The company ENTEL LTDA; domiciled in Bogotá, with physical address Cra 15 Dg 40 A-89, electronic address entela.libros@gmail.com, location on the web network www.entelalibros.com, telephone (+57-1) 6565954, and Nit 900021026-6 (hereinafter the “Company”) informs the Owners of the Personal Data that are treated in any way by the Company of this information treatment policy (the “Policy”), thus complying with the Law 1581 of 2012 and Decree 1377 of 2013. The main purpose of this Policy is to inform the Holders of Personal Data of the rights that assist them, the procedures and mechanisms provided by the Company to make effective those rights of the Holders, and inform them of the scope and purpose of the Treatment to which the Personal Data will be subjected in the event that the Holder grants his express, prior and informed authorization. 1 Main definitions Expressions used in capital letters in this Policy shall have the meaning given to them here, or the meaning given to them by applicable law or case law, as such law or case law is modified from time to time. a) “Authorization”: It is the prior, express and informed consent of the Owner to carry out the Processing of her Personal Data. b) “Database”: It is the organized set of Personal Data that are subject to Treatment, electronic or not, whatever the modality of its formation, storage, organization and access. c) “Financial Data”: It is all Personal Data referring to the birth, execution and termination of monetary obligations, regardless of the nature of the contract that gives rise to them, whose Treatment is governed by Law 1266 of 2008 or the regulations that complement it, modify or add. d) “Personal Data”: It is any information of any kind, linked or that may be associated with one or more specific or determinable natural or legal persons. e) “Public Data”: It is the Personal Data qualified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Data relating to the marital status of individuals, their profession or trade, their status as a merchant or public servant and those that may be obtained without reservation are public, among others. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, duly enforced judicial decisions that are not subject to reservation. f) “Sensitive Data”: It is the Personal Data that affects the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal union affiliations, racial or ethnic origin, political orientation, religious, moral or moral convictions. philosophical, membership in unions, social organizations, human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data. g) “Data Processor”: Is the natural or legal person, public or private, who, by itself or in association with others, performs the Processing of Personal Data on behalf of the Data Controller. h) “Authorized”: It is the Company and all the people under the responsibility of the Company, which by virtue of the Authorization and these Policies have the legitimacy to Process the Personal Data of the Owner. The Authorized includes the gender of the Authorized. i) “Authorization”: It is the legitimacy that expressly and in writing through a contract or document that takes its place, grants the Company to third parties, in compliance with the applicable Law, for the Processing of Personal Data, turning such third parties into Data Processors. Treatment of Personal Data delivered or made available. j) “Responsible for Treatment”: It is the natural or legal person, public or private, that by itself or in association with others, decides on the Database and/or the Treatment of Personal Data. k) “Owner” of the Personal Data: It is the natural or legal person to whom the information that rests in a Database refers, and who is the subject of the right of habeas data. l) “Transfer”: It is the Processing of Personal Data that implies the communication of the same within or outside the territory of the Republic of Colombia when its purpose is to carry out a Treatment by the Manager on behalf of the Responsible.

m) “Transmission”: It is the Personal Data Processing activity through which the same are communicated, internally or with third parties, inside or outside the territory of the Republic of Colombia, when said communication is intended to carry out any activity Treatment by the recipient of the Personal Data.

n) “Processing of Personal Data”: It is any operation and systematic procedure, electronic or not, that allows the collection, conservation, ordering, storage, modification, relationship, use, circulation, evaluation, blocking, destruction and in general, the processing of data

Personal, as well as their transfer to third parties through communications, consultations, interconnections, assignments, data messages.

2 Principles

The Company, in the development of its commercial activities, will collect, use, store, transmit and carry out various operations on the personal data of the Holders. In all Processing of Personal Data carried out by the Company, the Managers, Managers and/or third parties to whom Personal Data is transferred must comply with the principles and rules established in the Law and in this Policy, in order to guarantee the right to the habeas data of the Holders and to comply with the obligations of the Company Law. These principles are:

a) Prior Authorization: All Processing of Personal Data will be carried out once the prior, express and informed Authorization of the Owner has been obtained, unless the Law establishes an exception to this rule. In the event that the Personal Data has been obtained prior to the Law, the Company will seek the pertinent ordinary and alternative means to summon the Holders and obtain their retroactive authorization, following the provisions of Decree 1377 and the concordant regulations.

b) Authorized purpose: All Personal Data Processing activities must comply with the purposes mentioned in this Policy or in the Authorization granted by the Owner of the Personal Data, or in the specific documents where each type or process of Data Processing is regulated. Personal. The purpose of the particular Treatment of a Personal Data must be informed to the Holder of the Personal Data at the time of obtaining the Authorization from him. Personal Data may not be processed outside of the purposes informed and consented to by the Data Holders.

c) Data Quality: The Personal Data submitted to Treatment must be truthful, complete, exact, updated, verifiable and understandable. When in possession of partial, incomplete, fragmented or misleading Personal Data, the Company must refrain from Processing them, or request the owner to complete or correct the information.

d) Delivery of information to the Holder: When the Holder requests it, the Company must deliver the information about the existence of Personal Data that concerns the applicant. This delivery of information will be carried out by the Company’s unit in charge of personal data protection (see point 7 of this Policy). Restricted Circulation: Personal Data may only be Processed by Company personnel who have authorization to do so, or those who, within their duties, are in charge of carrying out such activities. Personal Data may not be delivered to those who do not have Authorization or have not been Authorized by the Company to carry out the Treatment.

e) Temporality: The Company will not use the owner’s information beyond the reasonable term required by the purpose that was informed to the Owner of the Personal Data.

f) Restricted access: Except for expressly authorized Data, the Company may not make Personal Data available for access through the Internet or other mass media, unless technical and security measures are established to control access and restrict it to Authorized people only.

g) Confidentiality: The Company must always carry out the Treatment by providing the technical, human and administrative measures that are necessary to maintain the confidentiality of the data and to prevent it from being adulterated, modified, consulted, used, accessed, eliminated, or known by people Unauthorized or by Authorized and Unauthorized persons fraudulently, or that the Personal Data is lost. Any new project that involves the Processing of Personal Data must consult this Treatment Policy to ensure compliance with this rule.

h) Confidentiality and Subsequent Treatment: All Personal Data that is not Public Data must be treated by those Responsible as confidential, even when the contractual relationship or the link between the Owner of the Personal Data and the Company has ended. Upon termination of said link, such Personal Data must continue to be Treated in accordance with this Policy and the Law.

i) Individuality: The Company will keep the databases in which it has the quality of Manager separate from the databases in which it is Responsible.

j) Necessity: Personal Data can only be Processed during the time and to the extent that the purpose of its Processing justifies it.

3 Treatment and Purposes

The Personal Data processed by the Company must be strictly submitted only to the purposes indicated below. Likewise, the Managers or third parties who have access to Personal Data by virtue of Law or contract, will maintain the Treatment within the following purposes:

a) Manage all the information necessary to comply with the Company’s tax obligations and commercial, corporate and accounting records.

b) Comply with the internal processes of the Company regarding the management of suppliers and contractors.

c) Comply with service contracts entered into with clients. .

d) Provide their services in accordance with the particular needs of the Company’s clients, in order to fulfill the service contracts entered into, including but not limited to the verification of affiliations and rights of the individuals to whom the Company’s clients Company will provide its services, use Personal Data for marketing and/or commercialization of new services or products.

e) The other purposes determined by the Controllers in the process of obtaining Personal Data for its Treatment and that are communicated to the Holders at the time of the collection of personal data.

f) The control and prevention of fraud and money laundering, including but not limited to consulting restrictive lists, and all the necessary information required for the SARLAFT.

g) The process of filing, updating systems, protection and custody of information and databases of the Company.

h) Processes within the Company, for development or operational and/or system administration purposes.

i) The transmission of data to third parties with whom contracts have been entered into for this purpose, for commercial, administrative, marketing and/or operational purposes, including but not limited to the issuance of cards, personalized certificates and certifications to third parties, of in accordance with current legal provisions.

j) Maintain and process by computer or other means, any type of information related to the client’s business in order to provide the relevant services and products.k) The other purposes determined by the Controllers in the process of obtaining Personal Data for Treatment, in order to comply with legal and regulatory obligations, as well as the Company’s policies.

4 Rights of the Holder of Personal Data

In accordance with the Law, the Holders of Personal Data have the following rights:

a) Know, update and rectify your Personal Data before the Company or those in charge of their Treatment. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Treatment is expressly prohibited or has not been authorized.

b) Request proof of the Authorization granted to the Company, unless the Law indicates that said Authorization is not necessary.

c) Submit requests to the Company or the Person in Charge of the Treatment regarding the use that has been given to your Personal Data, and for them to deliver such information.

d) Submit complaints to the Superintendency of Industry and Commerce for violations of the Law.

e) Revoke your Authorization and/or request the deletion of your Personal Data from the Company’s databases, when the Superintendency of Industry and Commerce has determined through a definitive administrative act that the Company or the Person in Charge of the Treatment has incurred in conduct contrary to the Law or when there is no legal or contractual obligation to maintain the Personal Data in the Responsible Party’s database.

f) Request access and free access to your Personal Data that have been processed in accordance with article 21 of Decree 1377 of 2013.

g) Know the modifications to the terms of this Policy prior and efficiently to the implementation of the new modifications or, failing that, of the new information treatment policy.

h) Have easy access to the text of this Policy and its modifications.

i) To

easily and simply access the Personal Data that is under the control of the Company to effectively exercise the rights that the Law grants to the Holders.

j) Know the agency or person empowered by the Company to whom you can submit complaints, queries, claims and any other request about your Personal Data.

k)

The Holders may exercise their legal rights and carry out the procedures established in this Policy, by presenting their citizenship card or original identification document. Minors may exercise their rights personally, or through their parents or adults who have parental authority, who must prove it through the relevant documentation. Likewise, the rights of the Holder may be exercised by successors in title who prove said quality, the representative and/or proxy of the holder with the corresponding accreditation and those who have made a stipulation in favor of another or for another.

Personal Data Protection Officer

The Company has designated the Customer Service management as Responsible for receiving and dealing with requests, complaints, claims and queries of all kinds related to Personal Data. The person in charge of Customer Service will process queries and claims regarding Personal Data in accordance with the Law and this policy.

Some of the particular functions of this area in relation to Personal Data are:

a) Receive requests from the Holders of Personal Data, process and respond to those that are based on the Law or these Policies, such as: requests to update Personal Data; requests to know the Personal Data; Requests for deletion of Personal Data when the Holder submits a copy of the decision of the Superintendency of Industry and Commerce in accordance with the provisions of the Law, requests for information on the use given to their Personal Data, requests to update Personal Data, requests for proof of the Authorization granted, when it has proceeded according to the Law.

b) Respond to the Holders of the Personal Data on those requests that do not proceed in accordance with the Law.

The contact details are:

Physical address: Cra 15 Dg 40 A-89

Email address: entela.libros@gmail.com

Telephone: (+571) 6562954

Position of the contact person: Administrative Assistant

6 Procedures to exercise the rights of the Holders of Personal Data

6.1. queries

The Company will have mechanisms so that the Holder, his successors in title, his representatives and/or attorneys-in-fact, those who have been stipulated in favor of another or for another, and/or the representatives of minor Holders, formulate queries regarding which are the Personal Data of the Holder that rest in the Company’s Databases.

These mechanisms may be physical as a window process, electronic through the mail entela.libros@gmail.com or by telephone on the hotline (+57-1) 6562954, responsible for receiving requests, complaints and claims on the phones.

Whatever the means, the Company will keep proof of the query and its response.

a) If the applicant has the capacity to formulate the query, in accordance with the accreditation criteria established in Law 1581 and Decree 1377, the Company will collect all the information about the Holder that is contained in the individual record of that person or that is linked to the identification of the Holder within the Company’s databases and will be made known to the applicant.

b) The Person Responsible for attending the query will respond to the applicant as long as he/she has the right to do so because he/she is the Holder of the Personal Data, his successor in title, agent, representative, has been stipulated by another or for another, or is the legal responsible in the case of minors. This response will be sent within ten (10) business days from the date the request was received by the Company.

c) In the event that the request cannot be processed within ten (10) business days, the applicant will be contacted to communicate the reasons why the status of their request is pending. For this, the same means or one similar to the one used by the Holder to communicate his request will be used.

d) The final response to all requests will not take more than fifteen (15) business days from the date the initial request was received by the Company.

6.2. claims

The Company has mechanisms so that the Holder, his successors in title, representative and/or attorneys-in-fact, those who stipulated by another or for another, and/or

the representatives of minors Holders, make claims regarding:

(i) Personal Data Processed by the Company that must be corrected, updated or deleted, or (ii) the alleged breach of the Company’s legal duties.

These mechanisms may be physical as a window procedure, electronic through the Customer Service email entela.libros@gmail.com or by telephone on the hotline (+57-1) 6562954., responsible for receiving requests, complaints and phone claims.

e) The claim must be presented by the Holder, his successors in title or representatives or accredited in accordance with Law 1581 and Decree 1377, as follows:

· You must go to ENTEL LTDA; electronically to the email address entela.libros@gmail.com; physically the address Cra 15 Dg 40 A-89; or by phone on the hotline (+571) 6562954

· It must contain the name and identification document of the Holder.

· It must contain a description of the facts that give rise to the claim and the objective pursued (update, correction or deletion, or fulfillment of duties).

· You must indicate the address and contact information and identification of the claimant.

· It must be accompanied by all the documentation that the claimant wants to assert.

The Company, before attending to the claim, will verify the identity of the Owner of the Personal Data, his representative and/or proxy, or the accreditation that there was a stipulation by another or for another. For this, you can demand the citizenship card or original identification document of the Holder, and the special, general powers or documents that are required as the case may be.

f) If the claim or the additional documentation is incomplete, the Company will require the claimant only once within five (5) days following receipt of the claim to correct the faults. If the claimant does not submit the required documentation and information within two (2) months following the date of the initial claim, it will be understood that he has withdrawn the claim.

g) If for any reason the person who receives the claim within the Company is not competent to resolve it, the Customer Service Assistant will be transferred within two (2) business days after receiving the claim, and will report such referral to the claimant.

h) Once the claim is received with the complete documentation, a legend that says “claim in process” and the reason for it, in a term not greater than two (2) business days. This legend must be kept until the claim is decided.

i) The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

7 Validity

This Policy is effective as of July 6, 2018. The Personal Data that is stored, used or transmitted will remain in our Database, based on the criteria of temporality and necessity, for as long as it is necessary for the purposes mentioned in this Policy, for which they were collected.

Annex: SUGGESTIONS, COMPLAINTS AND CLAIMS ATTENTION PROCEDURE.

TARGET

Establish the methodology to receive, record, analyze and follow up on the complaints and claims made by the holders of the databases processed by ENTEL LTDA.

2. REACH

Applies to all processes of the organization.

3. DEFINITIONS

3.1 Holders:

For ENTEL Ltda., its external and internal owners are: employees, suppliers and customers.

3.2 Claim or complaint:

Manifestation of dissatisfaction of a holder regarding the information stored and processed by ENTEL Ltda.

4. GENERAL CONDITIONS

4.1 All complaints or claims must contain the full name of the person presenting it and its content when referring to the serious, concrete and real facts to be transmitted.

4.2 All receipt of complaints or claims must be recorded in the established format and/or a letter with the description of the non-conformity.

4.3 The Administrative Assistant receives, registers and appoints an official who must treat and respond in less than 24 hours to complaints and claims. If the non-conformity requires more time, the Administrative Assistant will notify the sender in writing.

5. DESCRIPTION OF THE PROCEDURE

5.1 RECEPTION OF COMPLAINTS AND CLAIMS: The Holder sends the complaints or claims through our email entela.libros@gmail.com or letter sent via certified mail describing your non-compliance.

5.2 Administrative Assistant: Checks the emails, letters and establishes whether the complaints or claims meet the conditions required to start the process.

5.3 Administrative Assistant: Assigns an official responsible for solving the non-conformity.

5.4 Assigned official: Processes the complaint or claim and investigates the cause that gave rise to this nonconformity and what the corrective actions would be for the specific case, then informs the owner in writing of the conclusions and actions generated so that this nonconformity returns to occur in the shortest time possible depending on each particular case.