1. Purpose

To inform Data Subjects of the purposes for which CATA (the “Data Controller”) processes their personal data, the rights they are entitled to, the area responsible for handling requests, inquiries and complaints, and the service channels available to guarantee the exercise of the right to habeas data.

2. Scope

This policy applies to all databases and files containing personal data processed by CATA, acting as controller and/or processor, and to its stakeholders, including commercial prospects and customers.

CATA commits to: (i) comply at all times with applicable data-protection law; (ii) guarantee the habeas data rights of every Data Subject in its databases; and (iii) apply technical, legal and organizational measures to prevent unauthorized access, loss, alteration and fraudulent use of data. CATA does not obtain your personal data from third parties unless you provided it voluntarily through prior, express and informed consent.

3. Key definitions

• Authorization: prior, express and informed consent from the Data Subject to process personal data.
• Personal Data: any information linked to, or that may be associated with, one or more identified or identifiable natural persons.
• Sensitive Data: data affecting privacy or whose misuse may lead to discrimination (racial or ethnic origin, political orientation, religious or philosophical beliefs, union membership, health, sex life, biometric data).
• Habeas Data: the right of any Data Subject to know, update, rectify and oppose the processing of their personal data.
• Data Controller: the natural or legal person who decides on the database and its processing (here, CATA).
• Data Processor: a person who processes personal data on behalf of the Controller.
• Processing: any operation on personal data, collection, storage, use, circulation or deletion.
• Transfer / Transmission: sending personal data to another controller or processor, inside or outside Colombia.

4. Principles

• Lawfulness: processing pursues a legitimate purpose and complies with Law 1581.
• Purpose limitation: data is processed only for a legitimate purpose previously communicated to you.
• Freedom: processing requires your prior, express and informed consent; you may refuse the processing of sensitive data.
• Accuracy / quality: data must be truthful, complete, accurate, up to date, verifiable and understandable.
• Transparency: you may obtain information at any time about the data held on you.
• Restricted access and circulation: data is not published on the internet except where access is technically controllable to authorized parties.
• Security: technical, human and administrative measures protect records against loss, alteration and unauthorized access.
• Confidentiality: everyone handling non-public data must keep it confidential, even after their relationship with CATA ends.
• Demonstrated accountability: CATA is accountable for its data-protection activities and discloses results transparently.

5. How your data is processed

Purposes applicable to all Data Subjects who have granted their authorization:

• Inform about substantial changes to this policy.
• Establish and manage the pre-contractual and contractual relationship.
• Respond to requests, inquiries, complaints and claims through CATA's channels.
• Transfer or transmit data to judicial and/or administrative authorities when required.
• Know your financial, commercial and credit behavior, and validate and verify identity.
• Establish, maintain and terminate a contractual relationship, and offer and provide our products and services.
• Manage collection and debt recovery, directly or through a third party.
• Conduct commercial, statistical, risk, market and financial analyses.
• Prevent money laundering and terrorist financing, and detect fraud, corruption and other illegal activities.
• Consult fines and sanctions with authorities or public databases, and carry out marketing through CATA's website and social media.

As a commercial prospect or customer, additionally:

• Evaluate and register you as a customer of CATA.
• Comply with and follow up on the obligations you assume with CATA.
• Consult and report to credit data banks (your standing as a debtor, payment capacity, credit/insurance risk, compliance with legal and contractual duties).
• Provide, process, complete and follow up on the products you purchase, and perform invoicing.
• Manage collection of financial obligations you owe CATA.
• Send commercial, advertising or promotional messages by mail, email, SMS/MMS or WhatsApp, only through channels you authorized and, under Law 2300 of 2023, only Monday-Friday 7:00-20:00 and Saturday 8:00-15:00 (Colombia time), at most once per calendar week.
• Conduct statistical analyses of trends and consumer behavior.

CATA may subcontract third parties to process information; it requires them to protect it with appropriate security, prohibits use for their own purposes, and prevents onward disclosure. Once the need to process your data ceases, it is deleted or securely archived and disclosed only when required by law.

6. Your rights (Article 8, Law 1581 of 2012)

• A. Know, update and rectify your personal data with CATA as Data Controller.
• B. Request proof of the authorization granted to CATA.
• C. Be informed by CATA, upon request, about the use given to your personal data.
• D. File complaints before the Superintendence of Industry and Commerce (SIC) for infringements of Law 1581, once the procedure before the Controller has been exhausted.
• E. Revoke authorization and/or request deletion of your data when principles, rights and guarantees are not respected.
• F. Access, free of charge, personal data that have been processed.

7. Ways to exercise your rights

• On your own behalf, as the Data Subject.
• Through an attorney-in-fact (a copy of the power of attorney must be attached; otherwise the request is deemed not submitted).
• For minors, through whoever proves legal representation.

8. Procedures and response times

Submit requests, inquiries and complaints through either channel, both of which preserve evidence of submission: written mail to CATA CAFÉ EXPORT S.A.S., Calle 68 # 11-48, Bogotá D.C., Colombia, or email to administracion@catacafeexport.com. A complaint should describe the facts, your contact details, and attach any supporting documents.

• Requests and inquiries: answered within 10 business days from receipt (extendable by up to 5 additional business days).
• Complaints and claims: answered within 15 business days from the day after receipt (extendable by up to 8). An incomplete claim must be corrected within 5 days; if 2 months pass without the required information, it is deemed withdrawn.

9. Passively collected information

When you use our website, CATA may passively collect technical information through cookies (IP address, browser type, operating system, domain name, access times, referring website). These tools do not directly collect your personal data, and you can configure cookies in your browser.

10. Security of personal data

CATA implements the technical, human and administrative measures necessary to secure records and prevent alteration, loss, unauthorized or fraudulent access, and requires its processors to do the same. CATA provides appropriate means to this end but does not guarantee absolute security.

11. Transfer, transmission and disclosure

CATA may disclose your personal data to its affiliated companies worldwide, and to non-affiliated third parties acting as contractors or in the transfer of a line of business. Transmission agreements require the processor to follow the governing principles, safeguard the security of the databases and maintain confidentiality.

12. Sensitive data

Under Article 6 of Law 1581, processing of sensitive data is prohibited unless you grant prior, express and informed authorization or a legal exception applies. You are not required to authorize the processing of sensitive data, and no activity is ever conditioned on providing it.

13. Area responsible for requests

The Administrative Area handles requests for access, rectification, updating, deletion and revocation of consent, Calle 68 # 11-48, Bogotá D.C., Colombia · administracion@catacafeexport.com · (+57) 310 880 5587.

14. Authorization

CATA requests prior, express and informed authorization before processing your data. Consent may be given in writing, orally, or through unequivocal conduct; silence is never treated as consent, and CATA retains evidence of the authorization. Informed consent means CATA states the data collected, the identity and contact details of the controller and processor, the specific purposes, your rights, and the optional nature of answering questions about sensitive data or data of minors.

15. Applicable legislation

Article 15 of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013 and Decree 1727 of 2009, and any rules that amend or replace them.

16. Changes to this policy

CATA may adjust or modify this policy, indicating the update date at its business address to keep Data Subjects informed. If you disagree with a change, you may exercise your habeas data rights through the channels described above.