Personal Data Processing Policy

DATA CONTROLLER FOR PERSONAL DATA PROCESSING

APLICACIONES FARMACÉUTICAS AFAVEL S.A.S., in compliance with the Personal Data Protection Law 1581 of 2012 and its regulatory decrees, acting as the Data Controller, is identified by the following information and establishes its policies for the processing of personal data:

Corporate Name: APLICACIONES FARMACÉUTICAS AFAVEL S.A.S Tax ID (NIT): 900-622.445-8 Address: Carrera 5 No. 9-26 SUR, Tower 3, Office 611, Cajicá – Cundinamarca Email: info@afavel.com.co Phone: (601) 8660995 Website: www.afavel.com.co

PURPOSE

APLICACIONES FARMACÉUTICAS AFAVEL S.A.S., in compliance with Law 1581 of 2012, Decree 1377 of 2013, and other applicable regulations, establishes this Personal Data Processing Policy to ensure the protection of personal data of its clients, suppliers, and other data subjects interacting with the company, guaranteeing the exercise of their rights and the responsible handling of information.

SCOPE

This policy applies to all databases containing personal information collected, stored, used, processed, transferred, or transmitted by APLICACIONES FARMACÉUTICAS AFAVEL S.A.S. in the course of its commercial activities, including product sales, customer management, shipping, invoicing, and marketing activities.

DEFINITIONS

Databases: Organized sets of personal data subject to processing.

Personal Data: Any information linked or that can be associated with one or more identified or identifiable natural persons.

Private Data: Data of an intimate or reserved nature, relevant only to the data subject.

Public Data: Data not classified as semi-private, private, or sensitive. Includes, among others, civil status, profession, and status as a merchant or public servant.

Semi-private Data: Data not classified as intimate, reserved, or public, whose disclosure may be of interest to the data subject and certain sectors or society at large.

Sensitive Data: Data that affects the privacy of the data subject or whose misuse may lead to discrimination.

Data Processor: A natural or legal person, public or private, who processes personal data on behalf of the Data Controller.

Habeas Data: The right of individuals to access, update, and rectify personal data held in public or private databases.

Data Controller: A natural or legal person, public or private, who determines the purpose and means of processing personal data.

Data Subject: The natural person whose personal data is subject to processing.

Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

PRINCIPLES

APLICACIONES FARMACÉUTICAS AFAVEL S.A.S. adheres to the principles established in Law 1581 of 2012:

• Legality: Data processing is conducted in accordance with applicable laws.

• Purpose: Data is collected for specific, legitimate, and explicit purposes.

• Freedom: Processing requires the prior, express, and informed consent of the data subject.

• Accuracy: Information must be truthful, complete, and up to date.

• Transparency: Data subjects have the right to be informed about how their data is processed.

• Restricted Access: Data is accessed only by authorized personnel.

• Security: Measures are implemented to protect data against unauthorized access.

• Confidentiality: Data is handled with strict confidentiality.

PURPOSE OF PERSONAL DATA PROCESSING

Creation and management of clients and suppliers, invoicing and service provision, accounting and financial management, communication via phone and messaging, distribution of promotional materials, internal statistical analysis, delivery of communications and compliance with legal obligations

RIGHTS OF DATA SUBJECTS

The fundamental right to Habeas Data allows data subjects to request access, updates, rectification, and deletion of their personal data held by third parties. They may also revoke previously granted consent for data processing.

Data subjects may request:

A. Update of personal data if it is fragmented or incomplete

B. Rectification or correction if data is inaccurate or misleading

C. Deletion of personal data from databases (data may still be retained for legal purposes)

D. Revocation of consent for data processing, provided it does not conflict with legal obligations requiring data retention

PROCEDURES TO EXERCISE RIGHTS

Requests may be submitted via email to info@afavel.com.co or by mail to Carrera 5 No. 9-26 SUR, Tower 3, Office 611, Cajicá – Cundinamarca. Requests must include:

• Full name and ID of the data subject

• Clear description of the request (e.g., inquiry, rectification, deletion, revocation)

• Supporting documents, if applicable

Response Times:

• Inquiries: Within 10 business days

• Other requests: Within 15 business days, extendable by 8 additional days if necessary

If no response is received within the established timeframe, the data subject may file a complaint with the Superintendence of Industry and Commerce.

SECURITY MEASURES

APLICACIONES FARMACÉUTICAS AFAVEL S.A.S. implements technical, physical, and administrative measures to safeguard personal data, including:

• Encryption of sensitive data on the website and in databases

• Restricted access to databases via passwords and authentication

• Staff training on data protection

• Periodic audits to identify vulnerabilities

• Protocols to prevent unauthorized access, data loss, or alteration

In the event of a security incident, APLICACIONES FARMACÉUTICAS AFAVEL S.A.S. will notify affected data subjects and the Superintendence of Industry and Commerce, as required by law.

DATA TRANSFER AND TRANSMISSION

APLICACIONES FARMACÉUTICAS AFAVEL S.A.S. may transmit personal data to third parties (e.g., logistics or billing providers) solely for the fulfillment of authorized purposes, ensuring that such third parties comply with Law 1581 of 2012. Personal data will not be transferred to third countries unless the data subject has granted express authorization or an adequate level of data protection is guaranteed.

DATA RETENTION PERIOD

Personal data will be retained for the time necessary to fulfill the purposes described or to comply with legal obligations. Once the purpose has been fulfilled, the data will be deleted, unless there is a legal or contractual obligation to retain it.

POLICY AMENDMENTS

APLICACIONES FARMACÉUTICAS AFAVEL S.A.S. may amend this policy at any time, notifying data subjects through the website www.afavel.com.co. Amendments will take effect upon publication.

CONTACT INFORMATION

For any inquiries, requests, or complaints related to the processing of personal data, data subjects may contact:

• Email: info@afavel.com.co

• Phone: (601) 8660995

• Address: Carrera 5 No. 9-26 SUR, Tower 3, Office 611, Cajicá – Cundinamarca

APLICACIONES FARMACÉUTICAS AFAVEL S.A.S. is committed to ensuring the protection of personal data and compliance with applicable regulations.