1.- GENERAL PRINCIPLES AND ASSUMPTIONS.

• SPORT ENLACE S.A.S.., hereinafter referred to as 'THE COMPANY', guarantees the protection of fundamental rights such as Habeas Data, privacy, intimacy, reputation, and the image of individuals. For this purpose, all actions will be governed by the principles of good faith, legality, self-determination of information, freedom, and transparency.

• Whoever, in the exercise of any activity, including financial, commercial, and labor activities, whether permanent or occasional, may provide any type of personal information or data of the company, as the data controller may know, update and rectify it.

2.- LEGAL FRAMEWORK.

• These policies are developed and applied taking into account articles 15 and 17 of the Political Constitution of Colombia, Law 1581 of 2012 and regulatory decrees 1727 of 2009, 2952 of 2010, 1377 of 2013, 886 of 2014 and 1081 of 2015, in addition to the judgments of the Constitutional Court C-1011 of 2008, and C - 748 of 2011.

3.- DEFINITIONS.

• 3.1. Authorization:

  Prior, express, and informed consent of the data subject to carry out the processing of personal data.

• 3.2. Database:

  Organized set of personal data that is subject to processing.

• 3.3. Personal data:

  Any information linked or that can be associated with one or more identified or identifiable natural persons.

• 3.4. Data processor:

  Natural or legal person, public or private, who, on its own or in association with others, carries out the processing of personal data on behalf of the data controller.

• 3.5. Data controller:

  Natural or legal person, public or private, who, on its own or in association with others, decides on the database and/or the processing of the data.

• 3.6. Data subject:

  Natural person whose personal data is subject to processing.

• 3.7. Processing:

  Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

4.- SPECIFIC PRINCIPLES.

• 4.1. Legality Principle:

  The right of the Data Subject to obtain from THE COMPANY, at any time and without restrictions, information about the existence of any type of personal information or data that is of interest or ownership, must be guaranteed in the use, capture, collection and processing of personal data.

• 4.2. Freedom Principle:

  The use, capture, collection and processing of personal data can only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that waives consent.

• 4.3. Purpose Principle:

  The use, capture, collection and processing of personal data to which THE COMPANY or its suppliers have access and are collected and gathered will be subordinate to and will serve a legitimate purpose, which must be informed to the respective owner of the personal data.

• 4.4. Truthfulness or Quality Principle:

  The information subject to the use, capture, collection and processing of personal data must be truthful, complete, accurate, up-to-date, verifiable and understandable. The processing of partial, incomplete, fractional or misleading data is prohibited.

• 4.5. Transparency Principle:

  The right of the Data Subject to obtain from THE COMPANY, at any time and without restrictions, information about the existence of any type of personal information or data that is of interest or ownership, must be guaranteed in the use, capture, collection and processing of personal data.

• 4.6. Restricted Access and Circulation Principle:

  Personal data, except for public information, may not be available on the internet or other means of mass dissemination or communication, unless access is technically controllable to provide restricted knowledge only to Data Subjects or authorized third parties. For these purposes, THE COMPANY's obligation through its website will be the same.

• 4.7. Security Principle:

  Personal data and information used, captured, collected and subject to processing by THE COMPANY, will be protected to the extent that technical resources and minimum standards allow, through the adoption of technological protection measures, protocols, and all kinds of administrative measures that are necessary to grant security to electronic records and repositories, preventing their adulteration, modification, loss, consultation, and in general against any unauthorized use or access.

• 4.8. Confidentiality Principle:

  Each and every one of the people who administer, handle, update or have access to information of any kind that is found in Databases or in Data Banks, undertake to keep and maintain it in a strictly accounting, technical manner, in the execution and exercise of their functions. All persons who currently work or are linked in the future for this purpose, in the administration and management of databases, must sign an additional document or other if their employment or service contract for the purpose of ensuring such commitment. This obligation persists and remains even after the end of their relationship with any of the tasks that comprise the Processing.

5.- PURPOSE OF DATA PROCESSING.

• 5.1. General Part:

  The processing of personal data of workers, partners, allies, customers, suppliers, contractors and other stakeholders by THE COMPANY will be for collection, storage, use and deletion for accounting, financial, commercial, marketing, judicial purposes, of celebration and execution of business collaboration agreements with partners, customers or other associates, of entering into contracts with client companies, of acquiring goods and services necessary for the company's operations, as well as those related to the administrative operation of the company's facilities and other actions necessary for the operation of the company, including the guarantee of the rights of the people associated with it. The circulation of personal data will be carried out in order to allow contact with allied companies or people for expressly requested and authorized purposes by the holders, as well as for compliance with administrative or judicial orders of the State or international bodies. In any case, personal data may be processed for the following tasks:

• 5.1.1.

  To link the holders, with their prior consent, to marketing programs and activities and the offer of the company's products and services, including promotions, events and campaigns associated with our corporate purpose;

• 5.1.2.

  To link the holders, with their prior consent, to our continuous improvement processes, requiring their support in our service evaluation tasks, suggestions or opportunities for improvement;

• 5.1.3.

  To contact companies, allies or their representatives for the coordination of activities related to our corporate purpose;

• 5.1.4.

  Coordinate the delivery of goods delivered by our company for any reason, within the framework of the business collaboration entered into or as part of the delivery of details or souvenirs;

• 5.1.5.

  Control access to the company's offices and establish security measures, including the establishment of CCTV surveillance areas;

• 5.1.6.

  Generate evidence of the participation of people in our training, communication, advisory, meeting, video call, consulting or any activity in which THE COMPANY provides its services or defines civil, labor or commercial relationships; when they are recipients of the information provided by us; as well as the collection of information required by our partners or customers within the framework of the commercial or civil relationships established with them.

• 5.1.7.

  To respond promptly to queries, requests, complaints and claims made by the holders and administrative or judicial authorities and to transmit the data to the authorities that require it, in accordance with the Law and the Constitution, always exercising the duty of professional secrecy;

• 5.1.8.

  To contact, for reasons of strict necessity, people with people associated with the company, such as workers and their families, shareholders, customers, suppliers, creditors and debtors, for the aforementioned purposes.

• 5.1.9.

  To inform the holders about changes in the conditions of products and services, events, promotions and information of interest due to the collaboration link established with the company.

• 5.1.10.

  Use the collected information for the development of operations within the company (financial, purchases, billing, collection, portfolio, sales, logistics, judicial or administrative processes, assistance in company services, among others), indicating that the holder authorizes the use of the data messages exchanged through electronic contact means as judicial evidence;

• 5.1.11.

  To ensure the rights and obligations of the company's shareholders, including dividend payments, summons, corrections and other elements associated with corporate obligations.

• 5.1.12.

  Any other activity of a similar nature to those described above that are necessary to develop the corporate purpose of THE COMPANY;

• 5.1.13.

  Contact, request information and summons to those who participate in personnel selection processes and contractors of the company;

• 5.1.14.

  To carry out the activities of the company's Human Management, such as payroll, payment of salaries and social benefits, affiliations to entities of the General Social Security System, reporting of work accidents and occupational diseases, investigation of work accidents and incidents and occupational diseases, welfare activities and Safety and Health at Work, exercise of the employer's disciplinary power, linking to various benefits at the discretion of the worker or necessary for the provision of services (such as travel, accommodation, transfers, enrollment in training programs, etc.), among others.

• 5.2. Information for partners:

  The processing of personal data of partners by THE COMPANY will have the following purposes: to maintain commercial, civil and administrative relations associated with our partners, solely for purposes related to the collaboration provided between the partner and the company. The use of information and contact is required for the following purposes:

• 5.2.1.

  Security and access: information related to passwords, accounts, policy changes, platform changes, reports of suspicious accesses and other technical information for the proper, secure and friendly use of the platform and the services offered. This category includes the use of data for identity validation, security verification and access recovery.

• 5.2.2.

  Services: account statements, payment information, contact requests, documentation requests, clarifications, data originated from the partner's collaboration, and other quick information that may be useful to you to enjoy your experience with our services.

• 5.2.3.

  Commercial: Promotions, services, offers, marketing, advertising and other information or communications that tend to offer services of interest to the partner or to learn about their experience, obtain feedback from our service and strengthen business ties with the partner.

• 5.3. Cookies:

  When entering the site, it may store or retrieve information in your browser, mainly in the form of cookies. This information is necessary for the provision of the portal's services and may be about the person who is using the service, their preferences, the technical conditions of navigation or the equipment used; all of which are collected solely for the purpose of providing our services optimally and minimizing technical risks on our portal, thus allowing us to provide our services on a regular basis and ensure that your browsing experience is satisfactory for the user. In the same way, the information obtained can be used to provide you with a more personalized web experience, thus allowing our portal to identify itself solely for the purpose of improving your access to our services, without storing any personal identification information, sensitive or private data of the user, both in first-party and third-party cookies. Since cookies are necessary for the website to function properly, they cannot be disabled from this policy; therefore, entering the portal will constitute tacit acceptance of this policy. However, any blocking or deactivation of cookies by the user from their browser or using any software, application, add-on or application intended for this purpose will exonerate from any inconvenience in the provision of the service, the browsing experience or access to the benefits of the services provided. The details of the cookies used are listed below:

• 5.4. Consent to use of information channels:

  In accordance with this Privacy Policy, the user of the platform, upon registration and entering mandatory data such as phone number and email address, authorizes the use of these information channels for the following purposes related to our services:

• 5.4.1

  Verification of proper phone number registration and validation of password change or reset requests (required): SMS messages will be sent to the registered mobile phone number and messages will be sent and received from the WhatsApp platform for password change or reset purposes, as well as for phone number validation upon registration.

• 5.4.2

  Email registration confirmation (required): Messages will be sent to the partner's email address for the purpose of validating the registered email address.

• 5.4.3

  This (required): Messages will be sent and received to the partner's registered email address to provide and receive information related to passwords, accounts, policy changes, platform changes, reports of suspicious accesses, and other technical information for the proper, secure, and user-friendly use of the platform and the services offered. This channel will also be used to inform about aspects related to accounts and services such as account statements, payment information, contact requests, documentation requests, clarifications, and other quick information that may be useful for the user to enjoy their experience with our services.

• 5.4.4

  Commercial notifications (optional): SMS messages, WhatsApp messages, and emails may be used to send information about promotions, services, offers, marketing, advertising, and other information or communications that tend to offer services of interest to the user or to learn about their experience, obtain feedback on our service, and strengthen commercial ties with the user. These messages will only be sent when the partner authorizes it upon registration or account configuration, which authorization may be revoked at any time by the partner at their will. The provisions of this paragraph do not imply an absolute nature of the information received from the user and at any time the user may exercise their right to correct, rectify, retract or request the deletion of the information, as well as suspend or cancel this authorization, which is understood to be canceled at the time of closing the account of the portal, to which this authorization is associated. For the exercise of these rights, the user may request assistance through this medium or by email to [email protected], the latter having two (2) business days to respond to receipt. Likewise, the user may suspend the authorizations for receiving service notifications and commercial notifications, using the channels indicated herein. SPORT ENLACE SAS, as the owner of the portal, will be responsible for the effective fulfillment of the conditions set forth in this consent, as well as those set forth in its Terms and Conditions and its Privacy Policy. In this way, SPORT ENLACE SAS and the portal reaffirm their commitment to respect the fundamental rights of users to privacy, intimacy, good name, habeas data, legitimate trust and other related rights, which will be guaranteed to our users, allowing a satisfactory experience in our portals.

7.- RIGHTS OF CHILDREN AND ADOLESCENTS.

• The processing will ensure respect for the prevailing rights of minors.

• The processing of personal data of minors is prohibited, except for data that is of a public nature.

8.- DUTIES OF THE COMPANY AS DATA CONTROLLER.

• 8.1

  Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.

• 8.2

  Request and keep a copy of the respective authorization granted by the holder.

• 8.3

  Duly inform the holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.

• 8.4

  Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.

• 8.5

  Guarantee that the information that is provided to the data processor is truthful, complete, accurate, up-to-date, verifiable and understandable.

• 8.6

  Update the information, communicating to the data processor in a timely manner, all new information regarding the data that has previously been provided to him and adopt the other necessary measures so that the information provided to him is kept updated.

• 8.7

  Rectify the information when it is incorrect and communicate the pertinent to the data processor.

• 8.8

  Provide the Data Processor, as the case may be, only with data whose processing is previously authorized.

• 8.10

  Process queries and claims.

• 8.11

  Inform the Data Processor when certain information is under discussion by the Holder, once the claim has been filed and the respective procedure has not been completed.

• 8.12

  Inform the Holder, upon request, about the use of their data.

• 8.13

  Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the Holders' information.

9.- NATIONAL DATABASE REGISTRY.

11.- PRIVACY NOTICE:

• 11.1. Scope and Content of the Privacy Notice:

  The Privacy Notice must at least contain the following information:

• 11.1.1.

  The identity, address and contact details of the Data Controller

• 11.1.2.

  The type of processing to which the data will be subjected and the purpose of such processing.

• 11.1.3.

  The general mechanisms established by the Data Controller for the Data Subject to know the information processing policy and the substantial changes that occur in it. In all cases, it must inform the Data Subject how to access or consult the information processing policy.

12.- RIGHTS AND OTHER RIGHTS OF DATA SUBJECTS.

• 12.1.

  To access, know, rectify and update their personal data with THE COMPANY, in its capacity as data controller.

• 12.2

  By any valid means, request proof of the authorization granted to THE COMPANY, in its capacity as data controller.

• 12.3.

  To receive information from THE COMPANY upon request, regarding the use that has been given to their personal data.

• 12.4.

  To go before the legally constituted authorities, especially before the Superintendency of Industry and Commerce, and file complaints for violations of the provisions of current regulations in applicable standards, after a consultation or request procedure before the Data Controller.

• 12.5.

  Modify and revoke the authorization and/or request the deletion of the data when the processing does not respect the principles, rights and constitutional and legal guarantees in force.

13.- COMPANY'S OBLIGATIONS REGARDING PERSONAL DATA PROCESSING.

14.- GUARANTEES OF THE RIGHT OF ACCESS.

15.- INQUIRIES.

• 15.1.

  Enable electronic or other means of communication that it deems appropriate.

• 15.2.

  Establish forms, systems, and other simplified methods, which must be informed in the privacy notice.

• 15.3.

  Use the customer service or claims services that it has in operation. In any case, regardless of the mechanism implemented for handling access requests, such requests will be handled within a maximum of ten (10) business days from the date of receipt. When it is not possible to handle the request within this period, the interested party will be informed before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which their request will be handled, which in no case may exceed five (5) business days following the expiration of the first period.

16.- CLAIMS.

17.- IMPLEMENTATION OF PROCEDURES TO GUARANTEE THE RIGHT TO FILE CLAIMS.

• 17.1

  The data subject or his or her successors in title, upon proof of their identity, or through electronic instruments that allow them to identify themselves.

• 17.2

  Their representative, upon proof of representation.

• 17.2.1.

  When the request is made by a person other than the data subject, the person or power of attorney to act must be duly accredited; and if such quality is not accredited, the request shall be considered as not submitted.

• 17.3.

  The request for rectification, update or deletion must be submitted through the means enabled by THE COMPANY as indicated in the privacy notice and must contain, at least, the following information:

• 17.4.

  The name and address of the data subject or any other means of receiving the response.

• 17.5.

  The documents that prove the identity or personality of their representative.

• 17.6.

  A clear and precise description of the personal data in respect of which the data subject seeks to exercise any of the rights.

• 17.7.

  Any other elements or documents that may facilitate the location of the personal data.

18.- RECTIFICATION AND UPDATING OF DATA.

• THE COMPANY is obliged to rectify and update, at the request of the data subject, the information that the data subject considers should be organized in their personal data. In requests for rectification and updating of personal data, the data subject must indicate the corrections to be made and provide documentation to support their request.

• THE COMPANY is free to enable mechanisms that facilitate the exercise of this right, provided that they benefit the data subject. Consequently, electronic means or other means that it deems appropriate may be enabled.

• THE COMPANY may establish forms, systems, and other simplified methods, which must be informed in the privacy notice and which may be made available to interested parties on the website.

19.- DELETION OF DATA.

• The data subject has the right, at any time, to request THE COMPANY to delete (eliminate) their personal data when:

20.- REVOCATION OF CONSENT.

• Data subjects may revoke their consent to the processing of their personal data at any time, provided that this is not prevented by a legal or contractual provision. To do so, THE COMPANY must establish simple and free mechanisms that allow the data subject to revoke their consent, at least by the same means by which they granted it. It should be noted that there are two modalities in which the revocation of consent may occur. The first may be on all the purposes consented to, that is, that THE COMPANY must completely stop processing the data subject's data; the second may occur on specific types of processing, such as for advertising or market research purposes. With the second modality, that is, partial revocation of consent, other purposes of the processing that the controller, in accordance with the authorization granted, may carry out and with which the data subject agrees, are maintained.

21.- INFORMATION SECURITY AND SECURITY MEASURES.

• In accordance with the principle of security established in current regulations, THE COMPANY will adopt the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, unauthorized or fraudulent use or access.

22.- USE AND INTERNATIONAL TRANSFER OF PERSONAL DATA AND PERSONAL INFORMATION BY THE COMPANY.

• Depending on the nature of the permanent or occasional relationships that any data subject may have with THE COMPANY, all of their information may be transferred abroad, subject to the applicable legal requirements. With the acceptance of this policy, they expressly authorize the transfer of Personal information. The information will be transferred, for all the relationships that may be established with THE COMPANY. Notwithstanding the exceptions provided for by law, the processing requires the prior, express and informed authorization of the data subject, which must be obtained by any means that can be subject to consultation and subsequent verification.

23.- PERSONAL DATA PROTECTION FUNCTION WITHIN THE COMPANY.

• In the event that you consider that THE COMPANY is making a use contrary to that authorized and to the applicable laws, you may contact us through a reasoned communication addressed to SPORT ENLACE S.A.S., to the email address [email protected] or to the cell phone or WhatsApp 3245918650.