To establish guidelines for the collection, storage, use, circulation, updating, retention, and deletion of personal data processed by CM CONSULTING S.A.S., ensuring the protection of data subjects' rights and compliance with Law 1581 of 2012, Decree 1074 of 2015, and all other applicable provisions.

This policy applies to all personal data collected, stored, or processed by CM CONSULTING S.A.S. in the course of its commercial, administrative, contractual, and employment activities.

It applies to:

• Customers.
• Suppliers.
• Contractors.
• Employees.
• Job applicants.
• Visitors.
• Any other natural person whose data is processed by the organization.
• Solutions and customers that interact with the organization's platform.

Every employee, contractor, or third party with access to personal data must comply with this policy, including after their relationship with the organization has ended.

CM CONSULTING S.A.S. may process personal data for the following purposes:

• Management of commercial and contractual processes.
• Provision of consulting services.
• Customer and supplier management.
• Administrative and financial management.
• Human talent management.
• Compliance with legal and regulatory obligations.
• Handling requests, complaints, claims, and inquiries.
• Information security management.
• Access control for facilities and information assets.
• Sending information related to the organization's services.
• Internal and external audits.
• Compliance with contractual requirements.

The processing of personal data requires the data subject's prior, express, and informed authorization, except where otherwise provided by law.

Authorization may be obtained through:

• Physical or electronic forms.
• Contracts.
• Emails.
• Web portals.
• Acceptance checkboxes.
• Any other mechanism that preserves evidence of the authorization granted.

Data subjects have the right to:

• Access, update, and rectify their personal data.
• Request proof of the authorization granted.
• Be informed about how their data has been used.
• Submit inquiries or claims.
• Request the deletion of their data when appropriate.
• Revoke their authorization when applicable.
• File complaints with the Superintendence of Industry and Commerce.

CM CONSULTING S.A.S. will implement reasonable administrative, physical, and technological measures to protect personal data against:

• Unauthorized access.
• Loss.
• Alteration.
• Disclosure.
• Misuse.
• Accidental or intentional destruction.

These measures include access controls, authentication, password management, secure information storage, staff training, and other controls defined in the Information Security Management System.

Personal data will be retained only for the time necessary to fulfill the purposes for which it was collected and to meet legal, contractual, or regulatory obligations.

At the end of the retention period, provided there is no litigation, regulatory investigation, or active audit requiring the data to be retained, CM CONSULTING S.A.S. will securely delete it.

Data subjects may exercise their rights by submitting a request to the email address designated by the organization.

Response times

• Inquiries: CM CONSULTING S.A.S. will respond within ten (10) business days from the date the request is received. If the request cannot be handled within that period, the data subject will be informed of the reasons for the delay and the date on which the request will be addressed, which may not exceed five (5) business days after the first period expires (Article 14, Law 1581 of 2012).
• Claims: If a data subject believes the information must be corrected, updated, or deleted, or becomes aware of an alleged breach of the duties set out in Law 1581 of 2012, they may submit a claim. CM CONSULTING S.A.S. will address it within fifteen (15) business days beginning on the day after receipt. If it cannot be handled within that period, the data subject will be informed with justification before the deadline, and the response period may not exceed eight (8) additional business days (Article 15, Law 1581 of 2012).

CM CONSULTING S.A.S. may amend this policy when necessary due to regulatory, technological, operational, or business changes.

Amendments will be communicated through the organization's official channels.