NAME OF INSTITUTION: ABL Dental Solutions S.A.S., hereinafter referred to as LABORATORY BIODENTAL ART.

ADDRESS AND ADDRESS: ARTE BIODENTAL LABORATORIO is domiciled in the city of Envigado, and its only headquarters is located at Carrera 48 Nro. 25 AA Sur – 70 Office 514, Ed. Complex las vegas.

EMAIL: [email protected]

PHONE: (57-4) 271 90 26

Political Constitution, article 15.

Law 1266 of 2008.

Law 1581 of 2012.

Regulatory Decrees 1727 of 2009 and 2952 of 2010.

Partial Regulatory Decree 1377 of 2013.

Judgments C – 1011 of 2008, and C – 748 of 2011, of the Constitutional Court.

This policy will be applicable to personal data registered in any database of ARTE BIODENTAL LABORATORIO, whose owner is a natural person.

For the purposes of this policy and in accordance with current regulations on the protection of personal data, the following definitions shall be taken into consideration:[1]

Authorization: Prior, express and informed consent of the Holder to carry out the Processing of personal data.

Privacy notice: Verbal or written communication generated by the Responsible, addressed to the Holder for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, the way to access them and the purposes of the treatment that is intended to give to personal data.

Database: Organized set of personal data that is subject to treatment.

Assignee: Person who has succeeded another by reason of the death of the latter (heir).

Personal data: Any information linked or that can be associated with one or more determined or determinable natural persons.

Public data: It is the data that is not semi-private, private or sensitive. Public data includes, inter alia, data relating to the civil status of persons, their profession or trade and their status as a trader or public servant. By their nature, public data may be contained, inter alia, in public registers, public documents, official gazettes and bulletins, and duly enforceable court judgments that are not subject to confidentiality.

Sensitive data: Sensitive data is understood to be those that affect the privacy of the Holder or whose improper use may generate discrimination, such as revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights or that promotes the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.

Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller.

Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the Treatment of the data.

Holder: Natural person whose personal data are subject to Treatment.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

Transfer: The transfer of data takes place when the person responsible and/or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is inside or outside the country.

Transmission: Treatment of personal data that involves the communication of the same inside or outside the territory of the Republic of Colombia when the purpose of the processing is to be carried out by the processor on behalf of the controller.

[1] The definitions included in this document are taken from the regulations in force in Colombia that govern the protection of personal data.

In order to guarantee the protection of personal data, ARTE BIODENTAL LABORATORIO shall apply the following principles in a harmonious and comprehensive manner, in the light of which the treatment, transfer and transmission of personal data must be carried out:²

Principle of legality in terms of Data Processing: Data processing is a regulated activity, which must be subject to the current and applicable legal provisions governing the subject.Principle of purpose: The activity of the processing of personal data carried out by ARTE BIODENTAL LABRATORIO or to which it has access, shall obey a legitimate purpose in accordance with the Political Constitution of Colombia, which shall be informed to the respective owner of the personal data.

Principle of freedom: The processing of personal data can only be carried out with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that relieves consent.

² The principles included in this document are taken from the regulations in force in Colombia that govern the protection of personal data.

Principle of truthfulness or quality: The information subject to Personal Data Processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.

Principle of transparency:  In the processing of personal data, ARTE BIODENTAL LABORATORIO will guarantee the Holder the right to obtain at any time and without restrictions, information about the existence of any type of information or personal data that is of interest or ownership.

Principle of access and restricted circulation: The processing of personal data is subject to the limits that derive from the nature of these, the provisions of the law and the Constitution. Consequently, the processing may only be carried out by persons authorized by the owner and / or by the persons provided for by law. Personal data, except for public information, may not be available on the internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the holders or third parties authorized by law.

For these purposes the obligation of ARTE BIODENTAL LABORATORIO, will be of means.

Principle of security: The information subject to treatment by ARTE BIODENTAL LABORATORIO, must be handled with the technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

Principle of confidentiality: All persons who in ARTE BIODENTAL LABORATORIO, administer, manage, update or have access to information of any kind found in Databases, are obliged to guarantee the confidentiality of the information, so they undertake to keep and maintain strictly confidential and not disclose to third parties,  all information that they come to know in the execution and exercise of their functions; except in the case of activities expressly authorized by the law of data protection. This obligation persists and will be maintained even after the end of your relationship with any of the tasks included in the Treatment.

In accordance with the provisions of current applicable regulations on data protection, the following are the rights of the holders of personal data:

a) Access, know, update and rectify your personal data in front of ARTE BIODENTAL LABORATORIO in its capacity as responsible for the treatment. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized.

b) Request proof of the authorization granted to ARTE BIODENTAL LABORATORIO for data processing, by any valid means, except in cases where authorization is not required.³

c) Be informed by ARTE BIODENTAL LABORATORIO, upon request, regarding the use you have given to their personal data.

d) Submit to the Superintendence of Industry and Commerce, or the entity that takes its place, complaints for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it, after consultation or request to ARTE BIODENTAL LABORATORIO.

e) To revoke the authorization and / or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees.

f) Access free of charge to their personal data that have been subject to processing, at least once each calendar month, and whenever there are substantial modifications to that policy that motivate new consultations.

These rights may be exercised by:

a) The holder, who must prove his identity sufficiently by the different means made available by ARTE BIODENTAL LABORATORIO.

b) The assignees of the holders, who must prove such capacity.

c) The representative and/or attorney-in-fact of the holder, upon accreditation of the representation or power of attorney.

d) Other in favor or for whom the holder has stipulated

³ Law 1581 of 2012. Article 10. Cases in which authorization is not required. The authorization of the Holder will not be necessary when dealing with: a) Information required by a public or administrative entity in the exercise of its legal functions or by court order.

a) Data of a public nature.

b) Cases of medical or health emergency

c) Processing of information authorized by law for historical, statistical or scientific purposes

d) Data related to the Civil Registry of Persons.

Whoever accesses personal data without prior authorization must in any case comply with the provisions contained in this law.

ARTE BIODENTAL LABORATORIO recognizes the ownership of personal data held by people and consequently, they can exclusively decide on them. Therefore, ARTE BIODENTAL LABORATORIO will use personal data for the purposes expressly authorized by the owner or by current regulations.

In the treatment and protection of personal data, ARTE BIODENTAL LABORATORIO will have the following duties, without prejudice to others provided for in the provisions that regulate or regulate this matter:

a. Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.

b. Request and keep, a copy of the respective authorization granted by the holder for the processing of personal data.

c. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized Duly inform the owner about the purpose of the collection and the rights he/she is entitled by virtue of the authorization granted.
d. or fraudulent access.

e. Guarantee that the information is true, complete, accurate, updated, verifiable and understandable.

f. Update the information in a timely manner, thus taking care of all the novelties with respect to the owner’s data. Additionally, all necessary measures must be implemented to keep the information updated.

g. Rectify the information when it is incorrect and communicate the pertinent.

h. Respect the security and privacy conditions of the holderr’s information.

i. Process queries and claims made in the terms indicated by law.

j. Identify when certain information is under discussion by the owner.

k. Inform at the request of the owner about the use given to their data.

l. Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the holders.

m. Comply with the requirements and instructions issued by the Superintendence of Industry and Commerce on the particular subject.

n. Use only data whose treatment is previously authorized in accordance with the provisions of Law 1581 of 2012.

o. Ensure the proper use of the personal data of children and adolescents, in those cases in which the processing of their data is authorized.

p. Register in the database the legends “claim in process” in the manner regulated by law.

q. Insert in the database the legend “information under judicial discussion”, once notified by the competent authority about judicial processes related to the quality of personal data.

r. Refrain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce.

s. Allow access to information only to people who may have access to it.

t. Use the personal data of the holder only for those purposes for which it is duly empowered and respecting in any case the current regulations on protection of personal data.

ARTE BIODENTAL LABORATORIO requires the free, prior, express and informed consent of the holder of the personal data for the processing of the same, except in the cases expressly authorized by law, namely:

a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.

b. Data of a public nature.

c. Cases of medical or health emergency.

d. Processing of information authorized by law for historical, statistical or scientific purposes.
e. Data related to the Civil Registry of Persons.

Expression of authorization

The authorization to ARTE BIODENTAL LABORATORIO for the processing of personal data shall be granted by:

a) The owner, who must prove his/her identity sufficiently by the different means made available by ARTE BIODENTAL LABORATORIO.

b) The successors in title of the holder, who must prove such quality.

c) The representative and / or attorney-in-fact of the holder, upon accreditation of the representation or power of attorney.

d) Other in favor or for which the holder has stipulated.

Means of granting authorization

ARTE BIODENTAL LABORATORIO will obtain the authorization through different means, including the physical, electronic document, data message or any other format that in any case allows obtaining consent through unequivocal conduct through which it is concluded that if the same had not been given by the owner or the person entitled to do so, the data would not have been stored or captured in the database.
The authorization will be requested by ARTE BIODENTAL LABORATORIO prior to the processing of personal data.

Proof of authorization

ARTE BIODENTAL LABORATORIO will keep the proof of the authorization granted by the holders of the personal data for its treatment, for which it will use the mechanisms currently available to it and will adopt the necessary actions to keep the record of the form and date in which it was obtained. Consequently, ARTE BIODENTAL LABORATORIO may establish physical files or electronic repositories made directly.

Revocation of authorization.

The holders of personal data may at any time revoke the authorization granted to ARTE BIODENTAL LABORATORIO for the processing of their personal data or request the deletion of the same, provided that it is not prevented by a legal or contractual provision. ARTE BIODENTAL LABORATORIO will establish simple and free mechanisms that allow the owner to revoke their authorization or request the deletion of their personal data, at least by the same means by which it was granted.

For the above, it should be noted that the revocation of consent may be expressed, on the one hand, in a total way in relation to the authorized purposes, and therefore ARTE BIODENTAL LABORATORIO must cease any activity of data processing; and on the other hand, in a partial manner in relation to certain types of processing, in which case these will be the ones on which processing activities will cease, such as for advertising purposes, among others. In the latter case, ARTE BIODENTAL LABORARTORIO may continue to process personal data for those purposes in relation to which the holder has not revoked his consent.

The processing of the personal data of customers, suppliers, contractors, employees or any person with whom ARTE BIODENTAL LABORATORIO has established or establishes a relationship, permanent or occasional, will be carried out within the legal framework that regulates the matter and by virtue of its status as a merchant, and will be all those necessary for the fulfillment of its own mission.
In any case, personal data may be collected and processed to:

a. Send information related to products and other goods or services offered by ARTE BIODENTAL LABORATORIO.

b. Develop the mission of ARTE BIODENTAL LABORATORIO.

c. Comply with current regulations in Colombia for merchants.

d. Comply with the provisions of the Colombian legal system in labor and social security matters, among others, applicable to former employees, current employees and candidates for future employment.

e. Conduct surveys related to the services or goods of ARTE BIODENTAL LABORATORIO.

f. Fulfill all its contractual commitments.

Sensitive data

In the case of sensitive personal data, ARTE BIODENTAL LABORATORIO may use and process them when:

a. The holder has given his explicit authorization, except in cases where the law does not require the granting of such authorization.

b. The processing is necessary to safeguard the vital interest of the Holder and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.

c. The processing is carried out in the course of legitimate activities and with due guarantees by a foundation, ONG, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided that they refer exclusively to their members or persons who maintain regular contacts by reason of their purpose. In these events, the data may not be provided to third parties without the holder’s authorization.

d. The processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.

e. The processing has a historical, statistical or scientific purpose. In this event, measures must be taken to suppress the identity of the holders.

Notwithstanding to the exceptions provided for by law, in the processing of sensitive data, the prior, express and informed authorization of the owner is required, which must be obtained by any means that may be subject to consultation and subsequent verification.

The Privacy Notice is the physical, electronic or any other format document, made available to the holder to inform him about the processing of personal data. Through this document, the holder is informed of the information related to the existence of ARTE BIODENTAL LABORATORIO’s information processing policies that will be applicable to him/her, the way to access them and the characteristics of the processing that is intended to be given to the personal data.

The privacy notice shall contain, at a minimum, the following information:

a. The identity, address and contact details of the data controller.

b. The type of processing to which the data will be subjected and the purpose thereof.

c. The rights of the holder.

d. The general mechanisms provided by the controller for the holder to know the information processing policy and the substantial changes that occur in it. In all cases, the owner must be informed how to access or consult the information processing policy.

e. The optional nature of the answer to questions about sensitive data.

In order to guarantee the data owner’s right of access, ARTE BIODENTAL LABORATORIO will make available to the data owner, upon proof of identity, legitimacy, or personality of its representative, at no cost or expense, in a detailed and detailed manner, the respective personal data through all types of media, including electronic media that allow direct access to them by the data owner. Such access must be offered without any limit and must allow the holder the possibility of knowing and updating them.

a. Consultations:

Holders or their assignees may consult the personal information of the holder that is in ARTE BIODENTAL LABORATORIO, who will provide all the information contained in the individual record or that is linked to the identification of the Holder.

With regard to the attention of requests for consultation of personal data ARTE BIODENTAL LABORATORIO guarantees:

✔ Enable electronic or other means of communication that you consider relevant.

✔ Use the customer service or claims that it has in operation.

✔ In any case, regardless of the mechanism implemented for the attention of consultation requests, they will be answered within a maximum term of ten, 10 working days from the date of receipt. When it is not possible to attend the consultation within such term, the interested party will be informed before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term. Queries may be sent to the following e-mail address: [email protected]

b. Claims

The Holder or his assignees who consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the law, may file a claim with ARTE BIODENTAL LABORATORIO, which will be processed under the following rules:

1. The Holder’s claim shall be formulated by request addressed to the ARTE BIODENTAL LABORATORIO to the email [email protected] or by means of written communication, with the identification of the holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that he/she wishes to assert. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the failures. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that he has been abandoned.

In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum period of two (2) business days and inform the interested party of the situation.

2. Once the complete claim has been received, the maximum term to attend it will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to attend the claim within that term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

c. Request for updating and/or rectification

ARTE BIODENTAL LABORATORIO, will rectify and update, at the request of the holder, the information of this that turns out to be incomplete or inaccurate, in accordance with the procedure and the terms indicated above, for which it will be taken into account:
The holder must attach the request to the email [email protected] or on physical medium indicating the update and / or rectification to be made and will provide the documentation that supports your request.

d. Request for deletion of data

The holder of the personal data has the right to request ARTE BIODENTAL LABORATORIO its deletion (elimination) in any of the following events:

1. Consider that the same are not being treated in accordance with the principles, duties and obligations under current regulations.

2. They are no longer necessary or relevant for the purpose for which they were collected.

3. The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.

This deletion implies the total or partial elimination of personal information according to the holder’s request in the records, files, databases or treatments carried out by ARTE BIODENTAL LABORARTORATORIO. However, this right of the holder is not absolute and consequently ARTE BIODENTAL LABORATORIO may deny the exercise of the same when:

a. The holder has a legal or contractual duty to remain in the database.

b. The deletion of data hinders judicial or administrative proceedings linked to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

c. The data is necessary to protect the legally protected interests of the holder; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the holder.

ARTE BIODENTAL LABORATORIO, will proceed in accordance with the current regulations and the regulations issued for this purpose by the National Government, to register its databases, before the National Registry of Databases (RNBD) that will be administered by the Superintendence of Industry and Commerce. The RNBD is the public directory of the databases subject to processing operating in the country; and it will be of freely available for consultation by citizens, in accordance with the provisions issued by the National Government for such purpose.

In compliance with the principle of security established in current regulations, ARTE BIODENTAL LABORATORIO will adopt the technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

ARTE BIODENTAL LABORATORIO, may exchange personal information with governmental or other public authorities (including, but not limited judicial or administrative authorities, tax authorities and criminal, civil, administrative, disciplinary and fiscal investigative bodies), and third parties involved in legal, civil proceedings and their accountants, auditors, lawyers and other advisors and representatives, because it is necessary or appropriate:  (a) to comply with applicable laws, including laws other than those of your country of residence; (b) to comply with legal process; (c) to respond to requests from public authorities and government, and to respond to requests from public authorities and government authorities other than those in your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, yours or others; and (g) to obtain any applicable indemnification or limit any damages that may be incurred by us.

ARTE BIODENTAL LABORATORIO will be responsible for the processing of personal data and in turn the person in charge of the processing of personal data.

This Policy is effective as of June 12, 2021.