1. Authorization: data owners expressed and informed prior consent to carry out data processing.  
2. Database: an organized set of personal data that is subject to processing.
3. Personal data: any information linked or that may be associated with one or several determined or determinable natural persons.
4. Semi-private personal data: data that is not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to its owner but also to a group of persons or to society in general.  In this case, the express authorization of the owner of the information is required for its processing. For example, financial data, and data related to relations with social security entities (EPS, AFP, ARL, Cajas de Compensación).
5. Sensitive personal data: are those that affect the privacy of Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data relating to health, sex life, and biometric data.
6. Private personal data: personal data that, due to its intimate or reserved nature, is only of interest to its owner and requires express authorization for its processing. For example, the level of schooling, and merchants’ books, among others.
7. Public personal data: is that type of personal data that the norms and the Constitution have expressly determined as public and, for whose collection and processing, the authorization of the Holder of the information is not necessary. For example, the civil status of persons, data contained in the RUNT, and data contained in enforceable court judgments, among others.
8. Data Processor: natural or legal person, public or private, who by himself or in association with others, performs the Processing of personal data on behalf of the Data Controller.
9. Data Controller: natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the Processing of the data.
10. Data Subject: a natural person whose personal data is the object of Processing.
11. Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
12. Transfer: The transfer of data takes place when the controller and/or processor of personal data, located in Colombia, send the information or personal data to a recipient, which in turn is responsible for the processing and is located inside or outside the country.
13. Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when its purpose is the performance of a Processing by the Processor on behalf of the Controller.

Policy Objective

The purpose of this Personal Data Processing Policy is to establish the criteria under which the processing of personal information contained in the databases, physical and digital files of JOYCO S.A.S. BIC is carried out, thus complying with Articles 15 and 20 of the National Constitution, Law 1581 of 2012, Chapter 25 of Decree 1074 of 2015 and Ruling C-748 of 2011.

Scope of the policy

This policy applies to all personal information registered in the databases of JOYCO S.A.S. BIC, which acts as the party responsible for the processing of personal data. It also establishes the criteria that JOYCO S.A.S. BIC has incorporated for the processing of personal data, the mechanisms for holders to exercise their rights, the purposes, security measures, and other aspects related to the protection of personal information.

This Policy of personal data processing is addressed to any owner of the information or whoever acts as his legal representative and from whom JOYCO S.A.S. BIC has required personal information for the development of any activity.

1. ypes of personal data processed

   JOYCO S.A.S. BIC in the development of its activities requires the processing of the following categories of data:

   • Academic data
   • Personal characteristics data
   • Social circumstances data
   • Contact data
   • Health data
   • Electronic data
   • Identification data
   • Employment data
   • Property data
   • Public data
   • Sensitive data

   Treatment to which personal data is subjected.

   The personal data obtained by JOYCO S.A.S. BIC are subject to the following processing:

   Collection

   JOYCO S.A.S. BIC collects personal information through various means in the development of the different activities related to its corporate purpose, and the obligations it has as an employer. The personal information will be obtained in three different ways: a) directly from the owner, b) from a third party if the third party has authorization, and c) from public sources of information.

   Likewise, the collection of personal information may be carried out through physical, digital, or electronic means, and in each of them, a privacy notice and authorization shall be incorporated, thus complying with the requirements established in art. 2.2.2.2.25.3.2 and 2.2.2.2.25.3.3 of Decree 1074 and obeying the principles of freedom and purpose of art. 4 of Law 1581.

   Storage

   The storage of personal information contained in the databases or information systems is in the company’s servers within the country, and in external servers of third parties, which have physical, technical, and administrative security measures, and have access controls to the information, ensuring the principle of restricted access and circulation.

   The personal information that is subject to legal requirements will remain stored in our databases following what the Law has established for this, in those cases where the Law has not pronounced the information will remain as long as the purpose for which it was collected is in force.

   Circulation

   As a rule, JOYCO S.A.S. BIC does not share the personal data it collects with third parties. However, for the effective fulfillment of its obligations, it may deliver the data to other entities, covered by articles 2.2.2.2.25.5.1 and 2.2.2.25.5.2 of decree 1074 which establishes that the transmission of personal data is allowed when it is necessary for the execution of a contract between the holder and the data controller, or for the execution of pre-contractual measures as long as it has the authorization of the holder or there is a contract for the transmission of personal data.

   Deletion

   The suppression of personal information that has been collected will be carried out when: (I) it is not necessary for compliance with legal, contractual, tax, financial, or auditing or is covered by provisions or requirements of the law, (II) It does not affect or imply the loss of traceability or integrity of the databases or information systems where the information is stored; (III) The purpose for which it was collected has been fulfilled or eliminated. (IV) It is requested by the owner of the data or whoever proves that he/she is authorized and does not go against the above definitions. However, some information may be kept only for statistical or auditing purposes.

   Uses or purposes of the collection of information.

   The use or purpose given to the personal information collected from each type of holder is:

   Types of Holders	Purposes of use
   Clients	Keep historical, scientific, or statistical records. Sending or sending information related to the corporate purpose of the organization. Manage the relationships, rights, and duties that we have with the owners. Send general communications. Manage and maintain a history of commercial relations. Advance the offering of products and services. Conduct opinion surveys. Advance communications or contact via email, SMS, telephone, or other means. Perform verification of legal or regulatory compliance. Perform administrative management activities. Generate invoices. Receive and manage requests for products or services, and attention to the holders (PQR management). Comply with legal requirements for the prevention of money laundering and financing of terrorism. Carry out remote communications for the sale of products or services. Verify data or references provided to third parties or entities. Manage the requirements or needs that have been requested or are derived from a commercial relationship. To comply with the attention of citizens’ rights. To carry out investigations in case of risk situations or security violations Manage security in all its aspects. Send and share your own advertising. Comply with the economic and accounting duties of the organization. Perform collection and payment activities. Carry out campaigns to update data and information on changes in the processing of personal data. Carry out the formalization of adjustments or payment agreements. Perform traditional or digital marketing activities. Comply with the legal requirements associated with the formalization of contracts. Ensure the management of security in our facilities. Manage risks or accidents within the facilities. Control the access and exit of people in the facilities. Advance administrative and internal control procedures. To evidence the development of missionary activities carried out.
   Temporary	Manage the relationships, rights, and duties that we have with the owners. Advance communications or contact via email, SMS, telephone, or other means. Perform administrative management activities. To verify data and references. Comply with legal requirements for the prevention of money laundering and terrorism financing. Perform verification of data or references provided to third parties or entities. Comply with the attention to the rights of citizens. Conduct investigations in the event of risk situations or security breaches. Manage security in all its aspects. Carry out campaigns to update data and information on changes in the processing of personal data. Carry out the formalization of adjustments or payment agreements. Comply with the legal requirements associated with the formalization of contracts. Generate internal statistics. Ensure the management of security in our facilities. Comply with the provisions of the Colombian legal system regarding occupational health and safety. Comply with the requirements associated with labor relations and working conditions. Carrying out the administration of information systems, password management, user administration, etc. Processing of requirements from entities such as IPS, EPS, and ARL. Manage the activities associated with personnel management. Comply with the provisions of the Colombian legal system in labor and social security matters, among others, applicable to former or current employees. Comply with labor risk management requirements. Preserve the safety of assets and people. Manage and make payroll payments. To advance the management of labor risks and the prevention and protection of human resources against illnesses and accidents in the workplace. Perform time and attendance control. Manage risks or accidents within the facilities. Perform health risk verification. Registration in applications and forms of state entities and agencies by legal requirement. Comply with social benefits payment requirements. Comply with biosecurity protocols required by the Ministry of Health under COVID-19 prevention. Control the access and exit of people to and from the facilities. Carry out administrative and internal control procedures. Comply with the declaration and payment of social security contributions. Conduct internal personnel training processes.
   Visitors	spond to requests from judicial or administrative authorities. Manage the relationships, rights, and duties that we have with the owners. Advance communications or contact via email, SMS, telephone, or other means. Perform administrative management activities. Receive and manage requirements about products or services, attention to the holders (PQR Management). Manage the requirements or needs that have been requested or are derived from a business relationship. To comply with the attention of citizens’ rights. To advance investigations in case of risk situations or security violations. Manage security in all its aspects. Advance campaigns for updating data and information on changes in the processing of personal data. Generate internal statistics. Ensure the management of security in our facilities. Comply with the provisions of the Colombian legal system on occupational health and safety. Comply with the requirements associated with labor relations and working conditions. Processing of requirements from entities such as IPS, EPS, and ARL. Manage risks or accidents within the facilities. Control the access and exit of people in the facilities. Check-in and check-out assets, packages, documents, or correspondence. Perform the management and administration of the facilities. Informing or involving you in promotion and prevention programs Perform reproduction, broadcast, and dissemination in both printed and electronic media. Evidencing the development of missionary activities performed.
   Suppliers and contractors	Maintain historical, scientific, or statistical records. Generate models and data for decision-making. Forwarding or sending information related to the corporate purpose of the organization. Manage the relationships, rights, and duties of the owners. Send general communications. Manage and maintain a history of commercial relations. Advance communications or contact via email, SMS, telephone, or other means. Verify legal or regulatory compliance. Perform administrative management activities. Verify data and references. Generate invoices. Receive and manage requests for products or services and attention to the holders (PQR Management) Comply with legal requirements for the prevention of money laundering and financing of terrorism. Carry out remote communications for the sale of products or services. Verify data or references provided to third parties or entities. Comply with the attention of citizens’ rights. Conduct investigations in the event of risk situations or security violations. Manage security in all its aspects. Applying sanctions associated with non-compliance of any kind. Comply with the economic and accounting duties of the organization. Perform collection and payment activities. Carry out campaigns to update data and information on changes in the processing of personal data. Carry out the formalization of adjustments or payment agreements. Perform traditional or digital marketing activities. Comply with the legal requirements associated with the formalization of contracts. Ensure the management of security in our facilities. Comply with the provisions of the Colombian legal system regarding occupational health and safety. Processing requirements from entities such as IPS, EPS, and ARL. Control the access and exit of people in the facilities. Carry out administrative and internal control procedures. Comply with the declaration and payment of social security contributions. Verify legal, technical, and/or financial requirements. Manage relationships, rights, and duties with suppliers.
   Interns	Manage relationships, rights, and duties that we have with the owners. Advance communications or contact via email, SMS, telephone, or other means. Perform administrative management activities. To verify data and references. Comply with legal requirements for the prevention of money laundering and terrorism financing. Perform verification of data or references provided to third parties or entities. Comply with the attention to the rights of citizens. Conduct investigations in the event of risk situations or security breaches Manage security in all its aspects. Carry out campaigns to update data and information on changes in the processing of personal data. Carry out the formalization of adjustments or payment agreements. Comply with the legal requirements associated with the formalization of contracts. Generate internal statistics. Ensure the management of security in our facilities. Comply with the provisions of the Colombian legal system regarding occupational health and safety. Comply with the requirements associated with labor relations and working conditions. Carry out the administration of information systems, password management, user administration, etc. Processing requirements from entities such as IPS, EPS,  and ARL. Manage the activities associated with personnel management. Comply with the provisions of the Colombian legal system in labor and social security matters, among others, applicable to former or current employees. Comply with labor risk management requirements. Preserve the safety of assets and people. Manage and make payroll payments. To advance the management of labor risks and the prevention and protection of human resources against illnesses and accidents in the workplace. Perform time and attendance control. Manage risks or accidents within the facilities. Perform health risk verification. Registration in applications and forms of state entities and agencies by legal requirement. Comply with social benefits payment requirements. Comply with biosecurity protocols required by the Ministry of Health following COVID-19 prevention. Control the access and exit of people to and from the facilities. Carry out administrative and internal control procedures. Comply with the declaration and payment of social security contributions. Conduct internal personnel training processes.
   Retirees and pensioners	Manage the relationships, rights, and duties that we have with the owners. Send general communications. Advance communications or contact via email, SMS, telephone, or other means. Perform administrative management activities. Receive and manage requirements about products or services, attention to the holders (PQR Management). To comply with the attention of citizens’ rights. Carry out campaigns to update data and information on changes in the processing of personal data. Generate internal statistics.
   Employees and former employees	Maintain a historical, scientific, or statistical registry. Manage relationships, rights, and duties that we have with the owners. Advance communications or contact via email, SMS, telephone, or other means. Perform administrative management activities. To verify data and references Comply with legal requirements for the prevention of money laundering and financing terrorism. Perform verification of data or references provided to third parties or entities. Comply with the attention to the rights of citizens. Conduct investigations in the event of risk situations or security breaches. Manage security in all its aspects. Applying sanctions associated with non-compliance of any kind. Carry out campaigns to update data and information on changes in the processing of personal data. Formalize adjustments or payment agreements. Comply with the legal requirements associated with the formalization of contracts. Ensure the management of security in our facilities. Comply with the provisions of the Colombian legal system on occupational health and safety. Comply with the requirements associated with labor relations and working conditions. Carry out the administration of information systems, password management, user administration, etc. Processing requirements from entities such as IPS, EPS, and ARL. Manage the activities associated with personnel management. Comply with the provisions of the Colombian legal system in labor and social security matters, among others, applicable to former or current employees. Comply with labor risk management requirements. Preserve the safety of assets and people. Manage and make payroll payments. To advance the management of labor risks and the prevention and protection of human resources against illnesses and accidents in the workplace. Perform time and attendance control. Manage risks or accidents within the facilities. Perform health risk verification. Registration in applications and forms of state entities and agencies by legal requirement. Comply with social benefits payment requirements. Comply with biosecurity protocols required by the Ministry of Health following COVID-19 prevention. Control the access and exit of people to and from the facilities. Carry out administrative and internal control procedures. Comply with the declaration and payment of social security contributions. Conduct internal personnel training processes.
   Candidates and Applicants	Manage relationships, rights, and duties that we have with the owners. Send general communications. Advance communications or contact via email, SMS, telephone, or other means. Perform administrative management activities. Verify data and references. Verify data or references provided to third parties or entities. Comply with the attention of citizens’ rights. Manage security in all its aspects. Perform profile analysis. Carry out campaigns to update data and information on changes in the processing of personal data. Generate internal statistics. Promote and manage job offers. Feed the database of candidates to be considered in future opportunities. Ensure the management of security in our facilities. To carry out the selection and promotion of job opportunities. Make calls or appointments for interviews or tests.
   Prospectus	Generate models and data for decision-making. Send information related to the corporate purpose of the organization. Manage relationships, rights, and duties that we have with the owners. Advance communications or contact via email, SMS, telephone, or other means. Carry out administrative management activities. Receive and manage requests for products or services and attention to the holders (PQR Management). Carry out remote communications for the sale of products or services. To comply with the attention of citizens’ rights. Carry out campaigns to update data and information on changes in the processing of personal data. Conduct commercial prospecting. Generate internal statistics.

   Processing of sensitive data

   The sensitive data collected will be processed for the following purposes.

   Type of Sensitive Data	Purpose of Data Collection
   Biometrics	Perform administrative management activities. Control the access and exit of people in the facilities. Carry out administrative and internal control procedures. Manage security in all its aspects. Manage risks or accidents within the facilities.
   Moral or emotional characteristics	Maintain historical, scientific, or statistical records. Perform administrative management activities. Inform you about or involve you in promotion and prevention programs. Generate internal statistics. Generate models and data for decision-making. Manage safety in all its aspects. Perform profile analysis. Manage the activities associated with personnel management.
   Health data	To carry out administrative management activities. Comply with the provisions of the Colombian legal system on occupational health and safety. Processing requirements from entities such as IPS, EPS, and ARL. Comply with occupational risk management requirements. To advance the management of occupational risks and the prevention and protection of human resources against occupational illnesses and accidents. Manage risks or accidents within the facilities. Perform health risk verification. Comply with biosafety protocols required by the Ministry of Health in accordance with COVID-19 prevention. Manage and make payroll payments. Maintain historical, scientific, or statistical records. Generate models and data for decision making. Manage the relationships, rights, and duties with the holders. Fulfill citizens’ rights.

   Authorization for data processing

   JOYCO S.A.S. BIC will request freely, previously, expressly, and duly informed, the authorization by the owners of the personal data and for this purpose will generate suitable mechanisms guaranteeing for each case that it is possible to verify the granting of such authorization. The same may be recorded in any medium, whether a physical, digital, electronic document, or in any format that guarantees its subsequent consultation through technical tools, complying with the requirements established in the Law.

   • Authorization for the processing of data of children and adolescents

   In the processing of personal data of children and adolescents, respect for the rights of minors shall be ensured. JOYCO S.A.S. BIC may require the processing of personal data of minors to comply with legal aspects such as I) Article 32 of Law 789 of 2002 related to the obligation to advance the recruitment of apprentices and II) The right of affiliates to the Social Security System to affiliate any relative within the third degree of consanguinity or any child under 12 years (whether or not a relative) as long as they are economically dependent.

   In case of requiring the direct collection of personal data of children and adolescents, JOYCO S.A.S. BIC will request the authorization of treatment with the informed consent of parents or responsible adults of minors.

   Security and protection measures

   JOYCO S.A.S. BIC has adopted the technical, legal, human, and administrative measures necessary to ensure the security of personal data protecting confidentiality, integrity, use, unauthorized access, and/or fraud. Likewise, security protocols and guidelines have been implemented internally and are mandatory for all personnel with access to personal data and information systems.

   Obligations of those in charge of personal information

   Companies and/or persons external to JOYCO S.A.S. BIC, which under a contractual relationship perform the processing of personal data, must comply with the following obligations:

   Guarantee the holder access, consultation, updating, and rectification of their data.

   Request and keep a copy of the respective authorization for the processing of personal data informing the purpose of the collection.

   Keep the information under security conditions that prevent adulteration, loss, consultation, use, or unauthorized or fraudulent access.

   Adopt an internal policy manual to ensure compliance with Law 1581 of 2012, regarding the protection of personal data.

   Allow access to information only to persons who may have access to it.

   Comply with the obligations outlined in Article 18 of Law 1581 of 2012, and its respective regulatory decrees, relating to the protection of personal data.

   In the case of operating as a person in charge of the information

   In cases where JOYCO S.A.S. BIC operates as a data processor, the data controllers must request and retain the authorization of the owner of the information, for the processing of personal data by us, therefore JOYCO S.A.S. BIC assumes that the data controller has the consent of the owner of the information. JOYCO S.A.S BIC presumes that the person in charge of the information has the previous and express authorizations of the owners with whom it has contact, to make use of their data and will provide a copy of such authorizations in case we require it as managers, for the purposes outlined in the policy of processing of personal data.

Rights of the holders

The Fundamental Right to Habeas Data empowers the owner of the data to request access, update, rectification, and deletion of their personal data that own a third party, in turn, may revoke the authorization granted for treatment. If a holder of personal data considers that JOYCO S.A.S. BIC has access to his/her data, this person may at any time request the consultation of his/her data, or if he/she considers that JOYCO S.A.S. BIC is misusing his/her data, he/she may make the respective claim.

The holder is entitled to request:

1. Access free of charge to their data that have been subject to Processing.
2. Know, update, and rectify their information. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized.
3. Know why and for what purpose JOYCO S.A.S. BIC, collects information in a database.
4. To revoke the authorization given to contain personal information in JOYCO S.A.S. BIC’s databases and/or request the deletion of the data if no legal or contractual obligation prevents its deletion.
5. File a complaint before the Superintendence of Industry and Commerce, when JOYCO S.A.S. BIC has not satisfactorily dealt with queries or claims.
6. Request proof of the authorization granted to the data controller except when expressly exempted as a requirement for treatment, under the provisions of Article 10 of Law 1581 of 2012.
7. Refrain from answering questions about sensitive data the answers that deal with sensitive data or data of children and adolescents will be optional.

Time of attention

Consultation

Through the consultation mechanism, the owner of the data may request JOYCO S.A.S. BIC, access to his/her personal information. The query will be answered within a maximum term of ten (10) working days from the date of receipt thereof. If it is not possible to respond to the query within the referenced term, you will be informed of the reasons for the delay and will be given an answer within five (5) working days following the expiration of the first term.

Claim

Through the complaint mechanism, the owner of the data may complain to JOYCO S.A.S. BIC, any disagreement he/she may have about the use that is being made of his/her data.

The claim will be answered within a maximum term of fifteen (15) fifteen working days from the day following the date of receipt. In case it is not possible to attend the claim within such a term, you will be informed of the reasons for the delay, and you will be given an answer within eight (8) working days following the expiration of the first term.

In case the claim is incomplete, you will be required, within five (5) days following the receipt of the claim to correct the faults. After two (2) months from the date of the requirement, without submitting the required information, it will be understood that the claim has been withdrawn. When JOYCO S.A.S. BIC is not competent to resolve the claim, it will transfer it to the appropriate person within a maximum period of two (2) working days and inform the holder of the situation.

Procedure to exercise the rights of the data owner.

• Data owners or persons entitled to exercise their rights

Any holder of the information or the person acting as his legal representative may exercise his rights. The following holders are merely for illustrative purposes and are neither exclusive nor excluding.

• Customers
• Temporary
• Visitors
• Suppliers and Contractors
• Apprentices
• Retirees or Pensioners
• Employees or former employees
• Candidates or Applicants
• Prospectus 

• Information to be provided by the holder or person

For the filling and attention of your request, we ask you to provide the following information:

1. Full name and surname.
2. Type and number of identification.
3. Contact information (physical and/or electronic address and contact telephone numbers),
4. This means to receive a response to your request,
5. Reason(s)/fact(s) giving rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete, access to information)
6. Signature (if applicable) and identification number.

Any exercise of your rights requires prior legitimacy, as described in Article 2.2.2.2.25.4.1 of Decree 1074, so any request or claim associated with requests for access, rectification, updating, or deletion of data must be accompanied by any of the following documents:

1. Photocopy of your identity document.
2. Authenticated letter of accreditation of legal successor.
3. Authenticated letter of representation or power of attorney
4. Other documents prove the power of representation of the owner of the data.

• Request for images or videos

In case the owner of the information requests access to images and/or videos where his/her information is captured, he/she must follow the following procedure:

1. State the facts of the request, establishing the date, time, place, and other information that facilitates the location of the image or video fragment.
2. Justify the need for the request.
3. Provide the documents that justify that the owner is the right person to make the request. In case the interested party is a third party, the authorization document for access to such information by the data owner must be provided.

• Procedure for image and/or video request procedures

For the procedure to proceed, JOYCO S.A.S. BIC:

1. Verify that the information is still stored on its servers, under the provisions of paragraph 2.2.2 of this policy.
2. Review such request, and verify whether it is appropriate, checking that it does not affect the right to privacy, and other fundamental rights of third parties, other than the owner of the information found in such images and/or video.
3. In case it affects third-party rights, JOYCO S.A.S. BIC will notify that within the requested information there are images of third parties, so it is required to perform the anonymization (blur or fragment) of the data. The costs of such an anonymization process must be paid by the applicant.
4. In case it does not affect the fundamental rights of third parties, JOYCO S.A.S. BIC will summon the holder of the information in its facilities so that he/she can visualize the information required.

Channels and Responsible

• Channels enabled the exercise of rights

JOYCO S.A.S. BIC has enabled the following channels for holders to exercise their right to Habeas Data.

These are the only channels that JOYCO S.A.S. BIC has enabled for queries and claims for the protection of personal data, therefore, as the owner you should be aware of them.

• Responsible for compliance with the policy

The person responsible for effective compliance with the Policy, as well as for the queries and claims related to the protection of personal data of the owners in JOYCO S.A.S. BIC will be the Compliance Officer. In any case, the person responsible may require other areas of JOYCO S.A.S. BIC to verify compliance with the regulations related to the protection of personal data. In case of any doubt regarding this policy, you can contact us through the channels described above.

Provisions

• Permanent measures

In the treatment of personal data, JOYCO S.A.S. BIC will permanently verify in its processes, protocols, procedures, and policy, that the right of habeas data is guarantee to the owners of the information.

• Link with the policy

Any holder of the information that has any relationship with JOYCO S.A.S. BIC, must abide by this policy. The holders of the information, other than end users, must comply with the internal policy manual on the protection of personal data.

• Compliance with the principles

JOYCO S.A.S. BIC guarantees the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security, and confidentiality of the data contained in JOYCO S.A.S. BIC’s databases.

• Inscription of the databases in the RNBD

In compliance with the regulatory provisions, JOYCO S.A.S. BIC will carry out the registration of the databases in its possession following the provisions described in Decree 090 of January 2018, which amends and redefines articles 2.2.2.2.26.1.2 Scope of Application and 2.2.2.26.3.1 Registration Deadline of Decree 1074 of 2015.

• Validity

The databases in which the personal data will be registered will have a validity equal to the time in which the information is kept and used for the purposes described in this policy. The personal data provided will be kept if the contractual relationship with the Holder of the information is maintained or if its deletion is not requested by the interested party and as long as there is no legal duty to keep it.

Changes and Validity

• Date of approval of the policy and entry into force

This policy is effective as of March 30, 2023, in its version 2 and replaces our previous policy of May 2021.