PERSONAL DATA PROTECTION AND PROCESSING POLICY

This Personal Data Protection and Processing Policy governs the protection, collection, storage, processing, administration, and transmission of the information that LEX FINANCIAL ADVISORS S.A.S., identified with Tax Identification Number 900.530.007‑1, receives from its Clients, Employees, Contractors, Suppliers, and Third Parties in general, through the various information‑collection channels it has or may have in the future.

The content of this policy is based on the provisions of the Political Constitution of Colombia, Statutory Law 1581 of 2012, Decree 1377 of 2013, and other related regulations that establish general provisions for the protection of personal data.

LEX FINANCIAL ADVISORS S.A.S. is the entity responsible for handling Personal Data, as defined in Law 1581 of 2012, and respects the privacy of every third party who provides their Personal Data through the different collection points established for such purpose. LEX FINANCIAL ADVISORS S.A.S. receives this information, stores it appropriately and securely, and uses it, without preventing third parties from verifying its accuracy and exercising their rights to access, update, rectify, and delete the information provided.

LEX FINANCIAL ADVISORS S.A.S. collects Personal Data for consultation, processing, use, and transfer, primarily for the following specific purposes:

· To perform basic administrative management tasks · To activate advertising campaigns · To carry out commercial campaigns · To send information from the company or third parties · To create and offer new products and/or services · To provide corporate information · To identify new markets · To share information with third parties

LEX FINANCIAL ADVISORS S.A.S. will apply the following principles, which constitute the rules governing the use, capture, collection, processing, storage, protection, and exchange of personal data:

· Principle of Legality: In the use, capture, collection, and processing of personal data and other fundamental rights.

· Principle of Freedom: Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that waives consent.

· Principle of Purpose: Personal data accessed by the company shall be subject to and used for a legitimate purpose, which must be communicated to the respective data subject.

· Principle of Veracity or Quality: Information must be truthful, complete, accurate, up‑to‑date, verifiable, and understandable.

· Principle of Transparency: The data subject must be guaranteed the right to obtain, at any time and without restrictions, information from the company regarding the existence of any personal data of interest or ownership.

· Principle of Restricted Access and Circulation: Personal data may not be available on the Internet or other mass‑dissemination media, except for public information.

· Principle of Security: Necessary resources and measures must be established to ensure adequate protection of personal data.

· Principle of Confidentiality: A continuous commitment by LEX FINANCIAL ADVISORS S.A.S., as the Data Controller, and by its employees, as Data Processors, to comply with applicable legislation and corporate policy.

Data subjects must provide their authorization for the processing of their data. Such authorization will not be required in the following cases:

· Information required by a public or administrative entity in the exercise of its legal functions or by court order

· Data of a public nature · Cases of medical or health emergencies

· Processing authorized by law for historical, statistical, or scientific purposes

· Data related to civil registry records

Information that meets the conditions established by law may be provided to the following:

· Data subjects, their successors, or their legal representatives

· Public or administrative entities in the exercise of their legal functions or by court order

· Third parties authorized by the data subject or by law

The company has designated its Administrative Manager as the person responsible for ensuring compliance with this policy. This individual will address inquiries, requests, and claims from data subjects through the email contacto@lexfinad.co, where they may exercise their rights to access, update, and rectify their personal data.

Inquiries, requests, and claims will be addressed within a maximum of 10 business days, counted from the date of receipt.

Failure by LEX FINANCIAL ADVISORS S.A.S. employees to comply with the policies and procedures adopted regarding personal data protection constitutes a serious offense and will be sanctioned in accordance with the Internal Work Regulations, without prejudice to any penalties arising from violations of criminal or administrative regulations.

This policy shall apply and be enforced as of the fifth (05) day of October of the year 2015.

LEGAL FRAMEWORK

• Political Constitution of Colombia, Article 15

• Law 1266 of 2008

• Law 1581 of 2012

• Regulatory Decrees 1727 of 2009 and 2952 of 2010

• Partial Regulatory Decree 1377 of 2013

• Constitutional Court Rulings C‑1011 of 2008 and C‑748 of 2011