Privacy policies for the processing of personal data

1. OBJECTIVE

Ensure that the companies of “GreenLand Investment S.A.S. Group” properly manage the data of employees, customers, suppliers, manufacturers, partners, service providers, collaborators and communities benefiting from social support programs, among others. Besides, this policy aims to guarantee the rights of the owners of the information.

2. SCOPE

The scope of this policy covers all related companies that are part of GreenLand Investment S.A.S., from now on “GreenLand Business Group”, which collect, process, update, consult, store, transfer and report personal data of employees, customers, suppliers, producers, partners, service providers, among others; within the regular operation of their activities or functions.

3. RESPONSIBLE ENTITIES OR INDIVIDUALS

Para todos los casos el responsable es la persona natural o jurídica, pública o privada, que por sí misma o en asocio con otros, decida sobre la base de datos y/o el tratamiento de los datos. Para el caso en concreto los responsables de dicho tratamiento son todas las empresas relacionadas en el alcance de esta política la cual se encuentra en el numeral 2, todas las empresas domiciliadas en el municipio de Envigado – Antioquia, su sede principal está ubicada en: la calle 26 Sur No. 48-12, sitio web: www.GreenLand.co, y correo electrónico protecciondatospersonales@GreenLand.co, teléfono (4) 3396262.

In all cases, the person responsible is the individual or legal entity, public or private, that by itself or in association with others, decides on the database and/or the processing on the data. The above-mentioned companies are based in the municipality of Envigado – Antioquia, their headquarters is located at Calle 26 Sur No. 48-12, website: www.greenland.co, and e-mail protecciondatospersonales@greenland.co, telephone (4) 3396262.

4. POLICIES

This policy is issued in compliance with the National Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013, 886 of 2014, and other regulations applicable to the subject. The following is a description of the policy approved by the GreenLand Group regarding the processing of personal data and privacy notices which have been collected in the context of its contractual relationship with: customers, suppliers, producers, employees, partners, contractors, cooperators. Likewise, the data of all those individuals with whom we have or have had any commercial or working-based relationship, to obtain veracious, applicable, complete, updated, and
exact information about the holder.

5. DEVELOPMENT

Personal data provided to the GreenLand Group may be processed, collected, stored, used, distributed, deleted, shared, updated, transferred, and transmitted to countries that guarantee adequate levels of data protection.

The above is under the terms and conditions applicable in compliance with the privacy policies provided by law. The processed data will be used by GreenLand Group to facilitate the provision of its services by its corporate purpose, as well as for labor, administrative, accounting, tax, commercial and advertising purposes, and for contacting the data owners.

The personal data collected will only be used for the purposes set out in the respective privacy notices or data processing authorizations made available to the Owners to authorize the treatment of the data. However, databases may also be used for the following purposes:

• Sending information to its employees, clients, suppliers, producers, shareholders, contractors, cooperators, communities benefiting from social support programs, and in general to all those individuals and/or companies with whom the GreenLand Group may have a commercial or legal relationship.
• Management of payroll payments, affiliation to institutions of the general social security system, welfare, and occupational health activities. Likewise, administration and operation, directly or through third parties, of recruitment and hiring processes, including the evaluation of participants, verification of labor and personal references, and the conducting of security studies and registration of fingerprints where required.
• Establishment of contractual relationships with customers, suppliers, and contractors that allow the acquisition of goods and services required by the GreenLand Group for the regular operation of its business.
• Establishment of pending liabilities, consultation of financial information and credit history, as well as reporting of unfulfilled debts to central information offices.
• Attention to requests by public or administrative entities in the exercise of their legal functions and by court order.
• Responding to queries, requests, complaints, and claims that are made by the owners and transmit the personal data to control bodies and other authorities that, by virtue of applicable law, may require the personal data.
• Strengthen relationships with our suppliers, producers, and customers by sending relevant and interesting information.
• Notifying authorized contacts in case of emergencies during working hours or when carrying out their duties.
• Eventually, contacting by email or by any other means, individuals with whom the GreenLand Group has or has had a relationship, such as employees, former employees and their families, shareholders, clients, suppliers, producers, creditors, and debtors
• Interact with its customers, suppliers, employees, former employees, contractors, aid workers, and communities benefiting from social support programs. Also to verify compliance with their legal obligations and to invite them to events organized or sponsored by the GreenLand Group.
• Registering of customers, suppliers, and contractors in the GreenLand Group’s systems and process their payments.
• Marketing, communication, statistics, research, and other commercial purposes that do not contravene current legislation in Colombia.
• Transfer the information collected to different areas of the GreenLand Group in Colombia and abroad when necessary for the development of its operations and payroll management (cash collection and administrative collections, treasury, and accounting).
• Fraud control and prevention.
• Prevention and control of money laundering and financing of terrorism.
• Controlling access to GreenLand Group offices and establishing security measures, including the setting up of video-surveillance zones.
• Any other activity similar to those described above necessary to carry out the corporate purpose of the GreenLand Group.

5.1. Obligations of the personal data officer:

• To fully inform clients, suppliers, producers, employees, and all those individuals with whom we have or have had a commercial or work-related relationship, of this Personal Data Processing Policy of the GreenLand Group, to comply with the law and guarantee the rights of the parties.
• To keep the information stored in the database, with the appropriate updates, during the contractual relationship.
• To inform the right’s owners about the transmission and transferring of information from the Databases to third parties duly authorized, fulfilling the same or higher standards of legal protection than those determined by the law or indicated by the regulatory agency “Superintendence of Industry and Commerce.”
• Send by email or by physical means: i) Product updates, ii) Information or announcements of relevance to the company, iii) Invitations to own or third party events, iv) General communications, v) Offers, contracts; among others.
• GreenLand Group may manage the acquisition, processing, administration, and updating of the databases through third parties, whom in all cases must follow the current policy. A confidentiality agreement will be signed to guarantee the security and proper handling of all information.

5.2. Obligations of the personal data protection officer:

The GreenLand Group will process the information, which will, in any case, be limited to the purposes for which it was provided. GreenLand Group is committed to the correct data treatment since its acquisition, storage, use and final disposal, avoiding unauthorized access to third parties to access, violate, modify, disclose and/or destroy the information in GreenLand Group’s databases. The security protocols implemented to ensure that control measures are met to minimize the loss, abuse, or changes in the information.

5.3. Rights of the data owner

Individuals whose personal data are processed by GreenLand Group shall have the rights provided for in the Political Constitution of Colombia, Law 1581 of 2012, and its regulatory decrees. These individuals may:

• Know the personal data the GreenLand Group is processing. The data owner can request at any time his/her data to be updated or rectified.
• Request the authorization given to GreenLand Group for processing their personal data.
• To be informed, upon request, of the use made of personal data by the GreenLand Group.
• File complaints with the Superintendent of Industry and Commerce for violations of the provisions of the GreenLand Group Protection Act.
• Request GreenLand Group to delete their personal data and/or revoke the authorization granted for the processing of this data under the procedures outlined in GreenLand Group’s Personal Data Protection Policy. It is important to note that a request for deletion of information and revocation of the authorization will not proceed when the data subject has a legal or contractual obligation to remain in the database and/or files, nor while the relationship between the data subject and GreenLand Group, under which his/her data was collected, is in effect.
• Free access to their personal data being processed.
• Refrain from answering questions about sensitive data. Answers concerning children and adolescents and those related to health data are optional.

5.4. Receiving and responding to requests, inquiries, and complaints (RIC) from the owners of
personal data:

The holder of the information has the right to submit requests, inquiries, and complaints, from now on referred to as RIC, in written form with the following information: i) GreenLand Group with email address protecciondatospersonales@greenland.co, or delivered by post to the headquarters at Calle 26 Sur No. 48-12, Envigado, Colombia; ii) Including the following data: name, identification number, address, contact number and email iii) The documents with which he/she intends to support his/her RIC; and, iv) The specific facts on which the request is based..

• For complaints: GreenLand Group will reply within fifteen (15) working days from the date of receipt of a RIC. If the GreenLand Group is unable to respond to the RIC within such time frame, the petitioner will be informed of this fact, indicating the reasons for the delay and expressly stating the date on which the response will be resolved or given, which in any case may not exceed eight (8) business days after the expiration of the first term.
• For inquiries: GreenLand Group will reply within ten (10) working days from the date of receipt of a RIC. If the GreenLand Group is unable to respond to the RIC within this time frame, the petitioner must be informed of this fact, stating the reasons for the delay and expressly indicating a date when his/her inquiry will be answered, which in any case may not exceed five (5) business days after the expiration of the first term.
• Update and/or correction requests: The GreenLand Group at the request of the owner will correct and update any information of the holder found to be incomplete or inaccurate. Any modification under the terms above and considering the following:
  • The owner of the data must send a request by email to protecciondatospersonales@greenland.co or by post addressing the Personal Data Protection Officer stating the updates and/or corrections to be made and providing the supporting documentation.
  • The GreenLand Group may enable mechanisms to facilitate the exercise of this right, provided that it benefits the holder. Consequently, electronic or other means deemed appropriate may be enabled, which will be communicated in the privacy notice and made available on the website.
• Request for deletion of data: The owner of the personal data has the right to request the GreenLand Group to delete (remove) the data in any of the following cases:
  • The owner considers that the data is not being treated under the principles, duties, and obligations provided for in the current policy.
  • The data is no longer necessary or relevant for the purpose for which it was collected.
  • The period necessary for the purposes for which they were requested has exceeded. This deletion implies the total or partial removal of the personal information as required by the holder in the records, files, databases, or processing carried out by the GreenLand Group. However, this right of the holder is not absolute, and consequently, GreenLandGroup may refuse to exercise it when:
    1. The holder has a legal or contractual obligation to remain in the database.
    2. The deletion of data hinders legal or administrative actions related to tax liabilities, investigation, and prosecution of crimes or the updating of administrative sanctions.
    3. The data is necessary to protect the legally safeguarded interests of the owner to carry out an action for the public interest, or to comply with a legally acquired obligation of the owner.
• The data owner acknowledges that decisions made by the GreenLand Group within theprocess of a RIC will be carried out by the responsible division through email.

5.5. Children’s data:

Given the case that the responsible parties carry out the processing of sensitive data, it is guaranteed that an authorization for the use of such data will be obtained in advance, and explicit manner, in compliance with the following conditions:

• Within the context of Sensitive Data, the data subject shall be informed that he or she is not obliged to give his/her consent to the processing.
• The Data Subject will be informed beforehand and expressly what sensitive data is being processed and for what purpose.
• Particularly in the case of minors, their legal representatives may give their consent after the minor has exercised his/her right to be heard.

5.6. Substantial changes covered in the policy:

Any substantial change, update, deletion or correction covered by this policy will be communicated, before its application, to the Owners of the Personal Data through the GreenLand website in the section “about us,” and within the Group through the Intranet, to inform by these means the change made to the applicable intermediaries, suppliers, and third parties. Furthermore, any means can be used to report such changes effectively. The GreenLand Group reserves the right to change the personal data protection policy at any time.

6. MONITORING AND COMPLIANCE:

Compliance with this policy will be reviewed and evaluated periodically by the Company’s Agriculture and Control Divisions. Non-compliance will be classified as a SERIOUS FAULT and will result in the termination of the employment relationship, unilaterally, with JUST CAUSE.