Personal Data Protection and Processing Policy ferreterias.com

INTRODUCTION

ferreterias.com is a portal of COMERLIA SAS NIT 901697345-5, a leading company in Colombia whose main activity is to connect consumers with dispensers through a virtual platform composed of a Web page and a mobile application, so that consumers enter, learn about the consumer products displayed and can carry out the purchase and sale transaction directly with the retailers electronically, and in general all types of complementary activities.

ferreterias.com, in order to strictly comply with the current regulations for the protection of Personal Data, in accordance with the provisions of Law 1581 of 2012, Decree 1074 of 2015 and other provisions that modify or add them. or complement presents the following POLICY FOR PROTECTION AND TREATMENT OF PERSONAL DATA (hereinafter “Processing Policy”) with the purpose of protecting the personal information provided by the Owners who have a relationship with ferreterias.com such as partners, suppliers, clients, employees, collaborators and any other natural person from whom ferreterias.com obtains, collects, processes or processes personal data, whether said treatment is carried out by ferreterias.com or by third parties who do so on behalf of it.

Version updated in October 2023

1. PERSONAL DATA PROCESSED BY THE ferreterias.com PORTAL

1.1. Personal information. The personal data processed by the ferreterias.com portal (“User Account Data” and “Creator Account Data”) may vary, according to each of the respective companies and their processing practices. It also depends on the type of interaction of the User with the Platform or with said companies.

These personal data may be collected directly from the User, obtained through third parties or collected automatically.

Personal data may include, for example: (a) registration information, such as email, full name, address, telephone, cell phone, identification documents, profile photo and passport; (b) banking information, such as the name of the financial institution with which the User has a bank account, account number, type of account, branch, the first six and last four digits of the credit card, including the name of the owner.

Below, there is a list of the personal data that the ferreterias.com portal collects, presented in categories, and the different ways of collecting them to facilitate your understanding.

1.1. Personal data collected directly from the User. The ferreterias.com portal may collect personal data directly from you, when you create an account, for example, or start a purchasing process directly via checkout and/or interact with the ferreterias.com portal by any means, including our chatbot.< /span>

1.2. “Offline” interaction. The ferreterias.com portal may collect personal data when you interact with them by means other than access to the portal, such as, for example, your registration data or your image when you participate in an event organized by them, or an event organized by a third party whose activity is contractually linked to the ferreterias.com portal.

1.3. Optional fields. The Platform contains certain fields that can be optionally completed. These fields are highlighted as optional and are intended to improve the personalization of the content delivered to the User.

1.4. Public data. The ferreterias.com portal considers some personal data as public, because it can be seen by anyone, inside and outside the Platform, even if that person does not have an account on the Portal. The information that you add in the fields highlighted with the notice “public data” is considered public data. You, other people who use the Platform and the ferreterias.com companies themselves may provide access or send public data to anyone on and off the Platform. Public data may also be viewed, accessed, re-shared or downloaded through third-party tools, such as search engines, APIs and offline media, or through applications, websites and other Third-Party Services.

1.5. Personal data obtained from third parties. The ferreterias.com portal may have access to certain personal data through third parties, whether registration or banking information. This occurs, for example, when, when fulfilling a legal or regulatory obligation, one of the ferreterias.com companies needs to consult databases maintained by third parties, which enable the analysis of credit restrictions, anti-fraud analysis and risk management, integrated into the portal. . The ferreterias.com portal also collects registration information through third parties when you link, connect or starts session on the Portal through a Third Party Service (for example, Facebook). The ferreterias.com portal may also have access to registration information through third parties for registration in events, searches, advertising campaigns and other activities organized by these third parties, whose activity is contractually linked to the ferreterias.com portal.

1.6. Personal data collected automatically when entering the portal. Your personal data is collected automatically when you enter the portal, even if you do not have an account. Below are examples of the information that may be included.

1.6.1. Payment information: payment instrument used; date and time of the transaction; worth; expiration date of the payment instrument; collection zip code; IBAN information, address and other details related to the transaction.

1.6.2. Access or use information: pages and content that you view; ad searches; frequency of use of the Platform; browser information; connection data; purchase and browsing history.

1.6.3. Log data and device information: details of how you accessed and used the Platform (including links used); IP address; access dates and times; hardware and software information; device information; device event information; unique identifiers (for example, ferreterias.com ID); fault data; data from cookies, pixels and similar technologies (see Cookie Policy) and the pages you viewed or interacted with before and after accessing and using the Platform.

1.6.4. Cookies, pixel and similar technologies, as described in the Cookies Policy.

1.6.5. Participation in Creator Content. When you enroll in a course, Coaching service, or use or access other Creator Content, we collect personal data related to your participation in the Creator Content, such as the courses you enrolled in, test results, your progress, and certifications. .

1.7. Creator Payment Information. We use third-party payment gateways to process payments made through the Platform. For payments processed by the native payment gateways of any of the ferreterias.com portal, third parties provide us with information related to the payment status of your account, making it necessary for you to link your payment account to the portal to receive it. When you link your account, we will receive certain information related to your payments, including the type of your payment card and its last 4 digits, your zip code, country of origin, expiration date, and your email address associated with the type of payment. . Additionally, we collect certain informationpersonal information for tax purposes, which may include your full name, address and registration number. Our outsourced payment gateways are independent and have their own privacy policies. For additional information on how your payment data is processed and stored, we recommend that you review the privacy policies of the payment gateways.

1.8. Participation in Creator Content. When you enroll in a course, use or access other Creator Content, we collect personal data related to your participation in the Creator Content, such as the courses you enrolled in, test results, your progress and certifications.</span >

2. PURPOSES OF PERSONAL DATA PROCESSING

2.1. Purposes of the Processing of the User's Personal Data. The ferreterias.com portal may use personal data for the following purposes:</ span>

2.1 .1. Provide and develop the Platform:

• Link your account on the Portal with third-party social networks</span >

• Personalize the Platform according to the browsing experience

• Perform analysis and studies related to behavior, interest and demographics</span >

• Improve the Platform

• Archive Purchase History

• Update record

• Send messages, updates, and account notifications

• Carry out activities to support the User

• Allow the User to publish their content

• Disclose the User's content through the means available on the Portal</ span>

• Training in Artificial Intelligence systems built by ferreterias.com or by third parties, using only the User's registration data

2.1.2. Provide and optimize advertising and marketing activities

• Register for events

• Send newsletter

• Send communications by email, SMS or telephone recordings

• Send educational materials or ebooks

• Carry out advertising campaigns with a focus on advertising and promotions

• Manually send lists with media vehicles (Facebook and Google)

• Send communications such as email marketing, remarketing and other advertising campaigns on ad channels

• Analyze browsing behavior to optimize the Platform and the offering of products and services

2.1.3. Make EPayco Services Viable

• Make payment communications,for example, sending transactional emails

• Participate in the agreement with card flags

• Issue electronic currency

• Credit and issue payment instrument

• Manage payment account

• Convert physical currency into electronic currency

• Make remittance of funds

• Apply the conditions of the credit card Terms and Conditions and other policies involving the ferreterias.com card

• Provide tools that provide the User with a better payment experience.</ span>

2.1.4. Maintain a safe environment

• Perform authentication in the Portal

• Verify the authenticity of the data and documents provided, including through processing and cross-verification

• Send communications

• Perform analysis activities to prevent fraud, security incidents and abuses on the Portal

• Guarantee the physical security of the ferreterias.com properties

• Registration verification

• Content verification

2.1.5. Purposes of the Processing of Personal Data of Visitors. We may collect personal data from visitors to the Platform for the following purposes:</span

• Media campaigns with a focus on advertising and promotions

• Send communications such as email marketing, remarketing and other advertising campaigns through traffic channels

• Analyze your browsing behavior in the Portal

• Register for events

• Send newsletter

• Send communications by email, SMS or telephone recordings

• Send educational materials or ebooks

3. LEGAL BASIS OF PROCESSING

3.1. Legal Bases. The processing of personal data carried out by the ferreterias.com portal is always based on applicable legislation. The legal bases that the ferreterias.com portal uses may vary depending on the processing context and these are:

3.1.1. Consent. When the User expressly accepts the processing of personal data, for example, when he or she agrees to receive advertising communications or surveys. The User may revoke this consent at any time.

3.1.2. Compliance with legal or regulatory obligation. When a ferreterias.com company is obliged to process personal data due to legal or regulatory determination, for example, when a ferreterias.com company stores access records to comply with legislation on the prevention of money laundering.

3.1.3. Execution of the Contract or procedures related to the Contract. When the processing of personal data is necessary to execute a contract signed between a ferreterias.com company and the owner of the data, or when it is necessary for preliminary procedures to the contract, for example, when we need to process your payment data at the time who makes a purchase on the Portal.

3.1.4. Regular exercise of rights in judicial, administrative or arbitration proceedings. When the processing of personal data must be carried out due to judicial action, administrative or arbitration proceedings.

3.1. 5. Legitimate interest. When a ferreterias.com company decides to continue processing personal data, after carefully analyzing the purpose and need for said processing and the User's expectations in this regard. This legal basis is used when, for example, ferreterias.com sends a newsletter related to the interests of the User, considering their interaction with the Platform, to support and promote the activities of the ferreterias.com portal. In this case, the ferreterias.com portal always allows the User the option to cancel the sending of these communications.

4. RIGHTS RELATED TO YOUR PERSONAL DATA

4.1. Rights: Depending on the laws applicable to the processing of your personal data, you have certain specific rights over said information, and you can exercise them using this form.

These are the applicable rights:</span

• Confirmation of the existence of the processing. You have the right to question us about the processing of your data, confirming whether or not it is carried out.

• Data access. You have the right to request a copy of the personal data we process, by electronic, secure and suitable means or printed means, depending on your preference.

• Rectification. You have the right to request the correction of your personal data if it is incomplete, inaccurate or outdated.

• Anonymization, blocking or exclusion. In cases where unnecessary, excessive or non-compliant data has been processed, you have the right to request that it be anonymized, blocked or excluded.

• Portability. You have the right to request the portability of your personal data to other content platforms, in accordance with the regulations of the National Data Protection Authority, observing the commercial and industrial secret of the ferreterias.com portal.

• Information on shared data. You have the right to request information about the public and private entities with which we share your personal data.</span >

• Information on the possibility of denying your consent. You have the right to receive information about the possibility of not giving your consent, when consent is the applicable legal basis for the processing of personal data, with an indication of the consequences of such refusal.

• Revocation of consent. You have the right to revoke, easily and free of charge and at any time, the consent you have previously granted. It is important that you know that such revocation does not invalidate or render illegitimate the personal data processing activities that were carried out before the date of revocation.

• Opposition to processing. In cases where consent is not the legal basis applicable to the processing of your personal data, and where there is a violation of data protection law, you have the right to object to the processing, indicating your reasons for doing so. The ferreterias.com portal will evaluate whether your opposition is justified or not, adopting the necessary measures to suspend the processing or inform the grounds on which it understands that the processing is legal and permitted.

• Claim. You have the right to file with the National Data Protection Authority a claim related to the processing of your personal data carried out by the ferreterias.com portal. However, we hope that, before doing so, you will give us the opportunity to respond directly to any questions or complaints you may have.

• Exclusion of data processed with consent. In cases where your consent was the basisegal for a certain processing activity, you have the right to request the exclusion of said data, safeguarding the possibilities of continuing to store it, when necessary, to comply with a legal or regulatory obligation, or to defend our interests in judicial, administrative or arbitration proceedings.

4.2. To speak with the person responsible for the protection of personal data at ferreterias.com, contact us through this < span style="color: #7a7c84;">form.

4.3. Whenever a ferreterias.com company is acting on behalf of third parties and the User decides to claim any of their rights, we may respond to the respective request, in certain circumstances and if applicable.

4.4. If you wish to cancel the sending of newsletters, emails, or advertising SMS and telephone calls, you can do so through the link provided in the communications themselves.

4.5. ferreterias.com reserves the right to refuse to respond to visibly unfounded and/or excessive requests.

4.6. At any time and free of charge, you can exercise all the rights mentioned here, which apply to your jurisdiction, unless the collection of any fee is permitted in accordance with current legislation or regulations. The ferreterias.com portal is committed to doing everything possible to respond to your requests transparently and quickly.

4.7. To guarantee that you or your legal representative, duly constituted, are exercising your rights, the ferreterias.com portal may request information or necessary verifications about your identity, in order to avoid fraud and ensure your privacy, so that your personal data is not are shared with those who do not have authorization to do so. </p >

4.8. We will respond to your requests within a reasonable time, in accordance with applicable law, taking into account that we will only be able to respond to some requests after receiving the aforementioned confirmations.

4.9. In certain cases, for example if your request is particularly complex or if we receive a high volume of requests at the same time, the response may not be as fast as we would like. In these circumstances, we will always keep you informed and updated on the progress of your application.

5. SECURITY

5.1. Security measures. The ferreterias.com portal uses the necessary technical and organizational security measures to protect the personal data they process. The companies strive to mitigate risks of destruction, accidental or unlawful loss, alteration, unauthorized disclosure or access or any other form of unlawful or unauthorized processing. For this, the ferreterias.com portal has rigid restricted access controls, based on the least privilege, to information technology systems to protect personal data against eventual security incidents. For more information, check the Cyber and Information Security Policy .

Although the ferreterias.com portal implements these measures to minimize the risks of security incidents and improper access, it is not possible to guarantee the absolute security of your data, especially against attacks committed by malicious people, who can be extremely sophisticated and innovative, with techniques and methods unknown to the best information security tools.

The security of your data also depends on the reasonable measures you take when using your devices and software.

6. PROCESSING PERSONAL DATA OF MINORS

6.1. Personal data of Minors. The ferreterias.com portal does not intentionally collect or request personal data from children under 13 years of age. If we become aware that for any reason a registration of this type has been made, we will cancel the account created on the Portal and exclude said data, keeping only enough information to avoid a new registration attempt.

7. CONTACT INFORMATION

All communications, queries, complaints and/or claims must be directed to the Personal Data Base Protection Officer or the COSTUMER CARE/CUSTOMER SERVICE AREA of < b>ferreterias.com, by any of the following means: