PRIVACY POLICY:

Vívolo Specialty Colombian Coffee, a company domiciled in the city of Santa Marta, located at the address Carrera 1C 22-15, with telephone 311 8659633, and e-mail comercial@vivolocafe.com, hereby establishes and makes public the principles and parameters by which it will process the personal data it collects in the development of its corporate purpose, in the capacity of both responsible and in charge of the handling of the information:

Object
By means of this data processing policy, Vívolo Specialty Colombian Coffee intends to establish the rules applicable to the processing of personal data collected, used and stored by this company in the development of its corporate purpose; in the qualities of responsible and/or in charge of the processing of information as the case may be. All of the above is based on the statutory law 1581 of 2012, regulated by National Decree 1377 of 2013, and Decree 1074 of 2015, complementary circulars and its constitutional foundations regarding the protection of privacy, protection of personal data and the right to habeas data.

Scope of application
This policy shall apply to the processing of personal data carried out in Colombian territory, or when the regulation is applicable to the controller and/or processor located outside Colombian territory, by virtue of international treaties, contractual relations, among others. The provisions contained in this policy shall apply to any personal database in the custody of Colo, either as responsible and/or in charge of the processing.

Definitions
In accordance with Law 1581 of 2012, for the purposes of this policy, the following definitions apply:
a) Authorizations: Prior, express and informed consent of the holder to process their personal data that do not have the characteristic of public.
b) Personal database: Organized set of data that is subject to processing by the company. It can be automated or physical according to its storage form.
c) Personal Data: It is any information linked or that can be associated to one or several natural persons, identifying them.
d) Sensitive Personal Data: Those that affect the privacy of the holder or whose improper use can generate discrimination. Reason for which they enjoy special protection, specifically referring to health, sex, political affiliation, race or ethnic origin, biometric fingerprints, union membership, among others.
e) Data controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and its processing.
f) Data Processor: Natural or legal person, public or private, who by himself or in association with others, carries out the processing of personal data on behalf of the Controller.
g) Data Subject: The natural person whose data is the object of processing.
h) Data Processing: Any operation or set of operations performed on personal data such as collection, storage, use, deletion, etc.
i) Area in charge: Person or group of persons who have under their custody and responsibility within the company the personal databases.
j) Habeas data: Fundamental right of any person to know, update, rectify and/or cancel at any time the information of his property, handled by third parties.

Treatment and purposes
The treatment to be carried out by Vívolo Specialty Colombian Coffee acting as responsible and/or in charge will be to collect, store, process, use, manage, circulate and transmit personal data, strictly following the guidelines established by law, with the following purposes as appropriate:

4.1 Employee Data
Vívolo Specialty Colombian Coffee will process the data collected in these databases to:
a) Create specific files for each employee with their personal data in order to use them whenever required.
b) To comply with the obligations assumed by the company Vívolo Specialty Colombian Coffee in favor of the employee in the development of the employment contract signed with the employee.
c) To carry out the affiliations of the employees and the beneficiaries designated by the employee, directed to the compliance of the obligations determined by the labor law generated as a consequence of the employee's relationship with Vívolo Specialty Colombian Coffee.
d) Assignment of users and corporate email accounts, which brings with it the generation and sending of correspondence in development of the contract signed between the employee and Vívolo Specialty Colombian Coffee.
e) Consultation and custody of the academic, disciplinary and labor history of the employee in order to keep a historical record of such information of the workers who join the company, which in the future can be used to provide references if required.
f) Compliance in the payment of payroll and parafiscal obligations caused in favor of the employee by virtue of their labor relationship.
g) Creation of contact channels between the company, the employee and their relatives if required.
h) Management of accounting and labor information for compliance with contractual and legal requirements.
i) Regarding former employees, the information will be kept in case it is required by any judicial or administrative authority.
j) Regarding candidates who gave their information at the time of participating in selection processes, occasionally this information will be retained in order to make a new contact in case a new vacancy is opened.
k) Registration and biometric and video control in order to safeguard people and goods that are inside the Company and commercial establishments owned by Vívolo Specialty Colombian Coffee.

4.2 Suppliers
Within the organization, it has been decided to organize these databases into three categories for easier processing, namely: permanent, occasional and prospective suppliers. However, despite this internal scheme, the data compiled in this database will be used to:
a) Collect general information and contact information of all suppliers who have provided, provide and may provide services for Vívolo Specialty Colombian Coffee.
b) Establish a contact channel between suppliers and Vívolo Specialty Colombian Coffee.
c) Preparation and forwarding of correspondence and information by Vívolo Specialty Colombian Coffee regarding internal activities, promotions and sweepstakes, in which the holders may participate.
d) Generation and sending of correspondence in cases where Vívolo decides to promote campaigns to publicize its products, services and others.
e) Follow-up of the execution of agreements, contracts or purchase orders generated by virtue of the commercial relationship between Vívolo and the supplier.
f) Accounting records and internal follow-up with respect to payments to suppliers.
g) Request for quotations, proposals and generation of purchase orders.
h) Compliance with administrative, contractual, accounting and/or tax obligations.
i) Contact for quotations and request for new services and products required by the company in order to duly develop its corporate purpose.
j) Verification of commercial references.

4.3 Clients
Vívolo in the development of its corporate purpose treats the information contained in this database for the following purposes:
a) Marketing of products and services that, in the development of its corporate purpose, Vívolo usually offers in the market.
b) Issuance of sales invoices generated from the purchase of products by the client.
c) Carry out follow-ups or studies aimed at improving the service provided, as well as the products marketed by Vívolo.
d) Attention to requests, concerns, complaints and requests made by customers.
e) Inform by any means, promotions, news, current and future products and services related to events, contests, promotional activities, special dates, courtesies on your birthday and other commercial purposes directly or indirectly related to the activity of Vívolo, and/or promotions, news, products and services promoted directly by strategic allies of Vívolo that generate added value to users and/or customers.
f) To advance in due form the development of promotional activities, events, contests and sweepstakes designed by Vívolo to build customer loyalty.
g) To generate and send information of interest regarding advertising, promotional activities, contests and sweepstakes.
h) Offering incentives to all customers who are part of the interest groups created by Vívolo, aimed at customer loyalty.
i) Preparation of satisfaction surveys on the general operation and services provided by Vívolo.
j) Fulfillment of contractual obligations.
k) Fulfillment of administrative, accounting and/or tax obligations.
l) If applicable, taking collection actions in the event of overdue balances or capital in arrears on the part of customers.
m) Invitation to events promoted or organized by Vívolo, in order to promote and encourage new products and services.
n) Registration and biometric and video control in order to safeguard the security of goods and persons inside the commercial establishments owned by Vívolo.

4.4 Children and adolescents under age
In compliance with the provisions of Law 1581 of 2012 and Decree 1074 of 2015, these data will always be requested under the consent of the minor's representative who will be previously informed about the treatment that will be given to them, the purposes, and in full knowledge that he/she is not under the obligation to deliver the same. Likewise, they will be treated in accordance with what has been developed by the Colombian Constitutional Court, that is, always respecting their fundamental rights and seeking the achievement of their welfare and the development of their best interests. Thus, Vívolo may request data of minors for the following purposes:
a) Affiliations as beneficiaries of services linked to social benefits at the request of their representative.
b) Creation of a group of minors, children of employees, for Christmas gifts.
c) Biometric and video control and registration installed in commercial establishments owned by the company in order to safeguard the security of the goods and people inside them.

4.5 Biometric Data
Vívolo has decided to implement security systems (monitoring through Closed Circuit Television) in its facilities in order to avoid being the object of criminal activities, as well as to safeguard the integrity and security of persons and property there. Finally, and specifically, the other purposes that Vívolo considers pertinent for the correct and normal development of its corporate purpose, as long as the owner of the information is previously informed.

Rights of the owners of the information
The owners of the information contained in the databases processed by Vívolo either as the party responsible or as the party in charge of the processing have the rights listed below in accordance with the provisions of the Political Constitution of Colombia and the applicable regulations in force. The exercise of such rights may only be carried out exclusively by the owner of the data or by the persons authorized by the owner in accordance with the provisions of the law.
a) To know, update and rectify their personal data with respect to the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose Processing is expressly prohibited or has not been authorized.
b) Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing.
c) Be informed by the Data Controller or the Data Processor, upon request, regarding the use given to their personal data.
d) File complaints before the Superintendence of Industry and Commerce for violations of the provisions of this policy and the laws governing the matter.
e) Revoke the authorization and/or request the deletion of the data when the Processing does not respect the principles, rights and constitutional and legal guarantees. The revocation and/or suppression shall proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has incurred in conduct contrary to this law and the Constitution.
f) Access free of charge to their personal data that have been subject to Processing.

6. Duties of Vívolo with respect to databases containing personal information of third parties when it acts as the party responsible and in charge.

6.1 Duties as Data Controller
When Vívolo assumes the capacity of data controller, it will carry out such management in compliance with the following duties, without prejudice of course to the other provisions of the law.
a) Guarantee to the owner of the information at any time and free of charge the full and effective exercise of the rights to know, update, modify and rectify their data.
b) Request, and keep in the necessary cases, a copy of the respective authorization granted by the owner.
c) Keep the information under the necessary security conditions to prevent its use, access, adulteration, unauthorized or fraudulent consultation, adulteration or loss.
d) Update the information and in case of substantial changes in the treatment of the databases, inform both the owners and the person in charge, if any.
e) Rectify the information when it is incorrect and in case there is a person in charge of handling it, inform him/her.
f) In case there is a person in charge of handling the information, provide only data whose handling is previously authorized by the owner.
g) Process the queries and claims formulated by the owners of the information within the terms established by law and replicated in this handling policy.
h) Socialize with the areas in charge within the company the procedures and policies to ensure proper compliance with the law that regulates the matter.
i) Inform at the request of the holder on the use given to their data.
j) Inform the authority for the protection of personal data when there are violations to the standards of information security and therefore there are risks in the management of the information of the holders.
k) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

6.2 Duties as Data Processor
When Vívolo assumes the capacity of data processor of personal data under its custody, it shall comply with the following duties, without prejudice of course to the other provisions of the law.
a) Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.
b) To keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
c) To update, rectify or delete the data in a timely manner under the terms of the law.
d) To update the information reported by the data controllers in accordance with the terms agreed in the contracts with the data controllers.
e) To process the consultations and claims formulated by the owners in the terms indicated in this policy and the law that governs the matter.
f) To socialize with the areas in charge within the company the procedures and policies to guarantee the adequate compliance with the law that regulates the matter.
g) To abstain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce.
h) Allow access to the information only to those persons who may have access to it.
i) Inform the personal data protection authority when there are violations to the information security standards and therefore there are risks in the administration of the information of the owners.
j) Comply with the instructions and requirements given by the Superintendence of Industry and Commerce.

7. Procedure for the attention of requests and claims by the owners of the information
   In the development of the fundamental right of the owners to Habeas Data regarding the rights of access, consultation, updating, rectification, or cancellation the following procedure will be followed:
   a) The rights on personal data may only be exercised directly by the owner, or by a third party legally authorized in accordance with the provisions of Law 1581 of 2012. This condition shall be evidenced by a copy of the identity document, and in case of being authorized, the duly granted power of attorney.
   b) The request to exercise any of these rights must be made through the channel delimited by Vívolo within the present Personal Data Processing Policy.
   c) The request to exercise the rights must contain: Name of the owner of the data, and if applicable of his attorney-in-fact or representative; specific and precise request of the right he intends to exercise, in each case the request must be reasonably grounded so that Vívolo proceeds as responsible for the database to provide an answer; address for notifications; documents supporting the request; signature of the request. If any of the above requirements are missing, Vívolo will inform the applicant within 5 days of receipt of the request, so that they can be completed. If two months have passed without the required information being submitted, it is understood that the request has been withdrawn.
   . Vívolo will internally create a database on Requests and complaints, as well as comply with the legal obligation to report them to the Superintendence of Industry and Commerce.
   . In the event that Vívolo acts as the party responsible for the information, it will respond to the complaint within a maximum of 15 business days from the day following the date of receipt. When it is not possible to respond to the claim within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed 8 business days following the expiration of the first term.
   In turn, in the event that Vívolo acts as data processor, it will inform the owner or interested party of the request or claim and will communicate the request to the person responsible for the processing of the information so that the latter may respond to the request for consultation or claim submitted, which will be informed to the owner so that he/she is aware of the identity of the person responsible for the information and, consequently, the main party obliged to guarantee the exercise of his/her right.
   In accordance with the provisions of the law, in the event of seeking recourse to the Superintendence of Industry and Commerce in the exercise of the legal actions contemplated for data owners or interested parties, the procedure described herein must be previously exhausted.

8. Channel designated for the reception of petitions and claims in exercise of the rights of the owners of the information
   . In any case, Vívolo acting as the person in charge or as the owner of the information will receive petitions and claims in exercise of the rights of the owners of the information at the following e-mail address: comercial@vivolocafe.com. This email will be controlled and managed by the administrative area of the company, who is aware of its legal obligations in order to meet the requirements that are raised through this channel. Any change in this channel will be duly informed to the owners of the information.

9. Prohibitions
   In the development of this Personal Data Processing Policy, and its correct application, the following prohibitions are established:
   a) Colo prohibits the access, use, management, transfer, communication, storage and any other processing of sensitive personal data without prior authorization from the owner of the data and from Vívolo itself.
   b) Vívolo only processes personal data of children and minors with the express authorization of their legal representatives. Any processing of this type of data must be done in accordance with the prevailing rights that the Constitution recognizes for them, and for the purposes specifically informed prior to the delivery of the data.
   c) The international transfer of personal data to third countries that do not provide adequate levels of data protection in accordance with the provisions of Law 1581 of 2012 and the standards set by the Superintendence of Industry and Commerce is prohibited, applying the exceptions that have been established for these cases.

10. Temporality of the data
    The permanence of the data processed by Vívolo either as the data controller or as the data processor will be determined by the purpose for which such data were collected or provided to Vívolo, as the case may be. Therefore, once the purpose of Vívolo is exhausted, it will proceed to its destruction or return, as deemed appropriate. In any case, Vívolo is aware that there are legal, labor, accounting and tax obligations that require it to keep some data for a certain period of time, so it undertakes to do so only and solely for that purpose, adopting the technical and security measures that proper treatment requires.

11. Security measures
    Vívolo, as part of the processing of the personal data it collects or for which it is responsible, as the case may be, will adopt all the physical, technological and administrative security measures it deems appropriate according to the data it handles, which will be applicable in any case to the areas in charge. Vívolo, in compliance with the statutory law 1581 of 2012 and the requirements established by the Superintendence of Industry and Commerce, shall communicate to the latter any case of failure in the security of the information that may have caused loss, theft, fraudulent consultation or modification, and the measures taken in this regard.

12. Delivery of personal data to administrative and judicial authorities
    In the event that the authorities with jurisdictional or administrative functions request from Vívolo the consultation and/or delivery of personal data contained in its databases, such request will be evaluated internally, and if it complies with all legal requirements, the case will be documented internally and added to the history handled internally by the company, this in compliance with the rules governing the matter.

13. Validity
    The present policy of treatment of personal data in charge of Colo who acts as responsible and in charge of the treatment of information of third parties in parallel has been approved and therefore will be in force from January 1, 2018, with an indefinite term until a substantial reform to the same is advanced, phenomenon that will be duly informed through the channels provided.