PERSONAL DATA PROTECTION POLICY HOJAS VERDES S.A.S

HOJAS VERDES S.A.S., identified with NIT 901.876.975-2, domiciled in Bogotá, D.C., in compliance with the provisions of Law 1581 of 2012 and its Regulatory Decree No. 1377 of 2013 and any other rules that modify, add to, or complement them, hereby adopts this Policy and Procedures for the Protection of Personal Data of individuals included in the HOJAS VERDES S.A.S. database, in order to guarantee their right to know, update, and rectify the information registered in the database and/or files.

I. DATA CONTROLLER

Name: HOJAS VERDES S.A.S

Address: Carrera 7ª No. 32-93, Bogotá, D.C.

Phone: 3103054753

Email: protecciondedatos@greenleaves.com.co

II. SCOPE OF THE POLICY

 

This policy applies to all personal data registered in the database of HOJAS VERDES S.A.S, including employees, suppliers, contractors, or any other person who, for any reason, provides personal data to the Company.

III. DEFINITIONS

 

  • Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of personal data.
  • Privacy Notice: Verbal or written communication issued by the Data Controller to the Data Subject for the processing of their personal data, informing them of the existence of data processing policies applicable to them, how to access them, and the purposes of processing.
  • Database: Organized set of personal data subject to processing.
  • Successor: Person who replaces another due to the latter’s death (heir).
  • Personal Data: Any information linked or that can be associated with one or more identified or identifiable natural persons.
  • Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, information on a person’s marital status, profession, trade, status as a merchant or public servant. By nature, public data may appear in public records, documents, gazettes, official bulletins, and duly executed judicial rulings not subject to confidentiality.
  • Sensitive Data: Data that affects the privacy of the Data Subject or may cause discrimination if misused, such as information revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social or human rights organizations, political parties, or data related to health, sex life, or biometric data.
  • Data Processor: Natural or legal person, public or private, who processes personal data on behalf of the Data Controller.
  • Data Controller: Natural or legal person, public or private, who decides on the database and/or the processing of data.
  • Data Subject: Natural person whose personal data is processed.
  • Processing: Any operation or set of operations on personal data such as collection, storage, use, circulation, or deletion.
  • Transfer: Occurs when the Data Controller or Data Processor in Colombia sends personal data to a recipient who is also a Data Controller, located inside or outside the country.
  • Transmission: Processing of personal data that involves communication of such data within or outside Colombia when performed by the Data Processor on behalf of the Data Controller.

IV. PRINCIPLES

 

To guarantee the protection of personal data, HOJAS VERDES S.A.S will apply the following principles:

  • Legality: Processing of data must comply with current legal provisions.
  • Purpose: Data processing must have a legitimate purpose aligned with the Colombian Constitution, which must be communicated to the Data Subject.
  • Freedom: Data processing requires prior, express, and informed consent from the Data Subject.
  • Veracity/Quality: Data must be truthful, complete, accurate, updated, verifiable, and understandable.
  • Transparency: Data Subjects may request and obtain information about their personal data at any time.
  • Restricted Access and Circulation: Personal data, except public information, may not be available on the internet or other mass media unless restricted access is guaranteed.
  • Security: Data must be handled with technical, human, and administrative measures to prevent unauthorized or fraudulent access, loss, alteration, or misuse.
  • Confidentiality: Those handling data must keep it strictly confidential and not disclose it to unauthorized third parties.

V. PURPOSES OF DATA PROCESSING

 

Personal data collected, stored, used, circulated, and deleted by HOJAS VERDES S.A.S. will be processed for the following purposes:

a) Employees:

  • Hiring and contractual management
  • Payroll and social security administration
  • Payment management
  • Fulfillment of functions or service provision
  • Audits and legal reviews
  • Statistical processes
  • Occupational health and welfare activities
  • Exit or termination management

b) Providers and Contractors:

  • Preparation of contracts, purchase, or service orders
  • Any other activity necessary for the commercial relationship.

VI. RIGHTS OF DATA SUBJECTS

 

In accordance with Law 1581 of 2012, Data Subjects have the right to:

  1. Know, update, and correct their personal data.
  2. Request proof of authorization.
  3. Be informed of the use of their personal data.
  4. File complaints with the SIC (Superintendence of Industry and Commerce).
  5. Revoke authorization and/or request deletion of data.
  6. Access their personal data free of charge.

VII. SENSITIVE DATA

 

HOJAS VERDES S.A.S. will not request sensitive data unless strictly necessary for employment purposes and with the Data Subject’s express consent. Sensitive data includes racial origin, political opinions, religious or philosophical beliefs, union membership, health, sex life, and biometric data.

VIII. MINORS’ DATA

 

Processing minors’ data requires authorization from parents or legal guardians and will only be used for welfare or statistical purposes, ensuring protection under the Constitution and the Law.

IX. DATA SUBJECT AUTHORIZATION

 

Data processing requires prior, express, and informed authorization, except for cases established by law.

X. CASES WHERE AUTHORIZATION IS NOT REQUIRED

 

Authorization will not be required in cases such as:

  • Information required by a public authority or by court order.
  • Public data.
  • Medical or health emergencies.
  • Processing for historical, statistical, or scientific purposes.
  • Civil registry data.

XI. DISCLOSURE OF INFORMATION

 

HOJAS VERDES S.A.S. may disclose information to government authorities, comply with labor or tax obligations, or respond to administrative/judicial requirements, subject to confidentiality obligations.

XII. PROCEDURE FOR QUERIES AND CLAIMS

 

Data Subjects may exercise their rights by contacting HOJAS VERDES S.A.S. through:

  • Email: protecciondedatos@greenleaves.com.co
  • Address: Carrera 7 No. 32-93, Bogotá, D.C.
  • Phone: 3103054753

Queries:

Responses will be provided within 10 business days, extendable by 5 additional days with prior notice.

Claims:

Complaints must include identification, facts, supporting documents, and contact details. Processing time is 15 business days, extendable by 8 additional days with prior notice.

XIII. VALIDITY OF THE POLICY

 

This Personal Data Processing Policy of HOJAS VERDES S.A.S. takes effect as of September 25, 2025. HOJAS VERDES S.A.S. reserves the right to amend it in accordance with the law.