In compliance with Statutory Law 1581 of 2012 and Regulatory Decree 1377 of 2013 in the processing of personal data, in accordance with article 15 of the Colombian Constitution of Habeas Data, BUENAHORA S.A.S., hereinafter MICHÚ, adopts this policy in personal data processing. This way, the rights of privacy, intimacy and goodwill are guaranteed in the processing of personal data; and, consequently, all actions will be governed by the principles of legality, purpose, freedom, veracity or quality, transparency, access and restricted circulation, security, and confidentiality.

SCOPE: This policy applies to all personal information registered in the MICHÚ databases, who is responsible for the processing of personal data.

OBLIGATIONS: This policy is mandatory and shall be strictly enforced for MICHÚ.

RESPONSIBLE FOR PROCESSING: BUENAHORA S.A.S, a company legally established in Colombia, holder of Taxpayer Identification Number 805.022.251-7, with main address at Calle 2 Oeste No.2-38 in the city of Cali, Republic of Colombia. Website www.michu.com.co,Telephone (2) 8921713 in the city of Cali-Colombia.

PROCESSING AND PURPOSE: MICHÚ will carry out processing personal information as follows: collection, storage, use, circulation to carry out the pertinent steps for the development of the company’s corporate purpose related to the fulfillment of the object of the contract entered into with the Holder of the information, make invitations to events and offer new products, manage procedures (requests, complaints, claims), carry out satisfaction surveys regarding the goods offered, provide contact information to the commercial force and / or distribution network, tele marketing, market research and any third party with which MICHÚ has a contractual link for the development of activities of this type (market research and telemarketing, etc.) for the execution of the same. Contact the Holder by telephone to carry out surveys, studies and/or confirmation of personal data necessary for the execution of a contractual relationship. Contact the Holder through electronic means – SMS or chat – to send news related to loyalty campaigns or service improvement. Contact the Holder via email to send invoices regarding the obligations arising from the contract entered between the parties.

RIGHTS OF THE HOLDERS: As holder of your personal data, you have the right to: (i) Have free access to the data provided by you, which have been processed. (ii) Know, update, and correct your information in case there is partial, inaccurate, incomplete, fragmented, misleading data, or that information whose processing is prohibited or has not been authorized. (iii) Request proof of the authorization granted. (iv) Submit to the Superintendency of Industry and Commerce (SIC) complaints for violations of the provisions of current regulations. (v) Revoke the authorization and/or request the deletion of the data, provided there is no legal or contractual duty that prevents their deletion. (vi) Refrain from answering questions about sensitive data.

ASSISTANCE OF PETITIONS, INQUIRIES AND CLAIMS: Customer Service Area is the unit in charge of processing the requests of holders to enforce their rights. To receive and handle requests, queries, and claims, you can do so through the email customercare@michu.com.co or Tel (2) 8921713, Cell Phone 318 3491787.

PROCEDURE TO EXECUTE THE RIGHT OF HABEAS DATA In compliance with the regulations on personal data protection, MICHÚ presents the procedure and minimum requirements for the exercise of your rights: For the filing and attention of your request, we ask you to provide the following information:

• Full name and surnames
• Contact information (Physical and/or electronic address and contact telephone numbers)
• Means to receive a response to your request
• Reason(s)/event(s) giving rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete it, access information)
• Signature (if applicable) and identification number.

The maximum term provided by law to resolve your claim is fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to address the claim within said term, MICHÚ will inform the interested party of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

Once the terms indicated by Law 1581 of 2012 and the other regulations that legalize or complement it have been fulfilled, the Holder who is denied, totally or partially, the exercise of the rights of access, update, rectification, deletion, and revocation, may report your case to the Superintendency of Industry and Commerce –Delegation for the Protection of Personal Data-.

VALIDITY: This Policy for the Treatment of Personal Data is effective as of November 1, 2019. The databases in which personal data will be registered will have a validity equal to the time in which the information is maintained and used for the purposes described in this policy. Once that purpose(s) is/are fulfilled and if there is no legal or contractual duty to keep your information, your data will be removed from our databases.