Legal

Personal Data Protection Policy

How we protect the information you share with us, in accordance with Colombian Law 1581 of 2012 and its regulations.

Code GE-PT-05 · Version 00 · Effective 2026-05-30

This is an English translation provided for reference. In case of any discrepancy, the Spanish version of this Policy prevails.

TRUCHAS BELMIRA S.A.S., identified with Tax ID (NIT) 800.192.049-5, with its principal domicile in Medellín, Antioquia, address Calle 34 # 65C – 117, telephone 6045200440 and email operaciones@truchasbelmira.co, hereinafter TRUCHAS BELMIRA S.A.S., acts as Data Controller for the personal data collected, stored, used, circulated, transmitted, transferred, updated, retained or deleted in the course of its activities.

This Policy sets out the guidelines applicable to the processing of personal data carried out by TRUCHAS BELMIRA S.A.S., in accordance with the Political Constitution of Colombia, Law 1581 of 2012, its implementing regulations and any other provisions that amend, add to, replace or apply to them.

The purpose of this Policy is to establish the criteria and guidelines under which TRUCHAS BELMIRA S.A.S. processes the personal data of its various data subjects, guaranteeing the exercise of their rights and compliance with the principles established in Colombian personal data protection law.

TRUCHAS BELMIRA S.A.S. recognizes the fundamental right of individuals to access, update, correct and, where legally appropriate, request the deletion of the personal data being processed, as well as to exercise the other rights recognized by current legislation.

This Policy applies to all personal data processed by TRUCHAS BELMIRA S.A.S., regardless of the means by which it is collected, the type of relationship with the data subject or the business activity in the course of which it is obtained.

The Policy applies, among others, to the following data subjects:

• Employees and former employees.
• Applicants and candidates in selection processes.
• Apprentices and interns.
• Contractors.
• Suppliers.
• Customers and prospective customers.
• Shareholders.
• Representatives and contacts of legal entities.
• Visitors.
• Users.
• Carriers.
• People who take part in institutional or commercial activities.
• People whose data is recorded by video surveillance systems.

And, in general, any natural person whose personal data is processed by TRUCHAS BELMIRA S.A.S.

DEFINITIONS

For the purposes of this Policy, the following definitions, among others, shall apply:

• Personal data: any information linked to, or that may be associated with, an identified or identifiable natural person.
• Data subject: natural person whose personal data is processed.
• Processing: any operation or set of operations performed on personal data, such as collection, storage, use, circulation, updating, transmission, transfer or deletion.
• Data Controller: natural or legal person, public or private, who decides on the database and/or the processing of the data.
• Data Processor: natural or legal person who processes personal data on behalf of the Data Controller.
• Sensitive data: information whose improper use may affect the privacy of the data subject or may give rise to discrimination, under the terms established by applicable law.
• Authorization: prior, express and informed consent of the data subject for the processing of their personal data, when legally required.
• Transfer: processing that involves sending personal data to a recipient located inside or outside Colombia, where applicable.
• Transmission: communication of personal data inside or outside Colombian territory so that a Data Processor carries out specific processing on behalf of the Data Controller.

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

TRUCHAS BELMIRA S.A.S. will process personal data in observance of the principles established in Colombian law, in particular the following:

• Legality: Personal data will be processed within the framework of the Constitution, the law and applicable provisions.
• Purpose: Data will be processed for legitimate, specific and explicit purposes that are disclosed to the data subject.
• Freedom: Processing will be carried out with the authorization of the data subject when required, or on the basis of legally established exceptions.
• Accuracy or quality: Information will be processed seeking to ensure that it is truthful, complete, accurate, up to date, verifiable and understandable.
• Transparency: TRUCHAS BELMIRA S.A.S. will guarantee the data subject access to information about the processing of their data, under the terms established by law.
• Restricted access and circulation: Personal data will be processed under conditions that prevent unauthorized access or disclosure.
• Security: Reasonable technical, human, administrative and organizational measures will be implemented to protect personal data against tampering, loss, consultation, use or unauthorized or fraudulent access.
• Confidentiality: People involved in the processing of personal data must guarantee the confidentiality of the information, even after their relationship with the organization has ended, where applicable.
• Demonstrated accountability: TRUCHAS BELMIRA S.A.S. will adopt appropriate measures to demonstrate compliance with its personal data protection obligations.

CATEGORIES OF PERSONAL DATA

Depending on the relationship with the data subject and the corresponding purpose, TRUCHAS BELMIRA S.A.S. may process, among others, the following types of information:

• Identification data.
• Contact data.
• Employment information.
• Contractual information.
• Academic and professional information.
• Information related to selection processes.
• Social security information, where applicable.
• Information necessary for administrative, accounting, financial and commercial management.
• Information related to suppliers and customers.
• Records of entry to and presence at facilities.
• Photographs, videos, images and voice recordings.
• Information obtained through video surveillance systems.
• Information related to the Occupational Health and Safety Management System, where applicable.
• Information required to comply with legal or contractual obligations.

TRUCHAS BELMIRA S.A.S. will process only data that is relevant, necessary and adequate for the corresponding purposes.

PURPOSES OF PROCESSING

TRUCHAS BELMIRA S.A.S. may process personal data for the following purposes, among others compatible with its relationship with the data subject:

Employment and human resources management

• Carry out selection and hiring processes.
• Manage the employment relationship.
• Manage payroll, benefits, entitlements and other matters arising from the employment relationship.
• Carry out enrollments and procedures with the Comprehensive Social Security System.
• Manage training, well-being and development processes.
• Manage information related to employees and former employees.
• Comply with legal obligations arising from the employment relationship.

Occupational health and safety

• Manage activities related to the Occupational Health and Safety Management System.
• Manage health and safety prevention and promotion activities.
• Comply with legal obligations related to occupational risks.
• Manage occupational medical information only when there is a legal basis to do so and respecting the corresponding confidentiality.

Commercial and customer management

• Manage commercial relationships.
• Respond to requests, petitions, complaints, claims and inquiries.
• Manage quotations and commercial processes.
• Perform contracts.
• Follow up on products and services.
• Maintain communication related to existing or potential commercial relationships, where legally appropriate.

Supplier and contractor management

• Carry out selection and onboarding processes.
• Manage contracts and service orders.
• Verify information necessary for the contractual relationship.
• Manage payments and administrative obligations.
• Comply with legal, contractual and control obligations.

Administrative and legal management

• Manage administrative, accounting, financial and legal processes.
• Respond to requests from competent authorities.
• Comply with legal and regulatory obligations.
• Manage judicial, administrative or out-of-court proceedings, where applicable.
• Prevent and detect fraud, unlawful conduct or situations that may affect the organization's assets.

Physical security and access control

• Control the entry and exit of people.
• Protect employees, visitors, customers, suppliers and other people who enter the facilities.
• Protect the organization's property.
• Prevent security incidents.

Video surveillance

Images captured by video surveillance systems may be processed for purposes of security, incident prevention and response, protection of people and property, access control and other legitimate purposes related to the security of the facilities. Access to these images will be restricted to authorized personnel and to third parties with legal or contractual authorization to access them.

PROCESSING OF SENSITIVE DATA

TRUCHAS BELMIRA S.A.S. recognizes that certain personal data may be sensitive and therefore require enhanced protection.

The organization will avoid requesting or processing sensitive data when it is not necessary for the corresponding purposes.

When the processing of sensitive data is legally permitted and necessary, TRUCHAS BELMIRA S.A.S. will adopt the corresponding security and confidentiality measures and will request authorization when required.

The data subject will be informed, where applicable, of the sensitive nature of the information and of the option to refrain from authorizing its processing when legally appropriate.

PROCESSING OF HEALTH-RELATED DATA

When, in the course of its activities, TRUCHAS BELMIRA S.A.S. must process health-related information of employees or other data subjects, it will be handled under conditions of confidentiality, security and restricted access.

Medical or occupational information will be processed only for legally permitted purposes and by the people or entities with the competence or authorization to access it.

TRUCHAS BELMIRA S.A.S. will respect the special provisions on the confidentiality of medical and occupational information.

PROCESSING OF CHILDREN'S AND ADOLESCENTS' DATA

TRUCHAS BELMIRA S.A.S. will not process personal data of children and adolescents except in cases where such processing is permitted by applicable law and is necessary for a legitimate purpose.

Where applicable, processing will be carried out respecting the best interests of the minor and their fundamental rights.

PROCESSING OF IMAGE, VOICE AND AUDIOVISUAL MATERIAL

TRUCHAS BELMIRA S.A.S. may capture photographs, images, videos and voice recordings in the course of institutional, work, commercial, training or security activities, always in accordance with the corresponding purposes and applicable regulations.

When authorization is required for a specific use, it will be requested from the data subject in a prior, express and informed manner.

Where authorized, the material may be used, among others, in:

• The corporate website.
• Corporate social media.
• Institutional material.
• Communication campaigns.
• Management reports.
• Training activities.
• Educational material.
• Newsletters.
• Printed or digital publications.
• Event records.
• Social responsibility activities.
• Dissemination of institutional activities.

The use of image and voice will respect the dignity, honor, good name, privacy and other fundamental rights of the data subject.

The revocation of an authorization will be handled under the terms established by law, without prejudice to any processing that must be maintained due to a legal or contractual obligation or another legally valid reason.

TRANSMISSION AND TRANSFER OF PERSONAL DATA

TRUCHAS BELMIRA S.A.S. may transmit or transfer personal data to third parties when necessary to fulfill the disclosed purposes, to perform contractual relationships, to provide services, to comply with legal obligations or when there is another legal basis that allows it.

Third parties that may eventually have access to personal information include, as applicable:

• Technology service providers.
• Payroll and administrative service providers.
• Social Security System entities.
• Occupational risk insurers (ARL), health insurers (EPS), pension funds (AFP) and other competent entities.
• Contractors and suppliers.
• Professional advisors.
• Financial institutions.
• Administrative and judicial authorities.
• Data processors.
• Other legally authorized third parties.

When personal data is transmitted or transferred, TRUCHAS BELMIRA S.A.S. will adopt the corresponding contractual, technical and administrative measures to guarantee the protection of the information.

In the case of international transfers, the conditions and requirements established by applicable Colombian law will be observed.

DATA PROCESSORS

TRUCHAS BELMIRA S.A.S. may engage natural or legal persons to act as Data Processors.

Data Processors may process personal data only in accordance with the instructions and purposes authorized by TRUCHAS BELMIRA S.A.S., and must adopt the required security, confidentiality and protection measures.

SECURITY MEASURES

TRUCHAS BELMIRA S.A.S. will implement administrative, technical, human and organizational measures aimed at protecting personal data against loss, tampering, unauthorized access, consultation, use, disclosure or improper processing.

Access to information will be limited according to the functions, responsibilities and needs of each authorized user or third party.

Employees, contractors and other people with access to personal information must use it only for authorized purposes and maintain the corresponding confidentiality.

RIGHTS OF DATA SUBJECTS

Data subjects have the right to:

• Access, update and correct their personal data.
• Request proof of the authorization granted, when required.
• Be informed of how their personal data has been used.
• Submit inquiries and complaints.
• Request the updating or correction of information.
• Request the deletion of data when legally appropriate.
• Revoke the authorization when legally possible.
• Access their personal data free of charge under the terms established by law.
• Turn to the Superintendence of Industry and Commerce (SIC) if they consider their rights have been violated, once internal mechanisms have been exhausted when required.

PROCEDURE FOR EXERCISING RIGHTS

Data subjects, their successors, representatives or duly authorized persons may submit inquiries or complaints regarding their personal data through the channels established by TRUCHAS BELMIRA S.A.S.

Requests must allow the data subject to be identified and must contain, at a minimum, the information necessary to determine the purpose of the request.

• Inquiries: The data subject may request information about the personal data being processed. TRUCHAS BELMIRA S.A.S. will respond to inquiries within the time limits established by current legislation.
• Complaints: A data subject who considers that information in a database should be corrected, updated or deleted, or that there has been a breach of applicable provisions, may file the corresponding complaint. Complaints will be handled in accordance with the terms and procedures established by current regulations.
• Deletion requests: The data subject may request the deletion of their personal data when legally appropriate. The request may be denied when there is a legal or contractual duty to retain the information, when retention is necessary to comply with a legal or contractual obligation, or when there is another legally valid reason that prevents deletion.

CHANNELS FOR EXERCISING RIGHTS

Inquiries, requests and complaints related to the processing of personal data may be submitted through:

This Personal Data Processing Policy will remain available for consultation on the TRUCHAS BELMIRA S.A.S. website.

CONFIDENTIALITY

All people involved in the processing of personal data must maintain the confidentiality of the information they access in the course of their duties or contractual relationships.

This obligation will remain in force even after the employment, contractual or commercial relationship has ended, when legally applicable.

RETENTION OF PERSONAL DATA

TRUCHAS BELMIRA S.A.S. will retain personal data for as long as necessary to fulfill the purposes for which it was collected, while there is a contractual, commercial, employment or other relationship that justifies its processing, or for the period during which there is a legal or contractual obligation to retain it.

Once the purpose has been fulfilled and the applicable retention periods have expired, the data will be deleted, anonymized or subjected to the corresponding measures, in accordance with legal provisions and the organization's internal procedures.

AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

When the law requires the data subject's authorization, TRUCHAS BELMIRA S.A.S. will request it in a prior, express and informed manner, using the appropriate physical or electronic mechanisms.

Publishing this Policy on the website is a means of informing the data subject and does not, in itself, replace the specific authorizations legally required for certain types of processing.

In physical or electronic forms used to collect personal data, TRUCHAS BELMIRA S.A.S. may include the corresponding privacy notices and authorization mechanisms.

UPDATES TO THE POLICY

TRUCHAS BELMIRA S.A.S. may modify, update or supplement this Policy when necessary to adapt it to regulatory, case-law, administrative, technological or organizational changes, or to the organization's own needs.

Changes will be published through the corresponding institutional channels when necessary.

EFFECTIVE DATE

This Policy takes effect upon publication and will remain in force for as long as TRUCHAS BELMIRA S.A.S. processes personal data.

The current version will be permanently available for consultation on the corporate website.

Approval date: June 30, 2026
Last updated: September 30, 2026

ANDRES FELIPE MONTAGUT TORRADO
Legal Representative
TRUCHAS BELMIRA S.A.S.