Last updated: October 1, 2021

1. Responsible for the treatment

MOROCCO COLOMBIAN LEATHER SAS (hereinafter “MOROCOS 1986”), identified with NIT 800.061.127-1, with main address at Carrera 22 #82-33, Office 102, Bogotá, telephone 601 2560022, with website www.marruecos1986.co and email administracion@mclsas.com , in compliance with the provisions of Law 1581 of 2012 and Decree 1074 of 2015, is Responsible for the Processing of Personal Data of the Owners, about which it will decide directly and autonomously.

This privacy policy (the “Policy”) is directed to the clients of MARRUECOS 1986 and, in general, to any person whose Personal Data is being or will be processed by MARRUECOS 1986 (the “Owner” or the “Owners”). ), among them, workers, former workers, suppliers, visitors, and any other third party of which MORRUECOS 1986 processes personal data.

In the development of its activities and commercial relationships, MORRUECOS 1986 may access, collect, receive, manage, transfer, transmit and delete personal data. All information will be considered confidential information and will be subject to appropriate security measures to protect it from loss, misuse or unauthorized use and alteration, to the extent reasonable. MORRUECOS 1986 uses and will use this information in the future to develop the purposes established here and those expressly informed to you at the time of collecting the data. For the purposes of the above, MOROCCO 1986 carries out the Treatment under the mandates of Law 1581 of 2012 and Decree 1074 of 2015 and the other regulations that add, modify or repeal them.

2.Definitions

Terms used with an initial capital letter that are not expressly defined in this Policy will have the definition assigned to said terms in the Law 1581 of 2012 and its regulatory decrees or the rules that modify, complement or replace them:

The Personal Data that is subject to processing by MARRUECOS 1986 may come from the web portal www.marruecos1986.co, the email Tienda.online@mclsas.com, the telephone number 601 2560022, social networks such as Facebook, Instagram and Twitter, commercial negotiations, contracts, public directories, formats and/or forms authorized by clients, potential clients, potential workers, workers, former workers, suppliers and other Owners.

Specifically, the following Personal Data will be processed:

• Clients and potential clients: includes, but is not limited to, identification data, contact information, payment information,

• Workers, potential workers and former workers: includes, but is not limited to, contact data, identification, image, voice, financial information, sensitive data (for example medical information and biometric data) and professional information, among others.

• Suppliers: includes, but is not limited to, contact data, identification data, demographic data, licenses, vehicle information, biometric data such as fingerprint, among others.

• Visitors: includes, but is not limited to, contact information, identification data, personal image, voice, among others.

Sensitive Data will be Processed with the greatest possible diligence and with reasonable security standards for the type of Personal Data being Processed. Limited access to Sensitive Data will be a guiding principle to safeguard the privacy of such Personal Data and, therefore, only authorized personnel will be able to access this type of information.

4. Purposes:

Personal Data will be processed for the following purposes, without prejudice to what is established in each specific Authorization text:

• Clients and potential clients: confirm, update and verify your information and identity; establish and manage a contractual relationship; contact them for commercial, marketing and management purposes of the contractual relationship, through any means; conduct satisfaction and quality surveys; verify and manage compliance with legal and contractual obligations, including the control and prevention of fraud and money laundering, among others.

• Workers, potential workers and former workers: compliance with legal or contractual obligations; the proper execution of the employment contract; compliance with the internal policies of MOROCCO 1986; verification of compliance with the worker's obligations; the administration of information and communications systems, and the generation of copies and security files of the information on the equipment provided by MORRUECOS1986; carry out the relevant validations for your employment relationship, among others.

• Suppliers: compliance with legal or contractual obligations, including the control and prevention of fraud and money laundering; the proper execution of the contract; compliance with the internal policies of MOROCCO 1986; verification of compliance with the supplier's obligations; verify your identity, among others.

• Visitors: keep our facilities safe; carry out internal administrative processes and comply with our legal and contractual obligations, among others.

It is the duty of the Owners to guarantee the veracity of the data provided. MOROCCO 1986 has adopted the security measures within its reach, at a technical and administrative level with a view to protecting the Personal Data under its responsibility, however, the Owners must understand that these measures are not impregnable and are in a process of review and improvement. permanent.

5. Authorization:

All Treatment will be preceded by obtaining the Authorization of the Owners, whenever the Law requires it. To do this, MORRUECOS 1986, its employees and authorized third parties will collect Personal Data and sign an Authorization form, keeping a copy of this document for future reference.

6. Rights of the owners:

MOROCCO 1986 will guarantee the Holders the following rights, which may be exercised following the procedures and forms established in this Policy:

The Holders may exercise their rights enshrined in the Law and carry out the procedures established in this Policy by presenting an identification document.

Minors may exercise their rights personally or through their parents or adults who have parental authority, who must prove it through the relevant documentation. Those authorized must present the respective accreditation that authorizes them to exercise the rights of the Owners.

7. Personal Data Protection Area:

MOROCCO 1986 has a unit in charge of receiving and handling Queries and Claims related to Personal Data, the area in charge within MOROCCO 1986 is the area of ​​queries, complaints and claims.

The agency has the support of a person who will specifically process queries regarding Personal Data in accordance with the Law and this Policy. Some of the particular functions of this area in relation to Personal Data are:

• Respond to and receive all Queries, Claims and other requests from the Owners, process and respond to those that are based on the Law or this Policy, such as: requests to update Personal Data; requests for knowledge of Personal Data; requests for deletion of Personal Data, requests for revocation of authorization; requests for information about the Treatment and purposes given to Personal Data, and requests aimed at obtaining proof of the Authorization granted, when appropriate according to the Law.

• Respond to the Owners regarding those requests that do not proceed in accordance with the Law.

The contact details of the Legal Department, which will act as the area in charge of personal data issues, are:

Data Protection Officer:

Customer service area, attention to complaints and claims.

Email address:

administracion@mclsas.co

Phone:

321 482 6619

Address:

Carrera 22 # 82-33, office 102 Barrio El Polo, Bogotá

8. Attention to queries:

MOROCCO 1986 has mechanisms so that the Owner, his successors, his representatives and/or attorneys, those who by stipulation in favor of another or for another are legitimized, or the representatives of minor Owners, make INQUIRIES regarding what the Personal Data of the Owner that rests in the MOROCCO 1986 Databases, what is the Treatment to which they are subject and what are the purposes that they intend to satisfy. The Owner may send his queries through the email administracion @mclsas.co . MOROCCO 1986 will keep proof of the query and your response.

MOROCCO 1986, as Responsible for responding to the query, will respond to the applicant as long as the latter has the right to do so as the Owner of the Personal Data, his successor in title, his representative and/or attorney, those who by stipulation in favor of another or for another are legitimate, or the legal person responsible in the case of minors. This response will be sent within ten (10) business days from the date on which the request was received by TUL. In the event that MOROCCO 1986 considers that the applicant does not have the capacity to carry out the consultation, MOROCCO 1986 will inform the applicant.

In the event that the request cannot be attended to within ten (10) business days, the applicant will be contacted to inform them of the reasons why the status of their application is in process and to indicate the date on which the query will be attended to. which in no case will be more than five (5) business days following the expiration of the first term. MOROCCO 1986 will use the same means or one similar to that through which the query was presented to respond.

The final response to all requests will not take more than fifteen (15) business days from the date on which the initial request is received by TUL.

9. Claims:

MOROCCO 1986 has mechanisms so that the Owner, his successors, his representatives and/or attorneys, those who by stipulation in favor of another or for another are legitimized, or the representatives of minor Owners, make Claims so that their Personal Data be rectified, updated or deleted. The Owner may send his queries through the email administracion @mclsas.co . MOROCCO 1986 will keep proof of the claim and its response.

The Claim must be presented by the Owner, his successors in title, his representatives and/or attorney-in-fact, those who by stipulation in favor of another or for another are legitimate, or their representatives, as follows:

• It must be sent electronically to the email address administracion @mclsas.co .

• It must contain the name and identification document of the Owner.

• It must contain a description of the facts that give rise to the claim and the objective pursued (updating, correction or deletion, or compliance with duties).

• You must indicate the address, contact information and identification of the claimant.

• It must be accompanied by all the documentation that the claimant wants to assert.

If the claim or additional documentation is incomplete, MOROCCO 1986 will require the claimant once within five (5) business days following receipt of the claim to correct the deficiencies. If the claimant does not present the required documentation and information within two (2) months following the date of the initial claim, it will be understood that the claim has been abandoned.

Once the claim is received with the complete documentation, a legend that says “claim in process” and the reason for this will be included in the MOROCCO 1986 Database where the Holder Data subject to claim is stored, in a term no longer than two (2) business days. This legend must be maintained until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Please note that the specific person in charge of this process may change from time to time, but the contact information for the purposes of this Policy is maintained permanently, which is why a change in person will not require a change to this Policy. Policy.

10. Modifications:

MOROCCO 1986, reserves the right to modify or update this policy at any time. Whenever the Policy is substantially modified, the Owners will be notified. The Personal Data that is stored, used or transmitted will remain in our Database, based on the criteria of temporality and necessity, for as long as it is necessary for the purposes mentioned in this Policy, for which they were collected.

11. Shopify:

The MOROCCO 1986 website is hosted on Shopify Inc. They provide the online e-commerce platform that allows us to sell our products and services to you.

Personal Data is stored through Shopify's data storage, databases, and the general Shopify application. Personal Data is stored on a secure server behind a firewall

12. Payment:

If the customer chooses a direct payment gateway to complete their purchase, then Shopify stores their credit card data. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored only to the extent necessary to complete the purchase transaction. After the purchase is completed, the purchase transaction information is deleted.

All direct payment gateways adhere to the standards set by PCI-DSS as outlined by the PCI Security Standards Council, which is a joint effort of brands such as Visa, MasterCard, American Express and Discover.

PCI-DSS requirements help ensure the secure handling of credit card information by retailers and their service providers.

For a clearer view, Owners can read the Shopify Terms of Service here

13. Validity:

This Policy applies as of October 1, 2021 and the period of the databases will have a validity equal to the period in which the purpose or purposes are maintained, or the period of validity indicated by a legal, contractual or jurisprudential cause of specific way.