PRIVACY AND PERSONAL DATA PROTECTION POLICY

1. PERSONAL DATA PROTECTION LAW. This Data Processing Policy is about the use that DIVANO SAS., with NIT 860.526.796 - 2, as the entity responsible for the processing of personal data, will give to the personal data that rests in its records and databases in accordance with the provisions of Law 1581 of 2012 and Decree 1074 of 2015 (Book 2, Part 2, Title 2, Chapters 25 and 26) and other applicable regulations.

2. PRIVACY CLAUSES AND POLICY.  The purpose of this statement is to inform the holders, about the Privacy and Personal Data General Protection Policy followed by DIVANO SAS. This Privacy Policy may vary depending on legal requirements, which will be notified to personal data holders. Notwithstanding the above, it is advisable for holders to visit it periodically.

This Policy will be applicable in case Holders decide to fill out the registration form as customers, or the contact form and mark on this form their acceptance of the terms of the policy and the treatment that will be made to personal data.

3. DATA USE AND PROCESSING. DIVANO SAS is fully aware of the use and treatment that should be given to personal data that may be required or that can be obtained from customers and/or holders in their web sites in order to manage the services offered.

Management of personal data of girls, boys and/or adolescents:

Management of personal data of girls, boys and/or adolescents who are not of a public nature will comply with the following parameters and requirements:

• A. It must respond and respect the best interests of girls, boys and adolescents.
• B. It must guarantee respect of their fundamental rights.
• C. Evaluation of the opinion of the minor when he has the maturity, autonomy and ability to understand the matter.

Once the above requirements have been met, DIVANO SAS will request authorization to process data to the legal representative of the girl, boy or adolescent.

Treatment of sensitive data: Due to its commercial activity, DIVANO SAS does not need to handle sensitive data in its databases, however it must comply with the law, in case it has access to it.

PURPOSES OF THE PROCESSING OF PERSONAL DATA. DIVANO SAS. will use the data stored in its databases, mainly for the following purposes, without being limited to them:

• A. To invite its customers to the different events and/or launches of the services and/or products offered by DIVANO SAS.
• B. To inform its customers the news about DIVANO SAS.
• C. To report by any means, promotions and/or commercial campaigns.
• D. To generate efficient communication mechanisms and maintain permanent contact with the holder the personal data.
• E. To conduct quality and/or satisfaction surveys.
• F. To offer complementary services, developed in conjunction with commercial allies of DIVANO SAS.
• G. To send correspondence or any type of information and/or printed communication.
• H. To establish direct communication by different means (physical, printed, telephone, text messages, e-mails, etc.) for commercial purposes associated with sales of products and/or services.
• I. To Share the information with (i) the person or persons in charge of the treatment; (ii) the legal entities that are suppliers, allies, distributors, subcontractors, outsourcing and other third parties directly or indirectly related to the corporate purpose of DIVANO SAS. in the development of agreements, campaigns and/or agreements of a commercial nature; (iii) the operators necessary to comply with the rights and obligations derived from the contracts entered into in the ordinary course of our business. (iv) people with whom DIVANO SAS takes further steps to comply with its commercial, contractual, legal, administrative and other obligations, and; (v) third parties that manage databases for the purposes established in this Policy.
• J. To assess the quality of our goods and/or services
• K. To fulfill obligations contracted with our customers, suppliers, and employees.
• L. To provide information to the authorities that expressly request it and in the exercise of their duties or to respond to administrative and/or judicial requirements.

5. SECURITY OF INFORMATION. DIVANO SAS undertakes to comply with its obligation of secrecy of personal data and its duty to keep it as such, and will take the necessary technical and organizational measures to ensure the security of personal data and avoid their alteration, loss, treatment or unauthorized access, given the state of technology.

6. USE OF COOKIES. The Web of DIVANO SAS uses cookies. The cookie is a small text file that the server of the website places on the hard disk of the client's computer and/ or holder to collect statistical data about its navigation on the site and allow the display of advertising content. They do not have personal data. The client and/or holder can set his/her browser to accept or reject the installation of cookies or delete them once him/her have finished browsing the website. But nevertheless, DIVANO SAS advises and appreciates acceptance of cookies to be activated in order to obtain more precise data to improve the content and adapt it to the preferences of our client and/or holder. DIVANO SAS is not responsible for the fact that the deactivation of cookies may prevent the proper operation of the Web site.

7. AUTHORIZATION OF THE HOLDER - REGISTRATION. If the owner decides to register to any of the services offered by DIVANO SAS he/she will be asked for a series of essential personal data in order to manage the products or services requested (name, surname, email, physical condition of the client, purpose of contracting our services, etc.). Likewise, he/she may be required to voluntarily contribute a series of complementary data intended for information and marketing of offers, services, or activities related to them and limited to activities and services of DIVANO SAS.

The collection, storage, use, circulation or deletion of personal data by DIVANO SAS is done with the free, prior, express and informed consent of the holder thereof DIVANO SAS as the person responsible for the processing of personal data, has provided the necessary mechanisms to obtain the authorization of the holders, guaranteeing in all cases that it is possible to verify the granting of said authorization.

The authorization can be included in a physical, electronic document, in any other format in order to guarantee its subsequent consultation, or by means of a suitable technical or technological mechanism through which it can be unequivocally concluded that, if the owner's behavior has not been fulfilled, the data will never have been captured and stored in the database. The authorization will be issued by DIVANO SAS and will be made available to the owner prior to the processing of their personal data, in accordance to the provisions of La w 1581 of 2102.

DIVANO SAS will adopt the necessary measures to maintain records or technical or technological mechanisms suitable of when and how authorization was obtained from the holders of personal data for the treatment thereof.

8. TRUTHFULNESS OF THE INFORMATION. Customers and/or holders shall be responsible, in any case, for the veracity of the data supplied, being responsible for reporting any modification on such information and holding DIVANO SAS harmless concerning any responsibility in this connection. DIVANO SAS reserves the right to exclude from the registered services any client and/or holder that has provided false information, without prejudice as to the other actions that may be provided by Law.

9. ACCESS TO DATA. No third party unrelated to each of the aforementioned responsible entities may access in any case directly to the customer and/or holder’s personal data without his/her express consent for each occasion, except those considered responsible for the treatment, which need access to provide the management service or development of the activity.

10. RIGHTS OF CUSTOMERS AND/OR HOLDERS.. Customers and/or holders are entitled to know and have access, on a free of charge basis to their personal data that is under our control and can exercise their rights as their owner accordance with the provisions of Law 1581 of 2012. They may request for free, among other things, the following:

• A. General information concerning the data filed in the databases.
• B. Data corrections and/or updates.
• C. Total or partial data cancellation.
• D. Opposition to the data treatment.

The above can be done by writing to the email address info@divano.com.co where the client and/or holder must indicate the name, the specific request and the information to where he/she wishes a response to be sent.

11. COMMERCIAL COMMUNICATIONS. DIVANO SAS pursuant to Law 1581 of 2012 and its regulatory decrees, in no case can send advertising and communications for sale or other commercial purposes to customers and/or holders without their prior request or consent.

12. ELECTRONIC FORMAT INFORMATION SUBSCRIPTION CANCELLATION. DIVANO SAS hereby informs customers and/or holders that, if they have requested the sending of commercial messages or alerts in electronic format, they can unsubscribe from this type of communication by following the instructions shown in each case or by stating so to the following email info@divano.com.co.

13. PROCEDURE TO MAKE INQUIRIES. Holders may check the information that rests in any of our databases.

DIVANO SAS will process the inquiries made by the Holders or their successors concerning their personal data. For this purpose, it is necessary that the holder or his/her legal representative identify himself/herself and to make a clear, precise and detailed description of the data on which he/she bases his/her inquiry or seeks to exercise some of his/her rights, in order to guarantee a timely and effective response.

In the case of inquiries, DIVANO SAS will respond to petitioners within the term established in law 1581 of 2012, that is within a maximum term of ten (10) business days from the date of receipt thereof. When it is not possible to respond to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and stating the date on which the inquiry will be responded, which in no case shall exceed five (5) business days following the expiration of the first term.

In order to guarantee the inquiry right of Information Holders, DIVANO SAS shall puts at your disposal suitable consultation mechanisms.

It is important that Holder takes into account that he can only file a complaint at the Superintendence of Industry and Commerce once he/she has exhausted the inquiry procedure before DIVANO SAS.

14. CLAIM PROCEDURE

The Holder that considers that the information included in our database must be corrected, updated or deleted, or whenever an alleged breach of any of the duties contained in Law 1581 of 2012 is found, may file a claim through our telephone lines indicated above or by e-mail, for which the following procedure will be followed:

• • The claim will be made by means of a request addressed to the Customer Service area with the proper identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents to be asserted. If the claim is incomplete, the interested party will be required within five (5) following receipt of the claim to correct the faults. After thirty (30) calendar days from the date of the request, without the applicant submitting the required information, it shall be understood that the claim has been abandoned.
• • The maximum term to take care of the claim will be fifteen (15) business days as of the day following the date of receipt. When it is not possible to meet the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be handled, which in no case may exceed five (5) working days following the expiration of the first term.

It is important that the Holder takes into account that he can only file a complaint with the Superintendence of Industry and Commerce once he/she has exhausted the claim procedure before DIVANO SAS.

15. DATABASE VALIDITY

Databases managed by DIVANO SAS shall be maintained indefinitely, while developing its purpose, and as long as necessary to ensure compliance with its legal obligations.

16. VALIDITY

This Privacy and Personal Data Protection Policy, will become effective as of its publication and will have an indefinite duration.