1. PURPOSE OF THE POLICY: The present POLICY FOR THE PROCESSING OF PERSONAL DATA establishes the terms and conditions in which the personal data that are the subject of collection, storage, use and circulation by AZIMUT ENERGIA SAS, with the purpose of safeguarding the constitutional right that all people have to know, update and rectify the information that has been collected with respect to them in the databases and files owned by AZIMUT ENERGIA SAS, or whose treatment has been entrusted to it by its respective owner; as well as the protection of the other rights, freedoms and constitutional guarantees referred to in articles 15 (right to privacy) and 20 (right to information) of the Political Constitution of Colombia.

2.1 PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA . In the development, interpretation and application of this policy, in compliance with the Guiding Principles enshrined in Law 1581 of 2012, the following principles will be applied in a harmonious and comprehensive manner:

1. a) Principle of legality in terms of Data Processing: The Treatment referred to in this Policy is a regulated activity that must be subject to the provisions of the Law and the other provisions that develop it;
2. b) Principle of purpose: The Treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Holder;
3. c) Principle of freedom: The Treatment can only be exercised with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent;
4. d) Principle of veracity or quality: The information subject to Processing must be truthful, complete, accurate, up-to-date, verifiable and understandable. The Processing of partial, incomplete, fragmented or misleading data is prohibited;

1. e) Principle of transparency: In the Treatment, the right of the Owner to obtain from the person in charge of the Treatment or the Person in Charge of the Treatment, at any time and without restrictions, information about the existence of data that concerns him or her;
2. f) Principle of access and restricted circulation: The Treatment is subject to the limits derived from the nature of personal data, the provisions of this law and the Constitution. In this sense, the Treatment can only be done by persons authorized by the Owner and/or by the persons provided for in the Law;

Personal data, except public information, may not be available on the Internet or other means of disclosure or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties in accordance with this law;

1. g) Principle of security: The information subject to Treatment by the person in charge of the Treatment or in Charge of the Treatment referred to in this Policy, must be handled with the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, unauthorized or fraudulent use or access;
2. h) Principle of confidentiality: All persons involved in the Processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that the Processing comprises, and may only supply or communicate of personal data when this corresponds to the development of the activities authorized in this law and in the terms thereof.

3. AREA OF APPLICATION: The scope of application of this Policy, in accordance with Law 1581 of 2012, Decrees 1377 of 2013, 886 of 2014 and the Single Regulatory Decree 1074 of 2015, will be limited to the data of natural persons registered in all databases. owned by AZIMUT ENERGIA SAS, or whose treatment is entrusted to it, provided that the treatment of the same is carried out in Colombian territory or within the framework of a relationship to which Colombian legislation regarding international norms and treaties is applicable. On the contrary, the personal data protection regime established in this Policy will not be applicable to:

1. a) The databases or files maintained in an exclusively personal or domestic environment;
2. b) The databases and archives whose purpose is national security and defense, as well as the prevention, detection, monitoring and control of money laundering and the financing of terrorism;
3. c) Databases that have as their purpose and contain intelligence and counterintelligence information;
4. d) Databases and archives of journalistic information and other editorial content;
5. and) The databases and files regulated by Law 1266 of 2008, “by which the general provisions of habeas data are dictated and the handling of the information contained in personal databases is regulated, especially financial, credit, commercial, of services and that from third countries and other provisions are dictated”; Y
6. f) The databases and files regulated by Law 79 of 1993, “by which the carrying out of Population and Housing Censuses throughout the national territory is regulated.”

4. RECIPIENTS OF THIS POLICY : This POLICY will apply and therefore will bind the following people:

4.1. Legal representatives and/or corporate administrators.

4.2. Internal personnel of AZIMUT ENERGÍA SAS, directors or not, who guard and process personal databases.

4.3. Contractors and natural persons who provide their services to AZIMUT ENERGÍA SAS, under any type of contractual modality, by virtue of which any processing of personal data is carried out.

4.4. The Shareholders, statutory auditors and those other persons with whom there is a legal relationship of statutory order.

4.5. Public and private persons as users of personal data.

4.6. The other persons established by law.

5. DEFINITIONS : For a better understanding of the scope of the provisions contained in this Policy, some of the terms used in it have the meaning indicated below:

5.1. Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data.

5.2. Notice of Privacy: Verbal or written communication generated by the person in charge, addressed to the Owner for the Treatment of their personal data, through which they are informed about the existence of the information Treatment policies that will be applicable, the way to access them and the purposes of the Treatment that is intended to be given to the personal data.

5.3. Database: Organized set of personal data that is subject to Treatment.

5.4. Personal data: Any information linked or that can be associated with one or more specific or determinable natural persons.

5 . 5. Public data: It is the data that is not semi-private, private or sensitive. Public data is considered, among others, data related to the marital status of people, their profession or trade and their quality as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial decisions that are not subject to reservation.

5.6. Sensitive data: Sensitive data is understood as that which affects the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, of human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.

5.7. Treatment Manager: Person who by himself or in association with others, performs the Processing of personal data on behalf of the person responsible for the Treatment. For the purposes of this Policy, it will be considered AZIMUT ENERGÍA SAS , as data controller.

5.8. Responsible for Treatment: Person who, by himself or in association with others, decides on the database and/or the processing of the data. For the purposes of this Policy, it will be considered AZIMUT ENERGÍA SAS , as data controller.

5.9. Owner: Natural person whose personal data is subject to Treatment.

5.10. Treatment: Any operation or set of operations on personal data of the Owner, such as collection, storage, use, circulation or deletion.

5.11. Transfer: The transfer of data takes place when the person in charge and/or Person in Charge of the Treatment of personal data, located in Colombia, sends the information or personal data to a receiver, who in turn has the quality of person in charge of the Treatment and is within or out of the country.

5.12. Transmission: Treatment of personal data that implies the communication of the same inside or outside the territory of the Republic of Colombia when it has as its purpose the realization of a Treatment by the Manager on behalf of the person in charge.

6. DATABASES: AZIMUT ENERGÍA SAS is responsible and in charge of the databases detailed below:

6.1. DATABASE OF EMPLOYEES AND HUMAN MANAGEMENT :

• DESCRIPTION: It is a database to manage the information concerning the personnel that enters to work in the company, as well as that of the pensioners of the same (if any). It also includes information on people who have applied as candidates for a job position within AZIMUT ENERGIA SAS ; and to people who carry out their professional practices in the company; extending, all of the above, to staff, interns, pensioners and candidates.

• CONTENT: The data of workers, interns, pensioners (if any) and candidates that are collected and processed are the following: names, surnames, identity document, date of birth, address, residence address, marital status, salary, amount of pension, email, all social security administrative entities to which the person belongs, degree of schooling, institutions where he received schooling, work experience and companies where he has worked, account number to make payroll deposits and social benefits, financial entities for payroll deductions, legal proceedings that imply garnishment of wages, disability certificates of workers and employees, diagnoses and medical records related to disabilities presented by the worker, work records, as well as data related to your group family (i.e. name, relationship, identity document, age and marital status).

• HOW DATA IS COLLECTED: The data that is collected for this database is contained in employment contracts, apprenticeship contracts, and in all the relevant and pertinent information that the employee or intern must provide to carry out the hiring process and affiliation to the system of social security, including the information required in the affiliation forms handled by each of the social security entities. Likewise, in front of candidates and employees, personal data is collected through information that they themselves provide; as well as in personal interviews that are carried out as part of the selection process for future employees or interns.

• PURPOSE: The aforementioned data is only collected for the purpose of administering and managing payroll payments, social security and the administration of personnel and pensioners in general. Likewise, it is used to choose possible candidates who participate in the different selection processes carried out by the company, for which the information provided may be the object of study, validation or comparison in order to corroborate its veracity and suitability.

Similarly, this information is used, as appropriate, for the purposes of procedures related to the Occupational Health and Safety policy within AZIMUT ENERGÍA SAS .

Eventually, this information may also be used to provide referential information about the employee, when the employee has expressly requested it, to provide information to the “CONFE” Employee Fund, to auditors, information between AZIMUT ENERGÍA SAS, or to respond to legal requirements from entities administrative and judicial.

• TREATMENT : This Database is subject to the following treatment:

1. a) The information is collected by the different processes, within the company, whose activity is related to the hiring and management of personnel, as well as the payment of payroll and social security.
2. b) The information is ordered, catalogued, classified, divided or separated and stored in a physical or electronic file.
3. c) The information is updated.
4. d) If possible, a backup copy (back-up) of the information stored electronically is made.
5. e) It is not used to offer third party services or products.
6. f) It is not used for any other purpose than that established in this document.
7. g) Part of this information is sent to the social security entities (AFP, ARL, EPS; Compensation Funds) at the time of affiliation and payment of contributions to these entities, as well as sent as reports to the National Tax and Customs Office. -DIAN, and financial entities with which there are agreements for payroll discounts, as well as the “CONFE” Employee Fund for those people who have the double quality of workers and members of said Fund.

• VALIDITY: This information is kept in our databases during the term of the contract of the worker, trainee or apprentice, and for the time that, in accordance with the Substantive Labor Code, Law 100 of 1993 and the regulations of the General Archive of the Nation, required, which is currently 80 years old.

Likewise, this information, once the employment relationship or apprenticeship contract ends, is left in a database whose purpose is to serve as a query history. This same database stores the information of those who, having applied or having participated in a selection process, have not been chosen, in order to take them into account if their profile is suitable for future calls.

6.2. DATABASE OF SUPPLIERS AND CONTRACTORS :

• Description : The Database of Suppliers and Contractors corresponds to the information that AZIMUT ENERGÍA SAS collects from its natural person suppliers/contractors, both for goods and services, as well as their employees.

• Content : The data collected from the suppliers/contractors or their employees are the following: name, surnames, identity document, NIT and other tax information, telephone number, domicile and address, membership of the simplified/common regime, Internet, email, cell phone, fax, economic activity code.

• Form in which the data is collected : The data that is collected for this database comes from the information sent to us by those who are or aspire to be suppliers/contractors of AZIMUT ENERGÍA SAS In particular, the information that is collected is contained in quotes or commercial offers, as well as in contracts of all kinds entered into with suppliers and contractors. In the same way, information contained in the documentation requested from each supplier or contractor is collected for the purposes of the corresponding commercial relationship, such as commercial registration as a natural person merchant, RUT in force, bank certifications, commercial certifications, invoices and/or collection accounts, and supports of affiliations and payment of social security of their employees.

• Purpose : The treatment of this data is carried out in order to be able to establish contractual relationships with suppliers and contractors that allow the acquisition of the goods and services that AZIMUT ENERGÍA SAS required for the normal operation of the ordinary course of business (including the purchase of supplies) and for the adequate provision of its facilities or offices. For this purpose, suppliers and contractors will be sent invitations to offer or participate in bidding processes for the acquisition of goods and services.

• Treatment : This Database is subject to the following treatment:

1. a) The information is collected by the different processes, within the company, whose activity is related to the hiring of suppliers and contractors.
2. b) The information is ordered, catalogued, classified, divided or separated and stored in a physical or electronic file
3. c) The information is updated.
4. d) If possible, a backup copy (back-up) of the information stored electronically is made.
5. e) It is not used to offer third party services or products.
6. f) It is not used for any other purpose than that established in this Policy.
7. g) Said information is only handled internally.

• Validity : This information is kept in our databases during the validity of the commercial relationship with suppliers or contractors and for 10 more years, in accordance with the regulations of the Commercial Code.

6.3. CLIENTS AND STRATEGIC ALLIES DATABASE :

• Description : The Customer Database corresponds to the information that AZIMUT ENERGÍA SAS collects from its customers and strategic allies-individuals.

• Content : The information that is collected for this database includes: name, surnames, identity document, telephone, cell phone, fax, address, email, Internet page.

• Form in which the data is collected : The data that is collected for this database comes from the information directly provided to us by those who are clients and strategic allies of AZIMUT ENERGÍA SAS, by sending communications and exchanging documentation/information .

• Purpose: The aforementioned data is collected for the purpose of establishing business relationships. Likewise, this information is used to send messages of thanks, Christmas, congratulations, among other matters of corporate protocol.

AZIMUT ENERGÍA SAS , will use the personal data of the shareholders, for the purposes derived from the existing statutory relationship.

• Treatment : This Database is subject to the following treatment:

1. a) The information is collected.
2. b) It is stored in a physical file or on electronic media.
3. c) The information is updated.
4. d) If possible, a backup copy (back-up) of the information stored electronically is made.
5. e) It is not used to offer third party services or products.
6. f) It is not used for any other purpose than that established in this Policy.
7. g) Said information is only handled internally.

• Validity : This information is kept in the databases during the validity of the commercial relationship with clients and strategic allies, and for 10 more years, in accordance with the rules of the Commercial Code.

6.4. SHAREHOLDERS DATABASE :

• Description : The Database of the Company’s Shareholders corresponds to the information that AZIMUT ENERGÍA SAS collects from its Shareholders-natural persons.

• Content : The information that is collected for this database includes: name, surnames, identity document, telephone, cell phone, fax, address, email.

• Form in which the data is collected : The data that is collected for this database comes from the information directly provided to us by those who are shareholders of AZIMUT ENERGÍA SAS, through the subscription of corporate documents and the exchange of documentation/information.

• Purpose: The aforementioned data is collected in order to maintain relationships and/or corporate links. Likewise, this information is used to send corporate information such as: agreements, minutes, memorandums of understanding, and all information related to the status and evolution of the Company; Likewise, it is used to send messages of thanks, Christmas, congratulations, among other matters of corporate protocol.

The Personal Data of the Company’s shareholders will be considered reserved information, since it is registered in the trade books and is reserved by law. Consequently, access to such personal information will be carried out in accordance with the rules contained in the Commercial Code, which regulate the matter.

AZIMUT ENERGÍA SAS , will use the personal data of the shareholders, for the purposes derived from the existing corporate and statutory relationship.

• Treatment : This Database is subject to the following treatment:

1. a) The information is collected.
2. b) It is stored in a physical file or on electronic media.
3. c) The information is updated.
4. d) If possible, a backup copy (back-up) of the information stored electronically is made.
5. e) It is not used to offer third party services or products.
6. f) It is not used for any other purpose than that established in this Policy.
7. g) Said information is only handled internally.

• Validity : This information is kept in the databases during the term of the corporate relationship with the Shareholders, and for 10 more years, in accordance with the rules of the Commercial Code.

6.5. VIDEO SURVEILLANCE CAMERAS (SV) DATABASE :

• Description : The Company’s Video Surveillance Cameras (SV) Database corresponds to the images of specific or determinable people, operations such as capture, recording, transmission, storage, conservation, or reproduction in real time or later, among others, that circulate in the facilities of AZIMUT ENERGÍA SAS. located at Calle 16B Sur 41-91 B Medellín- Antioquia

• Content : The information that is collected for this database includes: images of certain or determinable people who circulate in the facilities of AZIMUT ENERGÍA SAS. located at Calle 16B Sur 41-91 B Medellín- Antioquia

These monitoring and observation tasks carried out through video surveillance systems involve the collection of images of people, that is, personal data in accordance with the definition contained in letter c) of article 3 of Law 1581 of 2012.

• Principles: In the handling or Treatment of these data, the principles established in Law 1581 of 2012 must also be observed, that is, legality, purpose, freedom, quality or veracity, security, confidentiality, restricted access and circulation, and transparency.

• Form in which the data is collected : The data that is collected for this database comes from the video surveillance systems (SV) installed inside the offices of AZIMUT ENERGÍA SAS. located in the Calle 16B Sur 41-91 B Medellín- Antioquia, which are located only in entry-exit areas and public circulation, respecting the places where private activities are carried out such as: bathrooms, rest areas; feeding areas. The video surveillance cameras are visible and duly marked with legible signs indicating “You are being recorded and monitored by CCT”

• Purpose: The Video Surveillance Systems (SV) or security cameras implemented in order to guarantee the safety of goods or people in the facilities of AZIMUT ENERGÍA SAS located in the Calle 16B Sur 41-91 B Medellin- Antioquia, being considered as an ideal means to carry out the monitoring and observation of activities in the business and labor scenario.

For the collection of data (images), the Holder expresses his authorization, either by means of a privacy notice (In the case of Workers and collaborators); by filling out the format (in the case of visitors); orally in the case of people who occasionally enter the facilities and remain there for a period of less than thirty (30) minutes. Having the manifestation and express consent of the owners: (i) in writing, (ii) orally, or (iii) through unequivocal conduct.

Consequently, access to such personal information will be carried out in accordance with the rules contained in the Colombian Legislation that regulate the matter.

AZIMUT ENERGIA SAS, will use the personal data of the owners, only in order to safeguard the security of goods or people in the facilities of AZIMUT ENERGÍA SAS, and these images are only used for this purpose. These data will be used in the event of any event or circumstance that threatens the security of goods or people within the Company and may be forwarded to the competent authorities, to clarify any criminal act.

• Treatment : This Database is subject to the following treatment:

1. a) The information is collected.
2. b) It is stored in electronic media and in the same Video Surveillance System (SV)
3. c) The information is updated.
4. d) If possible, a backup copy (back-up) of the information stored electronically is made.
5. e) It is not used to refer third parties, with the exception of the competent Authorities in case of being required by them or in case of needing to clarify any criminal act.
6. f) It is not used for any other purpose than that established in this Policy.
7. g) Said information is only handled internally.

• Validity : The images will be kept only for the time strictly necessary to fulfill the purpose of the Video Surveillance System.

7. RIGHTS OF THE DATA HOLDERS : The rights of the Data Holders are:

1. to) Know, update and rectify your personal data in front of those responsible for the Treatment or in Charge of the Treatment. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Treatment is expressly prohibited or has not been authorized;
2. b) Request proof of the authorization granted to the person responsible for the Treatment, except when expressly excepted as a requirement for the Treatment, in accordance with the provisions of article 10 of Law 1581 of 2012;
3. c) Be informed by the person in charge of the Treatment or the Person in Charge of the Treatment, upon request, regarding the use that has been given to their personal data;
4. d) Submit complaints to the Superintendency of Industry and Commerce for infractions of the provisions of Law 1581 of 2012, and the other regulations that modify, add or complement it;
5. and) Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that in the Treatment the person in charge or in Charge has incurred in conduct contrary to Law 1581 of 2012 and the Political Constitution of Colombia;
6. f) Free access to your personal data that has been subject to Treatment.

8. SENSITIVE DATA: Sensitive Data Holders have the right to choose not to respond to any sensitive information requested by AZIMUT ENERGIA SAS, related, among others, to data on your racial or ethnic origin, membership in trade unions, social or human rights organizations, political, religious, sexual life, biometric or health data convictions. However, the information related to the state or health condition, YES, must be reported without exception in cases of medical or health emergency and to prevent, treat or control the spread of infectious and contagious diseases and/or a Pandemic as declared by the World Organization of Health “WHO”

The collection and use of sensitive data may be provided to Local or Health Authorities in cases of medical or health emergency and to prevent, treat or control the spread of infectious and contagious diseases and/or a Pandemic declared by the World Health Organization. “WHO”

The provision of information and sensitive data complies with the Principles of: PURPOSE: Data processing is done to prevent, treat or control the spread of infectious diseases and/or a Pandemic declared by the World Health Organization “WHO” and mitigate its effects. ACCESS AND RESTRICTED CIRCULATION: Only authorized persons can access this data and the information will only be used to prevent or treat infectious diseases and/or a Pandemic. SECURITY: Security measures are adopted to avoid adulteration, loss, consultation, use or unauthorized access to this information. VERACITY: It is intended that people provide true, truthful, complete, accurate and updated information and data, in order to receive appropriate care.

9. DATA OF MINORS : The provision of personal data of minors is optional and must be done with the express authorization of the parents or legal representatives of the minor.

The collection and use of sensitive data of minors may be provided to the Local or Health Authorities in cases of medical or health emergency and to prevent, treat or control the spread of infectious and contagious diseases and/or a Pandemic declared by the Organization. World Health Organization “WHO”.

10. SECURITY MEASURES APPLIED TO THE TREATMENT OF DATABASES : AZIMUT ENERGÍA SAS , have adopted reasonable security measures to protect the information of the Holders and prevent unauthorized access to their data or any unauthorized modification, disclosure or destruction thereof. Access to personal data is restricted to those employees, contractors, representatives and agents of AZIMUT ENERGIA SAS, in charge of data processing and who need to know the same to perform their functions and develop the corporate purpose of the Company. AZIMUT ENERGIA SAS, do not allow access to this information by third parties under conditions other than those announced, except at the express request of the owner of the data or legitimate persons in accordance with national regulations.

11. PROCEDURES FOR THE HOLDERS TO EXERCISE THEIR RIGHTS : The Holders of the personal information that rests in the databases described in this Policy, as well as their successors in title, their representatives or attorneys-in-fact, may exercise the rights that the laws confer on them, through the following procedures:

11.1. Information query: Proof of authorization for the processing of Personal Data granted to AZIMUT ENERGÍA SAS may be requested., as well as knowing, updating and rectifying the personal data that is the material object of the treatment. For this, the Holder may formulate his queries by means of written communication to the email habeasdata@azimutenergia.co or by calling (57-4) 336 00 17 or by email from Monday to Friday between 8:00 AM and 12:00 M and between 2:00 PM and 5:30 P.M.

When making the request for consultation, the Holder must present the following documents:

1. a) If it is the Holder, you must present or attach a copy of the identity document.
2. b) If it is a successor in title, you must show the identity document, civil death record of the Holder, a document that proves the quality in which he acts and the number of the Holder’s identity document.
3. c) If it is a legal representative and/or proxy, you must present a valid identity document, a document that proves the capacity in which it acts (special or general Power of Attorney) and the number of the Holder’s identity document.

The query will be answered within a maximum term of ten (10) business days counted from the date of filing of the query. When it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their query will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

The Holder may access his personal data free of charge and the requested information may be provided by any means, including electronic means, as required.

11.2. claims: The Owner of the data, their successors in title, their representatives or attorneys-in-fact who consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the legislation applicable, they may file a claim with AZIMUT ENERGÍA SAS , in accordance with the following procedure:

To request the correction, update or deletion of the personal information contained in our databases, or to revoke the authorization granted for its Treatment, the Holder may make his written request for Monday to Friday from 8:00 AM to 12:00 PM and 2:00 PM to 5:30 PM to email habeasdata@azimutenergia.co or by calling (57-4) 336 00 17.

The request must explicitly indicate the intention to correct, update or delete the personal data from our databases or to revoke the authorization granted for the treatment of the same. Likewise, the request must be made clearly identifying the name of the Holder, the number of his identity document and his contact information (updated telephone and email), the description of the facts that give rise to the claim, accompanied by the documents that you want to assert.

When making the request for correction, updating, modification or deletion, the following documents must be presented:

1. a) If it is the Holder, you must present or attach a copy of the identity document.
2. b) If it is a successor in title, you must show the identity document, civil death record of the Holder, a document that proves the quality in which he acts and the number of the Holder’s identity document.
3. c) If it is a legal representative and/or proxy, you must present a valid identity document, a document that proves the capacity in which it acts (special or general Power of Attorney) and the number of the Holder’s identity document.

If the request is incomplete, the interested party will be required within five (5) days after receiving it to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

In the event that the person who receives the claim is not competent to resolve it, he or she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.

Once the complete application is received, the legend “claim in process” will be included in the database, in a term not exceeding two (2) business days. and the reason for it. Said legend will remain until the claim is decided.

The maximum term to respond to the request will be fifteen (15) business days from the day following the date of receipt. When it is not possible to meet the request within said term, the interested party will be informed of the reasons for the delay and the date on which their request will be met, which in no case may exceed eight (8) business days following the expiration of the first finished.

PARAGRAPH. The Holder or his successor in title may only file a complaint with the Superintendence of Industry and Commerce once he has exhausted the process of consultation or claim before the person in charge of the Treatment or in Charge of the Treatment.

12. DESIGNATION OF DEPARTMENT OR PERSON IN CHARGE OF PROCESSING FOR THE DATA HOLDER TO EXERCISE THEIR RIGHTS OF REQUESTS, QUERIES AND CLAIMS. The Communications process will be in charge of directing the other processes or dependencies to process the queries, complaints, claims and requests related to the Treatment and protection of personal data of workers, interns, pensioners, clients, contractors, suppliers and other owners of the personal data handled by the company(ies) in your databases.

Contact details are:

ADDRESS : Cl 16B Sur 41-91 B Medellín- Antioquia

CITY : Medellin- Antioquia (Colombia)

PHONE : (57-4) 336 00 17

MAIL : habeasdata@azimutenergia.co

13. DELIVERY OF PERSONAL DATA TO AUTHORITIES . When the State authorities request AZIMUT ENERGÍA SAS, the access and/or delivery of Personal Data contained in any of its Databases, the legality of the request will be verified, the relevance of the data requested in relation to the purpose expressed by the authority, and the delivery of the request will be documented. requested personal information providing that it complies with all its attributes (authenticity, reliability and integrity), and noting the duty of protection over these data, both to the official who makes the request, to the person who receives it, as well as to the entity for the which these work. The authority that requires the personal information will be warned about the security measures that apply to the Personal Data delivered and the risks that its improper use and inadequate Treatment entail. The content of the procedure must be adapted at all times to the provisions in force regarding the security of personal data.

14. EFFECTIVE DATE OF THE POLICY: This Policy is effective as of June twenty-four (24), two thousand and twenty (2020) and will be effective while the Databases to which it refers are in force. This Policy has been adopted and approved by the Legal Representative of the Company, on the twenty-third (23rd) day of June, two thousand and twenty (2020).

MARCH 2021 UPDATE : The update of this Policy is effective as of March fifteen (15), two thousand and twenty-one (2021) and will be effective while the Databases to which it refers are in force.