Política de Tratamiento de Datos

1. Purpose and Scope of Application of the Personal Data Processing Policy

MINING & LEGAL BUSINESS SERVICES S.A.S., with the purpose of rigorously complying with the regulations in force on Personal Data Protection, in accordance with Law 1266 of 2008, Law 1581 of 2012, Decree 1074 of 2015 and other complementary, amending or additional provisions, presents this Personal Data Processing Policy (hereinafter the "Policy") of MINING & LEGAL BUSINESS SERVICES, through which general provisions are established for the protection of information related to, or that may be associated with, one or more identified or identifiable natural persons (the "Personal Data"), by virtue of the authorisation previously granted by the Data Subjects.

This Policy shall apply to all Data Subjects who maintain a relationship with MINING & LEGAL BUSINESS SERVICES and/or whose Personal Data has been collected and processed in any way as a result of, or in connection with, a relationship established with the Company, regardless of whether such Processing is carried out by MINING & LEGAL BUSINESS SERVICES or by third parties acting on its behalf.

This Policy shall apply to all Processing carried out within the territory of the Republic of Colombia by MINING & LEGAL BUSINESS SERVICES and, where applicable, by those third parties with whom the total or partial performance of any activity relating to, or connected with, the Processing of Personal Data is agreed.

In this Personal Data Processing Policy, MINING & LEGAL BUSINESS SERVICES sets out the general corporate guidelines considered for protecting the Personal Data of Data Subjects, the purposes of the Processing of information, the rights of Data Subjects, the area responsible for handling complaints and claims, and the procedures necessary to know, update, rectify and delete information.

MINING & LEGAL BUSINESS SERVICES, in compliance with the constitutional right to Habeas Data enshrined in Article 15 of the Political Constitution, only collects and Processes Personal Data when it has been previously authorised by the Data Subject, implementing clear measures regarding the confidentiality and privacy of Personal Data. In cases where an Authorisation for the Processing of Personal Data is not required, the Company will also implement the measures necessary to Process the information in accordance with the regulations in force.

2. Definitions

For the purposes of this Policy, the definitions set out in Law 1581 of 2012 and Decree 1074 of 2015 shall apply, as transcribed below:

a. Personal Data: Any information linked to, or that may be associated with, one or more identified or identifiable natural persons.

b. Data Subject: A natural person whose Personal Data is subject to Processing.

c. Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use may give rise to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social organisations or human rights organisations, or data promoting the interests of any political party, or guaranteeing the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.

d. Data Processor: The natural or legal person, public or private, that, either alone or jointly with others, Processes Personal Data on behalf of the Data Controller.

e. Personal Data Processing Policy: Refers to this document.

f. National Database Registry: The public directory of databases subject to Processing, operated by the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio).

g. Data Controller: The natural or legal person, public or private, that, either alone or jointly with others, decides on the Database and/or the Processing of Personal Data. In this case, this refers to MINING & LEGAL BUSINESS SERVICES.

h. Processing: Any operation or set of operations carried out on Personal Data, such as collection, storage, use, circulation or deletion, as well as its Transfer and/or Transmission to third parties through communications, queries, interconnections, assignments and data messages.

i. Transfer: The Transfer of Personal Data takes place when the Data Controller and/or Data Processor, located in Colombia, sends Personal Data to a recipient who is, in turn, a Data Controller and who is located within or outside the country.

j. Transmission: Processing of Personal Data that involves communicating it to a third party, within or outside the territory of the Republic of Colombia, when such communication is intended for the Data Processor to carry out Processing on behalf of, and for the account of, the Data Controller, in order to fulfil the latter's purposes.

3. Principles

In accordance with Article 4 of Law 1581 of 2012, the principles governing the Processing of Personal Data by MINING & LEGAL BUSINESS SERVICES are:

a. Principle of legality in the Processing of Personal Data: The Processing of Personal Data is a regulated activity that must comply with the provisions of Law 1581 of 2012, Decree 1074 of 2015 and any other provisions that develop, add to or amend them.

b. Principle of purpose: Processing must respond to a legitimate purpose in accordance with the Constitution and the Law, which must be communicated to the Data Subject.

c. Principle of freedom: Processing may only be carried out with the Data Subject's prior, express and informed consent. Personal Data may not be obtained or disclosed without prior authorisation, or in the absence of a legal or judicial mandate that releases the requirement of consent.

d. Principle of accuracy or quality: Information subject to Processing must be truthful, complete, accurate, up to date, verifiable and comprehensible. The Processing of partial, incomplete or fragmented data, or data that may lead to error, is prohibited.

e. Principle of transparency: Processing must guarantee the Data Subject's right to obtain, at any time and without restrictions, information from the Data Controller or Data Processor regarding the existence of data concerning them.

f. Principle of restricted access and circulation: Processing is subject to the limits arising from the nature of the Personal Data. Accordingly, Processing may only be carried out by persons authorised by the Data Subject and/or by the persons provided for in Law 1581 of 2012.

g. Principle of security: Information subject to Processing by the Data Controller or Data Processor must be handled with the technical, human and administrative measures necessary to provide security to the records, preventing their adulteration, loss, unauthorised or fraudulent consultation, use or access.

h. Principle of confidentiality: All persons involved in the Processing of Personal Data that is not of a public nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks comprising the Processing has ended, and may only supply or communicate Personal Data when this corresponds to the development of activities authorised under Law 1581 of 2012 and on the terms set out therein.

4. Information and Mechanisms Provided by MINING & LEGAL BUSINESS SERVICES as Data Controller

Corporate name	MINING & LEGAL BUSINESS SERVICES S.A.S.
NIT	901.821.622-2
Registered office	Manizales, Caldas.
Address	Carrera 21 No. 64A-33, Edificio Multiplaza El Cable, Oficina 1215
Phone	3104222369
Email	protecciondatos@mininglegal.com.co
Website	www.mininglegal.com.co

5. Authorisation, Processing and Storage of Personal Data

As of the effective date of this Policy, MINING & LEGAL BUSINESS SERVICES, when collecting Personal Data, will request prior authorisation from Data Subjects, informing them of the specific purposes of the Processing for which such consent is obtained, unless one of the exceptions contained in Article 10 of Law 1581 of 2012 applies.

MINING & LEGAL BUSINESS SERVICES will Process the Personal Data voluntarily provided by the Data Subject. In general, the Company will collect, store, use, circulate, transmit and transfer the Personal Data it Processes. This information may only be used by MINING & LEGAL BUSINESS SERVICES, its employees, consultants, advisors, affiliates of the corporate group, and commercial and strategic partners expressly authorised by the Company that require access to this information. In any case, upon request from the Data Subject, MINING & LEGAL BUSINESS SERVICES will provide complete information on the authorised persons and/or third parties that carry out Processing of their Personal Data.

MINING & LEGAL BUSINESS SERVICES may request Sensitive Data at any time, informing the Data Subject, at the time of collection, that the data requested is of this nature, and what type of Sensitive Data will be collected. MINING & LEGAL BUSINESS SERVICES may Process sensitive data if (i) the Data Subject gives explicit and voluntary consent for specified purposes; (ii) Processing is necessary to comply with legal obligations; (iii) Processing is necessary to protect the vital interests of the Data Subject or another natural person; (iv) Processing relates to Personal Data that the Data Subject has made public; (v) Processing is necessary for the formulation, exercise or defence of claims, or when judges or courts act in the exercise of their judicial function; or (vi) Processing is necessary for reasons of essential public interest; (vii) Processing is mandatory by virtue of the Law. MINING & LEGAL BUSINESS SERVICES will strictly observe the legal limitations on the Processing of Sensitive Data. Under no circumstances will MINING & LEGAL BUSINESS SERVICES condition any activity on the provision of Sensitive Data. Sensitive Data will be treated with the greatest possible diligence and the highest security standards. Limited access to Sensitive Data will be a guiding principle to safeguard its privacy and, therefore, only authorised personnel may have access to this type of information.

The Data Subjects' authorisation for the Processing of their Personal Data may be given: (i) in writing, (ii) orally, or (iii) through unequivocal conduct that reasonably allows the conclusion that authorisation was granted.

MINING & LEGAL BUSINESS SERVICES will keep adequate proof of such authorisations, respecting the principles of confidentiality and privacy of information.

6. Purposes of the Processing of Personal Data

The Personal Data collected by MINING & LEGAL BUSINESS SERVICES is included in a Database to which authorised MINING & LEGAL BUSINESS SERVICES personnel have access in the exercise of their duties, noting that Processing of the information for purposes other than those described here is never authorised, and that Data Subjects will be informed of these purposes directly, no later than the time of collection.

6.1. Purposes regarding clients

a. Contacting Data Subjects to send information related to the contractual and obligational relationship, as applicable.

b. Knowing, storing and processing all information provided by Data Subjects in one or more databases, in the format deemed most appropriate.

c. Collecting information for commercial research and marketing purposes.

6.2. Purposes regarding suppliers

a. Supervising and monitoring the correct and proper performance of our contractual relationship.

b. Managing the administrative, accounting, financial, operational and logistical aspects associated with compliance with the obligations of both parties.

c. Administrative and tax procedures and formalities.

d. Invoicing procedures and the operations aimed at making them effective.

e. Economic and accounting management.

f. Historical record of commercial relationships.

g. Verification of legal, technical and financial requirements.

h. Tax and collection procedures.

i. Opinion surveys.

j. Verifying commercial background and reputation, as well as potential risks associated with money laundering and terrorist financing.

k. Reporting and querying current or overdue obligations to credit risk bureaus and legally established information operators.

l. Consulting, at any time, databases managed by risk bureaus or other operators, for all information relevant to understanding the Data Subject's performance as a debtor, their ability to pay, the feasibility of establishing or maintaining a contractual relationship, or any other purpose arising from knowledge of this information.

m. Reporting to risk bureaus or other data operators on the fulfilment or non-fulfilment of the Data Subject's credit obligations, their legal duties of a patrimonial nature, their location and contact details, their credit applications, and other matters relating to the Data Subject's commercial, financial or socioeconomic relationships.

n. Any other purposes intended to develop the commercial relationship between MINING & LEGAL BUSINESS SERVICES and the Supplier that are inherent to the nature of this type of relationship, without prejudice to the Supplier's right, under Law 1581 of 2012, to request, modify, delete and/or correct the information reported as the holder of the personal data provided.

6.3. Purposes regarding visitors, authorised personnel and authorised contractors

a. Having the necessary information available in the event of an emergency within the Company's premises.

b. Protecting the security of MINING & LEGAL BUSINESS SERVICES' premises.

c. Identifying and controlling the entry and exit of equipment, vehicles, visitors, authorised personnel, authorised contractors or natural persons, and carrying out other physical security activities.

d. Recording and using closed-circuit television footage or images to carry out investigations.

6.4. Purposes regarding the Company's employees and its contractors

a. Carrying out audits and administering our systems and databases.

b. Contacting Data Subjects to send information related to the contractual and obligational relationship with employees.

c. Knowing, storing and processing all information provided by Data Subjects in one or more databases, in the format deemed most appropriate.

d. Fulfilling the obligations assumed as Data Controller towards the Data Subject, in relation to the payment of salaries, social benefits and other compensation established in the employment contract or as required by law and the contract.

e. Developing occupational health and safety prevention and promotion programmes based on medical and occupational health information from the time of hiring, as well as during the performance and completion of assigned duties.

f. Developing training and coaching programmes according to the employee's position.

g. Performing contracts entered into with Data Subjects.

h. Managing, maintaining, developing and controlling the contractual relationship between the parties, attending to information requests, as well as managing claims, processing requests for termination of contract and revocation of authorisation for the processing of personal data.

i. Managing queries made by Data Subjects.

j. Managing information associated with the possible occurrence of facts or circumstances that involve ethical or disciplinary control procedures, in accordance with the applicable internal regulations and other applicable legal provisions.

k. Generating backup copies and files of information on equipment provided by MINING & LEGAL BUSINESS SERVICES.

l. Sorting, cataloguing, classifying, dividing or separating the information provided by Data Subjects.

m. Offering corporate wellness programmes and planning company activities for the employee and their beneficiaries.

n. Meeting the legal requirements and information requests of administrative, social security and judicial authorities that regulate, supervise or oversee the activities and operations of MINING & LEGAL BUSINESS SERVICES, subject to due process.

o. Complying with the Internal Labour Regulations and the internal policies of MINING & LEGAL BUSINESS SERVICES.

p. Verifying the information contained in the CV provided to MINING & LEGAL BUSINESS SERVICES.

q. Preventing fraud or the improper use of our services.

r. Enabling the creation of cases or users in MINING & LEGAL BUSINESS SERVICES' information systems, associated with the hiring of employees, as well as for the development of the strategic, administrative, commercial and accounting function.

s. Recording information about employees' family groups in order to comply with the duties established by Law, and to allow them to take part in wellness activities or benefits provided by the Company.

t. Controlling access to the Company's premises.

u. Collecting data to comply with the duties that correspond to the Company as the party responsible for the information and personal data.

v. Fulfilling legal obligations, such as those related to the prevention of money laundering and terrorist financing.

w. Verifying, corroborating, checking, validating, investigating or comparing the information provided by Data Subjects with any information legitimately available.

x. Recording and using closed-circuit television footage or images to carry out investigations or disciplinary or criminal sanctions, as applicable.

y. Consulting, at any time, databases managed by risk bureaus or other operators, for all information relevant to understanding the Data Subject's performance as a debtor, their ability to pay, the feasibility of establishing or maintaining a contractual relationship, or any other purpose arising from knowledge of this information.

z. Reporting to risk bureaus or other data operators on the fulfilment or non-fulfilment of the Data Subject's credit obligations, their legal duties of a patrimonial nature, their location and contact details, their credit applications, and other matters relating to the Data Subject's commercial, financial or socioeconomic relationships.

6.5. Common Provisions for All Purposes

The information provided by the Data Subject will only be used for the purposes set out here. Once the need for Processing of the Personal Data ceases, it will be deleted from MINING & LEGAL BUSINESS SERVICES' databases.

If MINING & LEGAL BUSINESS SERVICES requests sensitive data, please note that providing this information is never mandatory, and MINING & LEGAL BUSINESS SERVICES will not take reprisals if the Data Subject does not authorise it. This data will be treated with the greatest possible diligence and the highest security standards.

MINING & LEGAL BUSINESS SERVICES may transmit and/or transfer Personal Data to third parties located in Colombia or abroad, even if located in countries that do not provide adequate levels of protection, provided that the Data Subject has given prior and express authorisation.

7. Rights of the Data Subject

In accordance with Article 8 of Law 1581 of 2012, the Data Subject shall have the following rights:

a. To know, update and rectify their Personal Data before Data Controllers or Data Processors. This right may be exercised, among other cases, with respect to partial, inaccurate, incomplete or fragmented data, data that may lead to error, or data whose Processing is expressly prohibited or has not been authorised;

b. To request proof of the authorisation granted to the Data Controller, except when expressly exempted as a requirement for Processing, in accordance with Article 10 of Law 1581 of 2012;

c. To be informed by the Data Controller or Data Processor, upon request, about the use given to their Personal Data;

d. To file complaints with the Superintendence of Industry and Commerce for violations of Law 1581 of 2012 and any other rules amending, adding to or complementing it;

e. To revoke the authorisation and/or request the deletion of data, provided there is no legal or contractual obligation requiring the Data Subject to remain in the database;

f. To access, free of charge, their personal data that has been subject to Processing, at least once per calendar month and whenever there are substantial changes to the processing policies.

In accordance with Article 2.2.2.25.4.1 of Decree 1074 of 2015, the aforementioned rights may be exercised by:

a. The Data Subject, who must sufficiently prove their identity through the various means made available by the Data Controller.

b. Their successors, who must prove such status.

c. The Data Subject's representative and/or attorney-in-fact, upon prior proof of representation or power of attorney.

8. Duties of the Data Controller

In accordance with Article 17 of Law 1581 of 2012, the Data Controller shall have the following duties:

a. To guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data;

b. To request and keep a copy of the corresponding authorisation granted by the Data Subject;

c. To duly inform the Data Subject of the purpose of the collection and the rights granted by virtue of the authorisation given;

d. To keep information under the security conditions necessary to prevent its adulteration, loss, unauthorised or fraudulent consultation, use or access;

e. To guarantee that the information provided to the Data Processor is truthful, complete, accurate, up to date, verifiable and comprehensible;

f. To update information, promptly communicating to the Data Processor any changes regarding data previously provided, and to adopt other measures necessary to keep the information provided to the Data Processor up to date;

g. To rectify information when it is incorrect and communicate this to the Data Processor;

h. To provide the Data Processor, as applicable, only with data whose Processing has been previously authorised;

i. To require the Data Processor, at all times, to respect the security and privacy conditions of the Data Subject's information;

j. To handle queries and claims filed under the terms set out in this Policy;

k. To adopt an internal manual of policies and procedures to guarantee proper compliance with Personal Data protection regulations, and in particular, for handling queries and claims;

l. To inform the Data Processor when certain information is being disputed by the Data Subject, once the claim has been filed and the corresponding process has not concluded;

m. To inform the Data Subject, upon request, about the use given to their data;

n. To inform the data protection authority when security breaches occur and there are risks in the administration of Data Subjects' information;

o. To comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

9. Procedures for the Data Subject to Exercise their Rights over Personal Data

The Data Subject may exercise their rights over their Personal Data through the area designated within the Company to handle requests, queries and claims regarding Personal Data. The Data Subject may exercise the rights listed above as set out below:

a. Via electronic communication, through the email address protecciondatos@mininglegal.com.co

9.1. Procedure for making queries (requesting proof of authorisation, learning what data has been collected, and learning how it has been Processed)

The Data Subject, their successors, representatives and/or attorneys-in-fact may make queries regarding the Personal Data held in MINING & LEGAL BUSINESS SERVICES' databases, in accordance with the following rules:

a. The request will be reviewed to verify the identity of the Data Subject. If the request is made by a person other than the Data Subject and it is not proven that they are acting on the Data Subject's behalf in accordance with applicable law, the request will be rejected.

b. All queries will be handled within a maximum period of ten (10) business days from the date of receipt. When it is not possible to handle the query within this period, the interested party will be informed, stating the reasons for the delay and the date on which the query will be handled, which may in no case exceed five (5) business days following expiry of the initial period.

9.2. Procedure for filing claims for the update, correction, deletion or revocation of authorisation

The Data Subject, or their successors, who consider that the information contained in MINING & LEGAL BUSINESS SERVICES' databases should be corrected, updated or deleted, or who become aware of a possible breach of any of the duties described above, may file a claim in accordance with the following rules:

The request will be reviewed to verify the identity of the Data Subject. If the request is made by a person other than the Data Subject and it is not proven that they are acting on the Data Subject's behalf in accordance with applicable law, the request will be rejected.

The claim must contain the following information: (i) identification of the Data Subject; (ii) contact details (physical and/or electronic address and telephone numbers); (iii) documents proving the identity of the Data Subject, or their representation; (iv) a clear and precise description of the Personal Data in respect of which the Data Subject seeks to exercise any of their rights; (v) a description of the facts giving rise to the claim; (vi) any supporting documents; (vii) signature and identification number.

If the claim is incomplete, MINING & LEGAL BUSINESS SERVICES will require the interested party, within five (5) days of receiving the claim, to correct the deficiencies. If two (2) months elapse from the date of this request without the applicant providing the required information, the claim will be deemed withdrawn.

If the area receiving the claim is not competent to resolve it, it will forward it to the appropriate area within a maximum period of two (2) business days and will inform the interested party of the situation.

Once the complete claim has been received, a note stating "claim in progress" and the reason for it will be included in the database within a period not exceeding two (2) business days. This note must be kept in place until the claim has been decided.

The maximum period for handling the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to handle the claim within this period, the interested party will be informed of the reasons for the delay and the date on which the claim will be handled, which may in no case exceed eight (8) business days following expiry of the initial period.

The Data Subject has the right, at any time, to request the deletion of their Personal Data. Deletion involves the total or partial removal of Personal Data from the databases, in accordance with the Data Subject's request. The right to deletion is not absolute, and MINING & LEGAL BUSINESS SERVICES may deny its exercise in the following cases: (i) the Data Subject has a legal or contractual duty to remain in the database, or the Data Controller has a legal or contractual obligation requiring it to keep the Personal Data; (ii) deletion of the Personal Data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the enforcement of administrative sanctions; (iii) the Personal Data is necessary to protect the legally protected interests of the Data Subject, to carry out an action in the public interest, or to fulfil an obligation legally acquired by the Data Subject or the Data Controller.

10. Validity of the Processing Policy

This Data Processing Policy takes effect from 3 May 2025.

Personal Data included in the databases subject to Processing will be retained and Processed based on a temporal criterion, for the contractual term of the product or service contracted, for as long as the purpose for which it was collected subsists, plus any additional period established by law.

This Policy may be amended by MINING & LEGAL BUSINESS SERVICES whenever required, without prior notice, provided such amendments are not substantial. Only amendments regarding the purposes of Processing and the Data Controller's information, or any other substantial amendment, will be communicated to Data Subjects in advance.