1. Responsible for Personal Data Processing: XIMENA DEL ROSARIO OCHOA OLIVARI AND MANUELA MEDINA OCHOA, representing the association in fact MEDIOS NARANJA SAS.

2. General Description: MEDIOS NARANJA SAS, in accordance with the provisions of the Political Constitution of Colombia, Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other complementary provisions, adopts the Personal Data Processing Policy, which shall be enforced by MEDIOS NARANJA SAS regarding the collection, storage, use, circulation, deletion and the different activities that constitute the processing of personal data (hereinafter "The Responsible").

3. Scope of Enforcement: This handbook shall be enforced to the processing of personal data collected, administered and handled by MEDIOS NARANJA SAS and belonging to its employees, clients, allies, suppliers, contractors’ employees and/or other third parties with whom they have any type of relationship in accordance with the provisions of Law 1581 of 2012 and Decree 1377 of 2013.

4. Definitions: To enforce the provisions of this Policy, it is understood as:

1. Authorization: Holder’s prior, express and informed consent to carry out the processing of personal data.
2. Privacy Notice: Verbal or written communication prepared by MEDIOS NARANJA SAS or any third party designated by the latter for personal data processing, addressed to the Holder for the processing of his/her personal data, through which she/he is informed about the existence of the data processing policies that shall be enforceable, the way to access them and the purposes for the processing that is intended to be given to personal data.
3. Personal Data: Any information linked to or that can be associated with one or more specific or determinable natural persons. For the purposes of MEDIOS NARANJA SAS, the following, but not limited to, shall be personal data: Name, last name, age, gender, marital status, email, correspondence address, identification number, date of birth, telephone number and profession.
4. Sensitive Data: It is understood to be that which affects Holder’s privacy or improper use of which may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership to unions, social and/or human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
5. Person in Charge of Personal Data Processing: Natural or legal person, public or private, that by itself or in association with others, performs the processing of personal data on behalf of the person responsible for this processing.
6. Responsible for Personal Data Processing: Natural or legal person, public or private, that by itself or in association with others, decides on database and/or data Processing.
7. Holder: Natural person whose personal data is subject to Processing.
8. Processing: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion.

5. Principles: MEDIOS NARANJA SAS shall define its personal data processing policy taking into account the following principles:

1. Principle of Purpose: Processing of personal data must follow a legitimate purpose in accordance with the Political Constitution of Colombia and Law, which must be informed to the Holder; 
2. Principle of Authorization: Processing of personal data can only be exercised with Holder’s prior, express and informed consent. Personal data cannot be obtained nor disclosed without prior authorization, nor in the absence of a legal or judicial mandate that supersedes consent;
3. Principle of Veracity or Quality: Personal data subject to processing must be truthful, complete, correct, updated, verifiable and understandable. It is prohibited the processing of partial, incomplete, fragmented or misleading data; 
4. Principle of Transparency: In personal data processing, it must be guaranteed Holder’s right to obtain, at any time and without restrictions, information about the existence of data that concerns him or her;
5. Principle of Access and Restricted Circulation: Personal Data, except for public information, cannot be available on the Internet or other means of disclosure or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties according to Law;
6. Principle of Security: Personal data subject to processing must be handled with technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access;
7. Principle of Confidentiality: All persons involved in Personal Data Processing are obliged to guarantee information confidentiality, even after the end of their relationship with any of the tasks that comprise the processing, being able to only supply or communicate personal data, when this corresponds to the development of activities expressly authorized by Law.

6. Purpose of Personal Data Processing and Collection: This handbook complies with the provisions of paragraph k) from article 17 of law 1581 of 2012, and article 13 of regulatory decree 1377 of 2013, which regulates the duties that those responsible and in charge of processing personal data have. The purpose for which MEDIOS NARANJA SAS collects, stores, uses, refine, analyzes, processes, circulates, transmits or directly or indirectly transfers Holder’s personal data, such as but not limited to: name, last names, age, sex, marital status , email, identification number, correspondence address, date of birth and profession, is for:

1. Promoting our services and products and those of our related companies, affiliates, subsidiaries and third-party commercial allies and their allies;
2. Carrying out brand advertising campaigns with people who register on the website.
3. Having a record of the people who sign up for the discounts offered by the web platform.
4. Executing the existing contractual relationship with clients, contractors, suppliers, users, employees and third parties.
5. Delivering or sending your personal data to related companies, third-party commercial allies and their allies that require the information for the purposes described herein.
6. Achieving efficient communication related to our products, services, studies, offers, as well as those of our linked stores, third-party commercial allies and their allies to facilitate general access to the information collected.
7. Sending through any means of communication, that is created or is going to be created, advertising and marketing information of its own, of its linked stores, commercial allies or their allies, the implementation of a global marketing strategy aimed at acts of promotion and advertising of our products, services, offers, promotions, invitations, discounts, prizes, loyalty programs, campaigns, raffles, among others.
8. Evaluating products and services quality, and in general for the updating of data and other marketing and administration activities necessary for the full development of our commercial objective, and that of our linked stores, third-party commercial allies or their allies.
9. Informing about new products or services that are related to the development of our commercial objective, and that of our linked stores, third-party commercial allies, or their allies; and
10. Conducting internal research on consumer habits.

Personal data supplied by The Holder will be processed and used only for the purposes set forth herein, and for a period counted from the time the authorization was granted until the period determined as effective term by MEDIOS NARANJA SAS. Similarly, the information provided by The Holder may be shared with agencies, information managers, service providers, business allies and their allies, and third parties in general that provide services to MEDIOS NARANJA SAS or to third parties on our behalf.

MEDIOS NARANJA SAS does not request nor process sensitive data.

‍MEDIOS NARANJA SAS guarantees that the mechanisms through which it makes use of personal data are safe and confidential, since they have computer security mechanisms and the appropriate technological means to ensure that they are stored in such a way that it is prevented unwanted access by third parties.

7. Authorization: The collection, storage, use, refining, analysis, transmission or transfer, circulation or deletion of Personal Data by MEDIOS NARANJA SAS always requires the Holder’s prior, express and informed consent. In compliance with current laws, MEDIOS NARANJA SAS has provided the following mechanisms to obtain authorization or ratification by Personal Data Holders:

1. Authorization may consist of a physical, electronic or any other document that guarantees its subsequent consultation, or through a suitable technical or technological mechanism through which it can be concluded that the Holder granted his/her authorization to store his/her data in our Database. For these purposes, authorization is understood as that given through technological mechanisms such as, but not limited to, a click to accept our Terms and Conditions and the Personal Data Processing Policy, at the time of entering your data for sending emails, or “Newsletter”; the completion of forms on the website and/or through subscription through third-party applications such as, but not limited to, Facebook or Instagram.
2. With this approved Authorization procedure, it is expressly guaranteed that the Holder of personal data knows and accepts that MEDIOS NARANJA SAS will collect, store, use, refine, analyze, circulate, transmit, transfer, update or delete, under Law provisions, information for the purposes that you are informed in advance for the Authorization granting, and for the purpose herein.
3. In the authorization requested by MEDIOS NARANJA SAS, the following shall be established as a minimum requirement: (i) The complete identification of the person from whom Personal Data is collected; (ii) the Authorization referred to in previous paragraph b; iii) the purpose of Personal Data Processing, and; (iv) the rights of access, correction, updating or deletion of Personal Data provided by the Holder.
4. It shall be MEDIOS NARANJA SAS responsibility to adopt the necessary measures to keep records of when and how authorization was obtained from the Holders.
5. Holders of Personal Data may request at any time and without limitation of any kind, the deletion of their data and/or revoke the authorization granted for the processing thereof.

8. Rights of Personal Data Holders: The Personal Data holder shall have the following rights:

• Know, update and rectify his/her Personal Data before MEDIOS NARANJA SAS. This right can be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those of which Processing is expressly prohibited or has not been authorized;
• Request, when appropriate, proof of the authorization granted to MEDIOS NARANJA SAS;
• Be informed by MEDIOS NARANJA SAS or the Person in Charge of Personal Data Processing, regarding the use that has been given to his/her Personal Data;
• Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012, after exhausting the claims procedure established in the Personal Data Processing Policy;
• Revoke the authorization and/or request the deletion of Personal Data when the principles, rights and constitutional and legal guarantees are not respected in the Processing. In the same way, the revocation and/or deletion shall proceed when the Superintendency of Industry and Commerce has determined that the Responsible Persons or Persons in Charge have engaged in conduct contrary to this law and the Constitution.
• Free access to his/her Personal Data that has been processed.

9. Duties of MEDIOS NARANJA SAS: As the Responsible for Personal Data Processing, MEDIOS NARANJA SAS, its contractors and its employees undertake to comply with the following duties:

• Guarantee the data Holder, at all times, the full and effective exercise of habeas data right;
• Keep a copy of the communication and the respective authorization granted by the Holder;
• Duly inform the Holder of the purpose of the collection and the rights that assist him/her by virtue of the authorization granted;
• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
• In case of sharing and/or updating the information with a Person in Charge of Personal Data Processing, guarantee that the authorization given by the Holder is enough and that the information itself is true, complete, accurate, updated, verifiable and understandable;
• Correct information when it is incorrect;
• Process queries and claims made by the Holder under the terms of this Handbook and the Personal Data Processing Policy of MEDIOS NARANJA SAS;
• Inform, at Holder’s request, of the use given to his/her data;
• Inform the data protection authority when there are violations of the security codes and there are risks in the administration of Holders' information;
• Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce;
• Comply with other provisions contained in Law and in regulatory decrees;
• Register in database the legend "claim in process" when appropriate.
• Insert in database the legend "information under judicial discussion" once notified by the relevant authority about judicial processes related to the quality of personal data;
• Refrain from circulating information that is being controversial by the Holder and blocking of which has been ordered by the Superintendency of Industry and Commerce;
• Allow access to information only to people who can have access to it;
• Inform through MEDIOS NARANJA SAS website the new mechanisms that it implements, so that the information holders make their rights effective, as well as any modification to the Personal Data Processing Policy;
• In compliance with the express prohibition contained in article 12 of Decree 1377 of 2013, MEDIOS NARANJA SAS refrains from collecting personal data of children and adolescents in its databases;
• Responsible Area and Procedure for the Exercise of Holder’s Rights: The Holder, his/her representative or successor in title may submit at any time and free of charge, consultations, requests and/or claims before MEDIOS NARANJA SAS to know, update, rectify, and request the deletion of his/her personal data and/or to revoke the authorization.

For this reason, it is the entire team’s responsibility of MEDIOS NARANJA SAS direct and indirect employees, without exception, to comply with the Personal Data Processing Policy, and in particular, with due attention to requests, complaints and claims that the Holder submit before the company for this concept.

To exercise his/her rights, the Holder or whoever acting on his/her behalf, can submit his/her requests, complaints and/or claims to MEDIOS NARANJA SAS by the following means:

1. Written communication by electronic means through MEDIOS NARANJA SAS website.

The area responsible for databases handling and processing, as the case may be, will always be the person in charge of the customer service department who will be in charge of dealing with the requests, complaints and claims (peticiones, quejas o reclamos, PQRs) made by the Holder in the exercise of his/her rights. A consultation, request, complaint or claim (PQR), by electronic means, shall be processed according to the following procedure:

CONSULTATION: When the main aim is a consultation, i.e., The Holder’s personal information in MEDIOS NARANJA SAS database is consulted, the procedure shall be as established herein:

1. The consultation shall be made by filling out the PQR formats contained at the website.

2. Once consultation is received, a response must be given to The Holder, whoever may be, within the following ten (10) business days from the date of receipt.

3. If it is not possible to deal with the consultation within said term, The Holder shall be informed, stating the reasons for the delay and indicating the date on which the consultation shall be dealt with, which cannot exceed five (5) business days following the first term expiration.

CLAIM: When the main aim is a claim, i.e., when The Holder considers that the information contained in MEDIOS NARANJA SAS database should be corrected, updated or deleted, or when he/she notices a breach by MEDIOS NARANJA SAS of any of the duties contained in Law 1581 of 2012, the procedure shall be the following established herein:

1. The claim shall be formulated by means of a request addressed to the Responsible Person or Person in Charge of the information, with Holder’s identification number, description of the facts that give rise to the claim, address and documents that he/she considers necessary.

2. If claim is incomplete, The Holder or whoever acting on his behalf shall be required to correct the mistakes within five (5) business days after receipt of the claim.

3. If after two (2) months from the date of the correction request, the Holder or whoever acting on his/her behalf does not submit the required information, it shall be understood that the claim has been withdrawn.

4. Once a claim is received with all the requirements, it must be included in the databases within a term not exceeding two (2) business days, identifying it with a legend that says "claim in process" and the reason for the claim. Said legend must be kept until the claim is decided.

5. If after two (2) months from the date of the correction request, the Holder or whoever acting on his/her behalf does not submit the required information, it shall be understood that the claim has been withdrawn.

6. The maximum term to deal with the claim shall be fifteen (15) business days from the day after receipt. When it is not possible to deal with the claim within this term, the stakeholder shall be informed of the reasons for the delay and the date on which his/her claim shall be dealt with, which cannot exceed eight (8) business days following the term expiration.

7. In the event that MEDIOS NARANJA SAS receives a claim and it is not competent to resolve it, it shall transfer it, to the extent possible, to the appropriate party within a maximum term of two (2) business days and shall inform the stakeholder of the situation.

8. When the request is formulated by a person other than the holder and it is not proven that the same acts on behalf of the holder, it shall be considered as not submitted.

10. Correction, Updating and Deletion of Personal Data: In accordance with the provisions of paragraph 10 above, MEDIOS NARANJA SAS shall correct, update or delete, at the request of the Holder, any type of information, according to the procedure and terms indicated in the previous article. In the case of correction and/or updating, the proposed corrections must be duly substantiated.

Paragraph: The information Holder, at all times, shall have the right to request the total or partial deletion of his/her Personal Data, and for this, the procedure established in paragraph 10 above shall be followed. MEDIOS NARANJA SAS may only deny this deletion when: i) The Holder has the legal and/or contractual duty to remain in the database; ii) The data deletion hinders judicial or administrative proceedings in progress, and iii) In the other cases contemplated in article 10 of Law 1581 of 2012, when appropriate.

11. Information Security Measures: MEDIOS NARANJA SAS shall adopt the technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. Said measures shall respond to the minimum requirements under current laws.

12. Appointment: MEDIOS NARANJA SAS appoints the customer service department, or whoever acting on its behalf, to comply with the function of Personal Data protection, as well as to process Holders’ requests, for executing the rights of access, consultation, correction, updating, deletion and revocation referred to in Law 1581 of 2012, Decree 1377 of 2013 and the MEDIOS NARANJA SAS Personal Data Processing Policy.

13. Validity: This MEDIOS NARANJA SAS Personal Data Processing Policy shall be in force as long as the company actually exists.

Likewise, we remind you that you have the right to know, update, correct and request the deletion of your personal data at any time, for which we ask you to notify us of your decision by email at info@aguaderosa.com

Sincerely yours,

MEDIOS NARANJA SAS TEAM