CARVAJAL PULP AND PAPER & SUBSIDIARIES

01 LEGAL REGULATIONS AND AREA OF APPLICATION: This Personal Data Processing Policy is prepared in accordance with the provisions of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other complementary provisions and will be applied by CARVAJAL PULPA Y PAPEL SA and its SUBSIDIARIES: CARVAJAL PULPA AND PAPEL SAS SPECIAL PERMANENT FREE ZONE, PROPANDINA SAS, SUPAPEL SAS and FUNDACIÓN PROPAL (hereinafter THE COMPANY) regarding the collection, storage, use, circulation, deletion and of all those activities that constitute data processing personal.

02 DEFINITIONS: For the purposes of the execution of this policy and in accordance with legal regulations, the following definitions shall apply: a) Authorization: Prior, express and informed consent of the Holder for the processing of personal data; b) Privacy notice: Physical document, electronic or in any other format, generated by the Responsible that is made available to the Holder of the information made known regarding the existence of the information processing policies that will be applicable to him, the way to access them and the characteristics of the treatment that is intended to give personal data; c) Database: Organized set of personal data that is the object of Treatment; d) Personal data: Any information linked or that may be associated with one or more specific or determinable natural persons; e) Public data: It is the data classified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. The data relating to the marital status of people, their profession or trade, their merchant status are public, among others or of a public servant and those that can be obtained without any reservation. By their nature, public data may be contained, among others, in public records, public documents, gazettes and official bulletins; f) Private data: It is the data that due to its intimate or reserved nature is only relevant for the holder; g) Sensitive data: Sensitive data means those that affect the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or those that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data; h) Person in charge of the Treatment: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Person Responsible for the Treatment; i) Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the Data Processing; j) Holder: Natural person whose personal data is subject to Treatment; k) Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion thereof.

03 PURPOSE WITH WHICH THE COLLECTION OF PERSONAL DATA AND TREATMENT OF THE SAME IS PERFORMED: THE COMPANY may make use of personal data to a) Execute the existing contractual relationship with its customers, suppliers and workers, including the payment of contractual obligations; b) Provide the services and/or products required by its users; c) Inform about new products or services and / or changes in them; d) Evaluate the quality of service; e) Conduct internal studies on consumption habits; f) Send to physical, electronic, cellular or mobile device, via text messages (SMS and / or MMS) or through any other analogue and / or digital means of communication created or to be created, commercial, advertising or promotional information about the products and / or services, events and / or promotions of commercial type or not of these, in order to promote, invite, direct, execute, inform and in general, carry out campaigns, promotions or contests of a commercial nature or advertising, advanced by THE COMPANY and / or by third parties; g) Provide, share, send or deliver your personal data to subsidiaries, related companies, or subordinates of CARVAJAL S.A. located in Colombia or any other country in the event that said companies require the information for the purposes indicated here; h) Support internal or external audit processes; i) Register the information of employees and/or pensioners (active and inactive) in the databases of THE COMPANY: i) Those indicated in the authorization granted by the owner of the data or described in the respective privacy notice, depending on the case.Regarding the data (i) collected directly at the company’s security points, (ii) taken from the documents provided by the people to the security personnel and (iii) obtained from the videotapes that are made inside or outside the facilities of THE COMPANY, these will be used for the purposes of security of the people, goods and facilities of THE COMPANY and may be used as evidence in any type of process. If personal data is provided, said information will be used only for the purposes indicated here, and therefore, THE COMPANY will not proceed to sell, license, transmit, or disclose it, unless: (i) there is express authorization to do so; (ii) it is necessary to allow contractors or agents to provide the entrusted services; (iii) is necessary in order to provide the services and / or products of the company; (iv) its disclosure is necessary to the entities that provide marketing services on behalf of THE COMPANY or to other entities with which they have joint market agreements; (v) the information is related to a merger, consolidation, acquisition, divestment, or other restructuring processes of the company; (vi) that is required or permitted by law.

THE COMPANY may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is outsourced with third parties or personal information is provided to third-party service providers, THE COMPANY will warn said third parties of the obligation to protect such personal information with appropriate security measures and the prohibition of the use of information for own purposes and disclosure of personal information to third parties.

 

04 PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA: The processing of personal data in THE COMPANY will be governed by the following principles: a) Principle of purpose: The Treatment of personal data collected must comply with a legitimate purpose of which the Holder must be informed; b) Principle of freedom: The Treatment can only be carried out with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate that relieves consent; c) Principle of truthfulness or quality: The information subject to Treatment must be truthful, complete, accurate, updated, verifiable and understandable. Treatment of partial, incomplete, fractional or terror-inducing data will not be performed; d) Principle of transparency: In the Treatment, the right of the Holder to obtain from THE COMPANY at any time and without restrictions, information about the existence of data concerning him must be guaranteed; e) Principle of access and restricted circulation: The Treatment is subject to the limits that derive from the nature of personal data, from the provisions of this law and the Constitution. Personal data, except for public information, and the provisions of the authorization granted by the owner of the data, may not be available on the Internet or other means of disclosure or mass communication, unless access is technically controllable to provide restricted knowledge only to holders or authorized third parties; f) Principle of security: The information subject to Treatment by THE COMPANY must be protected through the use of technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or access unauthorized or fraudulent; g) Principle of confidentiality: All persons involved in the processing of personal data are obliged to guarantee the reservation of the information, even after the end of their relationship with any of the tasks included in the Treatment. If sensitive personal data is collected, the Holder may refuse to authorize its Treatment.

05 RIGHTS OF THE PERSONAL DATA HOLDERS SUBJECT TO THE PROCESSING BY THE COMPANY: The holders of personal data by themselves or through their representative and/or agent or their successor may exercise the following rights, with respect to the personal data that are the object of treatment by THE COMPANY: a) Right of access: Under which you can access personal data that are under the control of THE COMPANY, for consulting them for free, for which you must request the information you require of your data to the following email address cpphabeasdata@propal.com.co; b) Right to update, rectification and deletion: Under which you may request the update, rectification and/or deletion of the personal data processed. c) Right to request proof of authorization: except in the events in which, according to current legal regulations, authorization is not required to carry out the treatment; d) Right to be informed regarding the use of personal data; e) Right to file complaints with the Superintendence of Industry and Commerce: for violations of the provisions of current regulations on the processing of personal data; f) Right to require compliance with orders issued by the Superintendence of Industry and Commerce.
For the purposes of exercising the rights described above, both the holder and the person representing him must prove his identity and, if applicable, the quality by virtue of which he represents the holder. The rights of minors will be exercised through the persons who are empowered to represent them.

06. DUTIES OF THE COMPANY: All those obliged to comply with this policy must keep in mind that THE COMPANY is obliged to fulfill the duties that the law imposes in this regard. Consequently, the following obligations must be fulfilled: A. Duties when acting as responsible: (i) Request and keep, under the conditions provided in this policy, a copy of the respective authorization granted by the holder. (ii) Clearly and sufficiently inform the holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted. (iii) Inform at the request of the owner about the use given to their personal data. (iv) Process the queries and claims made in the terms indicated in this policy. (v) Ensure that the principles of truthfulness, quality, security and confidentiality in the terms established in the following policy. (vi) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (vii) Update the information when necessary. (viii) Rectify personal data when appropriate. B. Duties when you work as Person in charge of the processing of personal data. If you perform the data processing on behalf of another entity or organization (Responsible for the processing) you must fulfill the following duties: (i) Establish that the Data Controller is authorized to provide the personal data that will be treated as Manager (ii) Guarantee the holder , at all times, the full and effective exercise of the right of habeas data. (iii) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (iv) Timely update, rectify or delete the data. (v) Update the information reported by those responsible for the treatment within five (5) business days from the date of receipt. (vi) To process the consultations and claims made by the owners in the terms indicated in this policy. (vii) Record in the database the legend “claim in process” in the manner established in this policy. (viii) Insert in the database the legend “information in judicial discussion” once notified by the party of the competent authority on judicial processes related to the quality of personal data. (ix) Refrain from circulating information that is being controversial by the holder and whose blockade has been ordered by the Superintendence of Industry and Commerce. (x) Allow access to information only to persons authorized by the owner or authorized by law for that purpose. (xi) Inform the Superintendence of Industry and Commerce when there are violations of security codes and there are risks in the management of the information of the owners. (xii) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce. C. Duties when carrying out the processing through a Manager (i) Provide the person in charge of the processing only with personal data whose processing is previously authorized. For the purposes of the national or international transmission of data, a contract for the transmission of personal data must be signed or contractual clauses agreed in accordance with Article 25 of Decree 1377 of 2013. (ii) Ensure that the information provided to the Treatment Manager is truthful, complete, accurate, up-to-date, verifiable and understandable. (iii) Communicate in a timely manner to the person in charge of the treatment all the news regarding the data that he has previously provided and take the other necessary measures so that the information provided to him is kept updated. (iv) Inform in a timely manner to the person in charge of the treatment the rectifications made on the personal data so that he / she makes the pertinent adjustments. (v) Require the person in charge of the treatment, at all times, to respect the security and privacy conditions of the owner’s information. (vi) Inform the person in charge of the treatment when certain information is under discussion by the owner, once the claim has been submitted and the respective procedure has not been completed. D. Duties regarding the Superintendence of Industry and Commerce (i) Inform you of possible violations of security codes and the existence of risks in the administration of the information of the owners. (ii) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

07. APPLICATION FOR AUTHORIZATION WHEN THE PERSONAL DATA HOLDER: In advance and / or at the time of collecting the personal data, THE COMPANY will request the authorization of the data holder to carry out its collection and treatment, indicating the purpose for which the data is requested , using for that purpose automated technical means, written or oral, that allow to keep proof of the authorization and / or of the unequivocal conduct described in article 7 of Decree 1377 of 2013. Said authorization shall be requested for as long as is reasonable and necessary. to meet the needs that gave rise to the request for the data and, in any case, in compliance with the legal provisions governing the matter.

08. PRIVACY NOTICE: In the event in which THE COMPANY cannot make this information treatment policy available to the owner of the personal data, it will publish the privacy notice attached to this document, the text of which it will retain for later consultation by part of the holder of the data and / or the Superintendence of Industry and Commerce.

09. TEMPORARY LIMITATIONS TO THE PROCESSING OF PERSONAL DATA. THE COMPANY may only collect, store, use or circulate personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the treatment, taking into account the provisions applicable to the matter in question and administrative aspects, accounting, tax, legal and historical information. Once the purpose or purposes of the treatment have been fulfilled and without prejudice to legal regulations that provide otherwise, it will proceed to the deletion of personal data in its possession. Notwithstanding the foregoing, personal data must be kept when required to comply with a legal or contractual obligation.

10. RESPONSIBLE AREA AND PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF PERSONAL DATA HOLDERS: The area responsible for managing the database of suppliers, customers, workers and former workers, as appropriate, in THE COMPANY, will be responsible for attending the requests, complaints and claims made by the holder of the data in exercise of the rights contemplated in numeral 5 of this policy, except for that described in subparagraph e). For such purposes, the holder of the personal data or whoever exercises his representation may send his request, complaint or claim to the email cpphabeasdata@propal.com.co or file it at the following addresses:

 

OFFICE	DIRECTION
Carvajal Pulpa y Papel S.A.	Km 6 old road Cali-Yumbo
Carvajal Pulpa y Papel S.A.S. Zona Franca Permanente Especial	Km 6 old road Cali-Yumbo
Proveedora de Papeles Andina S.A.S.	Carrera 47 No.12ª-45
Suministradora de Papel S.A.S.	Calle 18 No.69F-45

The petition, complaint or claim must contain the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompany it with the documents that are to be enforced. If the claim is incomplete, the interested party will be required within five (5) business days of receipt of the claim to remedy the failures. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has given up the claim. If the person receiving the claim is not competent to resolve it, they will transfer it to the corresponding party within a maximum period of two (2) business days and inform the interested party of the situation. Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database, in a term not exceeding two (2) business days. This legend must be maintained until the claim is decided. The maximum term to handle the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

 

11 DATA COLLECTED BEFORE THE ISSUANCE OF DECREE 1377 OF 2013: Under the provisions of paragraph 3 of article 10 of Regulatory Decree 1377 of 2013, THE COMPANY has published a notice on its official website www.carvajalpulpaypapel.com. addressed to the owners of personal data to publicize this policy, as well as their rights as holders of personal data housed in the databases of THE COMPANY.

12. SECURITY MEASURES: In development of the security principle established in Law 1581 of 2012, THE COMPANY will adopt the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized access or fraudulent The personnel who carry out the processing of personal data will execute the established protocols in order to guarantee the security of the information.

13. DATE OF ENTRY INTO FORCE: This policy will take effect from July 27, 2013, until the COMPANY so determines under the applicable legal regulations. Any changes that occur concerning this policy will be reported through the official website www.carvajalpulpaypapel.com.

THE COMPANY: CARVAJAL PULPA Y PAPEL & SUBSIDIARIES

 

NOTICE OF PRIVACY

RESPONSIBLE FOR THE TREATMENT:

CARVAJAL PULPA Y PAPEL & its SUBSIDIARIES

 

ADDRESS: Km6 old road Cali-Yumbo

EMAIL: cpphabeasdata@propal.com.co

YUMBO TELEPHONE LINE +57 (2) 6512000

 

PURPOSE WITH WHICH THE COLLECTION OF PERSONAL DATA AND TREATMENT OF THE SAME IS PERFORMED: THE COMPANY may make use of personal data to a) Execute the existing contractual relationship with its customers, suppliers and workers, including the payment of contractual obligations; b) Provide the services and/or products required by its users; c) Inform about new products or services and / or changes in them; d) Evaluate the quality of service; e) Conduct internal studies on consumption habits; f) Send to physical, electronic, cellular or mobile device, via text messages (SMS and / or MMS) or through any other analogue and / or digital means of communication created or to be created, commercial, advertising or promotional information about the products and / or services, events and / or promotions of commercial or non-commercial type, with the purpose of promoting, inviting, directing, executing, informing and in general, carrying out campaigns, promotions or contests of a commercial or advertising nature, advanced by THE COMPANY and / or by third parties; g) Provide, share, send or deliver your data to subsidiaries, related companies, or subordinates of CARVAJAL S.A. located in Colombia or any other country in the event that said companies require the information for the purposes indicated here; h) Support internal or external audit processes; i) Register the information of employees and/or pensioners (active and inactive) in the databases of THE COMPANY: (i) Those indicated in the authorization granted by the owner of the data or described in the respective privacy notice, depending on the case. Regarding the data (i) collected directly at the security points in the company, (ii) taken from the documents provided by the people to the security personnel and (iii) obtained from the videotapes that are made inside or outside the facilities of THE COMPANY, these will be used for the purposes of security of the people, goods and facilities of THE COMPANY and may be used as evidence in any type of process.

 

If personal data is provided, said information will be used only for the purposes indicated here, and therefore, THE COMPANY will not proceed to sell, license, transmit, or disclose it, unless: (i) there is express authorization to do so; (ii) it is necessary to allow contractors or agents to provide the entrusted services; (iii) is necessary in order to provide the services and / or products of the company; (iv) its disclosure is necessary to the entities that provide marketing services on behalf of CARVAJAL PULPA Y PAPEL or to other entities with which they have joint market agreements; (v) the information is related to a merger, consolidation, acquisition, divestment, or other restructuring processes of the company; (vi) that is required or permitted by law.

 

THE COMPANY may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is outsourced with third parties or personal information is provided to third-party service providers, THE COMPANY will warn said third parties of the obligation to protect such personal information with appropriate security measures and the prohibition of the use of information for personal purposes and disclosure of personal information to third parties.

PERSONAL DATA PROCESSING POLICY: It can be consulted at the following address: www.propal.com.co. Any changes that occur concerning this policy will be reported through the same website.

If sensitive personal data is collected, the Holder may refuse to authorize its Treatment.

The area in charge of managing the database of suppliers, customers, workers and former workers, as the case may be, in THE COMPANY, will be responsible for handling the requests, complaints and claims made by the owner of the data in exercise of the rights referred to in numeral 5 of the personal data processing policy, with the exception of that described in its literal e). For such purposes, the holder of the personal data or whoever represents them may send their request, complaint or claim from Monday to Friday from 8:00 am to 5:00 pm to the email cpphabeasdata@propal.com.co, call the telephone line in Yumbo +57 (2) 6512000, or file it at the following addresses, corresponding to our offices throughout the Country:

OFICCE	DIRECTION
Carvajal Pulpa y Papel S.A.	Km 6 old roar Cali-Yumbo
Carvajal Pulpa y Papel S.A.S. Zona Franca Permanente Especial	Km 6 old roal Cali-Yumbo
Proveedora de Papeles Andina S.A.S.	Carrera 47 No.12ª-45
Suministradora de Papel S.A.S.	Calle 18 No.69F-45