PRIVACY NOTICE FOR COLOMBIA USERS

Colombia-Specific Privacy Information/Rights

This privacy notice (this “Notice”) establishes the terms and conditions under which Kayma Labs Ltd. (“Company,” “we,” or “us”) will process your Personal Information, in compliance with articles 15 and 20 of the Political Constitution, Law 1581 of 2012, and its regulatory decrees, particularly Chapter 25 of Decree 1074 of 2015, Sentence C-748 of 2011, provisions of the Superintendency of Industry and Trade and other regulations that modify or, complement them (collectively, “Colombia Privacy Law”).

This Notice supplements our general Milgo Privacy Policy [LINK TO GENERAL POLICY] (our “Privacy Policy”). Together, the purpose of our Privacy Policy and this Notice is to establish the criteria under which we process the information and personal data you share with us contained in our databases and physical and electronic files (“Personal Information”).

When you authorize the processing of your Personal Information to the Company, you are aware that said authorization extends to the provisions of this policy, therefore, you accept and understand that this policy is an integral part of the authorization that you provide to us (the “Authorization”). Therefore, we have made available in each of our channels, our Privacy Policy this Policy and other privacy notices that may be applicable to you (including this Notice), so that you know the scope of the processing of your Personal Information.

1. Your Rights over Your Information

According to Colombia Privacy Law, you may exercise the following rights:

  • To know, update and rectify your Personal Information. This right may be exercised, among others, against partial, inaccurate, incomplete, fractional, misleading data, or those whose processing is expressly prohibited or has not been authorized.
  • Request proof of the Authorization granted to the Company, unless Colombia Privacy Law indicates that such Authorization is not necessary.
  • Submit requests to the Company or the person in charge of the processing of your Personal Information regarding the use you have given to your data, and for them to deliver such information to you.
  • Submit complaints to the Superintendency of Industry and Trade for violations of the Law.
  • Revoke your Authorization and/or request the deletion of your Personal Information from our databases, when there is no legal or contractual obligation to maintain the Personal Information on our databases.
  • To know the modifications to the terms of our Privacy Policy, including this Notice, prior and efficiently to the implementation of the new modifications or, failing that, of the new terms.
  • Have easy access to the text of our Privacy Policy, including this Notice, and its modifications.
  • You may exercise your legal rights and carry out the procedures established in this Policy, by presenting your citizenship card or original identification document. Minors may exercise their rights personally, or through their parents or adults who have parental authority, who must prove it by means of the relevant documentation. Likewise, your rights may be exercised by the successors in title who prove such quality, representative and/or attorney with the corresponding accreditation and those who have made a stipulation in favor of another or for another.
2. Mechanisms To Know The Treatment Policy

The handling of your personal data by the Company will be done in accordance with the provisions of the “Privacy Policy”, which contains the policies established by the Company for data processing, the mechanisms for the effectiveness of the rights of the holders of the information, including knowing, updating, rectifying or deleting the information that rest in our databases, as well as, to complain and revoke the authorization for its use.

3. Regarding Minors

The representatives of minors who access our Services are responsible for providing authorization to the school who employs our Services for the processing of Personal Information of minors. In accordance with applicable law, we obtain consent from representatives of minors for the collection of Personal Information from their minors, through the corresponding school.  Therefore, Milgo presumes that the Personal Information of minors that it has in its databases and its treatment has been authorized by the representatives of minors as per the representation of schools.

4. Inquiries and Complaints Regarding Your Information

You can make inquiries to the Company regarding your Personal Information, including consultations, requests, claims and complaints by sending us an email at yoav.r.@kayma.com to request access to, correct, or delete any Personal Information that you have provided to us.  Please note that we cannot delete certain or all Personal Information except by also deleting your user account.  We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.
‍
If you delete your Uploads from Milgo, copies of your Uploads may remain viewable by us in cached and archived pages.

Additionally, please note that:

  • If the applicant has the capacity to formulate the query, in accordance with the accreditation criteria established in Law 1581 of 2012 and Decree 1377 of 2013, the Company will collect all the information contained in the individual registration of that person or that is linked to the identification of the person within our databases and will make it known to the applicant.
  • The Company will respond to the applicant as long as they have the right to do so. This response will be sent within ten (10) business days from the date on which the request is received by us.
  • In the event that the request cannot be attended to within ten (10) business days, the applicant will be contacted to inform them of the reasons why the status of this request is being processed.
  • The final response to all requests will take no more than fifteen (15) business days from the date on which the initial request was received by the Company.

For complaints, the following procedure shall apply:

  • The claim must be submitted by the you, your successors in title or representatives or accredited in accordance with Law 1581 of 2012 and Decree 1377 of 2013.
  • You must contact us electronically at the e-mail address stated above.
  • It must contain your name and identification document.
  • It must contain a description of the facts that give rise to the claim and the objective pursued (updating, correction or deletion, or fulfillment of duties).
  • It must indicate the address and contact and identification details of the claimant.
  • It must be accompanied by all the documentation that the claimant wants to assert.
  • The Company, before attending to the claim, will verify the identity of the holder of the Personal Information, his representative and/or proxy, or the accreditation. To do this, you can require the citizenship card or original identification document of the Holder, powers of attorney or documents that are required as the case may be.
  • If the claim or additional documentation is incomplete, the Company will require the claimant one time within five (5) business days of receipt of the claim to correct the faults. If the claimant does not submit the required documentation and information within two (2) months following the date of the initial claim, it will be understood that they have withdrawn from the claim.
  • The maximum term to deal with the claim will be fifteen (15) working days counted from the day following the date of its receipt. When it is not possible to deal with the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be dealt with, which in no case may exceed eight (8) working days following the expiration of the first term.
5. Data Retention

The Personal Information that the Company requests, may be kept on occasion to comply with aspects: legal, contractual, tax, and sometimes for audit purposes, and will remain stored according to the maximum times established in Colombian legislation for its retention. The deletion of Personal Information, the ends of which are not mandatory by law, will be carried out once the purpose has been fulfilled, in accordance with the authorizations, contracts and/or agreements that you have been previously agreed with us, or because you have requested for the deletion; however, if the you access our Services again, where it becomes necessary to incorporate your Personal Information, it is considered a new authorization for the processing of such Personal Information. The above condition does not apply to personal data, which the law requires its permanent conservation, in accordance with the contractual relationship that one party has with the Company.

6. Data Transfers, Storage, and Processing Globally

National Transmission of Personal Information. The processing of information in collection, circulation, storage, use or deletion may be transferred to third parties with whom there is a contractual relationship at a national or international level for the management of the service provided by the Company through third parties, as well as for the fulfillment of the purposes established in this policy.

International Transfers and Transmissions of Personal Information. The Company will carry out international transmissions and transfers of Personal Information for the management of the Services we provide directly or through third parties, as well as for the fulfillment of the purposes established in our Privacy Policy, including this Notice, exclusively to the countries that provide adequate levels of data protection, according to the list defined by the Superintendency of Industry and Commerce in number 3.2 of Chapter 3 of Title V of the Single Circular of the Superintendency of Industry and Trade, as well as, it will take into account the procedure established in said circular in cases where a request for declarations of conformity must be made, for international transfers to countries that are not on the list.
‍
In the case of transfer and/or international transmission of Information by us to a third party by virtue of a contractual relationship, the latter will guarantee that in its processing it will adhere exclusively (i) to the purposes authorized by the holders; (ii) to the principles established in Law 1581 of 2012; (iii) to its information processing policy, (iv) in general to the obligations contained in Law 1581 of 2012 and Chapter 25 of Decree 1074 of 2015 and other provisions that they modify, supplement or replace them.

044007\00001\17191402v6