GLASST INNOVATION COMPANY S.A.S.

This policy is adopted by GLASST INNOVATION COMPANY S.A.S. identified with NIT. 900.406.464-2, located in Medellín, hereinafter “GLASST INNOVATION,” in order to comply with Law 1581 of 2012, Decree 1377 of 2013 and other amending and complementary regulations.

CHAPTER 1

GENERAL PROVISIONS

1.1. General objective:

The general objective of this policy is that clients, employees, contractors, suppliers and other target audiences of GLASST INNOVATION, known about the treatment, use, management, protection and guarantees of their data, which rest in the database of the company and that they were authorized by them at the time of accessing the company’s products and services.

GLASST INNOVATION employees who are involved in the processing of the data and in the execution of the procedures aimed at guaranteeing the rights of the holders, must be aware of and apply this policy.

1.2. Application area:

1.2.1. Recipients

This policy applies to the personal data provided by each and every one of GLASST INNOVATION ‘s clients, contractors, suppliers, employees and other target audiences, whether or not they are domiciled in Colombia.

1.2.2. Responsible for the processing of personal data

The person responsible for the treatment of the data contained in the databases is GLASST INNOVATION, who will apply this policy and the provisions of the law.

1.3. Definitions:

– Authorization: Prior, express and informed consent of the owner to carry out the processing of personal data. It will be understood that the owner authorizes when it is manifested in writing, orally or through unequivocal conduct that allows a reasonable conclusion that he granted the authorization.

– Database: Organized set of personal data that is the object of treatment.

– Personal data: Any information linked or that can be associated with one or more individualized or individualizable natural persons.

– On charge of the Treatment: Natural or legal person, public or private, that by itself or in association with others, carries out the Treatment of personal data on behalf of the Person Responsible for the Treatment.

– Responsible for the Treatment: GLASST INNOVATION as a legal person that decides on the database or the treatment of the data.

– Owner: Natural person whose personal data is subject to treatment.

– Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion.

– Notice of treatment of personal data: Verbal or written communication generated by the responsible of the treatment, addressed to the owner of their data. Through this notice, they are informed about the existence of the treatment policies that will be applicable, the way to access them and the purposes of the treatment of the personal data.

– Transfer: The transfer of data takes place when the person on charge and/or the responsible of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is located within or out of the country.

– Transmission: Processing of personal data that implies the communication of them within or outside the territory of the Republic of Colombia when it is intended to carry out a treatment by the person in charge but on behalf of the responsible.

1.4. Principles:

The principles established below are the general parameters that will be respected by GLASST INNOVATION in the processing of personal data:

– Principle of legality: The processing referred to in this policy is a regulated activity that must be subject to what is established in the law and in the other provisions that develop it.

– Principle of purpose: The processing of Personal Data collected by GLASST INNOVATION must obey a legitimate purpose, known by the owner of the data.

– Principle of freedom: The treatment can only be carried out with the prior, express and informed consent of the owner. Personal Data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.

– Principle of truthfulness or quality: The information subject to treatment must be truthful, complete, exact, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.

– Principle of transparency: In the treatment must be guaranteed the right of the owner to obtain from GLASST INNOVATION at any time and without restrictions, information about the existence of data concerning him or her.

– Principle of access and restricted circulation: The treatment may only be done by the persons authorized by the owner and/or by the persons provided for in the Law. Personal Data, except for public information, may not be available on the Internet or other means of disclosure or mass communication, unless the access is technically controllable to provide restricted knowledge only to the owners or authorized third parties.

– Principle of security: The information subject to treatment by GLASST INNOVATION, must be protected through the use of technical, human and administrative measures that are necessary to grant security to the records, avoiding their adulteration, loss, consultation, use or access unauthorized or fraudulent.

– Principle of confidentiality: All persons involved in the processing of personal data are obliged to guarantee that is reserved information, even after the end of their relationship with any of the tasks that comprise the processing.

CHAPTER 2

THE RIGHTS AND DUTIES IN THE

PROCESSING OF PERSONAL DATA

2.1. Rights of the holders of the information:

Following the provisions of article 8 of the Law 1581 of 2012 and articles 21 and 22 of the Decree 1377 of 2013, the owner of Personal Data has the following rights:

a) Know, update and rectify his/her data in front of GLASST INNOVATION, in its capacity as the responsible of the data.

b) Request proof of the Authorization granted to GLASST INNOVATION.

c) Be informed by GLASST INNOVATION, upon request, regarding the use that has been given to his/her Personal Data.

d) Present before the Superintendency of Industry and Commerce complaints about infractions to the provisions of the Law 1581 of 2012 and the other regulations that modify, add or complement it, once the consultation or claim process has been exhausted before the person responsible for the treatment.

e) Revoke the Authorization and/or request the elimination of the data when the treatment does not respect the principles, rights and legal guarantees.

f) Free access to his/her Personal Data that has been processed. GLASST INNOVATION will keep the following means of contact enabled so that data owners can exercise their rights and apply the procedures provided in this Policy: service channels: email ventas@glasst.co – telephone 60 (4) (4) 4449577.

g) Authorize in advance, freely and expressly the processing of personal data.

h) Present petitions, complaints and claims that should be resolved within the legal terms counted from the day on which the petition, complaint or claim is known by GLASST INNOVATION.

2.2. Duties of the person responsible for the processing of personal data:

GLASST INNOVATION will keep in mind, at all times, that only the owner of the data can decide on them. In this sense, it will use them only for those purposes for which it is duly empowered according to the Law 1581 of 2012, the Decree 1377 of 2013 and the other applicable regulations on the protection of Personal Data. Following the provisions of article 17 of the Law 1581 of 2012 and articles 21 and 22 of the Decree 1377 of 2013, GLASST INNOVATION undertakes to comply with the following duties about the processing of personal data:

a) Guarantee to the owner of the data, at all times, the full and effective exercise of the right to habeas data.

b) Request and keep, under the conditions outlined in this law, a copy of the respective authorization granted by the owner.

c) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

d) Properly inform the owner about the purpose of the collection and the rights that assist him due to the Authorization granted.

e) Carry out on time, this is in the terms provided in articles 14 and 15 of the Law 1581 of 2012, the updating, rectification or deletion of the data.

f) Inform at the request of the owner about the use given to his/her data.

g) Process the queries and claims made by the owners in the terms indicated in articles 14 and 15 of the Law 1581 of 2012.

h) Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendency of Industry and Commerce.

i) Allow access to information only to people who can have access to it.

j) Inform the Superintendency of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the owners of the data.

k) Designate an area that assumes the function of protection of Personal Data, which will process the requests of the owners, for the exercise of the rights referred to in the Law 1581 of 2012 and the Decree 1377 of 2013.

l) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

m) Treat the information provided by the owners for the purposes outlined in this regulation.

CHAPTER 3

THE PROCEDURES

3.1. Collection of personal data:

The request for data to the owners must be limited to those personal data that are pertinent and adequate for the purposes covered by this policy or required following current regulations.

GLASST INNOVATION may collect the personal data of the owners thereof, by any of the following means: written, printed, magnetic, digital, telephone, virtual or through unequivocal conduct of the holder that allows to reasonably conclude that the authorization was granted. Those in charge and those responsible for the treatment of the information may not use fraudulent means to collect and process personal data.

3.2. Owner’s authorization:

The authorization of the owner of the information must be requested at the time of collection of personal data and the owner must know at least:

• The personal data that will be collected.

• The purposes for which authorization is being requested.

• The existence of a personal data protection policy.

• Her/his rights.

• In all cases, when GLASST INNOVATION considers that the purpose of processing personal data must change, it must request a new authorization from the owner.

3.3. Process for correction, update or deletion of data:

The owner who considers that the information contained in a database should be subject to correction, updating or deletion, or when he/she notices the breach of any of the duties contained in the law 1581 of 2012, may file a claim with the person responsible for the treatment which will be processed under the following steps:

a) The claim will be addressed to the person responsible for the treatment with the identification of the owner, the description of the facts that give rise to the claim, the address, and the documents to enforce. If the claim is incomplete, the interested party will be required within five (5) days after receiving the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim.

b) In the event that the person who receives the claim is not competent to resolve it, he/she will transfer it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation.

c) Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database, within a term not exceeding two (2) business days. This legend will remain until the claim is decided.

d) The maximum term to attend the claim, once it is complete, will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the claim within that term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case will exceed eight (8) business days following the expiration of the first term.

3.4 RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

GLASST INNOVATION COMPANY S.A.S. in its capacity as the person responsible for the processing of personal data, through this policy inform its identification:

COMPANY NAME: GLASST INNOVATION COMPANY S.A.S

NIT. 900.406.464-2

MAIN ADDRESS: Carrera 32 #13-49, of 504

PHONE: 60 (4) 444 95 77

The dependency of the company in charge of the processing of personal data in application of this policy will be the commercial one who will attend to requests, queries, claims through the following service channels: email ventas@glasst.co – telephone 60 (4) 4449577.

Those responsible and in charge of the treatment may only collect, store, use or circulate personal data for as long as is reasonable and necessary. Once the purpose or purposes of the treatment have been fulfilled and without prejudice to legal regulations that provide otherwise, the responsible and/or person in charge must proceed to delete the personal data in their possession. Notwithstanding the foregoing, personal data must be kept when required to comply with a legal or contractual obligation.

CHAPTER 4

PURPOSES OF THE PROCESSING OF PERSONAL DATA

4. Purposes of obtaining personal data:

GLASST INNOVATION will collect, store and use the personal data of the holders for the following purposes:

• Achieve efficient communication with the owner of the information, through any means of contact, related to our products, services, promotions, alliances, studies, contests, events, content, advertising and marketing campaigns, benefits, conditions or applicable policies, service channels, social networks, among others.

• Management of internal statistics to improve our procedures, services and products and to develop market strategies.

• Communicate activities related to the corporate purpose.

• Carry out customer loyalty strategies.

• Track the history of orders from suppliers and customers.

• Carry out the verification of bank references, commercial and credit history of customers, suppliers and distributors.

• Manage the internal affairs of the company including, but not limited to, accounting, financial and management reports, presentation and payment of taxes, other records and compliance reports, internal or external audit processes. This information includes the Personal Data of directors and agents of the company’s affiliates.

• Manage data related to human resources, selection processes, organizational analysis, development and management of performance reports, management of labor relations, payroll and compliance with legal obligations such as affiliation to social security and the creation and preservation of occupational history.

• Comply with the obligations contracted with our clients, suppliers and employees.

• Identify and collect information about the owner’s browsing preferences on GLASST INNOVATION´s portals.

CHAPTER 5

THE VALIDITY

This POLICY OF PERSONAL DATA PROCESSING applies as of July 16, 2021. The period of validity of the databases is determined by the treatment carried out on them and by the authorization given by the owners. As long as the data continues to be valid to carry out the authorized treatment, its use in the database will continue to be valid. Likewise, the data necessary for compliance with legal obligations will be kept in the databases. The transfer of personal data of any kind to countries that do not provide adequate levels of data protection is prohibited. It is understood that a country offers an adequate level of data protection when it complies with the standards set by the Superintendency of Industry and Commerce on the matter, which in no case may be lower than those required by law.

CHAPTER 6

FINAL PROVISIONS

If any of the provisions of this policy become illegal, invalid or void under current or future laws, it will be understood to be excluded. This policy will be executed without destroying its purpose, any legal provision that invalidates the policies established herein will make it understood as excluded as if it had not been part of it and the remaining provisions contained herein will retain the same value and effect.

GLASST INNOVATION, at any time, may add additional points or elements that ensure compliance with the object, or make modifications to this policy.