Personal Data Processing Policy

APPLICABLE REGULATIONS

Listed below are the main regulations in force in Colombia regarding the protection of personal data, to which B.A. Studios SAS is fully committed and which have been taken into account for the purposes of developing this Policy and the Comprehensive Personal Data Management System of B.A. Studios SAS

• Article 15 of the Political Constitution of Colombia

• Statutory Law 1266 of 2008

• Law 1273 of 2009

• Statutory Law 1581 of 2012

• Decree 1377 of 2013

• Decree 886 of 2014

• Decree 1074 of 2015

• Title V of the Single Circular of the Superintendence of Industry and Commerce

Context

B.A. Studios SAS, acting responsibly and guided by its corporate values, has created this Personal Data Processing Policy in accordance with the provisions of Law 1266 of 2008 and Law 1581 of 2012, as well as their implementing regulations.
In this regard, Law 1266 of 2008 established a special regime for the protection of personal data related to the processing of financial, credit, commercial, and service data, as well as data originating from third countries.

For its part, Law 1581 of 2012 established the general regime for the Protection of Personal Data in Colombia, developing the constitutional principles under which every person has the right to access, update, and correct personal information stored in databases or files (manual or automated), and to receive accurate and verifiable information.

SCOPE

B.A. Studios SAS, as the data controller, will ensure the security and quality of information processing, as well as compliance with Article 15 of the Political Constitution of Colombia, current regulations regarding the protection of personal data, and in particular the provisions of Law 1581 of 2012, Decree 1377 of 2013, and any other provisions that modify, add to, or supplement them.

Without prejudice to B.A. Studios SAS’s obligation to maintain confidentiality under Law 1266 of 2008 and Law 1581 of 2012, as a commercial entity, this Policy describes the guidelines that will be followed to protect the personal data of data subjects and ensure its proper processing.

The processing carried out by B.A. Studios SAS will be based on the consent provided by the data subject and will take into account the purposes expressly stated.

Likewise, B.A. Studios SAS, in the course of its operations and management, and for the purpose of fostering business collaboration among the companies in the group, may, during the performance of its activities, process personal data jointly with entities that belong or may come to belong to B.A. Studios SAS, or with any party that represents its rights or may in the future hold the status of creditor, assignee, or any other capacity vis-à-vis the data subjects.

Entities that belong to or may come to belong to B.A. Studios SAS in accordance with the law, its affiliates and/or subsidiaries, or entities in which these, directly or indirectly, hold an equity interest or are partners, whether domiciled in Colombia and/or abroad, shall be deemed to be part of B.A. Studios SAS.

INTENDED AUDIENCE

This policy is intended for our customers, users, employees, suppliers, partners, and, in general, all stakeholders whose personal information is processed by B.A. Studios SAS.

DEFINITIONS

For the purposes of this policy, the following definitions shall apply:

• Authorization: the prior, express, and informed consent of the data subject to process personal data.

• Privacy notice: a verbal or written communication intended to inform the data subject about the data protection policy of
  B.A. Studios SAS

• Database: an organized set of personal data subject to processing.

• Successor: the person who has succeeded another due to their death (this may also refer to heirs or legatees).

• Personal Data: any information linked to or that can be associated with one or more identified or identifiable natural persons.

• Public Data: data that the law or the Constitution defines as such, as well as all data that is not semi-private or private.

• Private Data: data that, due to its intimate or confidential nature, is relevant only to the data subject.

• Semi-private Data: data that is neither intimate, confidential, nor public in nature, and whose knowledge or disclosure may be of interest not only to the data subject but also to a specific sector or group of people.

• Sensitive Data: data that affects the data subject’s privacy or whose misuse may lead to discrimination against the data subject.

• Data Processor: a natural or legal person, public or private, who, either alone or in association with others, processes personal data on behalf of the data controller.

• Data Controller: a natural or legal person, public or private, who, either alone or in association with others, processes personal data.

• Data Subject: a natural person whose personal data is subject to processing. For B.A. Studios SAS, data subjects include customers, users, employees, suppliers, partners, shareholders, visitors, our stakeholders, and any other natural person whose data is processed by B.A. Studios SAS, either directly or indirectly.

• Data Transfer: occurs when the data controller and/or processor, located in Colombia, sends personal data to a recipient who is also a data controller and is located either within or outside the country.

• Data Transmission: the processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia, for the purpose of having a processor carry out processing on behalf of the data controller.

• Treatment: any operation or set of operations performed on personal data, such as collection, storage, use, dissemination, or deletion.

GUIDING PRINCIPLES OF PERSONAL DATA TREATMENT

B.A. Studios SAS is committed to data subjects to process their personal data in accordance with the following principles:

• Principle of legality in matter of data treatment: B.A. Studios SAS is aware that the processing referred to in Law 1581 of 2012 is a regulated activity, which must comply with the provisions of that law and any other regulations implementing it.

• Principle of purpose: B.A. Studios SAS will process data for a legitimate purpose, in accordance with the Constitution and the law, which will be communicated to the data subject.

• Principle of liberty: B.A. Studios SAS will process data only with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial order.

• Principle of truthfulness or quality: The information subject to processing must be accurate, complete, up-to-date, verifiable, and understandable. At B.A. Studios SAS, the processing of incomplete or misleading data is prohibited.

• Principle of transparency: B.A. Studios SAS acknowledges that data subjects have the right to obtain, at any time and without restriction, information regarding the existence of data concerning them.

• Principle of access and restricted circulation: Processing is subject to the limitations arising from the nature of personal data, in accordance with the provisions of Law 1581 of 2012 and the Constitution. In this regard, processing may only be carried out by persons authorized by the data subject and/or by the persons provided for by law. With the exception of public information, B.A. Studios SAS will not make personal data available on the Internet or other means of mass dissemination or communication, unless access is technically controllable to provide restricted access only to data subjects or authorized third parties in accordance with Law 1581 of 2012.

• Principle of security: B.A. Studios SAS will handle the information subject to processing as referred to in Law 1581 of 2012 using the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, unauthorized or fraudulent consultation, use, or access.

• Principle of confidentiality: All persons involved in the processing of personal data that is not of a public nature are required to ensure the confidentiality of such information, even after their involvement in any of the processing activities has ended. They may only disclose or communicate personal data when such disclosure is necessary for the performance of activities authorized by Law 1581 of 2012 and in accordance with its provisions.

AUTHORIZATIONS

B.A. Studios SAS will seek consent in such a way that the data subject provides prior, express, and informed consent to the processing of their personal data.

Authorization may also be obtained from unequivocal conduct by the data subject, which reasonably allows the conclusion that the data subject has granted consent for the processing of their information. Such conduct must clearly demonstrate the intention to authorize the processing.

The data subject’s consent may be obtained by any means that can be subject to subsequent verification, such as written, verbal, or virtual communication, or through unequivocal conduct.

By virtue of its nature and corporate purpose, B.A. Studios SAS receives, collects, records, retains, stores, modifies, reports, consults, delivers, transmits, transfers, shares, and deletes personal information, for which it obtains the prior authorization of the data subject.

The authorization granted to B.A. Studios SAS by the data subjects allows, among other things, for the following purposes: to offer and provide information about products and services; to consult, report, and update their data with credit and risk reporting agencies; to update existing contractual relationships; and to fulfill agreed-upon obligations, among others.

B.A. Studios SAS will retain adequate proof of such authorizations, ensuring and respecting the principles of privacy and confidentiality of the information.

Likewise, at B.A. Studios SAS, when dealing with information related to the following types of data, the following special considerations will apply:

a. Sensitive data

Regarding the processing of sensitive data, B.A. Studios SAS will inform the data subject of the following:

• For the processing of this type of information, the data subject is not required to provide authorization or consent.

• The specific types of sensitive data to be requested will be explicitly disclosed in advance.

• The data subject will be informed of the processing and the purpose for which the sensitive data will be used.

• Authorization for the processing of sensitive data must be given in advance, expressly, and clearly.

b. Data of children and adolescents.

B.A. Studios SAS will ensure that the processing of this type of data is carried out in accordance with the rights of children and adolescents. In this regard, their special status will be protected, and their fundamental rights will be upheld, in accordance with the provisions of Articles 5, 6, and 7 of Law 1581 of 2012, Articles 6 and 12 of Decree 1377 of 2013, and any other regulations that amend or supplement them.

To comply with the foregoing, B.A. Studios SAS will act in accordance with the following:

• Authorization will be sought from the legal representative of the child or adolescent after the minor has exercised their right to be heard; this opinion will be taken into account, considering the minor’s maturity, autonomy, and ability to understand the matter, for the purpose of processing their personal data.

• It will be made clear that answering questions regarding the data of children or adolescents is optional.

• The specific data to be processed and the purpose of such processing will be explicitly disclosed in advance.

B.A. Studios SAS hereby informs all its stakeholders that, in accordance with Article 10 of Law 1581 of 2012, the data subject’s authorization will not be required in the following cases: (1) information requested by a public or administrative entity in the exercise of its legal functions or by court order, (2) data of a public nature, (3) cases of medical or health emergencies, (4) processing of information authorized by law for historical, statistical, or scientific purposes, and (5) data related to the Civil Registry of Persons.

PURPOSES

The following are the main purposes for which B.A. Studios SAS processes personal information:

Clients and/or users

• To take all necessary steps to confirm and update customer information.

• To validate and verify the customer’s identity for the purpose of offering and managing products and services, as well as to share information with various market stakeholders.

• To establish, maintain, and terminate a contractual relationship.

• To offer and provide products or services through any means or channel in accordance with the customer’s profile and technological advancements.

• Receive information from B.A. Studios SAS regarding current and future marketing campaigns, promotions for both our own and third-party products and services, and other communications necessary to keep the customer informed and up-to-date via: phone call, text message, email, Facebook, Twitter, Instagram, or any other social media platform or instant messaging service, among others;

• To provide commercial, legal, product, safety, service, or other information.

• To obtain the customer’s location and contact information for the purpose of sending notifications related to security and offering benefits and commercial offers.

• To conduct commercial, statistical, risk, and market analyses and research, among others.

• To prevent money laundering and terrorist financing, as well as to detect fraud, corruption, and other illegal activities.

• To process, validate, authorize, or verify transactions, including, when required, the consultation and reproduction of sensitive data such as fingerprints, images, or voice recordings, among others.

• To conduct satisfaction surveys regarding the services provided by B.A. Studios SAS

• with various administrative and judicial authorities or public databases responsible for managing data of this nature.

Subject to the data subject’s prior consent and for the purpose of operating the digital channels of B.A. Studios SAS, the following uses will be made on the electronic devices on which the digital channels are used: (i) to improve the experience of our digital channels; (ii) to enable access to various features; (iii) to provide customization options; (iv) to manage security by monitoring, detecting, and preventing suspicious activity; and (v) to share information with third parties and/or partners.

Providers and allies

• The information requested from the supplier or partner may include information regarding the individual or legal entity, as applicable. Additionally, information may be requested regarding the supplier’s or partner’s employees who are engaged in performing a function or maintaining a relationship with B.A. Studios SAS and who, due to the nature of their work, require access to the organization’s facilities, applications, systems, or other resources.

• To manage and verify commercial and reputational backgrounds, as well as assess risks related to money laundering and terrorist financing, and to detect and/or prevent fraud, corruption, and other illegal activities by the supplier or its employees in connection with the operations of B.A. Studios SAS.

• To manage and strengthen contractual relationships with the supplier or partner, enabling greater control over the obligations assumed by the parties.

• To review and evaluate the performance of the supplier or partner, with the aim of strengthening procurement processes within B.A. Studios SAS.

• Offer and provide products or services through any means or channel in accordance with the supplier’s or partner’s profile and in line with technological advancements.

• Conduct commercial, statistical, risk, market, and financial analyses and research based on the supplier’s or partner’s performance.

Applicants and collaborators

The information that B.A. Studios SAS collects from job applicants or candidates for positions within the company is processed for the purpose of conducting the hiring evaluation and onboarding process.

The processing of our employees’ personal information is intended to manage our existing employment relationships with them, as well as to carry out the various activities established by the company. Among these, we highlight the following:

• To comply with the obligations and rights arising from its role as an employer, as well as with the activities inherent to its primary and related corporate purposes, which may be carried out directly or with the assistance of third parties with whom your information will be shared for purposes related to the subject matter of the contract.

• To share your personal data with national or foreign authorities (judicial or administrative) when the request is based on legal, procedural, and/or tax grounds.

• Access to and authorization of the benefits established by the employer, in accordance with the requirements defined in each case.

• Consultation of your data in internal control lists, in compliance with national regulations and internal policies associated with the Anti-Money Laundering and Counter-Terrorist Financing Risk Management System (SARLAFT), as well as compliance with the standards of ethics and integrity established by B.A. Studios SAS.

• To provide your information to employee funds and mutual investment funds that you have authorized to access it.

With regard to former employees, B.A. Studios SAS will retain, even after the employment contract has ended, the information necessary to fulfill any obligations that may arise from the employment relationship that existed under Colombian law, or from services that may be provided as a result of that relationship, as well as to provide employment certificates requested by the former employee or by third parties with whom the former employee is undergoing a selection process.

Shareholders

Shareholders’ information and personal data, including personal and contact information, as well as information and documentation provided through online channels, telephone, email, and information updates, will be collected, accessed, updated, modified, and processed directly by B.A. Studios SAS and/or by third parties designated by it, for the following purposes:

• To comply with the obligations and rights arising from its status as Issuer and Depositary, respectively.

• To carry out comprehensive administration of the shareholder registry.

• To provide information related to procedures, complaints, and requests from shareholders.

• To provide access to information to judicial or administrative authorities that request such data in the exercise of their functions.

• To manage the risks of money laundering, terrorist financing, and corruption.

• To fulfill the necessary activities and purposes of the issuer-shareholder relationship.

Access to buildings, surveillance and security of the facilities

• Maintain records of all employees, outsourced staff working for B.A. Studios SAS, and visitors entering the headquarters buildings or other organizational facilities.

• Monitor and control access to the General Management administrative offices.

• Maintain security and control access to buildings, branches, and other facilities.

B.A. Studios SAS hereby informs all data subjects that the data collected directly at security checkpoints in administrative offices, buildings, branches, and other facilities—including information provided in documents by security personnel—and data obtained from video recordings made inside or outside the facilities of B.A. Studios SAS are used for the purpose of ensuring the safety of individuals, property, and facilities.

DURATION OF DATA TREATMENT

Personal data will be processed by B.A. Studios SAS for the duration of the contractual relationship during which the data subject holds the product, service, contract, or relationship, plus any period required by law.

RIGHTS OF THE OWNER

Data subjects whose information is processed by B.A. Studios SAS may:

• Access, update, correct, delete, or revoke their personal data and be informed of the processing carried out by B.A. Studios SAS on their personal data.

• Submit requests and complaints related to current regulations regarding the Protection of Personal Data.

• Request revocation of authorization and/or deletion of personal data in
  the event that B.A. Studios SAS is found to have acted in violation of current regulations. The request for deletion or revocation shall not apply when data subjects have a legal or contractual obligation to remain in the B.A. Studios SAS database.

In accordance with Article 20 of Decree 1377 of 2013, the aforementioned rights may be exercised by the following persons:

• By the data subject, who must sufficiently prove their identity through the various means made available by the data controller.

• By their successors in title, who must prove their status as such.

• By the data subject’s representative and/or agent, upon proof of representation or power of attorney.

• By stipulation in favor of another or on behalf of another.

• The rights of children and adolescents shall be exercised by the persons authorized to represent them.

DUTIES OF B.A. STUDIOS SAS

As the entity responsible for the personal data stored in its databases, B.A. Studios SAS undertakes to:

• Ensure that the data subject can fully and effectively exercise their rights.

• Request and retain a copy of the authorization granted by the data subject or proof thereof.

• Inform the data subject of the purposes of the collection, the uses of their personal data, and their rights based on the authorization granted.

• Store the information securely to prevent its alteration, loss, unauthorized consultation, use, or access.

• Ensure that the information provided to third parties or data processors is truthful, complete, accurate, up-to-date, verifiable, and understandable.

• Update the information held by any third party or data processor regarding any changes to the provided data and take the necessary measures to ensure the information remains up-to-date.

• Correct the information when it becomes aware that it is incorrect.

• Ensure that third parties and/or data processors handling personal information on behalf of B.A. Studios SAS have effective measures and policies in place to guarantee the proper processing of such information. Likewise, it will require them to commit to adhering to and implementing the provisions of this Personal Data Processing Policy and other guidelines established by B.A. Studios SAS, or to certify that their internal policies include at least the provisions set forth herein. If it is not possible to issue such certification, B.A. Studios SAS must verify that the internal policies of the third parties and/or data processors include security and/or privacy standards equivalent to or higher than those set forth herein. In this regard, third parties and/or data processors must adopt security and privacy measures and conditions for the personal data shared with them that are at least equivalent to the level of protection adopted by B.A. Studios SAS. Process inquiries and complaints submitted in accordance with the provisions of this Policy and the law.

• Notify the data protection authority when security breaches occur and there are risks in the management of data subjects’ information.

ATTENTION OF CONSULTATIONS, COMPLAINTS AND CLAIMS

Data subjects who wish to submit an inquiry, complaint, or claim may do so through the following channels:

a. Consultations

Data subjects, their successors in interest, or any other person with a legitimate interest may request information regarding the data subject’s personal data stored in any database maintained by B.A. Studios SAS.

In accordance with the foregoing, B.A. Studios SAS will guarantee the right to access information by disclosing the personal data associated with the data subject.

b. Claims

Correction, update, suppression and revocation

Data subjects, their successors in title, or any other person with a legitimate interest who believes that the information contained in any of the databases of B.A. Studios SAS should be corrected, updated, or deleted, or who notice a possible breach of the duties established in Law 1581 of 2012 and its regulatory decrees, may file a complaint in accordance with the requirements of Article 15 of said law.

Requirements to present a claim:

• Identification of the data subject or the person filing the complaint, including their name and identification number.

• Clearly and explicitly describe the reason for the complaint, setting forth the facts that gave rise to it, and submit any supporting documents.

• Demonstrate the legitimate interest of the person filing the complaint and attach, if necessary, the corresponding supporting documents.

• Provide the telephone number, physical address, or email address to which the response to the request should be sent.

In any case, if the claim is incomplete, the claimant will be asked to correct the deficiencies within five (5) days of receipt. If two (2) months have elapsed since the date of the request and the claimant has not submitted the required information, B.A. Studios SAS will consider the claim withdrawn.

However, the maximum timeframe for addressing the complaint shall be fifteen (15) business days, counted from the day following the date of receipt. If it is not possible to address the complaint within this timeframe, the interested party will be informed of the reasons for the delay and the date by which the complaint will be resolved, which in no case may exceed eight (8) business days following the expiration of the initial timeframe.

Suppression of Information

If you request the deletion of all or part of your personal information, please note that B.A. Studios SAS will review your request. However, the information will not be deleted if the data subject has a legal or contractual obligation to remain in the database managed by B.A. Studios SAS

Revocation of Authorization

If you request the revocation of consent for your personal data, B.A. Studios SAS will review the request and notify you whether the revocation is granted.

CHANNELS OF ATTENTION OF CONSULTATIONS, COMPLAINTS AND CLAIMS

B.A. Studios SAS has established the following channels for data subjects to exercise their rights to access, update, correct, and/or delete their personal information.

• Physical address: Calle 4 sur #43a-195-Centro Ejecutivo, oficina 239

• Telephone number: 318-370-25-86

• Email: datospersonales@bombilloamarillo.com

• Web page: https://bombilloamarillo.com/

TRANSFER AND TRANSMISSION OF PERSONAL DATA

B.A. Studios SAS, as the controller of the personal data stored in its databases and in pursuit of the purposes described in this document, may transfer or transmit data domestically or internationally.

B.A. Studios SAS is committed to verifying the level of protection and security standards in the country receiving the personal information, issuing a declaration of conformity (where applicable), and entering into a transfer agreement or other legal instrument that guarantees the protection of the personal data being transferred.

RELATIONSHIP WITH THIRD PARTIES AND/OR PROCESSORS

In accordance with this Policy and internal provisions for the proper handling of personal data, B.A. Studios SAS will ensure that third parties with whom it enters into business, employment, or partnership relationships comply with Colombia’s personal data protection regime.

In light of the foregoing, B.A. Studios SAS, without prejudice to all documentation, forms, and means provided for requesting authorization for processing, privacy notices, records, and contractual and/or legal coverage, may request from third parties and/or data processors appropriate and relevant information to verify and ensure compliance with the provisions contained in this policy and in Colombia’s personal data protection regime.

In this regard, B.A. Studios SAS may request that third parties and/or data processors demonstrate, prior to, during, or after the relationship between them, compliance with the requirements of the personal data protection regime. Thus, it may request an occasional or periodic review and supervision of compliance with legal and/or contractual requirements, through evidence or documentation of the work performed, conduct visits to the third party’s facilities, among other activities that may be coordinated to validate compliance.

COOKIES

B.A. Studios SAS uses first-party and third-party cookies to improve its services on the website and digital applications, with the aim of optimizing the experience of our customers and users, monitoring statistical information, and presenting content and advertising tailored to users’ preferences when they browse our website, platforms, and/or technological and/or digital applications.

The information collected through cookies is encrypted and will not be used to identify and/or disclose user information. Similarly, we do not collect user data such as debit or credit card numbers, or other financial or personal information.

COMPLEMENTARY POLICIES AND GUIDELINES AND MODIFICATIONS OF THE PRESENT POLICY

Pursuant to this policy, B.A. Studios SAS may develop policies on specific matters (e.g., a cookie policy), as well as guidelines, directives, and circulars aimed at their implementation, provided they are consistent with the regulatory framework and this policy.

This policy may be amended at any time to adapt it to new practices that may arise or to legislative or jurisprudential developments in this area. Any updates will be made available to data subjects on the website https://bombilloamarillo.com/ or through any other means deemed appropriate, indicating the effective date of the corresponding amendment or update, as applicable.

VALIDITY

This Personal Data Processing Policy takes effect as of the date of its approval (September 2024)

Daniel Vélez Carvajal

Manager