Grupo de Inversiones Suramericana S.A., hereinafter Grupo SURA, in keeping with that stipulated in the Colombian Statutory Law 1581 of 2012 and Regulatory Decree 1377 of 2013, has adopted this Personal Data Protection Policy for the purpose of protecting the information obtained from its shareholders, investors, suppliers, employees, and other individuals who have any contact with Grupo SURA this in order to ensure the exercising of their rights.

The purpose of this document is to establish the necessary procedures for handling the personal data contained in Grupo SURA‘s databases, whether digital or physical, which shall be registered in the National Database Registry.

Grupo SURA guarantees the rights of privacy, honor and reputation, when treating the personal data it collects, and consequently everything it does shall be governed by principles of legality, purpose, freedom, truthfulness or quality, transparency, access and restricted circulation as well as security.

All information that has been provided by individuals as part of different activities carried out by Grupo SURA, or all information obtained through other related entities that share personal data with the Company, shall be governed by these principles, and the owners of such information may get to know, update and rectify such information, in accordance with the provisions of this policy.

Grupo SURA’s Data Protection Policy will be disclosed to all its employees, ensuring that it is duly appropriated and also updated in keeping with any organizational changes, legal provisions or other aspects that may affect what is herein described. Likewise, this policy shall be published in all those channels through which Grupo SURA collects personal data, ensuring that its stakeholders are clearly aware of the rights they have with regard to the processing of their information.

Based on the foregoing, a series of rules have been established through both legislation and jurisprudence, to guarantee the aforementioned constitutional rights. This policy is to be framed within the transcribed article and the Statutory Personal Data Protection Law 1581 of 2012, this in addition to the definitions and considerations issued by Colombia´s Constitutional Court.ata

Consent to the processing of personal data

Consent from the owner of the information is a presupposition for the constitutional legitimacy of personal data management, this being qualified consent, since it must be “prior”, that is to say, authorization must be provided before any data processing is carried out; “express”, to the extent that it must be unequivocal; and “informed”, since the owner must not only accept the processing of his or her data, but must also be fully aware of the effects of granting his or her authorization.

In keeping with the above, in order to process the personal data contained in Grupo SURA‘s databases, the prior and express authorization of the owner of the information must be obtained.

In order to guarantee this is carried out, when through any operation data belonging to individuals is incorporated into Grupo SURA‘s databases, an authorization clause for the processing of personal data shall be made available to the third party, which shall contain at least the following:

• The treatment to which his or her personal data will be subjected and the purpose of such treatment.
• An indication that the responses to the questions posed are optional in the case of authorization being given for the processing of sensitive data or that of children and adolescents.
• An indication of the person responsible for the treatment of such information, as well as his or her physical or electronic address.
• The rights of the owner of the personal data.

When there is no prior and express authorization from the owner of the information, Grupo SURA shall refrain from processing his or her information, except for the following events in which such authorization shall not be necessary:

• For carrying out the measures required for implementing a contract that has been entered into with the owner of the information.
• For sending any information required by a public or administrative entity exercising its lawful duties or by means of a court order.
• For processing information authorized by law for historical, statistical or scientific purposes.
• For processing data of a public nature, or that related to a person´s civil registry records.

For exercising rights governing personal data

The owners of the information subject to processing may, at any time, exercise their rights as enshrined in Law 1581 of 2012 for (i) getting to know, updating and rectifying their personal data; (ii) requesting proof of the authorization granted for its treatment; (iii) becoming informed regarding the use that has been made of such data; (iv) revoking their authorization; (vi) requesting the deletion of their data when appropriate; and (vii) accessing this free of charge. In order to exercise his or her rights, the owner of the information may contact the following e-mail: notificaciones@gruposura.com.co, or send a written communication addressed to Grupo SURA´s Dirección de Servicios Internos y Compartidos (Internal and Shared Services Department), at the following address: Carrera 43 A N° 5 A – 113, piso 14, Torre Norte, Edificio One Plaza, Medellín..

In the case of any queries, Grupo SURA shall respond within a maximum term of ten (10) business days as of the date on which these are received. When it is not possible to attend the query within said term, the interested party shall be informed of the reasons for the delay and the date on which the query shall be attended, which in no case may exceed five (5) business days following the end of the initial term.

When the owner of the information considers that his or her information should be corrected, updated or deleted, or when he or she notices any alleged breach of any of Grupo SURA’s duties, he or she may file a claim that shall include a description of the facts giving rise to such, the claimant´s address, and the documents asserting said claim. Should this claim be incomplete, the interested party will be required to correct the corresponding defects within a term of five (5) days following the date on which the claim is initially received. Should the applicant fail to provide the required information once two (2) months have elapsed since the date when the claim was received, it shall be understood that the claimant has desisted from such.

The maximum term for addressing the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) business days following the expiration of the initial term.

Processing sensitive data

Grupo SURA shall not collect, incorporate or store sensitive personal data, unless prior authorization has been obtained from the owner of the information.

The aforementioned authorization will only be requested when necessary and in a proportional manner for implementing the relationship with the owner of such information, provided the Law requires or allows access to the owner´s sensitive information.

Authorization for processing sensitive data will be requested prior to incorporating this in any data base, and the purpose for which this is incorporated shall be indicated, as well as the fact that the responses to questions regarding sensitive data are optional, and all other elements described in this policy for obtaining authorization for the processing of information will be indicated.

Sensitive data may not be processed for purposes other than those authorized by the owner.
All access to, circulation and treatment of sensitive data will be restricted and this shall be limited to what is expressly authorized by the owner and to what is stipulated by Law.