1. SCOPE

This Personal Data Protection Policy will apply to all Databases and/or Files containing Personal Data that are processed by GRUPO SAMBAL CTG SAS, considered responsible for and/or in charge of processing Personal Data (hereinafter SAMBAL).

  1. IDENTIFICATION OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

SAMBAL with address: Avenida 1, # 70-73 Conjunto Palmarés de Crespo in the city of Cartagena, Colombia, identified with Tax Identification Number NIT 1051815699-2

Email: info@jarisfarm.com, phone: 3015920818

  1. DEFINITIONS

Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of Personal Data.
Privacy Notice: Verbal or written communication generated by the data controller, addressed to the Data Subject for the Processing of their Personal Data, through which they are informed of the existence of the Information Processing Policies that will be applicable to them, how to access them, and the purposes of the Processing intended for their personal data.
Database: Organized set of Personal Data that is the object of Processing.
Personal Data: Any information linked to or that can be associated with one or more specific or determinable natural persons.
Sensitive Data: Information that affects the privacy of individuals or whose misuse may generate discrimination (racial or ethnic origin, political orientation, philosophical or religious beliefs, membership in trade unions or social or human rights organizations, health data, sexual life and biometrics)
Data Processor: A natural or legal person, public or private, who, either alone or in association with others, processes Personal Data on behalf of the Data Controller. In the event that the Controller does not act as the Database Manager, the Data Processor will be expressly identified.
Data Controller: A natural or legal person, public or private, who, either alone or in association with others, decides on the Database and/or the Processing of the data.
Terms and Conditions: general framework that establishes the conditions for participants in commercial or related activities.
Owner: Natural person whose Personal Data is subject to Processing.
Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.
Transfer: Data transfer occurs when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, who is also the Controller of the data and is located within or outside the country.
Transmission: Processing of Personal Data that involves communicating the same within or outside the territory of the Republic of Colombia when the purpose is to carry out Processing by the Data Processor on behalf of the Controller.

  1. TREATMENT

JARIS, acting as the Controller of Personal Data, for the proper development of its commercial activities, as well as to strengthen its relationships with third parties, collects, stores, uses, circulates and deletes Personal Data corresponding to natural persons with whom it has or has had a relationship, such as, but not limited to, employees and their families, shareholders, consumers, clients, distributors, suppliers, creditors and debtors.

  1. PURPOSE

Personal Data is processed by JARIS for the following purposes:

5.1 Participation in different types of surveys through online registrations or forms.

5.2 Completion of subscription applications, product orders or to facilitate the request for specific information that may be required from us.

5.3 Make it easier for you to use our website.

5.4 Tailor the most relevant content to your interests.

5.5 Inform you of important news concerning JARIS.

5.6 Inform you about our new products or services, product updates, events and special offers.

5.7 Promote products and services on our website and the websites of our business partners.

5.8 Prevent and detect fraud or other illegal or prohibited activities.

5.9 Ensure the security and integrity of our Website.

5.10 As part of an ongoing sales process.

5.11 While providing technical support or consulting regarding any product.

  1. 12 To be part of the process of improving our products.
  2. 13 To be part of automated media such as communication protocols.
  3. RIGHTS OF PERSONAL DATA OWNERS

Natural persons whose Personal Data is processed by JARIS have the following rights, which they may exercise at any time:

6.1. To know the Personal Data that JARIS is processing. Likewise, the Data Subject may request at any time that their data be updated or corrected, for example, if they find that their data is partial, inaccurate, incomplete, fragmented, misleading, or whose processing is expressly prohibited or unauthorized.

6.2. Request proof of the authorization granted to JARIS for the Processing of your Personal Data.

6.3. Be informed by JARIS, upon request, regarding the use that it has given to your Personal Data.

6.4. Submit complaints to the Superintendency of Industry and Commerce for violations of the Personal Data Protection Act.

6.5. Request JARIS to delete your Personal Data and/or revoke the authorization granted for its processing by submitting a complaint in accordance with the procedures established in Section 11 of this Policy. However, requests to delete information and revoke authorization will not be admissible when the Data Subject has a legal or contractual obligation to maintain the information in the Database and/or Archives, or while the relationship between the Subject and JARIS, under which their data was collected, is in effect.

6.6. Access your Personal Data being Processed free of charge.

  1. AUTHORIZATION

SAS must request prior, express and informed authorization from the Holders of the Personal Data on which it requires processing.

8.1. Prior authorization means that consent must be given by the Data Subject at the latest at the time of collection of Personal Data.

8.2. Express authorization means that the Data Subject's consent must be explicit and specific; open-ended and non-specific authorizations are not valid. The Data Subject must express their willingness to authorize JARIS to process their Personal Data.

This manifestation of the Holder's will may be given through different mechanisms made available by JARIS, such as:

In writing, for example, by completing an authorization form such as the one indicated in Annex 1.
Orally, for example, in a telephone conversation or video conference.
Through unequivocal conduct that allows us to conclude that you have given your authorization, for example, through your express acceptance of the Terms and Conditions of an activity within which the authorization of participants is required for the Processing of their Personal Data.
IMPORTANT: Under no circumstances will JARIS equate the Owner's silence with unequivocal conduct.

Regardless of the mechanism used by JARIS, the authorization must be retained so that it can be consulted later.

8.3. Informed Authorization means that, when requesting consent from the Data Subject, the Data Subject must be clearly informed:

The Personal Data that will be collected.
The identification and contact details of the Controller and the Data Processor.
The specific purposes of the Treatment that is intended to be carried out, that is: how and for what purpose the collection, use, and circulation of Personal Data will be carried out
What rights do you have as the Data Subject? For more information, see Section 6 of this Policy.
The optional nature of the response to questions asked when they relate to sensitive data or the data of children and adolescents.

  1. SPECIAL PROVISIONS FOR THE PROCESSING OF SENSITIVE PERSONAL DATA.

According to the Personal Data Protection Act, sensitive data is considered to be that which affects privacy or whose misuse may lead to discrimination, such as data related to:

Racial or ethnic origin.
Political orientation.
Religious/philosophical convictions.
Membership in trade unions, social organizations, human rights organizations or political parties.
Health.
Sex life.
Biometric data (such as fingerprint, signature and photo).
The processing of sensitive personal data is prohibited by law, unless expressly authorized in advance and with the prior written consent of the data subject, among other exceptions set forth in Article 6 of Law 1581 of 2012.

In this case, in addition to meeting the requirements established for authorization, JARIS must:

Inform the Owner that since the data is sensitive, he or she is not obliged to authorize its processing.
Inform the Data Subject which of the data to be processed are sensitive and the purpose of the processing.
IMPORTANT: No activity may be conditioned on the Owner providing Data

Sensitive people.

  1. SPECIAL PROVISIONS FOR THE PROCESSING OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS

Pursuant to Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, JARIS will only carry out Processing, that is, the collection, storage, use, circulation, and/or deletion of Personal Data corresponding to children and adolescents, provided that such Processing responds to and respects the best interests of the children and adolescents and ensures respect for their fundamental rights. Once the above requirements have been met, JARIS must obtain authorization from the child's or adolescent's legal representative, prior to the minor exercising their right to be heard. This opinion will be assessed taking into account their maturity, autonomy, and ability to understand the matter.

  1. PROCEDURE FOR HANDLING AND RESPONDING TO REQUESTS, QUERIES, COMPLAINTS AND CLAIMS FROM PERSONAL DATA OWNERS

The owners of Personal Data collected, stored, used, or circulated by JARIS may exercise their rights to access, update, correct, and delete information, as well as revoke their authorization, at any time. To this end, the following procedure will be followed, in accordance with the Personal Data Protection Law:

11.1. ATTENTION AND RESPONSE TO REQUESTS AND QUERIES:

What does the procedure involve?

The Holder or his successors in title may request JARIS, through the means indicated below:

Information about the Data Subject's Personal Data that is being processed.
Request proof of the authorization granted to JARIS for the Processing of your Personal Data.
Information regarding JARIS's use of your personal data. Means available for submitting requests and inquiries: JARIS has established the following means for receiving and responding to requests and inquiries, all of which allow for the preservation of evidence:
Communication addressed to The Jaris Farm, Avenida 1, # 70-73 Conjunto Palmarés de Crespo, Cartagena
Application submitted to the email: info@jarisfarm.com
Attention and response from JARIS:

Requests and queries will be attended to within a maximum period of ten (10) business days from the date of receipt. When it is not possible to attend to the request or query within this period, the interested party will be informed, stating the reasons for the delay and indicating how their request or query will be attended to, which in no case may exceed five (5) business days following the expiration of the first term.

11.2. ATTENTION AND RESPONSE TO COMPLAINTS AND CLAIMS:

What does the procedure involve?

The Holder or his successors in title may request THE COMPANY, through a complaint or claim submitted through the channels indicated below:

Correction or updating of information.
The deletion of your Personal Data or the revocation of the authorization granted for the Processing of the same.
That the alleged breach of any of the obligations contained in the Personal Data Protection Law be remedied or corrected.
The request must contain a description of the facts giving rise to the complaint or claim, the applicant's address and contact information, and must be accompanied by any documents to be asserted.

Means enabled for submitting complaints and claims:

JARIS has provided the following means for receiving and addressing complaints and claims, all of which allow for maintaining proof of their submission:

Communication addressed to The Jaris Farm, Avenida 1, # 70-73 Conjunto Palmarés de Crespo, Cartagena.
Application submitted to the email: info@jarisfarm.com
Attention and response from JARIS:

If the complaint or claim is submitted incompletely, JARIS must request the interested party to correct the deficiencies within five (5) days of receiving the complaint or claim. After two (2) months from the date of the request, if the applicant does not submit the required information, it will be understood that the applicant has withdrawn the complaint or claim.

In the event that the person receiving the complaint or claim is not competent to resolve it, he/she will forward it to JARIS within a maximum period of two (2) business days and inform the interested party of the situation.

Once the complete complaint or claim has been received, a legend stating "claim in process" and the reason for it will be included in the Database within a period of no more than two (2) business days. This legend must remain in effect until the complaint or claim is resolved.

The maximum term for addressing the complaint or claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the complaint or claim within this term, the interested party will be informed of the reasons for the delay and the date on which the complaint or claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

  1. INFORMATION OBTAINED PASSIVELY

When accessing or using the services contained within JARIS's websites, JARIS may passively collect information through information management technologies such as "cookies." These technologies collect information about the user's hardware and software, IP address, browser type, operating system, domain name, access time, and referring website addresses. These tools do not directly collect users' Personal Data. Information will also be collected about the pages a user visits most frequently on these websites in order to understand their browsing habits. However, users of SAS's websites have the option to configure the use of cookies according to their internet browser options.

  1. PERSONAL DATA SECURITY

JARIS, in strict application of the Principle of Security in the Processing of Personal Data, will provide the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, unauthorized or fraudulent consultation, use, or access. JARIS's obligation and responsibility is limited to providing the appropriate means for this purpose. JARIS does not guarantee the total security of your information nor is it responsible for any consequences arising from technical failures or improper access by third parties to the Database or File in which the Personal Data processed by JARIS and its Processors are stored. JARIS will require the service providers it hires to adopt and comply with the appropriate technical, human, and administrative measures for the protection of the Personal Data in relation to which said providers act as Processors.

  1. TRANSFER, TRANSMISSION, AND DISCLOSURE OF PERSONAL DATA SAS may disclose the Personal Data it processes to its affiliated companies worldwide, for use and processing in accordance with this Personal Data Protection Policy. Likewise, JARIS may provide Personal Data to third parties not affiliated with JARIS when:

a. They are contractors performing contracts for the development of JARIS activities;

b. By transfer of any kind of business line to which the information relates.

In any case, in the Personal Data transmission contracts signed between JARIS and the Data Processors, it will be required that the information be treated in accordance with this Personal Data Protection Policy and the following obligations will be included on the part of the respective Data Processor:

To process, on behalf of JARIS, the Personal Data in accordance with the principles that protect them.
Safeguard the security of databases containing Personal Data.
Maintain confidentiality regarding the processing of personal data.

  1. APPLICABLE LEGISLATION

This Personal Data Protection Policy, the Privacy Notice and the Authorization Form that is part of this Policy as Annex 1, are governed by the provisions of current legislation on the protection of Personal Data referred to in Article 15 of the Colombian Political Constitution, Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013, Decree 1727 of 2009 and other regulations that modify, repeal or replace them.

  1. DIVULGATION

This Data Protection Policy will be available on the JARIS website: www.jarisfarm.com and may also be consulted by sending an email to the following address: infor@jarisfarm.com

  1. VALIDITY

This Personal Data Protection Policy is effective as of July 28, 2020.