Privacy Policy and Personal Data Treatment

1. Identification of the Data Controller

The Data Controller for the information and personal data collected through this web portal is BEST4U, a Colombian brand based in Bogotá D.C., Colombia. For Habeas Data contact, the Privacy Officer will handle requests at the enabled emails privacidad@best4u.com.co and contacto@best4u.com.co.

2. Legal Framework and Scope

This policy is governed by the parameters established by the Colombian legal system regarding personal data protection and constitutional guarantees:

• Political Constitution of Colombia: Articles 15 (Right to Privacy and Habeas Data) and 20 (Right to Information).
• Statutory Law 1581 of 2012: Establishing general provisions for the protection of personal data.
• Regulatory Decree 1377 of 2013: Partially regulating Law 1581 of 2012.
• Single Decree 1074 of 2015: Chapter 25 regarding Personal Data Treatment.
• Instructions and Guides from the Superintendence of Industry and Commerce (SIC): The inspection, surveillance, and control authority for Personal Data Protection in Colombia.

3. Legal Definitions (Art. 3, Law 1581 of 2012)

For the correct interpretation of this Policy, the following definitions contained in the law will be taken into account:

• Authorization: Prior, express, and informed consent of the Data Owner to carry out the Treatment of their personal data.
• Database: Organized set of personal data that is subject to Treatment.
• Personal Data: Any information linked or associated with one or more specific or determinable natural persons.
• Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, data relating to the civil status of persons, their profession or trade, and their status as a merchant or public servant.
• Sensitive Data: That which affects the Owner's privacy or whose improper use may generate discrimination (e.g., racial origin, political orientation, religious convictions, health data, biometric data).
• Data Processor: Natural or legal person, public or private, who by themselves or in association with others, performs the Treatment of personal data on behalf of the Data Controller.
• Data Controller: Natural or legal person, public or private, who by themselves or in association with others, decides on the database and/or the Treatment of the data. For the purposes of this portal, it is BEST4U.
• Data Owner: Natural person whose personal data is subject to Treatment (users, customers, web visitors).
• Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

4. Guiding Principles of Data Treatment

In the development, application, and interpretation of this Policy, BEST4U will rigorously and comprehensively apply the following legally established guiding principles:

1. Principle of Legality: Data Treatment is a regulated activity that must adhere to Law 1581 of 2012 and other provisions that develop it.
2. Principle of Purpose: Treatment obeys a legitimate purpose in accordance with the Constitution and the Law, which will be previously informed to the Data Owner.
3. Principle of Freedom: Treatment can only be exercised with the prior, express, and informed consent of the Owner. Personal data cannot be obtained or disclosed without prior authorization.
4. Principle of Truthfulness or Quality: Information subject to Treatment must be truthful, complete, accurate, updated, verifiable, and understandable. The Treatment of partial, incomplete, fractioned, or misleading data is prohibited.
5. Principle of Transparency: The Owner's right to obtain from the Controller or Processor, at any time and without restrictions, information about the existence of data concerning them must be guaranteed.
6. Principle of Access and Restricted Circulation: Treatment is subject to the limits derived from the nature of the personal data. In this sense, Treatment can only be carried out by persons authorized by the Owner and/or by persons provided for by law.
7. Principle of Security: Information subject to Treatment will be handled with the technical, human, and administrative measures necessary to provide security to the records, avoiding their alteration, loss, consultation, use, or unauthorized or fraudulent access.
8. Principle of Confidentiality: All persons involved in the Treatment of personal data are obliged to guarantee the secrecy of the information, even after their relationship with any of the tasks comprising the Treatment has ended.

5. Purposes of Personal Data Treatment

BEST4U collects and treats the personal data of Owners through the web portal https://best4u.com.co/ legitimately for the following purposes:

5.1. User and Web Visitor Management

• Address, process, and respond to requests, petitions, complaints, or claims (PQR) sent through online contact forms.
• Manage user registration, account creation, and identity verification within the digital platform.
• Send confirmations, operational notifications, and updates on the contracted or requested service.

5.2. Service Provision and Commercial Management

• Process quotes, orders, service requests, electronic invoicing, and collection management.
• Maintain fluid communication regarding the execution of contracts or services provided by BEST4U.
• Evaluate the quality of services provided through satisfaction surveys.

5.3. Marketing, Analytics, and Promotional Communications

• Send newsletters, commercial offers, promotions, and news about BEST4U products and services (with prior express authorization).
• Analyze browsing habits, traffic metrics, and user behavior on the web to improve user experience (UX) and interface.
• Audience segmentation and optimization of digital marketing campaigns.

6. Treatment of Special Data (Sensitives and Minors)

6.1. Sensitive Personal Data

BEST4U will not condition any activity on the delivery of sensitive personal data. If the collection of sensitive data (such as biometric or health data) is exceptionally required, the Owner will be expressly informed of the optional nature of its delivery and the specific purpose it will be given.

6.2. Children and Adolescents' Data (Minors)

The portal https://best4u.com.co/ is primarily addressed to adults. BEST4U fully respects the prevailing rights of minors. If treatment of minors' data is required, prior authorization from the legal representative or guardian will be obtained, always looking after the best interests of the minor and respecting their right to be heard.

7. Rights of the Information Owners (Habeas Data)

In accordance with Article 8 of Law 1581 of 2012, the personal data Owner has the following inalienable rights:

• a) Access, update, and rectify their personal data with BEST4U. This right can be exercised, among others, against partial, inaccurate, incomplete, fractioned, or misleading data, or those whose Treatment is expressly prohibited or has not been authorized.
• b) Request proof of authorization granted to BEST4U, except when legally exempted from such requirement (Art. 10 Law 1581 of 2012).
• c) Be informed by BEST4U, upon request, regarding the use given to their personal data.
• d) Lodge complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law and other regulations that modify, add to, or complement it.
• e) Revoke authorization and/or request deletion of data when constitutional and legal principles, rights, and guarantees are not respected during Treatment.
• f) Free access to their personal data that has been subject to Treatment at least once every calendar month or every time there are substantial modifications to the Policy.

8. Procedure for the Exercise of Habeas Data Rights

Owners or their successors can exercise their rights of Consultation and Claim by addressing a formal request to the official privacy email: privacidad@best4u.com.co or through physical communication to our offices.

8.1. Requirements for Submitting Requests

Every request must contain at least:

1. Full name of the Owner and ID document (copy attached for verification).
2. Contact details for notification (email address, physical address, and phone number).
3. Clear and precise description of the facts giving rise to the consultation or claim and the right they wish to exercise (access, update, rectify, delete, or revoke).
4. Documents or evidence they wish to assert.

8.2. Procedure for CONSULTATIONS (Art. 14 Law 1581 of 2012)

Owners or their successors may consult the Owner's personal information resting in any BEST4U database.

Legal Response Term for Consultations: Consultations will be addressed within a maximum period of ten (10) business days from their receipt date. When it is not possible to address the consultation within said period, the interested party will be informed, stating the reasons for the delay and indicating the date it will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

8.3. Procedure for CLAIMS, RECTIFICATION, AND DELETION (Art. 15 Law 1581 of 2012)

Owners who consider that the information contained in a BEST4U database should be corrected, updated, or deleted, or when they notice the alleged breach of any of the duties legally provided, may file a claim adjusted to the following procedure:

1. Incomplete Claim: If the claim is incomplete, the interested party will be required within five (5) days following receipt to correct the faults. After two (2) months from the request date without the applicant submitting the required information, it will be understood that they have withdrawn the claim.
2. Inclusion of Legend: Once the complete claim is received, a legend saying "claim in process" and its reason will be included in the database within a period not exceeding two (2) business days. Said legend will be kept until the claim is decided.
3. Response Term: The maximum period to address the claim will be fifteen (15) business days from the day following its receipt. When it is not possible to address the claim within said period, the interested party will be informed of the reasons for the delay and the date it will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

8.4. Procedural Requirement before the SIC

The Owner or successor may only file a complaint with the Superintendence of Industry and Commerce (SIC) once they have exhausted the consultation or claim process directly with BEST4U, as provided by Article 16 of Law 1581 of 2012.

9. Cookies Policy and Web Tracking Technologies

The website https://best4u.com.co/ uses first-party and third-party cookies (including web analytics tools like Google Analytics and conversion pixels) to optimize navigation, remember user preferences, and measure portal performance.

• Technical / Necessary Cookies: Essential for browsing and the proper functioning of the page.
• Analytics Cookies: Allow quantifying the number of users and performing statistical measurements of web usage.
• Marketing Cookies: Used to display relevant ads according to user interests.

The user has the power to configure their browser to accept, reject, or delete cookies at any time. However, disabling certain cookies may affect the optimal functioning of the website.

10. International Data Transfer and Transmission

BEST4U may perform international transfers or transmissions of personal data to servers located abroad (e.g., hosting providers, cloud services, automation and bulk email platforms), always guaranteeing that receiving countries have adequate levels of data protection in accordance with SIC declarations or through the signing of Personal Data Transmission Contracts incorporating applicable model clauses.

11. Information Security Measures

In application of the Security Principle, BEST4U adopts technical, administrative, and physical security measures to protect the Owner's information from unauthorized access, loss, alteration, destruction, or misuse. These measures include SSL/TLS encryption protocols on the web platform, restricted access controls to databases, and confidentiality agreements with handling personnel.

12. Validity and Modifications to the Privacy Policy

This Personal Data Treatment Policy is effective from its publication on the website https://best4u.com.co/.

Databases managed by BEST4U will remain valid while the purpose for which the personal data was collected persists or during the period required by current legal or tax regulations.

BEST4U reserves the right to modify this Policy at any time. Any substantial change will be timely communicated to Owners through a prominent notice on the website or via email before its application.