Personal Data Processing Policy

• GAMMA INGENIEROS S.A.S., established in 1983, is a Colombian company that provides clients with services and solutions in Technology, Consulting, and Engineering, driven by innovation and sustainability and supported by excellent human talent.
• Identification details: GAMMA INGENIEROS S.A.S., NIT 891.501.783-1.
• Contact details: Address: Calle 166 #20-45, Bogotá. Tel.: (601) 4076000
• Website: www.gammaingenieros.com
  Email: protecciondatos@gammaingenieros.com

• Authorization: Refers to the prior, express, and informed consent of the Data Subject for GAMMA INGENIEROS S.A.S., or its Data Processors, to carry out the processing of the Data Subject’s personal data.
• Privacy Notice: Refers to the physical, electronic, or any other format document generated by GAMMA INGENIEROS S.A.S., made available to the Data Subject for the processing of their personal data. It informs the Data Subject about the existence of the Personal Data Processing Policies applicable to them, how to access them, and the characteristics of the intended processing of personal data.
• Database: Refers to an organized set of personal data subject to processing, including physical and electronic files. The databases owned by GAMMA INGENIEROS S.A.S. are detailed in Section VI of these policies.
• Personal Data: According to Law 1581 of 2012, any information associated with or that can be linked to one or more identified or identifiable natural persons.
• Public Data: Personal data classified as public by law or the Political Constitution. These include, among others, data related to marital status, profession or occupation, and status as a merchant or public servant.
• Sensitive Data: Personal data that affects the privacy of the Data Subject or whose improper use may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social or human rights organizations, or organizations promoting political interests, as well as data related to health, sexual life, and biometric data.
• Data Subject: A natural person whose personal data is subject to processing.
• Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion, carried out by GAMMA or Data Processors on behalf of the company.
• Transfer: The sending of personal data to a recipient who is, in turn, responsible for its processing under Law 1581 of 2012.
• Transmission: The communication of personal data to the Data Processor, within or outside the territory of the Republic of Colombia, for the purpose of processing on behalf of GAMMA INGENIEROS S.A.S.

The personal data collected hereafter or stored in our databases will be processed for the following purposes:

• Salesforce Clients: Salesforce is a CRM (Customer Relationship Management) application used to manage customer relationships focused on sales and customer service. Reports are generated regarding sales to measure projected performance indicators (KPIs – Key Performance Indicators). It also centralizes customer information (contact details, business opportunities, service-related documents, future projections). Additionally, user activity within the platform may be tracked (sales, task and daily event logging, and technical support case follow-up) according to the assigned user profile.
• Clients: Data collection is carried out for commercial activities and market exploration, enabling the identification of business opportunities for later contact, direct communication with clients, distribution of company service information, advertising campaigns, event information, customer loyalty activities, financial and economic assessment, and prospecting for future business.
• Prospective Clients: This database includes records of individuals or company contacts considered potential clients who have not yet acquired products or services but may belong to the target market. It is used for commercial activities, client prospecting, identification of business opportunities, meetings, submission of commercial proposals related to products and services, advertising campaigns, event information, portfolio communications, customer loyalty initiatives, and financial and economic assessment.
• Final Clients: GAMMA INGENIEROS S.A.S. will use the information provided to: 1. Carry out necessary activities for the pre-contractual, contractual, and post-contractual stages with GAMMA regarding any of its products, whether acquired or not, as well as any underlying contractual relationship, and to comply with Colombian or foreign law and orders from judicial or administrative authorities; 2. Manage procedures (requests, complaints, claims), conduct risk analysis, and perform satisfaction surveys regarding the company’s goods and services, as well as those of its business partners; 3. Provide contact information and relevant documents to the sales force and/or distribution network, telemarketing, market research, and any third party with whom the company has a contractual relationship of any kind; 4. Share, transfer, and/or transmit personal data within or outside the country to third parties as a result of a contract, legal obligation, or lawful relationship, or to implement cloud computing services. 5; Carry out, directly or through third parties, activities such as technical service scheduling and delivery, sales, purchasing, invoicing, portfolio management, product performance monitoring, collection, business intelligence, marketing, promotion or advertising activities, service improvement, payment follow-up, verification, consultation and control, payment gateway enablement, and any other activity related to current and future products and services, in compliance with contractual obligations and the company’s corporate purpose; 6. Send and receive goods or advertising materials according to operational requirements and business sustainability needs; 7. Control and prevent fraud in any of its forms.
• Technology UEN Suppliers: Used to issue purchase orders and establish business agreements for acquiring goods or services within the technology unit, as well as to manage control and payments for goods and services received by GAMMA INGENIEROS S.A.S.

Some of these activities are carried out in compliance with legal and contractual obligations; therefore, personal data processing is considered included within them.

In the case of personal data processing for advertising, marketing, or commercial prospecting purposes, the Superintendence of Industry and Commerce issued External Circular No. 006 of 2022, which establishes the protection of consumer information obtained through commercial mechanisms, advertising, and marketing campaigns. First, the organization must comply with personal data protection regulations. Second, it must verify that personal data was lawfully obtained and may be used for advertising, marketing, commercial prospecting, or any other intended purpose. Third, individuals who do not wish to receive further advertising must not be contacted, and their data must be deleted upon request. Fourth, effective mechanisms must be implemented for the exercise of data subjects’ rights. Fifth, inquiries and claims from data subjects must be answered in a timely and appropriate manner. Sixth, individuals must not be contacted at times or days that may affect their peace and privacy.

Gamma CyberAcademy Platform: Used to provide cybersecurity training services within the platform, track progress, generate management reports, and share service-related information for both clients and internal employees.

Physical Résumés: Used to record and archive job applications of personnel.

Active Personnel Résumés: Used to maintain updated records of currently active employees.

Inactive Personnel Résumés: Used to track former employees and generate statistical records.

Marketing Clients: Data collection used to register client or employee attendance at in-person, hybrid, or virtual events, identify business opportunities for future contact, and distribute information about company services, cybersecurity content, advertising campaigns, and event information.

Employees – Internal Marketing: Data collection used for internal communications, invitations to in-person, hybrid, or virtual events, corporate announcements, consultation tools, and training information.

Visitor Registry: Used to record the entry and exit of external personnel to the organization through logs managed by the Human Resources department.

CCTV System: Surveillance system used to control activities, monitor areas and personnel, and maintain continuous security oversight of facilities.

Supplier Agenda: Used to establish contact with entities or individuals from whom services or products will be requested.

Technology Suppliers Agenda: Companies that provide technological services used by the organization.

Contractors: Enables contact with providers of specific services.

Pre-sales Area Suppliers: Used for activities such as event sponsorships, direct contact with suppliers, and requesting quotations for products and services provided by partners and vendors.

Data Subjects whose personal data is registered in the databases of GAMMA INGENIEROS S.A.S. have the following rights:

1. a) To know, update, and rectify their personal data. These rights may be exercised, among others, in cases of partial, inaccurate, incomplete, fragmented data, data that leads to error, or data whose processing is expressly prohibited or has not been authorized.
2. b) To request proof of the authorization granted to GAMMA INGENIEROS S.A.S., except when it is expressly waived as a requirement for processing, in accordance with Article 10 of Law 1581 of 2012.
3. c) To be informed, upon request, regarding the use that has been made of their personal data by GAMMA INGENIEROS S.A.S. or the Data Processor.
4. d) Through a claim submitted in accordance with Article 15 of Law 1581 of 2012, to request the revocation of authorization and/or the deletion of personal data when the processing does not respect constitutional and legal principles, rights, and guarantees, or at any time provided that the data subject does not have a legal or contractual obligation to remain in GAMMA’s databases, and in accordance with the procedure set forth in Section IV of this Policy.
5. e) To access their personal data free of charge at least once per month, when such data has been subject to processing.

GAMMA INGENIEROS S.A.S. guarantees the right of inquiry by providing individuals exercising this right with all information contained in their individual record or that is linked to the identification of the Data Subject.

From the Service Transformation Directorate, together with the Customer Experience area, the inquiry process is carried out, specifically addressing nonconformities, complaints, and claims, ensuring that the services and solutions provided by Gamma Ingenieros meet the expectations of internal and external clients through Action Plans that strengthen and enhance processes. This is done through Form PGI005 Improvement (process improvement) focused on both external and internal clients, with follow-up recorded in Form FGI050 Improvement.

This department is responsible for receiving, processing, and channeling the different requests received and forwarding them to the corresponding data processing unit.

Once these units receive such communications, they will perform personal data protection functions and must process data subject requests within the terms, deadlines, and conditions established by applicable regulations for the exercise of rights of access, inquiry, rectification, updating, deletion, and revocation.

For handling personal data inquiries, GAMMA INGENIEROS S.A.S. provides electronic and telephone communication channels.

Contact details for exercising rights:
Correspondence address: Calle 166 #20-45, Bogotá
Phone: (601) 4076000
Email: protecciondatos@gammaingenieros.com

In any case, inquiries will be answered within a maximum term of ten (10) business days from the date of receipt. If it is not possible to respond within this term, the interested party will be informed before its expiration, stating the reasons for the delay and indicating the date on which the inquiry will be answered, which shall in no case exceed five (5) additional business days.

Likewise, we guarantee the right to file complaints regarding databases for correction, updating, or deletion, or when a possible breach of Law 1581 of 2012 and other applicable regulations is identified. Complaints will be processed under the following rules:

1. If the complaint does not contain sufficient information to process it—such as identification of the Data Subject, description of facts, address, and supporting documents—the claimant will be required within five (5) days to correct the information. If after two (2) months the required information is not provided, it will be understood that the complaint has been withdrawn.
2. If GAMMA INGENIEROS S.A.S. receives a complaint addressed to another organization, it will be forwarded to the appropriate entity within two (2) business days, informing the complainant.
3. Once the complaint is complete, the database will include a label stating “complaint in process” within two (2) business days, which will remain until the complaint is resolved.
4. The maximum term to resolve the complaint will be fifteen (15) business days from the day following receipt. If it is not possible to respond within this term, the interested party will be informed before its expiration, indicating the reasons for the delay and the date of response, which shall not exceed eight (8) additional business days.

Special rules for exercising data subject rights:
Requests for rectification, updating, or deletion must be submitted through the channels enabled by GAMMA INGENIEROS S.A.S., indicated in the privacy notice and this document, and must include at least:

1. Name, address of the Data Subject, and contact information for receiving a response (phone, email, residential address).
2. Documents proving identity or representation of the authorized person.
3. Clear and precise description of the personal data for which rights are being exercised.
4. Any additional elements or documents that facilitate the location of the personal data.

GAMMA INGENIEROS S.A.S. is obliged to rectify and update, upon request, any information that is incomplete or inaccurate, in accordance with the procedure and terms stated above.

Regarding data deletion, the Data Subject has the right at any time to request deletion of their personal data when:

2012. a) They consider that the data is not being processed in compliance with Law 1581 of 2012.
      b) The data is no longer necessary or relevant for the purpose for which it was collected.
      c) The retention period for fulfilling the purpose has been exceeded.

This deletion implies the total or partial removal of personal data from records, files, databases, or processing activities carried out by GAMMA. However, the right to deletion is not absolute, and it may be denied when:

1. a) The Data Subject has a legal or contractual obligation to remain in the database.
   b) Deletion interferes with judicial or administrative proceedings, tax obligations, criminal investigations, or administrative sanctions.
   c) The data is necessary to protect legally protected interests of the Data Subject, to perform actions in the public interest, or to comply with a legal obligation assumed by the Data Subject.

If deletion is appropriate, GAMMA INGENIEROS S.A.S. will carry it out in a way that prevents recovery of the information. Some data may remain in historical records due to legal obligations, and deletion will apply only to active processing in accordance with the Data Subject’s request.

When data is sent or transferred to another country, the authorization of the Data Subject whose information is being transferred must always be obtained. Unless otherwise required by law, such authorization is a necessary requirement for the international transfer of data.

In this regard, before sending personal data to another country, those responsible for complying with this policy must verify that prior, express, and unequivocal authorization has been obtained from the Data Subject, allowing the transfer of their personal data.

Such transfer of personal data is carried out only to third parties with whom GAMMA INGENIEROS S.A.S. has a contractual, commercial, and/or legal relationship.

The databases processed by GAMMA INGENIEROS S.A.S. are those established in the security document and shall remain in effect for the entire duration of the company’s corporate purpose.

The Privacy Notice is available in any physical or electronic format that is made known to the Data Subject before or at the time of the collection of their personal data. It serves as the means through which the Data Subject is informed of all matters related to the applicable Personal Data Processing Policy, how to access it, the purposes for which their personal data has been collected, and the processing that the company will carry out on such data.

In accordance with the security principle established in Law 1581 of 2012, GAMMA INGENIEROS S.A.S. adopts the technical, human, and administrative measures necessary to ensure the security of personal data under processing, thereby preventing its alteration, loss, unauthorized consultation, use, or fraudulent access.

These policies are effective as of September 30, 2015.

As a general rule, the term of authorization for the use of personal data granted by clients and/or users shall be understood to last for the duration of the commercial relationship or service engagement, and throughout the performance of the company’s corporate purpose.

Authorizations regarding the data of clients and/or users may be terminated at any time at their own will. If the individual is an active client of Gamma, their data may not be used for any purpose other than the provision of the product or service and for offering renewals when applicable.

When the terms of the privacy policies of any contracted services or products are substantially changed, renewal-based services shall obtain new authorization during the renewal process. For other cases, authorization will be obtained in the manner established in each policy or privacy notice, or through the usual communication channels between the company and the Data Subjects.

Any substantial change in data processing policies will be communicated in a timely manner to Data Subjects through regular communication channels and/or via:

• The website: www.gammaingenieros.com
• Email sent to Data Subjects

For Data Subjects without access to electronic means, or those who cannot be contacted, communication will be provided through public notices on the website or at the company’s headquarters.

Notifications will be sent at least ten (10) days prior to the implementation of the new policies and/or substantial updates.

This Personal Data Processing Policy was published on March 14, 2023, and its validity applies from its publication through the authorized channels described above, for the knowledge of all Data Subjects.