Personal Data Treatment Policy — DURA Proyectos SAS

Applicable to: Clients, Suppliers, and Business Partners

1. GENERAL PROVISIONS

DURA PROYECTOS S.A.S., a commercial entity identified with NIT 900.859.916-3, domiciled in Medellín, Colombia, with the website www.dura.com.co, in compliance with Law 1581 of 2012 and Decrees 1377 of 2013 and 886 of 2014, hereby adopts this Personal Data Treatment Policy. This policy is mandatory for all personal data collected, processed, stored, used, updated, and deleted by the company.

This policy is binding for all employees, executives, contractors, and third parties acting on behalf of DURA PROYECTOS S.A.S. In the absence of an employment relationship, a contractual clause must be included obliging those operating on behalf of the company to comply with its provisions.

Failure to comply with this policy will result in labor, civil, or contractual sanctions, without prejudice to the sanctions established in Articles 23 and 24 of Law 1581 of 2012, and the criminal sanctions contemplated in Law 1273 of 2009 regarding information leaks and personal data violations.

2. OBJECTIVE

The primary objective of this policy is to ensure compliance with Law 1581 of 2012 and its regulatory decrees, as well as any other regulations that modify, add to, or regulate them, under the following premise:

This document establishes the guidelines, procedures, and responsibilities for the proper protection of the personal data of clients, suppliers, and business partners in the development of the company's commercial, logistical, and representative activities, both in the domestic and international markets.

3. SCOPE OF APPLICATION

This policy applies to all personal data processed by DURA PROYECTOS S.A.S. in the development of its corporate purpose, which includes B2B industrial supply, provision of business services, commercial representation, and operation as an export intermediary for Colombian producers in international markets.

This policy covers data from the following categories of data subjects:

Domestic and international clients: individuals or legal entities that acquire products or services from DURA PROYECTOS S.A.S.
Suppliers: individuals or legal entities that supply goods, inputs, or services to the company.
Business partners and commercial allies: individuals or legal entities with whom alliances, representation contracts, distribution agreements, or other forms of commercial collaboration are signed.
Legal representatives, business contacts, and other individuals linked to the company's commercial relations.

4. LEGAL FRAMEWORK

This policy is governed by the following regulatory framework:

Law 527 of 1999: Defines and regulates the access and use of data messages, electronic commerce, and digital signatures.
Law 1266 of 2008: General provisions of Habeas Data and management of information in personal databases, especially those of a financial, credit, and commercial nature.
Law 1273 of 2009: Defines criminal conducts related to the protection of information and data, such as computer damage, personal data violation, and abusive access to computer systems.
Law 1581 of 2012: General statutory law for the protection of personal data in Colombia.
Decree 1377 of 2013: Regulates Law 1581 of 2012 regarding data subject authorization, treatment policies, data subject rights, and data transfer.
Decree 886 of 2014: Regulates the National Registry of Personal Databases before the Superintendence of Industry and Commerce.
SAGRILAFT and PTEE Regulations: Applicable to data processing within the framework of the Anti-Money Laundering and Terrorism Financing Risk Management System, and the Business Transparency and Ethics Program.

5. DEFINITIONS

For the purposes of this policy, the following definitions are adopted:

Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of their personal data.
Database: Organized set of personal data that is subject to processing, in physical or digital support.
Personal Data: Any information linked or that can be associated with one or more specific or determinable individuals.
Sensitive Data: Those that affect the Data Subject's privacy or whose improper use can generate discrimination, such as health data, racial or ethnic origin, religious convictions, political orientation, or biometric data.
Data Processor: Individual or legal entity that performs the processing of personal data on behalf of the Data Controller.
Data Controller: Individual or legal entity that decides on the database and/or the processing of the data. DURA PROYECTOS S.A.S. acts as the Data Controller.
Data Subject: Individual whose personal data is subject to processing.
Treatment/Processing: Any operation on personal data: collection, storage, use, circulation, transfer, transmission, or deletion.
Data Transfer: Sending personal data to a receiver located inside or outside Colombia, who becomes the Data Controller.
Data Transmission: Communication of data to a Data Processor, inside or outside the country, so that they process the data on behalf of the Data Controller.

6. PRINCIPLES APPLICABLE TO PERSONAL DATA PROCESSING

The processing of personal data in DURA PROYECTOS S.A.S. is governed by the following principles:

Purpose: Data is collected and processed with a legitimate, specific, and previously informed purpose to the data subject.
Freedom: Processing can only be carried out with the prior, express, and informed consent of the data subject, unless there is a legal mandate.
Veracity or Quality: Information must be truthful, complete, accurate, updated, verifiable, and understandable.
Transparency: The data subject has the right to know the information about them held in the company's databases.
Restricted Access and Circulation: Data may not be available on the internet or disclosed, unless the data subject has authorized it or there is a legal mandate.
Security: Technical, human, and administrative measures necessary to avoid tampering, loss, consultation, use, or unauthorized access are adopted.
Confidentiality: Persons involved in the processing of personal data are obliged to maintain secrecy, even after their relationship with the company has ended.

7. PERSONAL DATA COLLECTED

In the development of its commercial activities, DURA PROYECTOS S.A.S. may collect, among others, the following personal data from its clients, suppliers, and business partners:

7.1 Identification Data

First and last names or company name
Identification number (ID, NIT, passport, or other equivalent document)
Position or role within the organization
Country and city of residence or headquarters

7.2 Contact Data

Physical or electronic address
Landline or mobile phone
Corporate or personal email
Instant messaging channels (WhatsApp, Teams, or others)

7.3 Commercial and Financial Data

Tax information (RUT, tax regime, economic activity codes)
Bank details for payment and collection management
History of transactions, quotes, and contracts
Commercial references

7.4 Due Diligence Data

Information required within the framework of SAGRILAFT and PTEE programs for onboarding clients, suppliers, and business partners
Declarations of source of funds and onboarding forms

8. PURPOSES OF PROCESSING

DURA PROYECTOS S.A.S. processes the personal data of its stakeholders for the following purposes:

8.1 For Clients

Comprehensive management of the commercial relationship: quotes, orders, invoicing, delivery, and after-sales.
Compliance with contractual, accounting, and tax obligations.
Sending catalogs, offers, product launches, and commercial communications of interest.
Conducting satisfaction surveys and service quality monitoring.
Management of claims, warranties, and technical or logistical support.
Compliance with SAGRILAFT and PTEE programs.
Contact through digital channels, telephony, and instant messaging media.

8.2 For Suppliers

Management of the supplier selection, onboarding, and evaluation process.
Management of contracts, purchase orders, and payments.
Compliance with accounting, tax, and regulatory obligations.
Implementation of SAGRILAFT and PTEE programs in the due diligence process.
Communication for logistical coordination, updating commercial conditions, and contract renewal.

8.3 For Business Partners and Commercial Allies

Management of alliance agreements, commercial representation, distribution, or business cooperation.
Execution of export intermediation and representation operations before international buyers.
Operational, logistical, and commercial coordination in joint projects.
Compliance with contractual, legal, and regulatory obligations.
Exchange of commercial information for the purpose of joint promotion of products and services.

9. INFORMATION COLLECTION MECHANISMS

DURA PROYECTOS S.A.S. collects personal data through the following mechanisms:

Web portal: www.dura.com.co (contact forms, quote requests, and client registration).
Corporate email and instant messaging channels (WhatsApp Business, Teams, or others).
Physical or digital onboarding formats for clients, suppliers, and business partners.
Contracts, commercial proposals, and agreements signed with the company.
Trade fairs, commercial events, business missions, and national and international promotion activities.
Due diligence forms within the framework of SAGRILAFT and PTEE compliance.
Social networks and digital platforms where DURA PROYECTOS S.A.S. has a corporate presence.

10. INFORMATION STORAGE AND SECURITY

The personal data collected is stored in its own databases, whether physical or digital, with the following guarantees:

Restricted access to authorized personnel through authentication credentials.
Confidentiality agreements signed by all collaborators with access to personal information.
Technical measures for encryption, backup, and access control in information systems.
Periodic review of the security controls implemented.
Immediate reporting of any security incident or information leak to the designated person.

11. INTERNATIONAL TRANSFER AND TRANSMISSION OF DATA

Due to its activity as an export operator and commercial representative of Colombian producers before international buyers, DURA PROYECTOS S.A.S. may transfer or transmit personal data to recipients located outside Colombia, when necessary for the execution of commercial operations, representation contracts, or international business relationships.

Such transfer will be carried out in strict compliance with Articles 26 and 27 of Law 1581 of 2012, ensuring that the receiver provides adequate levels of protection or that express authorization is obtained from the data subject for the transfer. In cases of transmission to data processors abroad, transmission contracts or agreements will be signed to ensure compliance with applicable data protection regulations.

12. TEMPORARY LIMITATIONS ON PROCESSING

DURA PROYECTOS S.A.S. will keep personal data only for the time that is reasonable and necessary to fulfill the purposes that justified its collection, attending to applicable legal, accounting, tax, and contractual provisions. Once such purposes are fulfilled, and in the absence of a legal or contractual obligation requiring its conservation, it will proceed to the secure deletion of the data.

13. DATA SUBJECT AUTHORIZATION

DURA PROYECTOS S.A.S. will require prior, express, and informed authorization from the data subject to process their personal data, except in cases where the law does not require such authorization. This authorization will be obtained through mechanisms enabled for this purpose (physical formats, digital forms, contractual clauses, among others) and will be kept as proof of the consent granted.

13.1 Revocation of Authorization

The data subject may at any time revoke their authorization in whole or in part. Total revocation will prevent DURA PROYECTOS S.A.S. from continuing to process the data for all consented purposes. Partial revocation will allow continued processing for purposes not revoked. The request for deletion will not proceed when the data subject has a pending legal or contractual duty with the company.

14. DATA SUBJECT RIGHTS

In accordance with Law 1581 of 2012 and Decree 1377 of 2013, personal data subjects have the following rights, the exercise of which DURA PROYECTOS S.A.S. guarantees:

a. Know, update, and rectify their personal data before DURA PROYECTOS S.A.S., including partial, inaccurate, incomplete, fragmented data, or data that leads to error.
b. Request proof of the authorization granted for the processing of their data, except for cases excepted by law.
c. Be informed about the use that has been given to their personal data.
d. File complaints before the Superintendence of Industry and Commerce for violations of the data protection regulations.
e. Revoke the authorization and/or request the deletion of their data when the processing does not respect constitutional and legal principles, rights, and guarantees.
f. Access free of charge their personal data that has been subject to processing.
g. Know significant changes in the data protection policy no later than at the time of the entry into force of the new policies.

15. PROCEDURE FOR THE EXERCISE OF HABEAS DATA RIGHT

Data subjects or legitimized third parties may exercise their rights of inquiry, update, rectification, deletion, or revocation through the following channels:

Email: protecciondedatos@dura.com.co
Web portal form: www.dura.com.co (Privacy and Personal Data section)
Written request: Medellín, Colombia

Response times will be as follows:

Inquiries: within ten (10) business days following receipt.
Claims: within fifteen (15) business days following receipt. If it is not possible to attend to it within said period, the applicant will be informed of the reason for the delay and the new response date, which may not exceed eight (8) additional business days.
If the request is incomplete, its correction will be required within five (5) business days following. If two (2) months pass without response from the applicant, the request will be understood as withdrawn.

16. DATA CONTROLLER AND PRIVACY OFFICER

DURA PROYECTOS S.A.S. acts as the Data Controller of the personal data collected in the development of its commercial activity. The Legal Representation of the company will appoint a Privacy Officer or person in charge of compliance with personal data protection regulations, who will have among their functions:

Supervise the implementation and updating of this policy.
Attend to the requests and claims of data subjects.
Keep the National Registry of Databases updated before the Superintendence of Industry and Commerce.
Train personnel on personal data protection.
Identify and manage risks associated with the processing of personal data.
Report security incidents affecting personal data to Management.

17. COOKIES AND DIGITAL MEDIA

The web portal of DURA PROYECTOS S.A.S. (www.dura.com.co) may use its own and third-party cookies in order to optimize the browsing experience, monitor access statistics, and present relevant content to users. Information collected through cookies will not be used to individually identify users without their express consent. The user may configure their browser to block or delete cookies at any time.

Communications made through digital channels such as email, WhatsApp Business, or other messaging platforms will be governed by this policy and by the particular conditions informed to the data subject at the time of collection.

18. DATA PROTECTION CLAUSES IN COMMERCIAL RELATIONS

In all contracts, alliance agreements, purchase orders, commercial representation contracts, and other legal instruments signed with clients, suppliers, and business partners that involve access, processing, transmission, or transfer of personal data, DURA PROYECTOS S.A.S. will include the necessary clauses to guarantee the protection of such information, such as:

Confidentiality and personal data protection clauses.
Information transmission contracts or agreements with data processors.
Special clauses according to the risk level in data handling by third parties.

19. VALIDITY AND UPDATING

This policy enters into force as of its publication on the web portal of DURA PROYECTOS S.A.S. (www.dura.com.co) and will be updated when required by changes in legislation, modifications in the company's internal processes, instructions from the Superintendence of Industry and Commerce, or any other circumstance that affects the processing of personal data. Significant changes will be communicated to the data subjects through available channels.

For any additional inquiries regarding personal data protection, the data subject can communicate at:
Email: protecciondedatos@dura.com.co
Web portal: www.dura.com.co