Data Processing Policy – Asteri S.A.S.

1. Definitions

1. Authorization: The prior, express, and informed consent granted by the Data Subject for the Processing of their Personal Data.
2. Database: The organized set of Personal Data that is subject to Processing.
3. Personal Data: Any information that may be associated with or linked to an identified or identifiable natural person.
4. Public Data: Information that (i) by its nature is contained in public records, public documents, final and enforceable judicial decisions not subject to confidentiality, among others, and (ii) does not qualify as semi-private, private, or sensitive data.
5. Sensitive Data: Information that (i) affects the privacy of the Data Subject, (ii) may lead to discrimination if misused, (iii) reveals political party affiliations or interests, (iv) relates to the rights and guarantees of opposition political parties, or (v) is related to health, sexual life, or biometric data.
6. Data Processor: A natural or legal person who, individually or jointly with others, carries out the Processing of Personal Data on behalf of the Data Controller.
7. Data Controller: A natural or legal person who, individually or jointly with others, determines the purposes and means of the Processing and/or the Database.
8. Data Subject: A natural person whose Personal Data is subject to Processing.
9. Data Transfer: The transfer of Personal Data by the Data Controller or the Data Processor, located in the Republic of Colombia, to a recipient located within or outside the country, who also has the status of Data Controller.
10. Data Transmission: The Processing by which Personal Data is communicated to the Data Processor so that such processor may carry out an operation on Personal Data on behalf of the Data Controller.
11. Processing: Any operation or set of operations performed on Personal Data, such as collection, storage, use, circulation, deletion, or any other form of processing.

2. Processing and Purpose

2.1. Personal Data Collected by Asteri Through Its Website

1. To contact the Data Subject via email in order to offer the legal and multidisciplinary services provided by Asteri to its clients.
2. To provide Data Subjects with information regarding Asteri, its services, and the activities related to its ordinary and extraordinary course of business.
3. To send information related to areas of law and other services provided by Asteri.
4. To conduct analyses aimed at identifying: (i) the frequency with which Data Subjects provide their Personal Data through the website to obtain potential legal advice from Asteri; (ii) the effectiveness of Asteri’s marketing efforts through the website; (iii) the matters referred to in Data Subjects’ messages; and (iv) market analyses related to Asteri’s clients and potential clients.

2.2. Personal Data Collected by Asteri to Evaluate the Submission of Fee Proposals to Potential Clients

1. To conduct due diligence on the potential client, in compliance with Asteri’s Anti-Money Laundering and Counter-Terrorism Financing Risk Management System (SAGRLAFT).
2. To conduct research in restrictive lists and official databases regarding potential clients, their beneficial owners, directors, and/or counterparties.
3. To carry out conflict-of-interest verification processes, in compliance with Law 1123 of 2007.
4. To review the feasibility and suitability of a potential business relationship with the prospective client
5. Drafting and design of fee proposals.
6. Structuring work teams that may potentially provide services.
7. Preliminary analysis to request additional information from the Data Subject in order to carry out the purposes described above.
8. Implementation of the purposes set forth in Section 2.1 above.

2.3. Personal Data Collected by Asteri for the Provision of Its Services

1. To provide the professional services of Asteri and/or its affiliates to its clients.
2. To carry out the administrative, tax, accounting, and internal activities required by Asteri.
3. To manage, administer, control, monitor, and supervise Asteri’s SAGRLAFT policies or manuals.
4. To archive client information and case files, unless Asteri is expressly required by the client to return such information.
5. To transmit and transfer Personal Data to Asteri’s affiliates or third parties for the purpose of executing services, carrying out internal Asteri activities, marketing, and/or operational activities.
6. To implement the purposes set forth in Sections 2.1 and 2.2 above.

2.4. Legal Assumptions

1. Asteri assumes that the information provided by natural and legal peoplefor the purposes described in Sections 2.1, 2.2, and 2.3 of this Policy is truthful, complete, sufficient, and lawfully obtained.
2. Asteri assumes that the signatures contained in the documents delivered by its potential clients and clients are authentic and reliable.
3. Asteri presumes the legality of the documents provided by potential clients and clients.
4. Asteri assumes that any photocopies delivered by potential clients or clients are true copies of the originals.
5. Asteri assumes that the information provided by potential clients and clients is sufficient to: (i) understand the actual status of the matters for which Asteri and/or its affiliates may potentially provide services; (ii) carry out due diligence on the potential client, in accordance with Asteri’s SAGRLAFT system; and (iii) perform conflict-of-interest verification processes.

2.5. Confidentiality

2.6. Optional Nature of Responses

2.7. Processing of Personal Data of Children and Adolescents

1. Respect for the best interests of children and adolescents.
2. Guarantees of fundamental rights.

2.8. Processing of Sensitive Data

1. Where the Data Subject has been granted express Authorization for such Processing.
2. Where the applicable law does not require Authorization for Processing.
3. Where the Processing is necessary to protect a vital interest of the Data Subject and the Data Subject is physically or legally incapable. In such cases, Authorization must be granted by an authorized representative.
4. Where the Processing is carried out during legitimate activities and with appropriate safeguards by a foundation, non-governmental organization, association, or any other non-profit entity with political, philosophical, religious, or trade union purposes, provided that Personal Data relates exclusively to its members or people with whom it has regular contact. In such cases, the data may not be transferred to third parties without the Data Subject’s Authorization.Que el Tratamiento sea realizado dentro del trámite de actividades legítimas y con garantías por parte de una fundación, organización no gubernamental, asociación o cualquier otro organismo sin ánimo de lucro, cuya finalidad sea política, filosófica, religiosa o sindical.
5. Where the Processing is necessary for the recognition, exercise, or defense of a right in judicial proceedings.
6. Where the Processing has a historical, statistical, or scientific purpose.

3. Data Subject Rights

1. To know, update, and rectify their Personal Data held by the Data Controller or Data Processor. This right may be exercised with respect to data that is (i) partial, (ii) inaccurate, (iii) incomplete, (iv) fragmented, (v) misleading, or (vi) processed without authorization or in violation of the law.
2. To request proof of the Authorization granted for Processing, except where such Authorization is not required pursuant to Article 10 of Law 1581 of 2012.
3. Upon request, to receive information regarding the use given to Personal Data by the Data Controller or Data Processor.
4. To file complaints with the Superintendence of Industry and Commerce for violations of applicable data protection laws.
5. To revoke the Authorization and/or request the deletion of Personal Data when constitutional and legal principles, rights, and guarantees applicable to Processing are violated, provided that the Superintendence of Industry and Commerce has determined that the Data Controller or Data Processor has failed to comply with the law and the Political Constitution of Colombia.
6. To access Personal Data subject to Processing free of charge.

3.1. Standing to Exercise Data Subject Rights

1. The Data Subject, upon proof of identity to the Data Controller.
2. The Data Subject’s heirs, upon proof of such status.
3. The Data Subject’s representative or attorney-in-fact, upon proof of representation or power of attorney.
4. By stipulation in favor of or on behalf of another.

4. Persons to Whom Asteri May Provide Personal Data 

1. The Data Subjects, their heirs, or legal representatives.
2. Public or administrative authorities in the exercise of their legal functions or by court order.
3. Third parties are authorized by the Data Subject or by law.

5. Inquiries, Claims, and Complaints

5.1. Inquiries

1. Full name of the Data Subject or heir.
2. Copy of the Data Subject’s identification document.
3. Copy of documents evidencing their status, if applicable.
4. Specific inquiry.

5.2. Claims

1. Claims must be submitted by the Data Subject or heir through a request addressed to the Data Controller or Data Processor, including (i) identification of the Data Subject, (ii) a description of the facts, (iii) address, and (iv) any other relevant information. Claims must be submitted by email to info@asterilaw.com.
   ‍
   If a claim is incomplete, Asteri shall request the claimant to remedy the deficiencies within five (5) business days following receipt. If more than two (2) months elapse without correction, the claim shall be deemed withdrawn.
2. Once a complete claim is received, Asteri shall include a note in the Database stating “claim under review” and the relevant reason, within no more than two (2) business days. Such note shall remain until the claim is resolved.
3. The maximum term to address a claim shall be fifteen (15) business days from the day following its receipt. If it is not possible to respond within such period, Asteri shall inform the claimant of the reasons for the delay and the date on which the claim will be addressed.

5.3. Complaints

5.4. Competent Area and Mechanisms

6. Term and Amendments to the Policy 

Asteri S.A.S.