The purpose of this policy for the protection of personal data is to comply with the provisions of Law 1581 of 2012, its regulatory decree 1377 of 2013 and other concordant rules that regulate the constitutional right of citizens to authorize the processing of their personal data, as well as to know, update and rectify the information that has been collected about them in the databases or files of public and private entities.

These policies and procedures apply to all personal data registered in person or virtually, directly or through third parties, in the databases of DESTINY CO S.A.S. and the companies or entities that are part of its organization (The Company), with the exceptions established by law, for its treatment (collection, storage, use, circulation or deletion), so that the owner of the data can access or may access any product, service, offer, promotion, benefit and/or link supported by a legal relationship with The Company.

DEFINITIONS

• PRIVACY NOTICE: Verbal or written communication generated by the Controller, addressed to the Data Subject for the Processing of his/her personal data, using which he/she is informed about the existence of the information processing policies that will be applicable, the way to access them and the purposes of the Processing that is intended to be given to the personal data.
• DATABASE: Organized set of personal data that is subject to Processing;
• PERSONAL DATA: Any information linked or that may be associated with one or several determined or determinable natural persons.
• PUBLIC DATA: Public data includes, among others, data relating to the civil status of persons, their profession or trade, and their status as merchants or public servants. Due to their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality.
• PUBLIC PERSONAL INFORMATION: Any personal information that is freely and openly available to the general public.
• PRIVATE PERSONAL INFORMATION: All personal information that has a restricted knowledge, and in principle private for the general public, for identification purposes of customers, prospects, suppliers, employees, partners, and other persons related to one or more of our products and/or services, and/or our organization, for security purposes of people and things, or for the security of the processes and the information itself.
• SENSITIVE DATA. These are data that affect the privacy of the Data Subject or whose improper use may generate discrimination, in the terms defined by law. The Company does not treat many sensitive data, although, in labor, social security, or human resources matters it may have access to information related to the health of the employee or his/her family nucleus; it may also establish biometric identification systems, the capture of still or moving images, voice, fingerprints, photographs, and other existing ones.
• PERSON IN CHARGE OF PROCESSING: Natural or legal person, public or private, who by himself or in association with others, performs the processing of personal data on behalf of the Controller.
• THE COMPANY: DESTINY CO S.A.S. and the companies or entities that are part of its organization.
• DATA PROTECTION OFFICER: The person whose function is to monitor and control the application of the Personal Data Protection Policy.
• PERSON RESPONSIBLE FOR THE PROCESSING: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the processing of the data (for this policy, the Company shall act as the Responsible, in principle).
• Data Controller: Natural person whose personal data is subject to processing, whether customer, supplier, employee, or any third party who, because of a business or legal relationship, provides personal data to the Company.
• PROCESSING: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

This document establishes the purposes, measures and procedures that will govern the treatment of personal data within the company DESTINY CO S.A.S.

1. GUIDING PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

The Company will apply in a harmonious and comprehensive manner the following principles in the collection, handling, use, processing, storage and exchange of personal data:

• a) PRINCIPLE OF LEGALITY: The processing referred to in this document is a regulated activity that must be subject to the provisions of the law and other provisions that develop it.
• b) PRINCIPLE OF PURPOSE: The Processing must obey a legitimate purpose by the Constitution and the Law, which is determined in this same document, and is informed to the Data Subject for purposes of authorization;
• c) PRINCIPLE OF FREEDOM: Processing may only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent;
• d) PRINCIPLE OF TRUTH OR QUALITY: The information subject to Processing must be truthful, complete, accurate, updated, verifiable, and understandable. The Company will not process partial, incomplete, fractioned, or misleading data;
• e) PRINCIPLE OF TRANSPARENCY: The Company guarantees the right of the Data Subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of data concerning him/her;
• f) PRINCIPLE OF ACCESS AND RESTRICTED CIRCULATION: Processing is subject to the limits derived from the nature of the personal data, the provisions of the Constitution, and the law. In this sense, the Processing may only be made by persons authorized by the Holder and/or by the persons provided by law; Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication unless access is technically controllable to provide restricted knowledge only to the Holders or third parties authorized by this law;
• g) SECURITY PRINCIPLE: The information subject to processing by the Data Controller or Data Processor referred to in the law, will be handled with the technical, human, and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access;
• h) PRINCIPLE OF CONFIDENTIALITY: All persons in The Company involved in the processing of personal data that are not public, are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks included in the Processing, and may only supply or communicate personal data if they maintain a relationship with The Company and when it corresponds to the development of the activities authorized in this law and under the terms of the same.

2. PERSON IN CHARGE AND PERSON IN CHARGE OF THE TREATMENT OF INFORMATION.

DESTINY CO S.A.S. is responsible for the processing of personal data.

Whose main address is Calle 6 # 25 - 153, El Poblado. Medellín - Colombia

E-mail: info@destiny.ws

3. TYPE OF INFORMATION SUBJECT TO OUR TREATMENT.

The information subject to processing by DESTINY CO S.A.S. will consist solely of the personal data provided or provided by the owners, such as customers, prospects, suppliers, employees, partners and other persons related to any of our products and/or services, and/or our organization.

4. PURPOSE OF THE PROCESSING OF PERSONAL DATA COLLECTED.

The purpose of the personal data collected will consist of its use for informative, commercial, and statistical purposes, to guarantee and improve the usability or operation of our products and/or services, or for administrative purposes (quotations, invoicing, collection, orders, purchases, payment management, labor and/or human resources management issues, job offers, references, certifications, etc.), and in general, for other activities related to our policies, events, campaigns, and news.

The Company will give confidentiality to the personal data provided by the holders and will not give them to third parties for commercial purposes and without prior authorization and information to the holder.

The Company reserves the right to use the information collected for the purposes indicated, by the provisions of this policy, among others, for:

• a) Processing and administration of your transactions as a customer or user or prospect or ally or employee of DESTINY CO S.A.S.
• b) Offer through its means or jointly with third parties, information on new product launches, services, plans, promotions, events, and/or benefits.
• c) Additional information that benefits the operation, support, maintenance, updates, and warranty of our products or services in case of incidents, inconveniences, requirements, or failures.
• d) To comply with the notification of information of your interest when you have requested it, including the response to your QPR and in general requests, doubts or questions.
• e) Study and store information associated with requests for any of our products that as a customer or future customer we should know for the commercial relationship.
• f) The sending of communications related to the commercial activities of DESTINY CO S.A.S. news and useful information for our company, products, offers, news, invitations to events, job offers, advertising, publicity, and/or surveys about our products or services and/or the products and services of our business partners.
• g) Processing of data on the use of our products and/or services for statistical purposes, marketing, or relational analysis of information.
• h) Processing of data for purposes of research, innovation, and development of new products and/or services.
• i) Other activities related to the corporate purpose that must necessarily use the information or personal data of customers, prospects, suppliers, employees, partners, and other persons related to any of our products and/or services, and/or our organization.
• j) Export this information even abroad, in case the hosting used is not located in Colombia, within the legal guidelines and those determined by the control entity. This treatment can be carried out by the Company through physical, electronic, cellular, or mobile devices, via text messages (SMS), or through any analog and/or digital means of communication, known or to be known.

The owners of personal data stored in any of the Company's databases may at any time exercise their rights of access, updating, rectification, and deletion, against the data controller of The Company.

5. RIGHTS AND CONDITIONS OF LEGALITY FOR DATA PROCESSING.

5.1 RIGHTS OF THE OWNERS.The Holder of the personal data shall have the following rights:

• a) To know, update and rectify their personal data concerning the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized;
• b) Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing, by the provisions of the law;
• c) To be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been made of their personal data;
• d) File before the Superintendence of Industry and Commerce complaints about violations to the provisions of this law and other regulations that may modify, add or complement it;
• e) To revoke the authorization and/or request the deletion of the data when the Processing does not respect the constitutional and legal principles, rights, and guarantees, under the terms of the law and the jurisprudence that interprets it;
• f) Access free of charge to your personal data that have been subject to Processing.

The right of suppression is not an absolute right. The Company may deny or limit the exercise of this right when:

• a) The owner of the data has a legal or contractual duty to remain in the database.
• b) The deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation, and prosecution of crimes, or the updating of administrative sanctions.
• c) The data are necessary to protect the legally protected interests of the holder; to carry out an action in the public interest, or to comply with an obligation legally acquired by the holder.
• d) The data are data of a public nature and correspond to public records, the purpose of which is to make them public.
• e) The data constitutes a support for the normal operation of the Company and must be kept by the Company by the Law or its internal processes.

Likewise, the holder of personal data may revoke at any time, the consent to the processing of these, provided that it is not prevented by a legal or contractual provision. In this case it can operate partially or totally.

5.2 HOLDER'S AUTHORIZATION.

Notwithstanding the exceptions provided by law, the processing requires the prior and informed authorization of the Data Subject, which must be obtained by any means that may be subject to subsequent consultation.

By express authorization granted through physical or electronic mechanisms, including telephone, e-mail, those provided on the website DESTINY CO.com and other means (Landing page), etc., the owner of the information when registering or indicating that he/she authorizes the processing of his/her personal data and accepts the policy included in the privacy notice, allows DESTINY CO S.A.S. to collect, record, process, disseminate and market all data and information that he/she voluntarily provides at the time of registration, limited in each case to the type of link or database, which determines the type of personal information requested.

By giving his/her authorization, the holder accepts that the personal data provided at the time of registration, or any other data provided to the Company at any time, according to the type of link or database, for access to some of the services, events, promotions, information, etc., will be used for the purpose of facilitating the relationship established or intended to be established, providing the services requested, for the correct identification of users requesting personalized services, for statistical studies of users that allow the design of statistical studies that allow the design of the services requested, are used in order to facilitate the relationship established or intended to be established, to provide the requested services, for the correct identification of users requesting personalized services, to carry out statistical studies of users to design improvements in the services provided, for the management of basic administrative tasks, as well as to keep you informed, either by email or by any other means of news, products and services related to The Company.

5.3 CASES IN WHICH AUTHORIZATION IS NOT REQUIRED.

The authorization of the Holder shall not be necessary in the case of:

• a) Information required by a public or administrative entity in the exercise of its legal functions or by court order;
• b) Data of a public nature;
• c) Cases of medical or sanitary emergency;
• d) Processing of information authorized by law for historical, statistical or scientific purposes;
• e) Data related to the Civil Registry of Persons.

Whoever accesses personal data without prior authorization must in any case comply with the provisions contained in this law.

5.4 PROVISION OF INFORMATION.

The requested information may be provided by any means, including electronic means, as required by the Data Subject. The information shall be easy to read, without technical barriers that prevent its access and shall correspond in its entirety to the information contained in the database.

5.5 DUTY TO INFORM THE HOLDER.

The Data Controller, at the time of requesting the authorization to the Data Subject, shall clearly and expressly inform him/her of the following:

• a) The processing to which your personal data will be submitted and its purpose;
• b) The optional nature of the answer to the questions asked, when they deal with sensitive data or with the data of children and adolescents;
• c) The rights you have as Holder;
• d) The identification, physical or electronic address and telephone number of the Data Controller.

PARAGRAPH: The Data Controller shall keep proof of compliance with the provisions of this article and, when requested by the Data Subject, provide him/her with a copy thereof.

5.6 PERSONS TO WHOM THE INFORMATION MAY BE PROVIDED.

Information that meets the conditions set forth in this law may be provided to the following persons:

• a) To the Holders, their successors in title or their legal representatives;
• b) To public or administrative entities in the exercise of their legal functions or by court order;
• c) To third parties authorized by the Holder or by law.

5.7 PROCESSING OF PERSONAL DATA.

Once the authorization of the respective holder(s) has been obtained, DESTINY CO S.A. will collect all the personal data of the holder(s) in a corresponding electronic database, which will be managed and stored by DESTINY CO S.A..

DESTINY CO S.A.S. will prevent unauthorized access by third parties to the personal data collected and will implement all measures aimed at their protection.

DESTINY CO S.A.S. undertakes to comply with its obligation to keep private data secret, as well as its duty to treat them confidentially and assumes the necessary technical, organizational, and security measures to prevent their alteration, loss, treatment, or unauthorized access, by the provisions of the law and international treaties signed by Colombia governing the matter.

The Holder shall be responsible, in any case, for the veracity of the data provided. DESTINY CO S.A.S. may exclude the holder who has provided false data from any relationship generated based on such false information, without prejudice to any other actions that may be appropriate.

TREATMENT OF SENSITIVE DATA. The Company will not process sensitive data, except when:

• a) The Data Subject has given his/her explicit authorization to such Processing, except in those cases in which by law the granting of such authorization is not required;
• b) The Processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization;
• c) The Processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association, or any other non-profit organization, whose purpose is political, philosophical, religious, or trade union, provided that they refer exclusively to its members or to persons who maintain regular contacts because of their purpose. In these events, the data may not be provided to third parties without the authorization of the Data Controller;
• d) The Processing refers to data that is necessary for the recognition, exercise, or defense of a right in a judicial proceeding;
• e) The Processing has a historical, statistical, or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Holders must be adopted.

5.9 RIGHTS OF CHILDREN AND ADOLESCENTS.

Treatment will ensure respect for the prevailing rights of children and adolescents, under the guidelines of the law.

6. MECHANISM OF ATTENTION TO THE OWNERS OF THE INFORMATION.

To facilitate the protection of the rights of the holder(s) of the information, DESTINY CO S.A.S. establishes the following procedure for them:

6.1 Person or area responsible for the attention of requests: All requests, inquiries, and claims generated on the occasion of the processing of personal data shall be addressed to the main offices of DESTINY CO S.A.S. in Bogotá, as follows: correos_mercadeo@DESTINYCO.com or physically to the address Carrera 18 No. 79 A 42 Bogotá.6.2 Means of protection: In case the holder(s) of the information wish(s) to exercise any of their rights, they must send their request, explaining clearly, in detail, and precisely the reason for their requirement, the facts that support it, their contact information, the documents they wish to assert and their claim(s).

7. DUTIES OF DATA CONTROLLERS

In accordance with the Law, the following are duties of those responsible for the processing of personal data, without prejudice to the other provisions of the law:

• a) Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data;
• b) Request and keep, under the conditions provided by law, a copy of the respective authorization granted by the Data Subject;
• c) Duly inform the Data Subject about the purpose of the collection and the rights he/she is entitled to by the authorization granted;
• d) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access;
• e) Ensure that the information provided to the Data Processor is truthful, complete, accurate, updated, verifiable, and understandable;
• f) Update the information, communicate in a timely manner to the Data Processor, all developments concerning the data previously provided, and take other necessary measures to ensure that the information provided to it is kept up to date;
• g) Rectify the information when it is incorrect and communicate the pertinent to the Data Processor;
• h) To provide to the Data Processor, as the case may be, only data whose Processing is previously authorized by the provisions of this law;
• i) To demand from the Data Processor at all times, respect for the security and privacy conditions of the Data Subject's information;
• j) To process the consultations and claims formulated under the terms outlined in the law;
• k) Adopt an internal manual of policies and procedures to ensure adequate compliance with the law and, in particular, for the handling of queries and complaints;
• l) Inform the Data Processor when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not been completed;
• m) To inform, upon request of the Data Subject, about the use given to his/her data;
• n) Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Data Holders.
• o) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

8. DUTIES OF DATA PROCESSORS.

Data Processors shall comply with the following duties, without prejudice to the other provisions set forth in this law and others governing their activity:

• a) Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data;
• b) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access;
• c) Timely update, rectification, or deletion of data by the terms of the law;
• d) Update the information reported by the Data Controllers within five (5) business days from its receipt;
• e) To process the consultations and claims formulated by the Holders under the terms outlined in the law;
• f) Adopt an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, for the handling of queries and claims by the Data Holders;
• g) Register in the database the legend "claim in process" in the manner regulated by law;
• h) Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of the personal data;
• i) Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce;
• j) Allow access to information only to those persons who may have access to it;
• k) Inform the Superintendence of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the Data Holders;
• l) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

PARAGRAPH. In the event that the qualities of Data Controller and Data Processor concur in the same person, he/she will be required to comply with the duties provided for each one of them.

The Company, in order to guarantee the rights of the data subjects, has agreed with its employees, who intervene in any phase of data processing, the obligation to safeguard confidentiality and limit the use of such information to the specific purposes for which they were collected.

9. PRIVACY NOTICE

The Company, through verbal or written communication generated by the Responsible, addressed to the Holder for the Processing of personal data, informs him/her about the existence of the policies of Processing of information that will be applicable, how to access them, the purposes of the Processing that is intended to be given to the personal data, the privacy of this information and, in general, will allow access to this document so that before his/her authorization, he/she can consult it.

These notices can be easily located by the Holder in the advertising material, on the Landing pages, on the web page, in emails, when accessing products or services, on invoices, in the registration forms for the collection of data necessary for contracting, invoicing, payment, etc.