INTRODUCTION

In accordance with Law 1581 of 2012 and its regulatory decrees, LEANWARE SAS adopts this personal data protection and privacy policy, which regulates the collection, storage, treatment, protection, and administration of the data that "LEANWARE SAS" obtains from its customers, suppliers, employees, and other people with whom LEANWARE SAS has or will have any relationship of any nature.

LEANWARE SAS may modify this policy, in order to adapt it to changes in current legislation and jurisprudence and adapt it to industry practices. In that event, it will announce on its website, or by other appropriate means, the introduction of such changes with due anticipation.

The information that clients, suppliers, employees, or any other person freely and voluntarily provides to LEANWARE SAS by any means, is entered in their databases, for which LEANWARE SAS is responsible.

LEANWARE SAS treats personal data adequately and securely, complying with all legal requirements and following all the parameters of the ISO 27001 standard on Information Security.

GENERAL ASPECTS OF TREATMENT

Identification of the Data Controller:

• LEANWARE SAS, identified with NIT. 901364306, with main address in the city of Bogotá at Carrera 48 # 93-20, website: www.leanware.co, email: ( info@leanware.co ), phone: +57 311 3067851.

Nature of Personal Information Collected:

• LEANWARE SAS will collect contact information and any other information that is pertinent according to the nature of the relationship that LEANWARE SAS maintains with the owner of the data, be it labor, commercial or of any other nature.

In general, the personal data that LEANWARE SAS collects, have the following nature depending on the owner of the data, as follows:

• Interested in business relationships. People who of their own free will contact LEANWARE SAS through their websites, email, telephone calls or other means, in order to request information about their products or services, evaluate possibilities of commercial alliances, provide LEANWARE SAS with their products and services and in general, evaluate the possibility of developing some kind of relationship with the company. In these cases, the information requested is of a basic nature, related to the identification of the person and company to which it belongs, position, email, telephone, city, and subject. Sometimes, when contacted through the LEANWARE SAS website, the company’s servers obtain, for statistical purposes, data in relation to the operating system used by the person who contacts LEANWARE SAS, the version and type of browser .

• Client, suppliers and others. When a definitive commercial relationship is concluded, LEANWARE SAS collects the necessary information to adequately manage said relationship, in accordance with the parameters established in this policy and complying with all the requirements of the law and the respective contracts.

• Interested in joining LEANWARE SAS. People who voluntarily send their CV to the company, in order to be taken into account in the selection processes. The information provided in the CV is used solely for the purposes of the selection, recruitment and hiring process, by the personnel of the area in charge of carrying out said processes. LEANWARE SAS does not share the information collected with any natural or legal person outside the company.

• Employees. Information about employees is strictly confidential and complies with the requirements of Colombian law. It is only used by those who, by reason of their position, have to do with the management of the employment relationship. LEANWARE SAS does not publish data or information related to employees to people outside the employment relationship or to entities and people outside the company.

Information sources: LEANWARE SAS collects information from the following sources:

• Directly from the owner of the information.

• Automatically when the owner of the information uses the LEANWARE SAS websites. The LEANWARE SAS websites use cookies and other tools that collect information from those who visit them; By simply entering these websites, the following information can be automatically obtained:

  • The hyperlinks you have clicked on.

  • Information about the browser you are using.

  • Details of the pages you have viewed.

  • Your IP address.

  • The sites you visited before reaching the Portal.

Taking into account the foregoing, if the Information Owner does NOT want it to be collected automatically, he or she must disable the automatic acceptance settings in their Internet browser. There you can block it, as well as detect when such information is being sent to your computer. It should be taken into account that, if cookies are disabled, the experience on the website may be affected.

• From other sources. LEANWARE SAS may obtain personal information from public databases or from third parties authorized by the owner of the data to share information.

Treatment to which the data will be submitted: The personal information obtained by LEANWARE SAS may be subject to storage, use, circulation, or deletion, depending on the purpose for which it was collected, and / or in accordance with the provisions of the law.

The information subject to Treatment must be true, complete, exact, updated, verifiable, and understandable.

Purpose of the treatment: The information collected by LEANWARE SAS is used, with the authorization of its holders, for the following purposes:

• Offer information about products and services, as well as business opportunities.

• Materialize potential legal relationships with people interested in being clients, suppliers, or employees of LEANWARE SAS.

• Provide the owner of the information with the contracted services, as well as the assistance, consulting, and support necessary to fulfill the obligations arising from the commercial relationship.

• Keep clients updated on the development of commercial processes that are carried out, as well as the offer or execution of services provided by LEANWARE SAS, including cloud services.

• Carry out the necessary steps to comply with the obligations inherent to the services and products contracted with LEANWARE SAS.

• Carry out marketing, promotion, advertising, purchases, service and product improvements, consultations, controls, verifications, alliances, agreements, as well as any other activity related to the services of LEANWARE SAS and its current and future products.

• Keeping internal statistics and evaluating the quality of the products and services offered, as well as the level of satisfaction of customers, suppliers, and interested parties, through satisfaction surveys and other mechanisms that are enabled for this purpose.

• Do your own administrative, accounting, and tax management, including, but not limited to, billing management, collection and payment management, supplier management, client management, and reports to tax authorities.

• Link personnel to the company and comply with their legal obligations as an employer, such as, but not limited to, personnel management, temporary and internship management, payroll management, occupational risk prevention, personnel training, affiliations and payments to the system of social security and labor welfare.

• Comply with its legal and statutory obligations.

• Respond to inquiries, complaints, and claims.

• Carry out activities aimed at controlling and minimizing risks in terms of the security of the physical facilities and virtual sites of the company.

• Transfer and / or transmit data to third parties within or outside the country, if there is a need to do so, provided that said persons guarantee suitable conditions of confidentiality and security of the information transferred and / or transmitted.

• The aforementioned activities, for which personal data are used, are carried out by LEANWARE SAS or by those LEANWARE SAS hires to carry them out, according to their needs. In any case, LEANWARE SAS will ensure that third parties hired to process data comply with these policies and with the parameters established by law.

Treatment of sensitive data: Sensitive data are those that affect the privacy of the owner or whose improper use may generate discrimination, such as those related to their racial or ethnic origin, sexual life, health, biometric data (that is, those that allow a person to be identified by their traits physical, voice, movement, such as: photos, fingerprints, signatures, etc.,) or data related to their religious or philosophical conviction or political orientation.

The owner of the information has the right not to provide sensitive information requested by LEANWARE SAS. Likewise, the owner is recommended to refrain from sending information of a sensitive nature that is not necessary for the provision of LEANWARE SAS services.

Treatment of data of minors: LEANWARE SAS only processes information or personal data of minors that have been collected with the express consent of parents or their legal representatives, as the case may be, and only for those purposes that are relevant in accordance with this policy.

Authorization for the processing of personal data: LEANWARE SAS will inform the owner of the personal information about this policy and will obtain the respective authorization to process their personal data. It will also inform the owner about the changes made to this policy and will obtain a new authorization in case the change refers to the purpose of the treatment.

The authorization may be obtained by LEANWARE SAS by means of a written document, via email, verbally or by telephone, or by any other means that allows the respective authorization to be kept, consulted, or proven. Likewise, the authorization of the holder may be manifested through unequivocal behaviors that allow to reasonably conclude that the authorization was granted. In no case will LEANWARE SAS assimilate the owner’s silence to unequivocal conduct.

Confidentiality: LEANWARE SAS does not make public the personal information of its employees, customers, suppliers, interested parties, or any other person with whom it has a relationship of any kind and will only disclose said information to those persons authorized by LEANWARE SAS who must know it to make the respective treatment of the information or to those persons authorized by law.

DUTIES OF LEANWARE SAS

LEANWARE SAS can be both responsible and in charge of the processing of personal data. In the event that you perform both roles, you must comply with the legal duties of each of them, namely:

Duties of LEANWARE SAS as Data Controller:

As Data Controller, LEANWARE SAS has the following duties:

• Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.

• Request and keep, under the conditions provided in Law 1581 of 2012, and its regulatory decrees, a copy of the respective authorization granted by the Holder;

• Properly inform the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.

• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access.

• Guarantee that the information provided to the Treatment Manager is true, complete, accurate, updated, verifiable, and understandable.

• Update the information, communicating in a timely manner to the Person in Charge of Treatment, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it is kept up-to-date.

• Rectify the information when it is incorrect and communicate the pertinent to the Person in Charge of Treatment.

• Provide the Treatment Manager, as the case may be, only data whose Treatment is previously authorized in accordance with the provisions of Law 1581 of 2012.

• Require the Treatment Manager, at all times, to respect the security and privacy conditions of the Owner’s information.

• Process the queries and claims formulated in the terms indicated in Law 1581 of 2012.

• Adopt an internal manual of policies and procedures to guarantee adequate compliance with the law and, in particular, for the attention of queries and complaints.

• Inform the Treatment Manager when certain information is under discussion by the Holder, once the claim has been submitted and the respective process has not been completed.

• Inform at the request of the Owner about the use given to their data.

• Inform the Superintendency of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the Holders.

• Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

Duties of LEANWARE SAS as Data Controller:

• Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.

• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access.

• Timely update, rectify or delete the data in accordance with the law.

• Update the information reported by the Data Controllers within five (5) business days from receipt.

• Process the queries and claims made by the Holders in the terms indicated in the law.

• Adopt an internal manual of policies and procedures to guarantee adequate compliance with the law and, especially, for the attention of queries and claims by the Holders.

• Register in the database the legends “claim in process” in the manner in which it is regulated by law.

• Insert in the database the legend “information in judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data.

• Refrain from circulating information that is being controversial by the Holder and whose blocking has been ordered by the Superintendency of Industry and Commerce.

• Allow access to information only to people who can have access to it.

• Inform the Superintendency of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the Holders.

• Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

RIGHTS OF THE INFORMATION HOLDER

The holders of the information have the following rights:

• Know, update and rectify personal data against LEANWARE SAS. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized.

• Request proof of the authorization granted to LEANWARE SAS, except when expressly excepted as a requirement for Treatment in accordance with the law.

• Be informed by LEANWARE SAS, upon request, regarding the use that has been given to your personal data.

• Submit complaints to the Superintendency of Industry and Commerce for violations of the personal data protection regime.

• Revoke the authorization and / or request the deletion of personal data when the principles, rights and constitutional and legal guarantees are not respected in the treatment.

• Free access to personal data that have been subject to Treatment.

PROCEDURES

Area responsible for the attention to requests, queries, complaints and claims: The Information Security area will be responsible for responding to the requests, queries, complaints, and claims of the data holders, in accordance with the procedures described below.

Queries: The owner of the information or his successors in title have the right to consult the owner’s personal information, processed by LEANWARE SAS. For this, you can file the query at the address: Carrera 47 # 93-20, Bogotá

​

When making the request, the following information must be provided: If it is the Holder: Copy of the identity document (CC, TI, CE or passport). If it is the successor: Copy of the identity document, civil registration of death of the Holder, document that proves the quality in which he acts and the number of the holder’s identity document. If it is a legal representative and / or attorney: Copy of valid identity document, power of attorney for the process and the holder’s identity document number. The consultation will be answered within a maximum term of ten (10) business days from the date of filing of the same. When it is not possible to attend the consultation within said term, the interested party will be informed of the reasons for the delay and the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the foreground. Claims: The owner of the information has the right to request the updating, rectification and deletion of personal information, as well as revoke the authorization granted to LEANWARE SAS. For this, you can file the claim at the address: Carrera 47 # 93-20, Bogotá DC, or by phone +57 311 3067851, or send it to the email: info@leanware.io. When making the claim, the following information must be provided: If it is the Holder: Copy of the identity document (CC, TI, CE or passport). If it is the successor: Copy of the identity document, civil registration of death of the Holder, document that proves the quality in which he acts and the number of the holder’s identity document. If it is a legal representative and / or attorney: Copy of valid identity document, power of attorney for the process and the holder’s identity document number. Additionally, the request must clearly indicate what is intended with the claim, that is, if an update, correction or deletion of the data or a revocation of the authorization granted to LEANWARE SAS for the Treatment of personal information is required. Likewise, the request must identify the owner, make a description of the facts that give rise to the claim, provide the contact information and provide the documents that you want to enforce. If the application is incomplete, the interested party will be required to correct the failures within five (5) business days after receiving the claim. After two (2) months from the date of the request, without the interested party presenting the required information, it will be understood that the claim has been withdrawn. Once the complete claim is received, the legend “request in process” and the reason for it will be included in the database, within a term not exceeding two (2) business days. Said legend will be kept until the request is determined. The maximum term to attend the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the request within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished. VALIDITY OF THE PRIVACY AND PERSONAL DATA PROTECTION POLICY. This policy will be in force from its disclosure by any means. LEANWARE SAS reserves the right to update or modify it at any time, of which it will give timely notice by any means, to the recipients of the same. VALIDITY OF THE LEANWARE SAS DATABASES The personal databases of LEANWARE SAS will be valid for the period of time required by the law that is applicable, or by the contract that regulates them, or for the time necessary to fulfill the purpose of the database in accordance with this policy. In no case will LEANWARE SAS delete or eliminate databases that by law must remain in force for a specific time, when the period of validity established in the contract that regulates them or the purpose for which they were created, determines a period of validity less than legally established.

​