. The purpose of this policy is to adopt, establish, and regulate the processing of personal data collected, processed, circulated, and/or stored by JM ESTRADA S.A., in the development of its corporate purpose.

1.2. All areas of JM ESTRADA S.A. involved or in any way engaging in the processing of personal data must observe and adhere to the provisions of this policy; in the event of any gap, it shall be supplemented by the Law. This document applies to all databases containing personal data and subject to processing and protection by JM ESTRADA S.A.

SECOND: DUTIES AS RESPONSIBLE PARTY

2.1. JM ESTRADA S.A. shall have the following duties as the responsible party:

• 1. Guaranteeing the Data Subject, at all times, the full and effective exercise of the right to Habeas Data.
• 2. Requesting and retaining a copy of the respective Authorization granted by the Data Subject for the processing of personal data.
• 3. Properly informing the Data Subject about the purpose of the collection and their rights under the granted Authorization.
• 4. Safeguarding the information under necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
• 5. Ensuring that the information is truthful, complete, accurate, up-to-date, and understandable.
• 6. Updating the information, thereby addressing any changes regarding the Data Subject's data.
• 7. Rectifying the information when incorrect and communicating such changes.
• 8. Respecting the security and privacy conditions of the Data Subject's information.
• 9. Processing inquiries and complaints according to the terms set by law.
• 10. IInforming, upon request of the Data Subject, about the use of their data.
• 11. Reporting to the data protection authority in case of security breaches and risks in managing the information of the Data Subjects.
• 12. Using only data whose processing is previously authorized in accordance with the provisions of Law 1581 of 2012 or those modifying or adding to it.
• 13. Allowing access to information only to persons authorized to do so.
• 14. Using the Data Subject's personal data only for purposes for which it is duly authorized, respecting in all cases the current regulations on the protection of personal data.

THIRD: DUTIES AS DATA PROCESSOR

33.1. In the event that JM ESTRADA S.A. becomes the data processor of databases, it shall have the following duties:

• a. Guaranteeing the Data Subject, at all times, the full and effective exercise of the right to Habeas Data;
• b. Safeguarding the information under necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access;
• c. Promptly carrying out updates, rectifications, or deletions of data in the terms provided by law;
• d. Updating the information reported by the data controllers within five (5) business days from its receipt;
• e. Processing queries and complaints filed by the Data Subjects in the terms indicated by law;
• f. Ensuring the implementation of this Information Processing Policy and its procedures to ensure compliance with Law 1581 of 2012 and those modifying or adding to it, and especially for the handling of queries and complaints by the Data Subjects;
• g. Refraining from circulating information that is contested by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce;
• h. Allowing access to information only to persons authorized to do so;
• i. Reporting to the Superintendence of Industry and Commerce in case of security breaches and risks in the management of the Data Subjects' information;
• j. Maintaining strict confidentiality with all information or personal data that it may come to know in the exercise of its functions as Processor;
• k. Complying with the instructions and requirements issued by the Superintendence of Industry and Commerce, especially those related to the registration and updating of databases in the National Database Registry.

FOURTH: DEFINITIONS

4.1. For legal purposes and especially in matters of personal data protection, the following definitions shall apply, in accordance with Law 1581 of 2012 or those modifying and/or adding to it and its regulatory decrees:

• a. Authorization: Prior, express, and informed consent of the Data Subject to allow the Processing of their personal data.
• b. Database: Organized set of personal data subject to Processing.
• c. Personal data: Any information linked or that can be associated with one or more identified or identifiable natural persons.
• d. Private data: It is data that, by its intimate or reserved nature, is only relevant to the Data Subject.
• e. Public data: It is data that is not semi-private, private, or sensitive. Public data include, among others, data relating to the marital status of individuals, their profession or occupation, and their status as merchants or public servants. By its nature, public data may be contained, among others, in public records, public documents, gazettes and official bulletins, and duly executed court judgments that are not subject to confidentiality.
• f. Semi-private data: Data that is not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to the Data Subject but also to a certain sector or group of people.
• g. Sensitive data: Those that affect the personal intimacy of the Data Subject or whose misuse could lead to their discrimination.
• h. Data Processor: Natural or legal person, public or private, who, by themselves or in association with others, carries out the Processing of personal data on behalf of the Data Controller.
• i. Habeas Data: Right of any person to know, update, and rectify the information collected about them in databases and files of public and private entities.
• j. Internal mechanisms: Those adopted by the responsible area to implement internal policies, including implementation tools, security, training, and education programs.
• k. Data Controller: Natural or legal person, public or private, who, by themselves or in association with others, decides on the Database and/or the Processing of data.
• l. Data Subject: Natural person whose personal data is subject to Processing.
• m. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, transfer, transmission, or deletion.
• n. Transfer: Data transfer occurs when the Data Controller and/or Data Processor, located in Colombia, send information or personal data to a recipient, who in turn is responsible for Processing and is located inside or outside the country in accordance with the authorized purpose contained in this policy.
• o. Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when it is intended for Processing by the processor on behalf of the controller, in accordance with the authorized purpose contained in this policy.

FIFTH: DATA CONTROLLER

5.1. In accordance with the provisions of Law 1581 of 2012 or any regulations modifying or adding to it, the Data Controller is identified and can be contacted as follows:

• A. LEGAL NAME: JM ESTRADA S.A.
• B. ADDRESS: Carrera 55 # 87 Sur – 146. La Estrella-(Ant).
• C. EMAIL: pqrs@jmestrada.com

SIXTH: PRINCIPLES

6.1. For all purposes of this policy and when processing personal data, the following essential principles of personal data shall apply:

• A. LEGALITY PRINCIPLE: Data processing is a regulated activity that must comply with what is established in the Law and in the other provisions that develop or modify it.
• B. PURPOSE PRINCIPLE: Processing must comply with a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject.
• C. FREEDOM PRINCIPLE: Processing can only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior Authorization, or in the absence of a legal or judicial mandate relieving consent.
• D. VERACITY OR QUALITY PRINCIPLE: Information subject to Processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.
• E. TRANSPARENCY PRINCIPLE: The right of the Data Subject to obtain, at any time and without restrictions, information about the existence of data concerning them must be guaranteed in the Processing by the Data Controller or the Data Processor.
• F. ACCESS AND RESTRICTED CIRCULATION PRINCIPLE: The administration of personal data is subject to the limits derived from the nature of the data, the provisions of this policy, and the principles of personal data administration, especially the principles of information temporality and the purpose of the database. Personal data, except for public information, may not be accessible via the Internet or other mass media communication, unless access is technically controllable to provide restricted knowledge only to Data Subjects or authorized users in accordance with this policy.
• G. SECURITY PRINCIPLE: The information comprising the individual records constituting the databases referred to in the Law, as well as the resulting from the queries made by their users, must be handled with the technical measures necessary to guarantee the security of the records, preventing their alteration, loss, consultation, or unauthorized use.
• H. CONFIDENTIALITY PRINCIPLE: All natural or legal persons involved in the administration of personal data that are not public in nature are obliged, at all times, to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks comprising data management, being able to only provide or communicate data when it corresponds to the development of the activities authorized in this policy.

SEVENTH: RIGHTS OF THE DATA SUBJECT

7.1. In accordance with the provisions of Law 1581 of 2012 or any regulations that modify or add to it, and its regulatory decrees, all data subjects have the following rights regarding the processing of their personal data:

• A. Information: Prior to the Data Subject's Authorization of personal data, they have the right to request that JM ESTRADA S.A. indicate the use and processing that will be given to their information and the rights they have as data subjects.
• B. Access and Knowledge: The data subject has the right to request and/or access, free of charge -except for legal exceptions-, to the information being processed by JM ESTRADA S.A. and the use being given to it.
• C. Rectification: The data subject has the right to request the correction of partial, inaccurate, incomplete, fragmented information that may lead to error, when it relates to their personal data and is in the possession of JM ESTRADA S.A.
• D. Update: It is the right of the data subject to request modifications to their information, either by addition or deletion.
• E. Request for Authorization Proof: The data subject has the right to request from JM ESTRADA S.A. proof of authorization for the processing of their personal data, provided there is no legal exception to request it, such as when it is public data.
• F. Revocation and Deletion: It is the right of the data subject to revoke the authorization for the processing of their personal data at any time. They also have the right to request the deletion of personal data when the processing thereof does not comply with the applicable constitutional and legal principles, rights, and guarantees.
• G. Non-obligation: The Data Subject is not obliged to authorize the processing of their sensitive personal data.
• H. Gratuitousness: Without prejudice to legal exceptions, the data subject has the right to know the information held in databases free of charge.
• I. Lodge complaints: The data subject has the right to inform the Superintendence of Industry and Commerce of possible infringements of Law 1581 of 2012 and other related regulations.

EIGHTH: AUTHORIZATION

8.1. The Authorization for the processing of personal data must be obtained in advance, expressly, and with the consent of the data subject, in order to process their personal data, without prejudice to legal exceptions. In addition, the Authorization will be directed to the purposes established in the respective Database in accordance with this policy, which will always be directly related to the development of the corporate purpose of JM ESTRADA S.A. The Authorization will always be governed by the principles established in the law and in this policy. JM ESTRADA S.A. will not require Authorization when the law permits it.

8.2. Authorized to authorize Processing: Authorization for the Processing of personal data will be granted by:

• 1. The Data Subject, who must prove their identity.
• 2. The representative and/or attorney-in-fact of the Data Subject, upon accreditation of representation or power of attorney.

8.3. Means to obtain Authorization: Authorization may be obtained and/or granted through different means such as: i) verbal, ii) physical or electronic documents, iii) websites, iv) any other format. In any case, obtaining consent and Authorization must contain unequivocal behaviors, through which it is concluded that if it had not been carried out by the Data Subject, or the person empowered to do so, the data would not have been stored or captured in the Database.

8.4. Proof of authorization: Regardless of the means by which Authorization for the processing of personal data has been obtained, it is necessary to retain the proof of the Authorization granted by the data subjects to JM ESTRADA S.A., for which it will use the mechanisms available to it and adopt the necessary actions to maintain the record of the form, date, and manner in which the Authorization was obtained.

8.5. Legal exceptions to obtaining authorization: The Authorization of the data subject must be prior, express, and informed, except for the following exceptions:

• a. Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
• b. Public nature data.
• c. Cases of medical or health emergency.
• d. Processing of information authorized by law for historical, statistical, or scientific purposes.
• e. Data related to the Civil Registry of Persons.

NINTH: PURPOSE OF DATA PROCESSING

9.1. JM ESTRADA S.A. is a company dedicated to carrying out any lawful act of commerce according to the following activities:

• 1. Manufacturing, assembly, repair, distribution, import, and export of all kinds of machinery for agricultural or industrial use.
• 2. Import, export, purchase, distribution, and sale of spare parts, components, and accessories for all kinds of machinery for agricultural or industrial use.
• 3. Acquisition, economic exploitation, and administration of commercial establishments related to the aforementioned activities or businesses.
• 4. Agency or representation of natural or legal persons, national or foreign, that manufacture, assemble, or distribute the aforementioned items.
• 5. Investment in real estate, shares, securities, income papers, or other credit documents, and in general, in assets that produce income.

In the development of its object, the company may acquire, give or take on lease, encumber or limit the ownership of all kinds of equipment, movable or immovable property, materials, or elements necessary for the execution of its object; carry out financial operations to acquire the funds or other assets necessary for the development of the company; establish companies, link to others with a similar or complementary purpose to its own, or associate with third parties; and in general, carry out all business or operations directly related to the corporate purpose and all acts aimed at exercising the rights and fulfilling the obligations arising from the existence and activities carried out by the company.

Additionally, acts directly related to the aforementioned purpose and those aimed at exercising the rights or fulfilling the legal or conventional obligations arising from the existence and activity of the company are understood to be included in the aforementioned corporate purpose. JM ESTRADA S.A. requires the processing of personal data, the purpose of which is as follows:

● Human Resources Databases: JM ESTRADA S.A. has a permanent staff necessary to achieve its statutory purposes and comply with its legal and contractual obligations. JM ESTRADA S.A. is responsible for the personal data of all its employees in order to adequately develop its corporate purpose. It is also necessary to have the personal data of individuals who are potential employees to be part of JM ESTRADA S.A., in order to streamline the selection processes and obtain more efficient results. This database aims to fulfill JM ESTRADA S.A.'s contractual obligations with its employees and also facilitates JM ESTRADA S.A.'s obligations to its customers, suppliers, or contractors. Regarding potential employees, the database aims to conduct more efficient and shorter selection processes, classifying potential candidates if necessary or retaining their data for a subsequent call, which may also be used for other selection processes within JM ESTRADA S.A. The Human Resources Database is primarily composed of, but not limited to:

i. Information recorded in the application of possible candidates to be employed by JM ESTRADA S.A..

ii. Information of JM ESTRADA S.A. employees, which includes: i) Full name. ii) Identification number. iii) Address. iv) Marital status. v) Telephone. vi) Email. vii) Bank account. viii) Social security-related data. First Paragraph: Individuals interested in joining JM ESTRADA S.A. as employees or becoming part of it through a service provision contract must first expressly state that they authorize the processing of their personal data in accordance with this policy and the stated purposes.

9.2. Suppliers Databases: JM ESTRADA S.A. requires various suppliers of products and/or services to fulfill its contractual obligations and to provide tools to its employees within their duties. Therefore, for the hiring of suppliers and for JM ESTRADA S.A. to comply with its legal, contractual, and statutory obligations, certain personal data of:

• (a) Suppliers.
• (b) Potential suppliers.
• (c) Employees or personnel of its suppliers or potential suppliers.

Must be collected. Therefore, JM ESTRADA S.A. requires collecting, storing, using, circulating, and in general, carrying out activities related to the processing of personal data, which allow it to guarantee compliance with its obligations, verify compliance with the obligations by the suppliers, as well as the payment of benefits to its employees, if applicable, and other activities to carry out its corporate purpose properly, efficiently, and integrally. The Suppliers Database primarily consists of, but is not limited to: i) Name. ii) Tax identification number. iii) Financial, credit, and service information. iv) General and specific identification data of each contact. v) Personal and professional data of each contact. vii) Financial information (bank accounts). viii) Tax information (whether it is a large taxpayer, self-withholder, etc.)

9.3. Customer Databases: Customers are ultimately those who allow JM ESTRADA S.A.'s corporate purpose to be developed, so it is essential to collect, store, and use their personal data, essentially to know the nature of the service to be provided to them and also to send the corresponding invoices for the services rendered. Customer personal data is necessary to maintain constant contact with them and to fulfill the contractual obligation derived from the provision of services, which goes hand in hand with JM ESTRADA S.A.'s policy and quality standards. In addition, the data will be used for accounting, commercial purposes, as well as for the promotion of events of JM ESTRADA S.A. and sending newsletters. This Database also includes information about potential customers of JM ESTRADA S.A., in order to send them service proposals or to maintain contact in case the authorization for service proposals is pending, or any other document that allows the start of service provision. The data with which the customer database is composed, -but not necessarily limited to-: i) Customer name. ii) Contact name. iii) Identification. iv) Address. v) Email. vi) Telephone. vii) City. viii) Tax information (whether it is a large taxpayer, self-withholder, etc.) ix) Financial information (bank accounts), x) Financial, credit, and service information and consultation in databases.

TENTH: DATA OF MINORS:

10.1. The processing of personal data must always respect the rights of minors. To obtain Authorization, -if applicable-, parents or, failing that, legal representatives, have the power to authorize or not the processing of personal data of minors, provided that:

• a) It responds to and respects the best interests of the minors.
• b) It ensures respect for the fundamental rights of minors.
• c) It is supported by the proper written consent in which their parents or, failing that, the legal representative, grants Authorization for the processing of the minor's personal data, prior to the exercise by the minor of their right to be heard, taking into account the maturity, autonomy, and capacity of the minor to understand the matter.

10.2. The data of minors that JM ESTRADA S.A may possess is exclusively for recreational events or for the delivery of occasional gifts, for matters related to compliance with labor and social security obligations.

ELEVENTH: INFORMATION SECURITY

11.1. JM ESTRADA S.A., in application of the Principle of Security in the Processing of Personal Data, will provide the technical, human, and administrative measures that are necessary to grant security to the records, avoiding their adulteration, loss, consultation, use, or unauthorized or fraudulent access.

11.2. On the other hand, Databases that are consolidated in electronic files will have a backup copy assigned the same security key as the main file, and access to it will be limited to the Data Processor and their Substitute Data Processor. The obligation and responsibility of JM ESTRADA S.A. is limited to providing the adequate means for this purpose. JM ESTRADA S.A. will maintain security protocols that are mandatory for personnel with access to personal data and information systems.

TWELFTH: INFORMATION SECURITY PROCEDURE FOR HANDLING INQUIRIES, COMPLAINTS, REQUESTS FOR RECTIFICATION, UPDATES, DATA ERASURE, AND AUTHORIZATION REVOCATION.

12.1. The security measures of the Databases, whose administration is under JM ESTRADA S.A, are subject to strict security measures, the compliance of which must be guaranteed by each of the employees of JM ESTRADA S.A who have access to them. The Databases that exist in electronic files, either on the computers of the officials or in the backup copy of JM ESTRADA S.A, are protected by passwords, which only the employees who need to access them for the ordinary exercise of their duties can know. The Databases that exist in physical media are the responsibility of each official of JM ESTRADA S.A, who must always keep them under lock and key or any equivalent mechanism that allows restricted access to them at all times. Any kind of violation or threat to the databases must be reported immediately to the systems area and to the administrative direction, who must inform the Superintendence of Industry and Commerce in the most expeditious manner.

12.2. Procedure for addressing requests, inquiries, or complaints by Data Subjects Requests, complaints, claims, requests for updates, Data Erasure, together with requests for revocation of the Authorization, will be received at the email address: pqrs@jmestrada.comm, by the responsible persons who will have access to the email set up to receive inquiries or complaints. A record of the receipt and processing of the request will always be made, under the following procedure:

• a. INQUIRIES: Inquiries will be addressed within the legal term granted for this purpose (10 business days). When it is not possible to address the inquiry within said term, the interested party will be informed before the expiration of the ten (10) business days from the date of receipt of the inquiry, expressing the reasons for the delay and indicating the date on which their inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.
• b. COMPLAINTS, UPDATES, OR RECTIFICATIONS: The Data Subject may file complaints, updates, or rectifications when the information needs to be corrected, deleted, or updated, and/or in case JM ESTRADA S.A is not complying with the duties contained in this policy or the law. The complaint will be processed under the following rules: - ● The Data Subject's complaint will be filed to the email address [pqrs@jmestrada.comm] or physically at the premises of the Company, with the identification of the Data Subject, the description of the facts that give rise to the complaint, the address, and the documents that they wish to assert. - In case the recipient of the complaint is not competent to resolve it, it will be forwarded to the appropriate person within a maximum term of two (2) business days and the situation will be reported to the interested party. - The maximum term to address the complaint will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to address the complaint within said term, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

c. REQUEST FOR DATA ERASURE: The Data Subject has the right to request its Erasure (deletion) in any of the following events:

• - They consider that they are not being processed in accordance with the principles, duties, and obligations established by current regulations.
• - They have ceased to be necessary or relevant for the purpose for which they were collected.
• - The period necessary for the fulfillment of the purposes for which they were collected has elapsed. This deletion implies the total or partial elimination of personal information in accordance with the request made by the Data Subject in the records, files, databases, or Treatments carried out by JM ESTRADA S.A. However, the above, JM ESTRADA S.A may deny the Erasure of the data when:
• The Data Subject has a legal or contractual duty to remain in the Database.
• The deletion of data obstructs judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions.

In case of refusal by JM ESTRADA S.A, the Data Subject has the right to request the Superintendence of Industry and Commerce to order the Erasure of the personal information.

d. AUTHORIZATION REVOCATION: The Data Subject has the right to request the revocation of the Authorization in any of the following events:

In case of refusal by JM ESTRADA S.A, the Data Subject has the right to request the Superintendence of Industry and Commerce to order the Erasure of the personal information.

• • They consider that they are not being processed in accordance with the principles, duties, and obligations established by current regulations.
    • They have ceased to be necessary or relevant for the purpose for which they were collected.
  • The period necessary for the fulfillment of the purposes for which they were collected has elapsed. Revocation of the Authorization implies that JM ESTRADA S.A cannot continue to process the personal data of the Data Subject. However, the above, JM ESTRADA S.A may deny the Erasure of the data when:
    • The Data Subject has a legal or contractual duty to remain in the Database.
    • The revocation of the Authorization obstructs judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions.

THIRTEENTH: NATIONAL DATABASE REGISTRATION

13.1. The National Database Registry is the public directory of databases subject to processing in the country, and it will be freely accessible to citizens according to the regulations issued by the National Government for this purpose.

13.2. The Registry is managed by the Superintendence of Industry and Commerce. As the data controller, JM ESTRADA S.A. must ensure compliance with all obligations arising from the registration of databases and their administration as per Article 17 of Law 1581 of 2012 and those indicated in section 4 of this document.

FOURTEENTH: DURATION AND MODIFICATION OF THE DATA PROCESSING POLICY

14.1. The Data Processing Policy is effective from January 1, 2022. Any substantial modifications to it will be communicated efficiently to Data Subjects before implementation.

MANAGER.

_________________________

C.C.