Invest Latam

INVEST LATAM SAS

PERSONAL DATA PROTECTION POLICY

The Personal Data Protection Policy (hereinafter “the Policy) of INVEST LATAM SAS (hereinafter “INVEST LATAM” or “the Company”) establishes the conditions, obligations, procedures and other guidelines aimed at guaranteeing the constitutional right of habeas data. of all the holders of whom INVEST LATAM, as Data Controller, requests, uses, stores, corrects, assigns, deletes or in general processes personal data and/or sensitive data. The purpose of this Policy is to comply with the provisions of Law 1581 of 2012, Decree 1377 of 2013, Law 1266 of 2008 and, in general, the applicable legislation, which regulates the processing of personal data and establishes the owners' rights.

By expressly accepting this Policy; Through oral manifestation, written communication, by clicking "accept" on the Website, through messages through social networks, in INVEST LATAM Apps or through any other unequivocal conduct, the owner acknowledges that he has read and understands all the terms included here and that in turn expressly authorizes INVEST LATAM to Process personal data and/or sensitive data under the provisions of this Policy and for the purposes described in this document or in accordance with those additional that are presented to the owner prior to the processing of their personal data. With the acceptance of this Policy, the owner also declares to know what his rights are in relation to his personal data and sensitive data,

1. RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

INVEST LATAM is Responsible for the Processing of personal data of the holders with respect to which it obtains authorization, on which it will decide directly and autonomously. Their contact details are:

Address: Bogotá (Colombia)

Address: Calle 95 #14-45, 8th Floor

Email: info@investlatam.com

Telephone: +5713814900

2. DEFINITIONS AND PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

2.1. DEFINITIONS

For the full understanding of these policies, the words in bold that are cited below will have the corresponding meaning that is found in front of each of them:

Authorization: Prior and express consent by the owner to process their personal data.

Database: Organized set of data in digital or physical form that is subject to treatment.

Personal data: Any information linked or associated with a specific or determinable natural person.

Public data: Public data is considered, among others, data related to the marital status of people, their profession or trade and their quality as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial decisions that are not subject to reservation.

Sensitive data: It is any personal data that may affect the privacy of its owner or whose inappropriate use leads to situations of discrimination. These could include racial or ethnic origin, political orientation, religious orientation, membership in union groups, social organizations or political parties. Likewise, data related to the state of health, sexual life, biometric data, photographs, among others.

Responsible for the processing of personal data: Natural or legal person who performs the processing of personal data on behalf of the Data Controller (INVEST LATAM) and who does not have the quality of employee or official of the Data Controller.

Responsible for the processing of personal data: Natural or legal person who, by itself or in association with others, decides on the database and/or the Treatment thereof. In this case, the Data Controller is INVEST LATAM.

Holder: Natural person whose personal data is subject to treatment.

Treatment: Any operation that is carried out on personal data such as collection, storage, use, circulation or deletion, among others.

Transfer: The transfer of data takes place when the Person in Charge and/or Person in Charge of the Processing of personal data, located in Colombia, sends the information or personal data to a receiver, who in turn is Responsible for the Treatment and is inside or outside from the country.

Transmission: Treatment that implies the communication of personal data inside or outside the Colombian territory, so that a Manager carries out a specific treatment of that information on behalf of the Responsible.

Security incident: tampering, loss, consultation, use or unauthorized or fraudulent access.

PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA

For the Processing of personal data, INVEST LATAM will take into account the following principles:

Principle of legality regarding the Processing of Personal Data: For the processing of personal data, INVEST LATAM will be subject to what is established in the regulatory framework that governs the protection of personal data.

Principle of purpose: INVEST LATAM will process personal data for a legitimate purpose in accordance with the applicable legislation and the authorization granted by the owner, a purpose that will be informed to the owner in any case.

Principle of freedom: INVEST LATAM will only carry out the processing of non-public personal data with the prior, express and informed consent of the owner, except in cases where the processing is authorized by law. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.

Minimization principle: The personal data processed by INVEST LATAM will be adequate, pertinent and limited to what is necessary in relation to the purposes for which they were collected and reported to the owner.

Principle of veracity or quality: The information subject to treatment by INVEST LATAM must be truthful, complete, exact, updated, verifiable and understandable. The Treatment of partial, incomplete, fragmented or misleading data is prohibited. All reasonable steps will be taken to promptly delete or rectify personal data that is inaccurate with respect to the purposes for which it is processed.

Principle of transparency: In the processing of your personal data, the Holder's right to obtain from INVEST LATAM, in his capacity as the Data Controller, or the respective Data Processor, at any time and without restrictions, information about the existence of of data that concerns you.

Principle of access and restricted circulation: The Treatment is subject to the limits derived from the nature of the personal data, and the provisions of constitutional and legal order. In this sense, except for public information, personal data may not be publicly available on the Internet or other means of disclosure or mass communication, unless there is authorization from the holder and access is technically controllable to provide restricted knowledge only to the Holders. or to authorized third parties. In this sense, the obligation of INVEST LATAM is one of means.

Security principle: The information subject to Treatment by INVEST LATAM will be handled with the minimum technical, human and administrative measures that are necessary to provide security to the records, in order to avoid their adulteration, loss, consultation, use or unauthorized access. or fraudulent.

Confidentiality principle: All persons involved in the processing of personal data or personal databases, which are not of a public nature, will be obliged to guarantee the confidentiality of such information, an obligation that subsists even after the end of their relationship with any of the tasks included in the Treatment.

Conservation limitation principle: The personal data processed by INVEST LATAM will be kept in a way that allows the identification of the interested parties for no longer than is necessary for the purposes for which authorization was obtained. However, INVEST LATAM may keep personal data for longer periods when it is exclusively for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in accordance with what the applicable law establishes in this regard, without prejudice to the application of appropriate technical and organizational measures to guarantee the rights of the owners.

3. PROCESSING OF PERSONAL DATA and AUTHORIZATION OF THE HOLDER

3.1. Public Data

Data of a public nature and/or contained in public records may be processed by INVEST LATAM without the prior authorization of its owner, in accordance with the provisions of the Law; however, with respect to such data, the rest of the measures contemplated in the aforementioned principles and the other provisions of this Policy that are applicable will be adopted.

3.2. Sensitive Data

If the Holder is a candidate, employee or former employee of INVEST LATAM, by accepting this Policy they accept that the Company may Process their Personal Data and Sensitive Data such as those related to health and their background to (i) carry out the selection processes, (ii) carry out activities derived from the execution of the contractual employment relationship and (iii) to comply with legal obligations and administrative or judicial orders.

On the other hand, the portfolio of products offered by INVEST LATAM requires the Processing of Personal Data and Sensitive Data of clients by the Company. Due to the foregoing, in addition to the Processing of Personal Data of the client included in section 4 of this Policy, INVEST LATAM requires Processing Sensitive Data limited to those regarding the credit history, payment capacity and debts of its clients. If the Holder is a client, he accepts that the Company carries out the Treatment of his Sensitive Data for the granting of the credit and its subsequent collection. Likewise, by accepting this Policy, the Holder accepts and authorizes in a prior, express and informed manner that both the information on their contact data and that regarding their debt, may be shared with third parties, which includes, without limitation, contacts of the Holder on social networks with the sole purpose of carrying out the collection of the credit granted through third parties when it is not possible to contact the Holder.

In any case, by clicking "accept" on the Website, through messages through social networks, in INVEST LATAM Apps or through any other unequivocal conduct, the Holder acknowledges that he has read and understands all of the terms included herein and which in turn expressly authorizes INVEST LATAM to Process your Sensitive Data under the provisions of this Policy and for the purposes described. The Holder accepts that he has been informed that his authorization for the Treatment of his Sensitive Data is strictly voluntary, without prejudice to the fact that without obtaining them, the Purpose of the Treatment cannot be carried out.

The Sensitive Data that INVEST LATAM collects will be treated under adequate security and confidentiality standards only for the purposes set forth herein and will be eliminated once the Purpose of the Treatment is fulfilled.

3.3. Treatment of data of minors

INVEST LATAM does not process personal data of minors; however, if it is necessary to process such data in the development of its processes and activities, INVEST LATAM will do so taking into account the following guidelines:

● That responds to and respects the best interests of children and adolescents.

● To ensure respect for their fundamental rights.

● That the minor's opinion be valued when he/she has the maturity, autonomy and capacity to understand the matter.

● That there is authorization for the processing of the data by the representative or guardian of the child or adolescent.

3.4. Processing of other personal data

Without prejudice to the guidelines previously established for the Treatment of personal data of a public, sensitive nature and of minors, INVEST LATAM requires Processing the personal information described below. Therefore, by clicking "accept" on the Website, through messages through social networks, in INVEST LATAM Apps or through any other unequivocal conduct, the owner acknowledges that he has read and understands all of the terms included herein and that in turn expressly authorizes INVEST LATAM to Process your Personal Data under the provisions of this Policy and for the purposes described in Section 4 of this document or in accordance with those additional ones that may be requested. present to the Holder to obtain his authorization prior to the processing of his personal data:

INVEST LATAM will use the mechanisms available to it to prove, through physical files and/or electronic repositories, that the Owner has granted its authorization in cases where this is required in accordance with the principle of demonstrated responsibility.

4. PURPOSE OF PERSONAL DATA PROCESSING

Personal Data will be Processed for the following purposes (“Processing Purposes”):

4.1. Employees: The personal data of the Employees will be processed by INVEST LATAM for the design and execution of education, training, and well-being plans; settlement and payment of payroll and social benefits; design and execution of the occupational health and safety plan; emergency care; affiliations to healthcare providers, pension and severance funds, compensation funds; consultation of your data on the OFAC list, the United Nations and other official lists on the financing of terrorism and money laundering; profile study; search of judicial, fiscal or disciplinary antecedents; be passed on to customers contractors or suppliers when strictly necessary for the management and development of the commercial relationship between the latter and INVEST LATAM or the resolution of conflicts; its transmission to other entities or authorities before which INVEST LATAM requires to carry out a procedure or request information or that require INVEST LATAM some specific activity of its corporate purpose or activity, as well as for other purposes that are authorized by the owners. When the image is captured through photography and video, it will be treated for registration and security purposes. The biometric data, if collected, will be used to subsequently validate and when necessary the authenticity of the respective documents signed by the owner. its transmission to other entities or authorities before which INVEST LATAM requires to carry out a procedure or request information or that require INVEST LATAM some specific activity of its corporate purpose or activity, as well as for other purposes that are authorized by the owners. When the image is captured through photography and video, it will be treated for registration and security purposes. The biometric data, if collected, will be used to subsequently validate and when necessary the authenticity of the respective documents signed by the owner. its transmission to other entities or authorities before which INVEST LATAM requires to carry out a procedure or request information or that require INVEST LATAM some specific activity of its corporate purpose or activity, as well as for other purposes that are authorized by the owners. When the image is captured through photography and video, it will be treated for registration and security purposes. The biometric data, if collected, will be used to subsequently validate and when necessary the authenticity of the respective documents signed by the owner. as well as for other purposes that are authorized by the owners. When the image is captured through photography and video, it will be treated for registration and security purposes. The biometric data, if collected, will be used to subsequently validate and when necessary the authenticity of the respective documents signed by the owner. as well as for other purposes that are authorized by the owners. When the image is captured through photography and video, it will be treated for registration and security purposes. The biometric data, if collected, will be used to subsequently validate and when necessary the authenticity of the respective documents signed by the owner.

The processing of Employee data for the indicated purposes may be done directly by INVEST LATAM or through its Processing Managers.

4.2. Contractors, suppliers (includes representatives, employees, and in general collaborators of contractors and/or suppliers): The data will be processed by INVEST LATAM to search for, quote and contract the supply of goods or services; verify the holder's data and the required requirements; manage the proper fulfillment of the object and obligations of the contract for the supply of goods or services; administrative, financial and accounting management of the payment of fees or corresponding sums; seek the resolution of conflicts through alternative procedures, arbitration tribunals or judicial mechanisms, which includes their transfer to the legal, accounting, financial and other advisors that are necessary;

4.3. Users of the Website or App: Your personal information will be processed by INVEST LATAM to allow the owner to use certain services available on the INVEST LATAM Website and/or App that are subject to the provision of certain information, the sending of commercial information of INVEST LATAM, its services, platform and activities associated with its corporate purpose to the communication channels registered by the owner, call the indicated telephone number for the same purpose; respond to requests, queries, requests for information and any communication made by the owners; manage the creation of accounts and profiles on the website when required, and others that are authorized by the owners.

The treatment of the data of these holders for the indicated purposes may be done directly by INVEST LATAM or through its Treatment Managers.

4.4. Investors: Investor information will be processed to verify data and compliance with the requirements required to access the INVEST LATAM Services in such capacity; authorize the creation of your account on the INVEST LATAM platform and your participation in the auctions; verify OFAC, United Nations and other official lists on financing of terrorism and money laundering; design and apply customer knowledge programs; verify the origin of the resources and the activity or job performed; consult history and credit behavior; resolve conflicts that arise through alternative mechanisms or judicial procedures; send information through the owner's registered channels regarding INVEST LATAM, its services, platform, and all other commercial information or information not related to the object of INVEST LATAM, its Managers and the relationship established with the owner; transmit them to the Treatment Managers when necessary by virtue of the services to which the holders access; transmit and transfer them to the Companies and their Legal Representatives with respect to whose Financing Projects it has submitted offers or has committed to the disbursement of resources, so that it or its Treatment Managers manage all the corresponding activities for the formalization and fulfillment of the respective operation; make a profile of the owner, as well as statistics and internal ratings, which may eventually be published on the web page for the knowledge of the Companies participating in the auction with their Financing Projects; care of petitions and requests; and all other purposes authorized by the owners through other means.

The treatment of the data of these holders for the indicated purposes may be done directly by INVEST LATAM or through its Treatment Managers.

4.5. Partners, representatives, administrators, agents, employees, collaborators of the Borrowers and any person designated by them for the management of their account and services: The Borrowers who can use the services of the Platform are legal entities; however, on the occasion of the authorization requested by said legal entities to access the Platform and the use they make of it, it may be necessary to supply personal data of their partners, representatives, administrators, employees, collaborators, agents, attorneys-in-fact or other natural persons.

By providing such data, the respective Borrower declares and guarantees to have the authorization of the respective owners to transmit their personal information to INVEST LATAM, which will be processed to verify the information provided about the Borrower; authorize and process the creation of your account on the INVEST LATAM platform and manage the users who can access it; carry out a legal, financial, credit and risk study of the Borrower; create and apply know-your-customer programs for both the Borrower and its representatives, administrators, agents and others; consult your data on the OFAC list, the United Nations and other official lists on financing of terrorism and money laundering; verify their administrative, fiscal, disciplinary and judicial records; analyze and qualify the credit behavior of the Borrower; be transmitted to those in charge of the Treatment, including legal, financial and accounting advisors that are necessary, to verify the profile of the Borrower and its related natural persons; manage portfolio payments and collection; send information through the owner's registered channels regarding INVEST LATAM, its services, platform, obligations, and all other commercial information or information not related to the object of INVEST LATAM, its Managers and the relationship established with the owner; transmit them to the Investors or their Treatment Managers so that they carry out all the necessary steps for the formalization and fulfillment of the operation; manage all other financial activities, administrative and accounting necessary by virtue of the Services used by the Borrower and/or the respective owner and the commercial relationship established with him; make a profile of the Borrower, as well as financial reports, internal statistics and internal ratings, which may eventually be published on the website for the purposes of knowledge of those who participate in the auction as Investors; care of petitions and requests; carry out studies on habits of our services; and all other purposes authorized by the owners. Likewise, they may be transmitted to the Treatment Managers or transferred to other Treatment Managers so that they are used only for the purposes indicated here and in relation to the service provided to the owner.

4.7. Customer contacts: the personal data of customer contacts will be used only to request their help in the collection process prior to the debtor's authorization to share their debt information with such third parties (see section 3.2 of this Policy). The Holders will only be contacted once they expressly accept the friend request through the Facebook social network, which includes a messaging channel. The holder will only continue to be contacted once he expressly accepts the processing of his personal data in accordance with this Policy.

4.8. General public: The data will be processed to respond to requests, queries, and any request for information through the contact channels indicated by the owner; send information about the services, news and, in general, advertising information of INVEST LATAM to the channels registered or indicated by the owner; and the others for which the owner grants authorization.

In addition to the purposes described, INVEST LATAM will process the personal data of the owners for statistical purposes; compliance with the legal and regulatory obligations to which the Company is subject; be transmitted to the Managers so that they carry out the treatment according to the indicated and authorized purposes; and transferred to third parties in the event of a merger, spin-off, transformation, transfer and/or sale of assets of INVEST LATAM and when necessary in the development of the respective relationship established with the owner.

Managers or third parties who have access to personal data by virtue of the Law or contract, will process it exclusively for the aforementioned purposes and under the terms of the respective authorization.

5. USE OF COOKIES

Cookies are small data files that are sent to the browser of a user visiting a website. INVEST LATAM uses cookies for the following purposes:

- Allow you to log in to our Website when you have created an account.

- Remember preferences and parameters.

- Understand how our services are used, and improve and promote them based on that data.

- Perform internal statistics on consumption and use of the Website.

By clicking "accept" on the Website, the owner authorizes the use of cookies by the Company and by third parties for the aforementioned purposes.

6. VALIDITY OF PERSONAL DATA PROCESSING AND CONSERVATION PERIOD

The treatment of personal data will have a validity equal to the period in which the purpose or purposes for which the information was collected is maintained, or the period of validity indicated by the Law, contract or sentence, as appropriate. In any case, the information of the Users of the Website will be treated for the purposes for which their authorization was granted, while the User maintains an active account on the Website.

Although no specific treatment is carried out on the information, it may be kept after the expiration of the validity for which it was collected, when the law establishes the obligation of the Responsible to preserve documents or information, for which in any case INVEST LATAM will make an effort to avoid the identification of the holders if it is appropriate.

7. RIGHTS OF THE HOLDERS

Under the Law, the holders of personal data have the following rights:

● Know, update and rectify your personal data against INVEST LATAM in its capacity as Data Controller, and against those in charge of Data Processing. The rights of updating and rectification may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose treatment is expressly prohibited or has not been authorized.

● Request proof of the authorization granted to INVEST LATAM, except when expressly excepted as a requirement for treatment, in accordance with the provisions of the legislation.

● Be informed by INVEST LATAM or the Person in Charge of Treatment, upon request, regarding the use that has been given to their personal data.

● Submit to the Data Protection Authority complaints or claims for violations of the provisions of the Law, after exhausting the consultation or claim process with INVEST LATAM.

● Request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the treatment. The deletion will proceed when the Personal Data Protection Authority has determined that in the treatment the Responsible and/or Manager have incurred in conduct contrary to the Law.

The request for deletion of the information will not proceed when the holder has a legal or contractual duty to remain in the database or the person in charge has a legal or contractual duty to continue with the treatment.

● Obtain from INVEST LATAM the limitation of the processing of your personal data when: a) the owner contests the accuracy of the personal data, during a period that allows INVEST LATAM to verify the accuracy thereof; b) the treatment is unlawful and the owner opposes the deletion of the personal data and requests instead the limitation of its use; c) INVEST LATAM no longer needs the personal data for the purposes of the treatment, but the owner needs them for the formulation, exercise or defense of claims; d) the owner has opposed its treatment, while it is verified if the legitimate reasons of INVEST LATAM prevail over those of the owner. When the processing of personal data has been limited by virtue of the foregoing, said data may be processed by INVEST LATAM, With the exception of its conservation, with the consent of the owner or for the formulation, exercise or defense of claims, or with a view to protecting the rights of another natural or legal person or for reasons of public interest. Any holder who has obtained the limitation of treatment in accordance with the section will be informed in a timely manner of the lifting of said limitation.

● Free access to your personal data that is subject to treatment. The holder can consult his personal data free of charge: (i) at least once every calendar month, and (ii) every time there are substantial modifications to the information processing guidelines that motivate him to make new consultations.

● Receive the personal data of which you are the owner and that you have provided to INVEST LATAM in a structured format, for common use and mechanical reading, and transmit them to another Data Controller, when: a) the treatment is based on consent, and b ) the treatment is carried out by automated means. When technically possible, the portability of personal data may be made directly from INVEST LATAM to the Data Controller indicated by the owner.

● Object at any time, for reasons related to your particular situation, to your personal data being processed based on the fulfillment of a mission of public interest, in the exercise of public powers conferred on INVEST LATAM, or the satisfaction of legitimate interests pursued by INVEST LATAM or by a third party. Except for the existence of compelling legitimate reasons for the treatment that prevail over the interests, rights and freedoms of the owner, or for the formulation, exercise or defense of claims, INVEST LATAM will cease the treatment of the data that it based on the noted circumstances.

8. PROCEDURES FOR THE EXERCISE OF THE RIGHTS OF THE HOLDERS

In accordance with the purpose of this Policy, the owner's rights are: access, rectification, updating, deletion, limitation and opposition to the processing of their personal data, and portability of their information.

The owner can exercise their rights by writing to info@investlatam.com through the procedures described below:

7.1. Consultation Procedure

The holders may make a query to the email info@investlatam.com when they wish to access or consult their personal information that resides in the INVEST LATAM databases. For this purpose, they must indicate the word "Consultation" in the subject of the mail and must attach a copy of the identity document. If the person making the query is a legal representative and/or proxy of the owner, they must attach a copy of their identity document and the document that proves the capacity in which they are acting (power of attorney).

The query, presented in accordance with what is indicated above, will be answered within a maximum term of ten (10) business days from the date of receipt of the query. When it is not possible to attend the consultation within said term, the interested party will be informed of said situation, expressing the reasons for the delay and indicating the date on which the consultation will be attended, which in no case will be greater than five (5) business days following the expiration of the first term.

Through this procedure, the holders may also request the portability of their personal data, however the term to effectively carry out the portability will not be computed within the term referred to in the preceding paragraph of response to the query. In any case, INVEST LATAM will make the portability of the information in a timely manner according to the amount and size of the information on which the owner makes said request. INVEST LATAM will not be liable for damages or losses suffered by the owner for the time it takes for the data portability to become effective for the owner or another Data Controller, if the owner made this request in advance that was not reasonably enough.

7.2. Claim Procedure

Holders may submit a claim to info@investlatam.com when they consider that the information contained in an INVEST LATAM database should be subject to correction, updating, deletion, limitation or when they notice the alleged breach of any of the contained duties. in the legislation for the treatment of their data, or when they wish to oppose a treatment that is made based on the fulfillment of a mission of public interest, in the exercise of public powers conferred on INVEST LATAM, or the satisfaction of legitimate interests pursued by INVEST LATAM or by a third party.

The claim must contain the identification of the holder, the description of the facts that give rise to the claim, the address, and must be accompanied by a copy of the identification document, and if the person making the claim is a legal representative and/or proxy of the owner, you must also attach the document that proves the capacity in which you are acting (power of attorney). Additionally, the claim must be accompanied by the other documents that are to be asserted and the subject must indicate “Claim”.

If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim. In the event that the person who receives the claim at INVEST LATAM is not competent to resolve it, because for example it was not sent to the indicated email, it will be forwarded to the appropriate person within a maximum period of two (2) business days and the interested party will be informed of the situation. .

Once the complete claim is received, a legend will be included in the database that says "claim in process" and the reason for it, in a term not exceeding two (2) business days. Said legend must be kept until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

8 . PERSONAL DATA PROTECTION OFFICER

The Personal Data Protection Officer or Delegate or the Legal Representative of INVEST LATAM is appointed, who will exercise the functions established by the legislation on data protection for said position. The Personal Data Protection Officer or Delegate can be contacted through info@investlatam.com

9. TRANSFER AND TRANSMISSION OF PERSONAL DATA

In the development of its activities, INVEST LATAM may designate third parties to carry out a specific activity or treatment of the personal data of its Holders, on its behalf. These third parties will have the quality of Treatment Managers, in accordance with the Law, and must observe all the guidelines established in this Personal Data Treatment Policy, especially those related to the principles, purposes, rights of the owners and procedures, for which which INVEST LATAM will ensure that they have access to this document prior to the processing of personal data. Likewise, those in charge of the Treatment must comply with the specific obligations established in the applicable legislation.

Additionally, according to the nature of the activities carried out by INVEST LATAM, the national or international transfer of personal data to third parties may eventually be necessary, so that it is treated by them only in relation to said activities and under confidentiality and reserve guidelines. The transfer of data will be carried out in accordance with the provisions of the legislation and in any case there will be no place for international transfer when the country of the third party that receives it does not offer adequate levels of data protection. In the case of the information of those who participate as Investors in the INVEST LATAM platform, the transfer of their information will only be made for the purposes of executing the Participation Agreement in the Platform entered into between the respective owner and INVEST LATAM,

By clicking "accept" on the Website, through messages through social networks, in INVEST LATAM Apps or through any other unequivocal conduct, the owner authorizes the transmission and transfer of their personal data and/or data sensitive personal information to authorized third parties, including, without limitation, administrative or judicial authorities under the conditions of this document.

10. DATABASE SECURITY MEASURES

INVEST LATAM will implement the minimum technical, human and administrative measures that are necessary to provide security to the personal databases and the personal information and sensitive personal information contained therein, in order to prevent their adulteration, loss, consultation, use or unauthorized access. or fraudulent.

Any Security Incident will be treated as required by applicable law and in accordance with the guidelines of the Superintendency of Industry and Commerce.

11. REGISTRATION OF DATABASES

By virtue of the obligations established by Law, and in accordance with the regulations issued by the National Government, INVEST LATAM will register the personal databases whose information it processes in the National Registry of Databases (RNBD) administered by the Superintendence of Industry and Commerce (SIC). The RNBD is the public directory of databases subject to Treatment that operate in the country and is freely accessible to citizens. The registration does not imply the provision or delivery of specific data of the holders to the SIC or their registration in the RNBD.

12. VALIDITY OF THE POLICY AND CHANGES IN THE POLICIES

This Personal Data Processing Policy corresponds to Version 2 and is effective as of January 14, 2021.

INVEST LATAM is empowered to update or modify this Data Processing Policy periodically, so it is advisable to pay attention to the announcements or additional windows that appear on this Website.

Invest Latam

NIT: 901 204 195 - 2