LEGAL FRAMEWORK

ACEROS MAPA S.A., domiciled at Carrera 42 # 32 - 10 in the city of

Itagüí, with NIT 890904459-6, in its capacity as responsible and in charge of

data processing in compliance with the Statutory Law 1581 of 2012, the

Regulatory Decree 1377 of 2013 and Article 15 of the Political Constitution,

adopts the present Policy of treatment of personal data, stating of

expressly guaranteeing the rights to privacy, intimacy and good faith.

the name of the data subjects, in the processing of personal data, and in the

Consequently, all of its actions will be strictly governed by the principles of

enshrined in the General Personal Data Protection Regime.

Colombian.

2. DEFINITIONS

For all purposes of this data processing policy (hereinafter referred to as the

PTD), ACEROS MAPA complies with the definitions of the law 1581 of 2012 and

other regulations that complement, add to or modify it.

3. GENERAL PRINCIPLES

For all the purposes of this policy, all of the following apply and are guaranteed.

principles in the treatment of data, as stated in law 1581 of 2012: legality,

freedom, purpose, truthfulness or quality, transparency.

4. HOLDER'S AUTHORIZATION

The collection, storage, use, circulation, and deletion of personal data

by Aceros Mapa S.A. requires the free, prior, express and express consent of Aceros Mapa S.A.

informed of the Owners of the same. Aceros Mapa S.A., in its condition of

responsible for and in charge of the processing of personal data, has made available the

mechanisms necessary to obtain the authorization of the data subjects.

at the time of collection of the same, ensuring in any case that

it is possible to verify the granting of such authorization.

5. FORM AND MECHANISMS FOR GRANTING THE AUTHORIZATION

The authorization can be in a physical or electronic document, or in any other form.

another format that guarantees its subsequent consultation, or by means of a

technical or technological mechanism by means of which it can be concluded from

unequivocally that, in the absence of conduct on the part of the Data Subject, the data would have

have never been collected and stored in the database. The format

for the authorization will be prepared by Aceros Mapa S.A. and will be submitted to

the Data Subject prior to the processing of his or her personal data, of

in accordance with the provisions of Law 1581 of 2102 and Decree 1377 of 2013.

6. RIGHTS OF THE OWNERS

In compliance with the fundamental guarantees enshrined in the Constitution and the

In accordance with the Law, the owners of the personal data have the right to know, update,

rectify or suppress the data object of treatment, as well as to revoke total or partial

or partially the authorization for data processing granted, as well as to

file complaints and grievances and request proof of authorization.

Holders have the right to be informed by the person in charge or

responsible for the use and treatment that will be given to the personal data, as well as

of the modifications and updates of the protection policies, security measures and

security and purposes.

7. PROOF OF AUTHORIZATION

Aceros Mapa S.A. will use the mechanisms that it currently has, and

will implement and adopt the necessary actions to maintain and improve the

records or suitable technical or technological mechanisms of when and how it was obtained.

authorization by the owners of personal data for the processing of personal data.

the same. In order to comply with the foregoing, the following files may be established

physical or electronic repositories made either directly or through

third parties contracted for this purpose.

8. USE AND PURPOSE OF THE TREATMENT

Aceros Mapa SA recognizing the privacy expectations of the Data Subjects and the

right to know how personal data is treated,

expresses that it will use the personal data only and exclusively for:

➢ With customers and suppliers.

a. To promote and facilitate the handling of goods, products, services and other products and services.

relations that exist or may exist between the Holder and Aceros Mapa SA.

b. To publicize goods or services through the sending of messages of

advertising and promotion of its own or of a third party, in a direct way by

Aceros Mapa SA. or through third parties.

c. Market studies, improvement of goods and services offered or acquired.

d. Facilitate the performance of the obligations acquired by or in favor of Aceros

Mapa SA, such as sales, leasing, invoicing, collection management,

collection, verifications and consultations, control, behavior, means and means, and

payment habits.

e. To follow up on the commitments acquired between the Contractor and Aceros

Map SA.

f. Advise on any relevant situation or changes related to

the Corporate Purpose of Aceros Mapa S.A.

g. To forward to private and public entities the information contained therein, of

in accordance with the authorizations given by the owner of the data.

h. Support audits, both internal and external.

i. Enter the information in the respective customer databases and

suppliers.

j. Complying with the obligations inherent to and derived from the quality of

responsible and in charge of the data processing.

k. Any other purpose that may be required in connection with the activities

Aceros Mapa SA's own relations with its customers and suppliers.

➢ With employees, applicants for vacant positions and trainees.

ACEROS MAPA will process the personal data of its employees and contractors,

as well as those applying for vacancies, in three years.

The following are the moments: before, during and after the employment or work relationship.

services.

➢ Treatment prior to the employment relationship:

a. For personnel selection processes.

b. Psycho-technical tests, interviews, family visits, security studies, etc.

c. Hiring of personnel selection processes through third parties,

in which case the authorization to share data will be requested.

➢ Data processing during the contractual relationship:

a. Administer the contractual relationship between Aceros Mapa and the employee.

b. Affiliation to social security, reports required by law, payment of payroll and

other legal and contractual purposes.

c. Maintenance, development and/or control of the employment relationship between the holder

and Aceros Mapa.

d. Processes within the company, for the purpose of operational development and / or

systems administration and accounting management.

e. Human resources management on issues related to benefits.

and in general matters related to payroll.

f. Personnel promotion process.

g. Information related to the health condition of the personnel.

h. Issuance of certifications relating to your status as an employee such as.

income and withholding certificates, labor certificates, etc.

i. Reporting to surveillance and control authorities.

➢ Processing of data after termination of the contractual relationship:

a. Labor records, social security, tax and parafiscal obligations.

b. Reporting to state entities.

This information will only be used in the ways described above,

ensuring that they will not be sold or licensed.

9. PRIVACY NOTICE

Aceros Mapa S.A. with address at Carrera 42 # 32 - 10 in the city of Itagüí,

act as the person responsible for the processing of personal data, for which it will

informs that personal data will be used only and exclusively for the purposes for which they were collected.

described in the previous point.

Aceros Mapa S.A. makes available to you the data processing policy in the

web page www.acerosmapa.com.co where you will find the guidelines and

consultation and complaint procedures that will enable you to enforce your rights.

rights, to know, update, rectify or delete the data being processed,

to revoke in whole or in part the authorization for the processing of personal data.

data provided, as well as to file complaints, claims, and request proof of the

authorization.

Aceros Mapa S.A. makes the following information available to the owners of the information

following service channels:

By telephone:

➢ Bogota: (601) 237 9008

➢ Medellin: (604) 374 1313

➢ Cali: (602) 382 8250

➢ Dosquebradas: (606) 332 2344

Via Email:

➢ contacto@acerosmapa.com.co

Via Web Page:

➢ www.acerosmapa.com.co

10. RIGHTS OF THE OWNERS OF THE INFORMATION

Pursuant to the provisions of Article 8 of Law 1581 of 2012 and the provisions of the

Articles 21 and 22 of Decree 1377 of 2013 the Data Controller of the personal data has the following rights

the following rights:

➢ To know, update and rectify your personal data in relation to Aceros Mapa.

S.A., in its capacity as data controller.

➢ To request proof of the authorization granted to Aceros Mapa S.A., in its

condition of Data Controller.

➢ To be informed by Aceros Mapa S.A., upon request, regarding the use that

has been given to your personal data.

➢ File complaints before the Superintendence of Industry and Commerce for

violations of the provisions of Law 1581 of 2012 and other regulations.

that modify, add to or complement it, once it has exhausted the

consultation or complaint procedure before the Data Controller.

➢ To revoke the authorization and/or request the deletion of the data when in the

Treatment not respecting the principles, rights and guarantees

constitutional and legal provisions.

➢ Access free of charge to your personal data that have been the subject of

Treatment.

➢ Aceros Mapa S.A. will keep contact means available so that the

Data subjects may exercise their rights and give effect to the

procedures foreseen in these Policies, which will be informed and

made available in the Privacy Notice.

11. IMPLEMENTATION OF PROCEDURES FOR

TO GUARANTEE THE RIGHTS OF THE HOLDERS.

Inquiries:

ACEROS MAPA will respond within a maximum term of ten (10) business days,

counted from the date of receipt of the consultation. When it is not possible to

The interested party will be informed of the consultation within said period, indicating

the reasons for the delay and indicating the date of attention, which in no case shall be

may exceed five (5) business days following the expiration of the first term.

For the processing of inquiries, the following must be provided:

➢ The name and identification document of the holder.

➢ In case you are the successor in title: Identity card, civil registry

death certificate of the holder, a document certifying the capacity in which he/she is acting and the

holder's identity card number.

➢ In the case of a legal representative or proxy: Identity Document

document certifying the capacity in which he/she is acting and the number of the

identity document of the holder, and in the case of minors

identity card and civil registry.

➢ Complete description of the consultation.

➢ Address and contact information of the consultant.

Claims:

When the owner considers that his/her information should be corrected,

updating, suppression, revocation of the authorization or when it notices the

alleged non-compliance with any of its rights, the maximum time limit for the

(10) working days, counted from the day after the date of the claim.

following the date of receipt. When it is not possible to attend the claim

within that period, the interested party shall be informed of the reasons for the delay and the

date on which it will be attended, which in no case may exceed eight (5) days.

following the expiration of the first term. If the claim results

incomplete, the interested party will be required within five (5) days following the date of the

receipt of the claim in order to remedy the faults.

After two (2) months have elapsed from the date of the request, without the

applicant submits the requested information, the complaint shall be deemed to have been withdrawn.

or claim. The claim document must contain:

➢ The name and identity document of the holder.

➢ In case you are the successor in title: Identity card, registration

of death of the holder, document proving the capacity in which he/she was born.

acts and the number of the holder's identity document.

➢ In the case of a legal representative or proxy: Identity Document

document evidencing the capacity in which he/she is acting (Power of Attorney) and the

number of the holder's identity document and, in the case of a minor, the number of the holder's identity document

of age, identity card and civil registry.

Description of the facts giving rise to the claim.

➢ Claimant's address and contact information.

12. INFORMATION SECURITY AND SECURITY MEASURES

SAFETY.

In development of the security principle established in the current regulations,

Aceros Mapa S.A. will adopt the technical, human and administrative measures that

necessary to ensure the security of the records and prevent their adulteration,

loss, unauthorized or fraudulent use or access.

13. PERSONAL DATA PROTECTION FUNCTION TO THE

INTERIOR DE ACEROS MAPA S.A.

Aceros Mapa S.A. designates the CRM area, or the area that takes its place, as the

person who will receive, process and channel the different requests that will be received, processed and

receive through a communication addressed to the following e-mail address

contacto@acerosmapa.com.co (604) 3741313 who will send them to the

the respective unit in charge of data processing, the units or departments responsible for the

area that once they receive the communications, they must process them.

requests of the holders under the terms, deadlines and conditions established by

the regulations in force for the exercise of the rights of access, consultation, rectification, updating, suppression and revocation referred to in the regulations in force on personal data protection.