Skip links

PERSONAL DATA PROCESSING POLICY OF UBICCA CONSTRUCTORA S.A.S.

Privacy notice

In accordance with the provisions of Statutory Law 1581 of 2012, which establishes general provisions for the protection of personal data and Regulatory Decree 1377 of 2013, which partially regulates said law, UBICCA CONSTRUCTORA SAS, a company domiciled in Medellín, identified with NIT. 900.476.010-1, legally constituted by private document dated the third (3) of November 2011 and registered on the thirty-first (31) of December 2015 under number 108659 of Book IX of the Commercial Registry of the Aburra Sur Chamber of Commerce, as stated in the certificate of existence and legal representation issued by the Aburra Sur Chamber of Commerce (hereinafter, “UBICCA”), we would like to inform you that we have been incorporating into our different databases, personal information that has been obtained through its different channels of attention and/or due to contractual or pre-contractual relationships in the development of the ordinary course of our economic activity. In this regard, UBICCA informs that in compliance with Law 1581 it has adopted the necessary legal, technical and administrative measures to prevent the loss, access or alteration of the personal data that we process, guaranteeing the security and integrity of this type of data throughout the processing we carry out on this type of information.

The holders of the information, through their consent, freely, expressly and unequivocally accept that their personal data be processed by UBICCA for the following purposes:

    1. Manage the correct provision of the services offered by UBICCA.
    2. To provide information about our own products and/or services or those of others, about the construction, management, promotion, sale and administration of real estate projects or programs, promotion of urban development or subdivision businesses.
    3. Report changes in information processing policies.
    4. Process orders, requests or any type of request made by the user through any of the contact forms made available to the user on the company’s website.
    5. Correctly manage the protection and exercise of the rights of UBICCA shareholders.
    6. Send newsletters.
    7. Prepare statistical studies.
    8. Manage contractual, labor and commercial relationships acquired in a correct manner.
    9. Manage pre-judicial and judicial collection processes.
    10. Manage requirements from administrative and judicial authorities in the performance of their duties.
    11. Send commercial and advertising communications from time to time by any of the means listed below, such as email, SMS, MMS, FAX, SOCIAL NETWORKS or any other electronic or physical means known at present or in the future, which makes it possible to carry out commercial and/or advertising communications. These commercial communications will be related to products or services offered by UBICCA or its affiliates, commercial and/or strategic allies with whom a commercial promotion agreement is agreed between its clients.

UBICCA then establishes the following:

PERSONAL DATA PROCESSING POLICY

UBICCA informs its clients, collaborators, contractors and/or suppliers (hereinafter “STAKEHOLDERS”), and in general all persons who have provided or who will provide their personal data in the future, about the processing that UBICCA will carry out on their personal data, in accordance with the applicable legislation on the matter.

1. OBJECT

The purpose of this document is to inform INTEREST GROUPS and, in general, all persons who have provided or will provide their personal data to UBICCA in the future, about the personal information processing policy and to allow the holders of personal data to exercise their right to habeas data, establishing the necessary procedure that they must follow if they wish to know, update, rectify or oppose the data found in our databases and/or files. This document is intended to protect and guarantee everything related to the processing of personal data, the freedoms and fundamental rights of all natural persons and, in general, INTEREST GROUPS. This document is aligned with Statutory Law 1581 of 2012 and Regulatory Decree 1377 of 2013, regarding compliance with the privacy notice that must be provided to the holders of personal information by UBICCA, who acts as the controller of personal data. This document informs the holder of the personal information of the information processing policies that will be applicable to his/her personal data. Likewise, this document will explain how to access your personal data and will determine the manner in which the personal data will be processed and subsequently used. In this sense, the Personal Data is collected, stored, organized, used, purified, analyzed, circulated, transmitted, transferred, updated, rectified, suppressed, eliminated and cross-referenced with own information and/or that of authorized third parties and in general managed in accordance with and in proportion to the purpose or purposes of each treatment.

10. CONSULTATION AND COMPLAINT PROCEDURES FOR KNOWLEDGE, UPDATE, RECTIFICATION, OPPOSITION AND CANCELLATION OF PERSONAL DATA OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:

    1. To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:
    2. Requirements for exercising the right to habeas data through a representative: This right may be exercised by the interested party duly identified or by the representative of the owner of the personal information (a copy of the power of attorney must be attached to the request). If the request is submitted by a person who is not the owner of the personal information, without complying with the presentation of the appropriate document that supports the representation, it must be considered as not presented and no response will be given to said request. Minors must exercise their right to habeas data through someone who proves their legal representation.
    3. Inquiries: The Client or members of INTEREST GROUPS who are the owners of the Personal Data and wish to make inquiries, must take into account that UBICCA, as the party responsible for or in charge of the Processing of the Personal Data, must provide said persons with all the information contained in the individual record or that is linked to the identification of the owner. The inquiry will be made through the enabled means and will be attended to within a maximum term of ten (10) business days counted from the date of receipt of the request. When it is not possible to attend to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which his inquiry will be attended to, which in no case may exceed five (5) business days following the expiration of the first term, without prejudice to the provisions contained in special laws or regulations issued by the National Government that may establish shorter terms, taking into account the nature of the personal data.
    4. Claims: The Client or member of INTEREST GROUPS who owns the Personal Data and considers that the information contained in a UBICCA database should be corrected, updated or deleted, or when he or she notices the alleged non-compliance of any of the duties contained in Statutory Law 1581 or its regulations, may file a claim with UBICCA, which will be processed under the following rules:
      a. The claim must be made by means of a request addressed to the Data Controller, with the identification of the owner, the description of the facts that give rise to the claim and the physical and email address, accompanied by the relevant documents on which the claim is based.
      b. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. If two months have passed from the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn.
      c. If the person receiving the complaint is not competent to resolve it, he or she will forward it to the appropriate party within a maximum period of two business days and will inform the interested party of the situation.
      d. Once the complete claim has been received, within a period of no more than two (2) business days, a legend stating “claim in process” and the reason for it will be included in the database. This legend must be maintained until the claim is decided.
      e. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
    5. Applicability: Clients or members of INTEREST GROUPS who are the owners of the Personal Data and wish to exercise any of the rights mentioned in this document may do so by written communication to the entity responsible for the Processing of their personal information, accompanying said request with their signature and a copy of their personal identification or similar analogous document.
    6. Inadmissibility of deletion of Personal Data: The deletion of Personal Data may not be carried out by UBICCA when the maintenance of said Personal Data is a legal or contractual obligation, when keeping the Personal Data is essential to safeguard the interests of the applicant who owns said Personal Data or is of public interest, or when the deletion hinders or impedes the exercise of the functions of the national administrative or judicial authorities.
    7. Revocation of Authorization: When requesting revocation of the Authorization, the interested party must inform UBICCA precisely whether the revocation is total or partial. Revocation of the Authorization is partial when the interested party states that he or she wishes to revoke the Processing of his or her Personal Data for certain specific purposes such as advertising, competitions, consumer studies, etc. Revocation of the Authorization will be total when it is requested that the Processing of Personal Data be stopped for all authorized purposes.
    8. Revocation of Authorization: Clients or members of INTEREST GROUPS who own the Personal Data may file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim procedure provided for in this document.

11. VALIDITY OF THE PERSONAL DATA POLICY

This UBICCA Personal Data Processing Policy is effective from the date of its publication.

This Policy may be modified by UBICCA at any time, in order to adapt it to any legislative or jurisprudential changes that may occur, as well as to best practices that may be developed on the subject, in which case the Client or members of INTEREST GROUPS will be promptly informed.

Any modification or update of this Policy will be notified through the UBICCA website, where the latest version of said Policy will be made available to the Client or members of INTEREST GROUPS, indicating the date of entry into force of the corresponding modification or update, as the case may be.

The use or acquisition of the products or services offered by UBICCA, by the Client or members of INTEREST GROUPS or their failure to disassociate themselves from them, after the new Policy is made available, constitutes acceptance of the same.

The Personal Data or databases subject to Processing will be valid for the contractual term that the Client or members of INTEREST GROUPS have entered into with UBICCA for the product or service, plus the term established by law.

7. PURPOSES OF PROCESSING PERSONAL DATA

The Personal Data of Clients and members of INTEREST GROUPS are collected by UBICCA in the development of its corporate purpose, for the purposes of:

    1. Provide information on products and/or services, whether owned or on behalf of others, on the construction, management, promotion, sale and administration of real estate projects, promotion of urban development or subdivision businesses, among others.
    2. Evaluate the quality of UBICCA’s products or services.
    3. Manage the correct provision of UBICCA services.
    4. Conduct advertising and marketing campaigns to offer own or third-party products or services.
    5. Process orders, requests or any type of petition made by users through the communication channels provided for this purpose.
    6. Send newsletters.
    7. Prepare statistical studies.
    8. Advance commercial agreements, events or institutional programs directly or in association with third parties.
    9. Data verification through consultation of public databases or risk centers.
    10. Comply with legal obligations to provide information to administrative entities, as well as to the competent authorities that so require.
    11. Sharing with third parties that collaborate with UBICCA and that, in order to perform their functions, must access the information to some extent, such as messaging service providers, advertising agencies, call centers and collection agencies. It is specified at this point that these third parties are obliged to maintain the confidentiality of the information to which they have access, all of which is regulated by confidentiality agreements signed with them.
    12. Execute the contracts signed by UBICCA.
    13. Support UBICCA audit processes.
    14. Enter into agreements with third parties.
    15. Occasional sending of commercial and advertising communications by any of the means listed below, such as email, SMS, MMS, social networks or any other electronic or physical means known, now or in the future, that makes it possible to carry out commercial and/or advertising communications. These commercial communications will refer to products or services offered by UBICCA or its commercial and/or strategic partners with whom a commercial promotion agreement is entered into between its clients.
    16. Any other purpose that may result in the development of the contract or the commercial relationship between UBICCA and the Client or members of the INTEREST GROUPS.
    17. The information provided by the Client or members of the INTEREST GROUPS will only be used for the purposes stated herein and once the need for the Processing of Personal Data ceases, they may be eliminated from UBICCA’s databases or archived in secure terms so as to only be disclosed when required by law.

8. DUTIES OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

Pursuant to art. 17 of Statutory Law 1581 of 2012, the Data Controller shall have the following duties, without prejudice to the other provisions set forth in this law and in other laws that govern its activity:

    1. Guarantee the Client or members of INTEREST GROUPS at all times the full and effective exercise of the right to habeas data.
    2. Request and retain, under the conditions provided by law, a copy of the respective authorization granted by the Client or members of the INTEREST GROUPS.
    3. Properly inform the Client or members of the INTEREST GROUPS about the purpose of the collection and the rights that they have by virtue of the authorization granted.
    4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
    5. Ensure that the information provided to the Data Processor is true, complete, accurate, up-to-date, verifiable and understandable.
    6. Update the information, communicating in a timely manner to the Data Processor all new developments regarding the data previously provided and adopting the other measures necessary to ensure that the information provided to the Data Processor remains up to date.
    7. Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.
    8. Provide the Data Processor, as the case may be, only with data whose processing has been previously authorized in accordance with the provisions of the law.
    9. Demand that the Data Processor at all times respect the security and privacy conditions of the information of the Client or members of the INTEREST GROUPS.
    10. Process queries and complaints made under the terms set out in the law.
    11. Adopt an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, to address queries and complaints.
    12. Inform the Data Processor when certain information is being discussed by the Client or members of the INTEREST GROUPS, once the claim has been submitted and the respective process has not been completed.
    13. Inform, upon request of the Client or members of the INTEREST GROUPS, about the use given to their data.
    14. Inform the data protection authority when security code violations occur and there are risks in the management of the information of the Client or members of INTEREST GROUPS.
    15. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

9. RIGHTS OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

For the protection of personal data of Clients and members of INTEREST GROUPS, they will have the following rights:

    1. Know and access your Personal Data that has been processed by UBICCA, in addition to exercising the right to know the origin of your data and whether or not it has been transferred to third parties and, therefore, the identification of the assignees.
    2. Update your Personal Data that has been processed by UBICCA.
    3. Be informed, upon request, regarding the use that has been given to your Personal Data.
    4. Verify the accuracy and truthfulness of the information with the Data Controller and request rectification of the personal data collected when it is inaccurate, incomplete or leads to errors. The owners of the information must indicate the data they request to be corrected and also provide the documentation justifying the request.
    5. Oppose and cancel your authorization for the Processing of your Personal Data, when the processing of the same has not respected the principles established in Statutory Law 1581 of 2012 or its regulations. The owner of the personal information must indicate the data that must be cancelled or rectified, providing, if applicable, the documentation or evidence that justifies it. The cancellation will result in the blocking of your data, which will be kept by the Data Controller for the sole purpose of making them accessible to administrative or judicial authorities, always obeying the limitation period that exists on them. Once this period has elapsed, the Data Controller must proceed to the definitive cancellation of the personal information of the interested party or affected party, which is stored in our databases or files. Likewise, the owner of the personal information may request the deletion or cancellation of their personal data when the processing of the same by the controller or person in charge is excessive or even inadequate. The data of the holders of the information will be kept for the time periods provided for in the applicable regulations and/or, depending on the case, in the contractual relations between the holder of the personal information and the person responsible for the processing. In any case, the request for deletion of the information and the revocation of the authorization will not proceed when the holder has the legal or contractual obligation to remain in the database.
    6. Request proof of the authorization granted for the Processing of your Personal Data. These rights may be exercised directly by the owner of the information, his/her representative or his/her successor in title, as the case may be, provided that the appropriate document for such representation is presented, such as a signed and authorized special power of attorney.
    7. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Statutory Law 1581 of 2012 and other regulations that modify, add to or complement it.

10. CONSULTATION AND COMPLAINT PROCEDURES FOR KNOWLEDGE, UPDATE, RECTIFICATION, OPPOSITION AND CANCELLATION OF PERSONAL DATA OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:

    1. To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:
    2. Requirements for exercising the right to habeas data through a representative: This right may be exercised by the interested party duly identified or by the representative of the owner of the personal information (a copy of the power of attorney must be attached to the request). If the request is submitted by a person who is not the owner of the personal information, without complying with the presentation of the appropriate document that supports the representation, it must be considered as not presented and no response will be given to said request. Minors must exercise their right to habeas data through someone who proves their legal representation.
    3. Inquiries: The Client or members of INTEREST GROUPS who are the owners of the Personal Data and wish to make inquiries, must take into account that UBICCA, as the party responsible for or in charge of the Processing of the Personal Data, must provide said persons with all the information contained in the individual record or that is linked to the identification of the owner. The inquiry will be made through the enabled means and will be attended to within a maximum term of ten (10) business days counted from the date of receipt of the request. When it is not possible to attend to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which his inquiry will be attended to, which in no case may exceed five (5) business days following the expiration of the first term, without prejudice to the provisions contained in special laws or regulations issued by the National Government that may establish shorter terms, taking into account the nature of the personal data.
    4. Claims: The Client or member of INTEREST GROUPS who owns the Personal Data and considers that the information contained in a UBICCA database should be corrected, updated or deleted, or when he or she notices the alleged non-compliance of any of the duties contained in Statutory Law 1581 or its regulations, may file a claim with UBICCA, which will be processed under the following rules:
      a. The claim must be made by means of a request addressed to the Data Controller, with the identification of the owner, the description of the facts that give rise to the claim and the physical and email address, accompanied by the relevant documents on which the claim is based.
      b. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. If two months have passed from the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn.
      c. If the person receiving the complaint is not competent to resolve it, he or she will forward it to the appropriate party within a maximum period of two business days and will inform the interested party of the situation.
      d. Once the complete claim has been received, within a period of no more than two (2) business days, a legend stating “claim in process” and the reason for it will be included in the database. This legend must be maintained until the claim is decided.
      e. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
    5. Applicability: Clients or members of INTEREST GROUPS who are the owners of the Personal Data and wish to exercise any of the rights mentioned in this document may do so by written communication to the entity responsible for the Processing of their personal information, accompanying said request with their signature and a copy of their personal identification or similar analogous document.
    6. Inadmissibility of deletion of Personal Data: The deletion of Personal Data may not be carried out by UBICCA when the maintenance of said Personal Data is a legal or contractual obligation, when keeping the Personal Data is essential to safeguard the interests of the applicant who owns said Personal Data or is of public interest, or when the deletion hinders or impedes the exercise of the functions of the national administrative or judicial authorities.
    7. Revocation of Authorization: When requesting revocation of the Authorization, the interested party must inform UBICCA precisely whether the revocation is total or partial. Revocation of the Authorization is partial when the interested party states that he or she wishes to revoke the Processing of his or her Personal Data for certain specific purposes such as advertising, competitions, consumer studies, etc. Revocation of the Authorization will be total when it is requested that the Processing of Personal Data be stopped for all authorized purposes.
    8. Revocation of Authorization: Clients or members of INTEREST GROUPS who own the Personal Data may file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim procedure provided for in this document.

11. VALIDITY OF THE PERSONAL DATA POLICY

This UBICCA Personal Data Processing Policy is effective from the date of its publication.

This Policy may be modified by UBICCA at any time, in order to adapt it to any legislative or jurisprudential changes that may occur, as well as to best practices that may be developed on the subject, in which case the Client or members of INTEREST GROUPS will be promptly informed.

Any modification or update of this Policy will be notified through the UBICCA website, where the latest version of said Policy will be made available to the Client or members of INTEREST GROUPS, indicating the date of entry into force of the corresponding modification or update, as the case may be.

The use or acquisition of the products or services offered by UBICCA, by the Client or members of INTEREST GROUPS or their failure to disassociate themselves from them, after the new Policy is made available, constitutes acceptance of the same.

The Personal Data or databases subject to Processing will be valid for the contractual term that the Client or members of INTEREST GROUPS have entered into with UBICCA for the product or service, plus the term established by law.

3. SCOPE OF APPLICATION

The Personal Data Processing Policy contained in this document and the procedures for handling claims from information holders shall be applied to all personal data recorded on physical or digital media that may be processed by UBICCA as the party responsible for said data. The personal data protection regime established in this document shall not apply to the databases or files indicated in article 2 of Law 1581 of 2012.

4. SPECIAL REQUIREMENTS FOR THE PROCESSING OF CERTAIN PERSONAL DATA

    1. Personal data of children and adolescents:
    2. The processing of personal data of minors or adolescents by UBICCA will always be carried out in compliance with the following requirements:
    3. Always respond to and respect the best interests of children and adolescents.
    4. Always ensure that the person responsible respects your fundamental rights.
    5. That, to the extent possible, said treatment is carried out taking into account the opinion of the minors who are the owners of the personal information, considering the following factors:
      a. Maturity
      b. Autonomy
      c. Ability to understand the purpose of said treatment
      d. Explain the consequences that the treatment entails
    6. Any person responsible, in charge or third party involved in the Processing of Personal Data of minors must always ensure the appropriate use of this type of data.
    7. Sensitive Personal Data established in Law 1581 of 2012.
    8. UBICCA identifies the sensitive data that may be collected or stored, with the aim of:
    9. Implement special attention and reinforce its responsibility regarding the processing of this type of data, which translates into greater demands in terms of compliance with the principles and duties established by current regulations on data protection.
    10. Establish the technical, legal and administrative security levels to handle this information appropriately.
    11. Increase access and use restrictions by UBICCA staff and third parties.

5. GUIDING PRINCIPLES OF DATA PROTECTION

UBICCA’s Data Processing Policy complies with all the guiding principles contemplated in Statutory Law 1581 of 2012, among which are:

    1. Principle of legality in data processing. The processing referred to in Statutory Law 1581 of 2012 and its Regulatory Decree is a regulated activity that must be subject to the provisions of the Law and other provisions that develop it.
    2. Principle of purpose. The processing must be for a legitimate purpose in accordance with the Constitution and the law, which must be communicated to the data subject.
    3. Principle of freedom. Processing may only be carried out with the prior, express and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate that waives consent.
    4. Principle of truthfulness or quality. The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable and understandable. The processing of partial, incomplete, fractional or misleading data is prohibited.
    5. Principle of transparency. The processing of personal data must guarantee the right of the data subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of personal data concerning him or her.
    6. Principle of restricted access and circulation. Processing is subject to the limits arising from the nature of the personal data, the provisions of Statutory Law 1581 and the Constitution. In this regard, processing may only be carried out by persons authorized by the owner and/or by the persons provided for in this Law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the owners or authorized third parties.
    7. Security principle. The information subject to processing by the Data Controller or Data Processor must be handled with the necessary technical, human and administrative measures to ensure the security of the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access.
    8. Confidentiality principle. Persons involved in the processing of personal data that are not public in nature are obliged to ensure the confidentiality of the information, even after their relationship with any of the tasks that comprise the processing has ended, and may only provide or communicate personal data when this corresponds to the development of authorized activities.

6. AUTHORIZATION

Each personal data that is going to be used by UBICCA must have an authorization and the same must be obtained from the Client or person belonging to INTEREST GROUPS in advance and at the latest at the time of the collection of personal data, either orally, in writing or through unequivocal conduct of the Client or person belonging to INTEREST GROUPS of the data that allows to reasonably conclude that they granted the authorization. However, in no case the silence of the data owner in relation to the authorization may be assimilated to unequivocal conduct. At the time of requesting the authorization, the Client or person belonging to INTEREST GROUPS must be informed:

    1. The processing to which your personal data will be subjected and the purpose thereof;
    2. The optional nature of the response to the questions asked, when these relate to sensitive data or the data of girls, boys and adolescents;
    3. The rights that assist you as a Client or person belonging to INTEREST GROUPS;
    4. The identification, physical or electronic address and telephone number of the Data Controller.
    5. The authorization of the Client or person belonging to INTEREST GROUPS will not be necessary when it concerns:
    6. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
    7. Data of a public nature.
    8. Cases of medical or health emergencies.
    9. Processing of information authorized by law for historical, statistical or scientific purposes.
    10. Data related to the Civil Registry of Persons.

Under the authorization granted, UBICCA will collect from Clients and members of the INTEREST GROUPS information regarding their Personal Data: (i) Type of identity document; (ii) Identity document number; (iii) First and last names; (iv) Address 1; (v) Office telephone; (vi) Home telephone; (vii) Cell phone; (viii) Email address; (ix) City; (x) Department and (xi) Country.

7. PURPOSES OF PROCESSING PERSONAL DATA

The Personal Data of Clients and members of INTEREST GROUPS are collected by UBICCA in the development of its corporate purpose, for the purposes of:

    1. Provide information on products and/or services, whether owned or on behalf of others, on the construction, management, promotion, sale and administration of real estate projects, promotion of urban development or subdivision businesses, among others.
    2. Evaluate the quality of UBICCA’s products or services.
    3. Manage the correct provision of UBICCA services.
    4. Conduct advertising and marketing campaigns to offer own or third-party products or services.
    5. Process orders, requests or any type of petition made by users through the communication channels provided for this purpose.
    6. Send newsletters.
    7. Prepare statistical studies.
    8. Advance commercial agreements, events or institutional programs directly or in association with third parties.
    9. Data verification through consultation of public databases or risk centers.
    10. Comply with legal obligations to provide information to administrative entities, as well as to the competent authorities that so require.
    11. Sharing with third parties that collaborate with UBICCA and that, in order to perform their functions, must access the information to some extent, such as messaging service providers, advertising agencies, call centers and collection agencies. It is specified at this point that these third parties are obliged to maintain the confidentiality of the information to which they have access, all of which is regulated by confidentiality agreements signed with them.
    12. Execute the contracts signed by UBICCA.
    13. Support UBICCA audit processes.
    14. Enter into agreements with third parties.
    15. Occasional sending of commercial and advertising communications by any of the means listed below, such as email, SMS, MMS, social networks or any other electronic or physical means known, now or in the future, that makes it possible to carry out commercial and/or advertising communications. These commercial communications will refer to products or services offered by UBICCA or its commercial and/or strategic partners with whom a commercial promotion agreement is entered into between its clients.
    16. Any other purpose that may result in the development of the contract or the commercial relationship between UBICCA and the Client or members of the INTEREST GROUPS.
    17. The information provided by the Client or members of the INTEREST GROUPS will only be used for the purposes stated herein and once the need for the Processing of Personal Data ceases, they may be eliminated from UBICCA’s databases or archived in secure terms so as to only be disclosed when required by law.

8. DUTIES OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

Pursuant to art. 17 of Statutory Law 1581 of 2012, the Data Controller shall have the following duties, without prejudice to the other provisions set forth in this law and in other laws that govern its activity:

    1. Guarantee the Client or members of INTEREST GROUPS at all times the full and effective exercise of the right to habeas data.
    2. Request and retain, under the conditions provided by law, a copy of the respective authorization granted by the Client or members of the INTEREST GROUPS.
    3. Properly inform the Client or members of the INTEREST GROUPS about the purpose of the collection and the rights that they have by virtue of the authorization granted.
    4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
    5. Ensure that the information provided to the Data Processor is true, complete, accurate, up-to-date, verifiable and understandable.
    6. Update the information, communicating in a timely manner to the Data Processor all new developments regarding the data previously provided and adopting the other measures necessary to ensure that the information provided to the Data Processor remains up to date.
    7. Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.
    8. Provide the Data Processor, as the case may be, only with data whose processing has been previously authorized in accordance with the provisions of the law.
    9. Demand that the Data Processor at all times respect the security and privacy conditions of the information of the Client or members of the INTEREST GROUPS.
    10. Process queries and complaints made under the terms set out in the law.
    11. Adopt an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, to address queries and complaints.
    12. Inform the Data Processor when certain information is being discussed by the Client or members of the INTEREST GROUPS, once the claim has been submitted and the respective process has not been completed.
    13. Inform, upon request of the Client or members of the INTEREST GROUPS, about the use given to their data.
    14. Inform the data protection authority when security code violations occur and there are risks in the management of the information of the Client or members of INTEREST GROUPS.
    15. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

9. RIGHTS OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

For the protection of personal data of Clients and members of INTEREST GROUPS, they will have the following rights:

    1. Know and access your Personal Data that has been processed by UBICCA, in addition to exercising the right to know the origin of your data and whether or not it has been transferred to third parties and, therefore, the identification of the assignees.
    2. Update your Personal Data that has been processed by UBICCA.
    3. Be informed, upon request, regarding the use that has been given to your Personal Data.
    4. Verify the accuracy and truthfulness of the information with the Data Controller and request rectification of the personal data collected when it is inaccurate, incomplete or leads to errors. The owners of the information must indicate the data they request to be corrected and also provide the documentation justifying the request.
    5. Oppose and cancel your authorization for the Processing of your Personal Data, when the processing of the same has not respected the principles established in Statutory Law 1581 of 2012 or its regulations. The owner of the personal information must indicate the data that must be cancelled or rectified, providing, if applicable, the documentation or evidence that justifies it. The cancellation will result in the blocking of your data, which will be kept by the Data Controller for the sole purpose of making them accessible to administrative or judicial authorities, always obeying the limitation period that exists on them. Once this period has elapsed, the Data Controller must proceed to the definitive cancellation of the personal information of the interested party or affected party, which is stored in our databases or files. Likewise, the owner of the personal information may request the deletion or cancellation of their personal data when the processing of the same by the controller or person in charge is excessive or even inadequate. The data of the holders of the information will be kept for the time periods provided for in the applicable regulations and/or, depending on the case, in the contractual relations between the holder of the personal information and the person responsible for the processing. In any case, the request for deletion of the information and the revocation of the authorization will not proceed when the holder has the legal or contractual obligation to remain in the database.
    6. Request proof of the authorization granted for the Processing of your Personal Data. These rights may be exercised directly by the owner of the information, his/her representative or his/her successor in title, as the case may be, provided that the appropriate document for such representation is presented, such as a signed and authorized special power of attorney.
    7. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Statutory Law 1581 of 2012 and other regulations that modify, add to or complement it.

10. CONSULTATION AND COMPLAINT PROCEDURES FOR KNOWLEDGE, UPDATE, RECTIFICATION, OPPOSITION AND CANCELLATION OF PERSONAL DATA OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:

    1. To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:
    2. Requirements for exercising the right to habeas data through a representative: This right may be exercised by the interested party duly identified or by the representative of the owner of the personal information (a copy of the power of attorney must be attached to the request). If the request is submitted by a person who is not the owner of the personal information, without complying with the presentation of the appropriate document that supports the representation, it must be considered as not presented and no response will be given to said request. Minors must exercise their right to habeas data through someone who proves their legal representation.
    3. Inquiries: The Client or members of INTEREST GROUPS who are the owners of the Personal Data and wish to make inquiries, must take into account that UBICCA, as the party responsible for or in charge of the Processing of the Personal Data, must provide said persons with all the information contained in the individual record or that is linked to the identification of the owner. The inquiry will be made through the enabled means and will be attended to within a maximum term of ten (10) business days counted from the date of receipt of the request. When it is not possible to attend to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which his inquiry will be attended to, which in no case may exceed five (5) business days following the expiration of the first term, without prejudice to the provisions contained in special laws or regulations issued by the National Government that may establish shorter terms, taking into account the nature of the personal data.
    4. Claims: The Client or member of INTEREST GROUPS who owns the Personal Data and considers that the information contained in a UBICCA database should be corrected, updated or deleted, or when he or she notices the alleged non-compliance of any of the duties contained in Statutory Law 1581 or its regulations, may file a claim with UBICCA, which will be processed under the following rules:
      a. The claim must be made by means of a request addressed to the Data Controller, with the identification of the owner, the description of the facts that give rise to the claim and the physical and email address, accompanied by the relevant documents on which the claim is based.
      b. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. If two months have passed from the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn.
      c. If the person receiving the complaint is not competent to resolve it, he or she will forward it to the appropriate party within a maximum period of two business days and will inform the interested party of the situation.
      d. Once the complete claim has been received, within a period of no more than two (2) business days, a legend stating “claim in process” and the reason for it will be included in the database. This legend must be maintained until the claim is decided.
      e. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
    5. Applicability: Clients or members of INTEREST GROUPS who are the owners of the Personal Data and wish to exercise any of the rights mentioned in this document may do so by written communication to the entity responsible for the Processing of their personal information, accompanying said request with their signature and a copy of their personal identification or similar analogous document.
    6. Inadmissibility of deletion of Personal Data: The deletion of Personal Data may not be carried out by UBICCA when the maintenance of said Personal Data is a legal or contractual obligation, when keeping the Personal Data is essential to safeguard the interests of the applicant who owns said Personal Data or is of public interest, or when the deletion hinders or impedes the exercise of the functions of the national administrative or judicial authorities.
    7. Revocation of Authorization: When requesting revocation of the Authorization, the interested party must inform UBICCA precisely whether the revocation is total or partial. Revocation of the Authorization is partial when the interested party states that he or she wishes to revoke the Processing of his or her Personal Data for certain specific purposes such as advertising, competitions, consumer studies, etc. Revocation of the Authorization will be total when it is requested that the Processing of Personal Data be stopped for all authorized purposes.
    8. Revocation of Authorization: Clients or members of INTEREST GROUPS who own the Personal Data may file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim procedure provided for in this document.

11. VALIDITY OF THE PERSONAL DATA POLICY

This UBICCA Personal Data Processing Policy is effective from the date of its publication.

This Policy may be modified by UBICCA at any time, in order to adapt it to any legislative or jurisprudential changes that may occur, as well as to best practices that may be developed on the subject, in which case the Client or members of INTEREST GROUPS will be promptly informed.

Any modification or update of this Policy will be notified through the UBICCA website, where the latest version of said Policy will be made available to the Client or members of INTEREST GROUPS, indicating the date of entry into force of the corresponding modification or update, as the case may be.

The use or acquisition of the products or services offered by UBICCA, by the Client or members of INTEREST GROUPS or their failure to disassociate themselves from them, after the new Policy is made available, constitutes acceptance of the same.

The Personal Data or databases subject to Processing will be valid for the contractual term that the Client or members of INTEREST GROUPS have entered into with UBICCA for the product or service, plus the term established by law.

    1. Authorization: Prior, express and informed consent of the Client or subject included in the INTEREST GROUPS to carry out the Processing of Personal Data.
    2. Database: an organized set of personal data that is the subject of processing of clients, associates, employees, regardless of the form or modality of its creation, storage, organization and access.
    3. Clients: individuals or legal entities interested in the purchase, sale or rental of real estate and/or construction projects.
    4. Consent: any manifestation of will, free, express, unequivocal and informed, by which the Client or subject included in the INTEREST GROUPS accepts the Processing of Personal Data that concerns him/her.
    5. Personal Data: any information linked to or that may be associated with one or more specific or identifiable natural persons included in the INTEREST GROUPS, numerical, alphabetical, graphic, photographic, acoustic or any other type of information concerning identified and identifiable natural persons included in the INTEREST GROUPS.
    6. Data Processor: natural or legal person, public or private, who by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller.
    7. Real Estate Management: legal and administrative procedures for real estate on behalf of a third party or directly by the owner. Real estate management can include property purchase and sale transactions.
    8. Habeas Data: is the right that every owner of information has to know, update, rectify or oppose information concerning his or her personal data.
    9. Processing: set of automated or non-automated technical operations or procedures that allow the collection, recording, storage, processing, modification, consultation, use, modification, cancellation, blocking or deletion.
    10. Data Controller: natural or legal person, public or private, who by itself or in association with others, decides on the purpose, content and use of the Processing of Personal Data.

3. SCOPE OF APPLICATION

The Personal Data Processing Policy contained in this document and the procedures for handling claims from information holders shall be applied to all personal data recorded on physical or digital media that may be processed by UBICCA as the party responsible for said data. The personal data protection regime established in this document shall not apply to the databases or files indicated in article 2 of Law 1581 of 2012.

4. SPECIAL REQUIREMENTS FOR THE PROCESSING OF CERTAIN PERSONAL DATA

    1. Personal data of children and adolescents:
    2. The processing of personal data of minors or adolescents by UBICCA will always be carried out in compliance with the following requirements:
    3. Always respond to and respect the best interests of children and adolescents.
    4. Always ensure that the person responsible respects your fundamental rights.
    5. That, to the extent possible, said treatment is carried out taking into account the opinion of the minors who are the owners of the personal information, considering the following factors:
      a. Maturity
      b. Autonomy
      c. Ability to understand the purpose of said treatment
      d. Explain the consequences that the treatment entails
    6. Any person responsible, in charge or third party involved in the Processing of Personal Data of minors must always ensure the appropriate use of this type of data.
    7. Sensitive Personal Data established in Law 1581 of 2012.
    8. UBICCA identifies the sensitive data that may be collected or stored, with the aim of:
    9. Implement special attention and reinforce its responsibility regarding the processing of this type of data, which translates into greater demands in terms of compliance with the principles and duties established by current regulations on data protection.
    10. Establish the technical, legal and administrative security levels to handle this information appropriately.
    11. Increase access and use restrictions by UBICCA staff and third parties.

5. GUIDING PRINCIPLES OF DATA PROTECTION

UBICCA’s Data Processing Policy complies with all the guiding principles contemplated in Statutory Law 1581 of 2012, among which are:

    1. Principle of legality in data processing. The processing referred to in Statutory Law 1581 of 2012 and its Regulatory Decree is a regulated activity that must be subject to the provisions of the Law and other provisions that develop it.
    2. Principle of purpose. The processing must be for a legitimate purpose in accordance with the Constitution and the law, which must be communicated to the data subject.
    3. Principle of freedom. Processing may only be carried out with the prior, express and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate that waives consent.
    4. Principle of truthfulness or quality. The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable and understandable. The processing of partial, incomplete, fractional or misleading data is prohibited.
    5. Principle of transparency. The processing of personal data must guarantee the right of the data subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of personal data concerning him or her.
    6. Principle of restricted access and circulation. Processing is subject to the limits arising from the nature of the personal data, the provisions of Statutory Law 1581 and the Constitution. In this regard, processing may only be carried out by persons authorized by the owner and/or by the persons provided for in this Law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the owners or authorized third parties.
    7. Security principle. The information subject to processing by the Data Controller or Data Processor must be handled with the necessary technical, human and administrative measures to ensure the security of the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access.
    8. Confidentiality principle. Persons involved in the processing of personal data that are not public in nature are obliged to ensure the confidentiality of the information, even after their relationship with any of the tasks that comprise the processing has ended, and may only provide or communicate personal data when this corresponds to the development of authorized activities.

6. AUTHORIZATION

Each personal data that is going to be used by UBICCA must have an authorization and the same must be obtained from the Client or person belonging to INTEREST GROUPS in advance and at the latest at the time of the collection of personal data, either orally, in writing or through unequivocal conduct of the Client or person belonging to INTEREST GROUPS of the data that allows to reasonably conclude that they granted the authorization. However, in no case the silence of the data owner in relation to the authorization may be assimilated to unequivocal conduct. At the time of requesting the authorization, the Client or person belonging to INTEREST GROUPS must be informed:

    1. The processing to which your personal data will be subjected and the purpose thereof;
    2. The optional nature of the response to the questions asked, when these relate to sensitive data or the data of girls, boys and adolescents;
    3. The rights that assist you as a Client or person belonging to INTEREST GROUPS;
    4. The identification, physical or electronic address and telephone number of the Data Controller.
    5. The authorization of the Client or person belonging to INTEREST GROUPS will not be necessary when it concerns:
    6. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
    7. Data of a public nature.
    8. Cases of medical or health emergencies.
    9. Processing of information authorized by law for historical, statistical or scientific purposes.
    10. Data related to the Civil Registry of Persons.

Under the authorization granted, UBICCA will collect from Clients and members of the INTEREST GROUPS information regarding their Personal Data: (i) Type of identity document; (ii) Identity document number; (iii) First and last names; (iv) Address 1; (v) Office telephone; (vi) Home telephone; (vii) Cell phone; (viii) Email address; (ix) City; (x) Department and (xi) Country.

7. PURPOSES OF PROCESSING PERSONAL DATA

The Personal Data of Clients and members of INTEREST GROUPS are collected by UBICCA in the development of its corporate purpose, for the purposes of:

    1. Provide information on products and/or services, whether owned or on behalf of others, on the construction, management, promotion, sale and administration of real estate projects, promotion of urban development or subdivision businesses, among others.
    2. Evaluate the quality of UBICCA’s products or services.
    3. Manage the correct provision of UBICCA services.
    4. Conduct advertising and marketing campaigns to offer own or third-party products or services.
    5. Process orders, requests or any type of petition made by users through the communication channels provided for this purpose.
    6. Send newsletters.
    7. Prepare statistical studies.
    8. Advance commercial agreements, events or institutional programs directly or in association with third parties.
    9. Data verification through consultation of public databases or risk centers.
    10. Comply with legal obligations to provide information to administrative entities, as well as to the competent authorities that so require.
    11. Sharing with third parties that collaborate with UBICCA and that, in order to perform their functions, must access the information to some extent, such as messaging service providers, advertising agencies, call centers and collection agencies. It is specified at this point that these third parties are obliged to maintain the confidentiality of the information to which they have access, all of which is regulated by confidentiality agreements signed with them.
    12. Execute the contracts signed by UBICCA.
    13. Support UBICCA audit processes.
    14. Enter into agreements with third parties.
    15. Occasional sending of commercial and advertising communications by any of the means listed below, such as email, SMS, MMS, social networks or any other electronic or physical means known, now or in the future, that makes it possible to carry out commercial and/or advertising communications. These commercial communications will refer to products or services offered by UBICCA or its commercial and/or strategic partners with whom a commercial promotion agreement is entered into between its clients.
    16. Any other purpose that may result in the development of the contract or the commercial relationship between UBICCA and the Client or members of the INTEREST GROUPS.
    17. The information provided by the Client or members of the INTEREST GROUPS will only be used for the purposes stated herein and once the need for the Processing of Personal Data ceases, they may be eliminated from UBICCA’s databases or archived in secure terms so as to only be disclosed when required by law.

8. DUTIES OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

Pursuant to art. 17 of Statutory Law 1581 of 2012, the Data Controller shall have the following duties, without prejudice to the other provisions set forth in this law and in other laws that govern its activity:

    1. Guarantee the Client or members of INTEREST GROUPS at all times the full and effective exercise of the right to habeas data.
    2. Request and retain, under the conditions provided by law, a copy of the respective authorization granted by the Client or members of the INTEREST GROUPS.
    3. Properly inform the Client or members of the INTEREST GROUPS about the purpose of the collection and the rights that they have by virtue of the authorization granted.
    4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
    5. Ensure that the information provided to the Data Processor is true, complete, accurate, up-to-date, verifiable and understandable.
    6. Update the information, communicating in a timely manner to the Data Processor all new developments regarding the data previously provided and adopting the other measures necessary to ensure that the information provided to the Data Processor remains up to date.
    7. Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.
    8. Provide the Data Processor, as the case may be, only with data whose processing has been previously authorized in accordance with the provisions of the law.
    9. Demand that the Data Processor at all times respect the security and privacy conditions of the information of the Client or members of the INTEREST GROUPS.
    10. Process queries and complaints made under the terms set out in the law.
    11. Adopt an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, to address queries and complaints.
    12. Inform the Data Processor when certain information is being discussed by the Client or members of the INTEREST GROUPS, once the claim has been submitted and the respective process has not been completed.
    13. Inform, upon request of the Client or members of the INTEREST GROUPS, about the use given to their data.
    14. Inform the data protection authority when security code violations occur and there are risks in the management of the information of the Client or members of INTEREST GROUPS.
    15. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

9. RIGHTS OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

For the protection of personal data of Clients and members of INTEREST GROUPS, they will have the following rights:

    1. Know and access your Personal Data that has been processed by UBICCA, in addition to exercising the right to know the origin of your data and whether or not it has been transferred to third parties and, therefore, the identification of the assignees.
    2. Update your Personal Data that has been processed by UBICCA.
    3. Be informed, upon request, regarding the use that has been given to your Personal Data.
    4. Verify the accuracy and truthfulness of the information with the Data Controller and request rectification of the personal data collected when it is inaccurate, incomplete or leads to errors. The owners of the information must indicate the data they request to be corrected and also provide the documentation justifying the request.
    5. Oppose and cancel your authorization for the Processing of your Personal Data, when the processing of the same has not respected the principles established in Statutory Law 1581 of 2012 or its regulations. The owner of the personal information must indicate the data that must be cancelled or rectified, providing, if applicable, the documentation or evidence that justifies it. The cancellation will result in the blocking of your data, which will be kept by the Data Controller for the sole purpose of making them accessible to administrative or judicial authorities, always obeying the limitation period that exists on them. Once this period has elapsed, the Data Controller must proceed to the definitive cancellation of the personal information of the interested party or affected party, which is stored in our databases or files. Likewise, the owner of the personal information may request the deletion or cancellation of their personal data when the processing of the same by the controller or person in charge is excessive or even inadequate. The data of the holders of the information will be kept for the time periods provided for in the applicable regulations and/or, depending on the case, in the contractual relations between the holder of the personal information and the person responsible for the processing. In any case, the request for deletion of the information and the revocation of the authorization will not proceed when the holder has the legal or contractual obligation to remain in the database.
    6. Request proof of the authorization granted for the Processing of your Personal Data. These rights may be exercised directly by the owner of the information, his/her representative or his/her successor in title, as the case may be, provided that the appropriate document for such representation is presented, such as a signed and authorized special power of attorney.
    7. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Statutory Law 1581 of 2012 and other regulations that modify, add to or complement it.

10. CONSULTATION AND COMPLAINT PROCEDURES FOR KNOWLEDGE, UPDATE, RECTIFICATION, OPPOSITION AND CANCELLATION OF PERSONAL DATA OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:

    1. To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:
    2. Requirements for exercising the right to habeas data through a representative: This right may be exercised by the interested party duly identified or by the representative of the owner of the personal information (a copy of the power of attorney must be attached to the request). If the request is submitted by a person who is not the owner of the personal information, without complying with the presentation of the appropriate document that supports the representation, it must be considered as not presented and no response will be given to said request. Minors must exercise their right to habeas data through someone who proves their legal representation.
    3. Inquiries: The Client or members of INTEREST GROUPS who are the owners of the Personal Data and wish to make inquiries, must take into account that UBICCA, as the party responsible for or in charge of the Processing of the Personal Data, must provide said persons with all the information contained in the individual record or that is linked to the identification of the owner. The inquiry will be made through the enabled means and will be attended to within a maximum term of ten (10) business days counted from the date of receipt of the request. When it is not possible to attend to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which his inquiry will be attended to, which in no case may exceed five (5) business days following the expiration of the first term, without prejudice to the provisions contained in special laws or regulations issued by the National Government that may establish shorter terms, taking into account the nature of the personal data.
    4. Claims: The Client or member of INTEREST GROUPS who owns the Personal Data and considers that the information contained in a UBICCA database should be corrected, updated or deleted, or when he or she notices the alleged non-compliance of any of the duties contained in Statutory Law 1581 or its regulations, may file a claim with UBICCA, which will be processed under the following rules:
      a. The claim must be made by means of a request addressed to the Data Controller, with the identification of the owner, the description of the facts that give rise to the claim and the physical and email address, accompanied by the relevant documents on which the claim is based.
      b. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. If two months have passed from the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn.
      c. If the person receiving the complaint is not competent to resolve it, he or she will forward it to the appropriate party within a maximum period of two business days and will inform the interested party of the situation.
      d. Once the complete claim has been received, within a period of no more than two (2) business days, a legend stating “claim in process” and the reason for it will be included in the database. This legend must be maintained until the claim is decided.
      e. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
    5. Applicability: Clients or members of INTEREST GROUPS who are the owners of the Personal Data and wish to exercise any of the rights mentioned in this document may do so by written communication to the entity responsible for the Processing of their personal information, accompanying said request with their signature and a copy of their personal identification or similar analogous document.
    6. Inadmissibility of deletion of Personal Data: The deletion of Personal Data may not be carried out by UBICCA when the maintenance of said Personal Data is a legal or contractual obligation, when keeping the Personal Data is essential to safeguard the interests of the applicant who owns said Personal Data or is of public interest, or when the deletion hinders or impedes the exercise of the functions of the national administrative or judicial authorities.
    7. Revocation of Authorization: When requesting revocation of the Authorization, the interested party must inform UBICCA precisely whether the revocation is total or partial. Revocation of the Authorization is partial when the interested party states that he or she wishes to revoke the Processing of his or her Personal Data for certain specific purposes such as advertising, competitions, consumer studies, etc. Revocation of the Authorization will be total when it is requested that the Processing of Personal Data be stopped for all authorized purposes.
    8. Revocation of Authorization: Clients or members of INTEREST GROUPS who own the Personal Data may file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim procedure provided for in this document.

11. VALIDITY OF THE PERSONAL DATA POLICY

This UBICCA Personal Data Processing Policy is effective from the date of its publication.

This Policy may be modified by UBICCA at any time, in order to adapt it to any legislative or jurisprudential changes that may occur, as well as to best practices that may be developed on the subject, in which case the Client or members of INTEREST GROUPS will be promptly informed.

Any modification or update of this Policy will be notified through the UBICCA website, where the latest version of said Policy will be made available to the Client or members of INTEREST GROUPS, indicating the date of entry into force of the corresponding modification or update, as the case may be.

The use or acquisition of the products or services offered by UBICCA, by the Client or members of INTEREST GROUPS or their failure to disassociate themselves from them, after the new Policy is made available, constitutes acceptance of the same.

The Personal Data or databases subject to Processing will be valid for the contractual term that the Client or members of INTEREST GROUPS have entered into with UBICCA for the product or service, plus the term established by law.

2. DEFINICIONES

The following definitions are terms that are enshrined in Law 1581 of 2012 and that must be taken into account in order to understand this Data Processing Policy:

    1. Authorization: Prior, express and informed consent of the Client or subject included in the INTEREST GROUPS to carry out the Processing of Personal Data.
    2. Database: an organized set of personal data that is the subject of processing of clients, associates, employees, regardless of the form or modality of its creation, storage, organization and access.
    3. Clients: individuals or legal entities interested in the purchase, sale or rental of real estate and/or construction projects.
    4. Consent: any manifestation of will, free, express, unequivocal and informed, by which the Client or subject included in the INTEREST GROUPS accepts the Processing of Personal Data that concerns him/her.
    5. Personal Data: any information linked to or that may be associated with one or more specific or identifiable natural persons included in the INTEREST GROUPS, numerical, alphabetical, graphic, photographic, acoustic or any other type of information concerning identified and identifiable natural persons included in the INTEREST GROUPS.
    6. Data Processor: natural or legal person, public or private, who by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller.
    7. Real Estate Management: legal and administrative procedures for real estate on behalf of a third party or directly by the owner. Real estate management can include property purchase and sale transactions.
    8. Habeas Data: is the right that every owner of information has to know, update, rectify or oppose information concerning his or her personal data.
    9. Processing: set of automated or non-automated technical operations or procedures that allow the collection, recording, storage, processing, modification, consultation, use, modification, cancellation, blocking or deletion.
    10. Data Controller: natural or legal person, public or private, who by itself or in association with others, decides on the purpose, content and use of the Processing of Personal Data.

3. SCOPE OF APPLICATION

The Personal Data Processing Policy contained in this document and the procedures for handling claims from information holders shall be applied to all personal data recorded on physical or digital media that may be processed by UBICCA as the party responsible for said data. The personal data protection regime established in this document shall not apply to the databases or files indicated in article 2 of Law 1581 of 2012.

4. SPECIAL REQUIREMENTS FOR THE PROCESSING OF CERTAIN PERSONAL DATA

    1. Personal data of children and adolescents:
    2. The processing of personal data of minors or adolescents by UBICCA will always be carried out in compliance with the following requirements:
    3. Always respond to and respect the best interests of children and adolescents.
    4. Always ensure that the person responsible respects your fundamental rights.
    5. That, to the extent possible, said treatment is carried out taking into account the opinion of the minors who are the owners of the personal information, considering the following factors:
      a. Maturity
      b. Autonomy
      c. Ability to understand the purpose of said treatment
      d. Explain the consequences that the treatment entails
    6. Any person responsible, in charge or third party involved in the Processing of Personal Data of minors must always ensure the appropriate use of this type of data.
    7. Sensitive Personal Data established in Law 1581 of 2012.
    8. UBICCA identifies the sensitive data that may be collected or stored, with the aim of:
    9. Implement special attention and reinforce its responsibility regarding the processing of this type of data, which translates into greater demands in terms of compliance with the principles and duties established by current regulations on data protection.
    10. Establish the technical, legal and administrative security levels to handle this information appropriately.
    11. Increase access and use restrictions by UBICCA staff and third parties.

5. GUIDING PRINCIPLES OF DATA PROTECTION

UBICCA’s Data Processing Policy complies with all the guiding principles contemplated in Statutory Law 1581 of 2012, among which are:

    1. Principle of legality in data processing. The processing referred to in Statutory Law 1581 of 2012 and its Regulatory Decree is a regulated activity that must be subject to the provisions of the Law and other provisions that develop it.
    2. Principle of purpose. The processing must be for a legitimate purpose in accordance with the Constitution and the law, which must be communicated to the data subject.
    3. Principle of freedom. Processing may only be carried out with the prior, express and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate that waives consent.
    4. Principle of truthfulness or quality. The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable and understandable. The processing of partial, incomplete, fractional or misleading data is prohibited.
    5. Principle of transparency. The processing of personal data must guarantee the right of the data subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of personal data concerning him or her.
    6. Principle of restricted access and circulation. Processing is subject to the limits arising from the nature of the personal data, the provisions of Statutory Law 1581 and the Constitution. In this regard, processing may only be carried out by persons authorized by the owner and/or by the persons provided for in this Law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the owners or authorized third parties.
    7. Security principle. The information subject to processing by the Data Controller or Data Processor must be handled with the necessary technical, human and administrative measures to ensure the security of the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access.
    8. Confidentiality principle. Persons involved in the processing of personal data that are not public in nature are obliged to ensure the confidentiality of the information, even after their relationship with any of the tasks that comprise the processing has ended, and may only provide or communicate personal data when this corresponds to the development of authorized activities.

6. AUTHORIZATION

Each personal data that is going to be used by UBICCA must have an authorization and the same must be obtained from the Client or person belonging to INTEREST GROUPS in advance and at the latest at the time of the collection of personal data, either orally, in writing or through unequivocal conduct of the Client or person belonging to INTEREST GROUPS of the data that allows to reasonably conclude that they granted the authorization. However, in no case the silence of the data owner in relation to the authorization may be assimilated to unequivocal conduct. At the time of requesting the authorization, the Client or person belonging to INTEREST GROUPS must be informed:

    1. The processing to which your personal data will be subjected and the purpose thereof;
    2. The optional nature of the response to the questions asked, when these relate to sensitive data or the data of girls, boys and adolescents;
    3. The rights that assist you as a Client or person belonging to INTEREST GROUPS;
    4. The identification, physical or electronic address and telephone number of the Data Controller.
    5. The authorization of the Client or person belonging to INTEREST GROUPS will not be necessary when it concerns:
    6. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
    7. Data of a public nature.
    8. Cases of medical or health emergencies.
    9. Processing of information authorized by law for historical, statistical or scientific purposes.
    10. Data related to the Civil Registry of Persons.

Under the authorization granted, UBICCA will collect from Clients and members of the INTEREST GROUPS information regarding their Personal Data: (i) Type of identity document; (ii) Identity document number; (iii) First and last names; (iv) Address 1; (v) Office telephone; (vi) Home telephone; (vii) Cell phone; (viii) Email address; (ix) City; (x) Department and (xi) Country.

7. PURPOSES OF PROCESSING PERSONAL DATA

The Personal Data of Clients and members of INTEREST GROUPS are collected by UBICCA in the development of its corporate purpose, for the purposes of:

    1. Provide information on products and/or services, whether owned or on behalf of others, on the construction, management, promotion, sale and administration of real estate projects, promotion of urban development or subdivision businesses, among others.
    2. Evaluate the quality of UBICCA’s products or services.
    3. Manage the correct provision of UBICCA services.
    4. Conduct advertising and marketing campaigns to offer own or third-party products or services.
    5. Process orders, requests or any type of petition made by users through the communication channels provided for this purpose.
    6. Send newsletters.
    7. Prepare statistical studies.
    8. Advance commercial agreements, events or institutional programs directly or in association with third parties.
    9. Data verification through consultation of public databases or risk centers.
    10. Comply with legal obligations to provide information to administrative entities, as well as to the competent authorities that so require.
    11. Sharing with third parties that collaborate with UBICCA and that, in order to perform their functions, must access the information to some extent, such as messaging service providers, advertising agencies, call centers and collection agencies. It is specified at this point that these third parties are obliged to maintain the confidentiality of the information to which they have access, all of which is regulated by confidentiality agreements signed with them.
    12. Execute the contracts signed by UBICCA.
    13. Support UBICCA audit processes.
    14. Enter into agreements with third parties.
    15. Occasional sending of commercial and advertising communications by any of the means listed below, such as email, SMS, MMS, social networks or any other electronic or physical means known, now or in the future, that makes it possible to carry out commercial and/or advertising communications. These commercial communications will refer to products or services offered by UBICCA or its commercial and/or strategic partners with whom a commercial promotion agreement is entered into between its clients.
    16. Any other purpose that may result in the development of the contract or the commercial relationship between UBICCA and the Client or members of the INTEREST GROUPS.
    17. The information provided by the Client or members of the INTEREST GROUPS will only be used for the purposes stated herein and once the need for the Processing of Personal Data ceases, they may be eliminated from UBICCA’s databases or archived in secure terms so as to only be disclosed when required by law.

8. DUTIES OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

Pursuant to art. 17 of Statutory Law 1581 of 2012, the Data Controller shall have the following duties, without prejudice to the other provisions set forth in this law and in other laws that govern its activity:

    1. Guarantee the Client or members of INTEREST GROUPS at all times the full and effective exercise of the right to habeas data.
    2. Request and retain, under the conditions provided by law, a copy of the respective authorization granted by the Client or members of the INTEREST GROUPS.
    3. Properly inform the Client or members of the INTEREST GROUPS about the purpose of the collection and the rights that they have by virtue of the authorization granted.
    4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
    5. Ensure that the information provided to the Data Processor is true, complete, accurate, up-to-date, verifiable and understandable.
    6. Update the information, communicating in a timely manner to the Data Processor all new developments regarding the data previously provided and adopting the other measures necessary to ensure that the information provided to the Data Processor remains up to date.
    7. Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.
    8. Provide the Data Processor, as the case may be, only with data whose processing has been previously authorized in accordance with the provisions of the law.
    9. Demand that the Data Processor at all times respect the security and privacy conditions of the information of the Client or members of the INTEREST GROUPS.
    10. Process queries and complaints made under the terms set out in the law.
    11. Adopt an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, to address queries and complaints.
    12. Inform the Data Processor when certain information is being discussed by the Client or members of the INTEREST GROUPS, once the claim has been submitted and the respective process has not been completed.
    13. Inform, upon request of the Client or members of the INTEREST GROUPS, about the use given to their data.
    14. Inform the data protection authority when security code violations occur and there are risks in the management of the information of the Client or members of INTEREST GROUPS.
    15. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

9. RIGHTS OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

For the protection of personal data of Clients and members of INTEREST GROUPS, they will have the following rights:

    1. Know and access your Personal Data that has been processed by UBICCA, in addition to exercising the right to know the origin of your data and whether or not it has been transferred to third parties and, therefore, the identification of the assignees.
    2. Update your Personal Data that has been processed by UBICCA.
    3. Be informed, upon request, regarding the use that has been given to your Personal Data.
    4. Verify the accuracy and truthfulness of the information with the Data Controller and request rectification of the personal data collected when it is inaccurate, incomplete or leads to errors. The owners of the information must indicate the data they request to be corrected and also provide the documentation justifying the request.
    5. Oppose and cancel your authorization for the Processing of your Personal Data, when the processing of the same has not respected the principles established in Statutory Law 1581 of 2012 or its regulations. The owner of the personal information must indicate the data that must be cancelled or rectified, providing, if applicable, the documentation or evidence that justifies it. The cancellation will result in the blocking of your data, which will be kept by the Data Controller for the sole purpose of making them accessible to administrative or judicial authorities, always obeying the limitation period that exists on them. Once this period has elapsed, the Data Controller must proceed to the definitive cancellation of the personal information of the interested party or affected party, which is stored in our databases or files. Likewise, the owner of the personal information may request the deletion or cancellation of their personal data when the processing of the same by the controller or person in charge is excessive or even inadequate. The data of the holders of the information will be kept for the time periods provided for in the applicable regulations and/or, depending on the case, in the contractual relations between the holder of the personal information and the person responsible for the processing. In any case, the request for deletion of the information and the revocation of the authorization will not proceed when the holder has the legal or contractual obligation to remain in the database.
    6. Request proof of the authorization granted for the Processing of your Personal Data. These rights may be exercised directly by the owner of the information, his/her representative or his/her successor in title, as the case may be, provided that the appropriate document for such representation is presented, such as a signed and authorized special power of attorney.
    7. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Statutory Law 1581 of 2012 and other regulations that modify, add to or complement it.

10. CONSULTATION AND COMPLAINT PROCEDURES FOR KNOWLEDGE, UPDATE, RECTIFICATION, OPPOSITION AND CANCELLATION OF PERSONAL DATA OF THE CLIENT OR MEMBERS OF INTEREST GROUPS

To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:

    1. To exercise the rights mentioned in the ninth section of this document, the Client or members of INTEREST GROUPS who own the Personal Data may contact the main office of UBICCA located at kilometer seventeen (17) via Las Palmas, Mall Indiana, Office No. 278. You may also make your request through the website www.ubicca.com.co or by email at medios.digitales@ubicca.com.co, always being necessary to fill out the form provided by UBICCA for such purposes and to carry out the procedure in accordance with the following provisions for the exercise of the respective right:
    2. Requirements for exercising the right to habeas data through a representative: This right may be exercised by the interested party duly identified or by the representative of the owner of the personal information (a copy of the power of attorney must be attached to the request). If the request is submitted by a person who is not the owner of the personal information, without complying with the presentation of the appropriate document that supports the representation, it must be considered as not presented and no response will be given to said request. Minors must exercise their right to habeas data through someone who proves their legal representation.
    3. Inquiries: The Client or members of INTEREST GROUPS who are the owners of the Personal Data and wish to make inquiries, must take into account that UBICCA, as the party responsible for or in charge of the Processing of the Personal Data, must provide said persons with all the information contained in the individual record or that is linked to the identification of the owner. The inquiry will be made through the enabled means and will be attended to within a maximum term of ten (10) business days counted from the date of receipt of the request. When it is not possible to attend to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which his inquiry will be attended to, which in no case may exceed five (5) business days following the expiration of the first term, without prejudice to the provisions contained in special laws or regulations issued by the National Government that may establish shorter terms, taking into account the nature of the personal data.
    4. Claims: The Client or member of INTEREST GROUPS who owns the Personal Data and considers that the information contained in a UBICCA database should be corrected, updated or deleted, or when he or she notices the alleged non-compliance of any of the duties contained in Statutory Law 1581 or its regulations, may file a claim with UBICCA, which will be processed under the following rules:
      a. The claim must be made by means of a request addressed to the Data Controller, with the identification of the owner, the description of the facts that give rise to the claim and the physical and email address, accompanied by the relevant documents on which the claim is based.
      b. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. If two months have passed from the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn.
      c. If the person receiving the complaint is not competent to resolve it, he or she will forward it to the appropriate party within a maximum period of two business days and will inform the interested party of the situation.
      d. Once the complete claim has been received, within a period of no more than two (2) business days, a legend stating “claim in process” and the reason for it will be included in the database. This legend must be maintained until the claim is decided.
      e. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
    5. Applicability: Clients or members of INTEREST GROUPS who are the owners of the Personal Data and wish to exercise any of the rights mentioned in this document may do so by written communication to the entity responsible for the Processing of their personal information, accompanying said request with their signature and a copy of their personal identification or similar analogous document.
    6. Inadmissibility of deletion of Personal Data: The deletion of Personal Data may not be carried out by UBICCA when the maintenance of said Personal Data is a legal or contractual obligation, when keeping the Personal Data is essential to safeguard the interests of the applicant who owns said Personal Data or is of public interest, or when the deletion hinders or impedes the exercise of the functions of the national administrative or judicial authorities.
    7. Revocation of Authorization: When requesting revocation of the Authorization, the interested party must inform UBICCA precisely whether the revocation is total or partial. Revocation of the Authorization is partial when the interested party states that he or she wishes to revoke the Processing of his or her Personal Data for certain specific purposes such as advertising, competitions, consumer studies, etc. Revocation of the Authorization will be total when it is requested that the Processing of Personal Data be stopped for all authorized purposes.
    8. Revocation of Authorization: Clients or members of INTEREST GROUPS who own the Personal Data may file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim procedure provided for in this document.

11. VALIDITY OF THE PERSONAL DATA POLICY

This UBICCA Personal Data Processing Policy is effective from the date of its publication.

This Policy may be modified by UBICCA at any time, in order to adapt it to any legislative or jurisprudential changes that may occur, as well as to best practices that may be developed on the subject, in which case the Client or members of INTEREST GROUPS will be promptly informed.

Any modification or update of this Policy will be notified through the UBICCA website, where the latest version of said Policy will be made available to the Client or members of INTEREST GROUPS, indicating the date of entry into force of the corresponding modification or update, as the case may be.

The use or acquisition of the products or services offered by UBICCA, by the Client or members of INTEREST GROUPS or their failure to disassociate themselves from them, after the new Policy is made available, constitutes acceptance of the same.

The Personal Data or databases subject to Processing will be valid for the contractual term that the Client or members of INTEREST GROUPS have entered into with UBICCA for the product or service, plus the term established by law.