Security policies and data management

CLUBBIN S.A.S.

INTRODUCTION

CLUBBIN S.A.S. is a Colombian company, whose main activity is to act as an intermediary between End Users and Allied Users, through a digital platform composed of a mobile application, so that End Users can log in, get information about the products and services provided by Allied Users and can purchase such products or services and make their payment electronically.

In compliance with the provisions of Law 1581 of 2021, regulated by Decrees 1377 of 2013 and 886 of 2014, this document adopts the Personal Data Processing Policy in order to protect the personal information provided by End Users, Allied Users, employees, suppliers, shareholders and any other natural person from whom CLUBBIN S.A.S. obtains or processes personal information. For this reason, CLUBBIN S.A.S. takes all precautions to safeguard your personal information, using the most complete and effective information protection computer security mechanisms.

The purpose of the Personal Data Treatment Policy is to protect the constitutional right of Habeas Data that all persons have to know, update and rectify the information that has been collected and stored in the different databases of CLUBBIN S.A.S., what CLUBBIN S.A.S. can do with such information, as well as to make known the rights of the holders of personal data and the channels through which these rights can be protected.

By obtaining an Account and/or browsing the Clubbin App, End Users and visitors unequivocally consent to the use of their personal information in accordance with the Personal Data Processing Policy described below.

This document is an integral part of the Terms and Conditions of Clubbin App. By accepting the Terms and Conditions at the time of registration, the Fnal User accepts the Personal Data Processing Policy contained herein.

DEFINITIONS

- Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of Personal Data;
- Privacy Notice: Verbal or written communication generated by the Controller, addressed to the Data Subject for the Processing of his Personal Data, through which he is informed about the existence of the information processing policies that will be applicable, how to access them and the purposes of the Processing that is intended to be given to the Personal Data;
- Personal Data Base: Organized set of Personal Data that is subject to Processing;
- Clubbin: It is the Colombian company CLUBBIN S.A.S.;
- Personal Data: Any information linked or that can be associated to one or several determined or determinable natural persons;
- Public Data: Data that is not semi-private, private or sensitive. Public Data are considered, among others, the data related to the civil status of persons, their profession or trade and their status as merchant or public servant. By their nature, Public Data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality;
- Sensitive Data: Sensitive Data is understood as that which affects the privacy of the Data Subject or whose improper use may generate discrimination, such as that which reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data;
- Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of Personal Data on behalf of the Data Controller;
- Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the Database and/or the Processing of Personal Data;
- Data Subject: Natural person whose Personal Data is the object of Processing;
- Transfer: The transfer of data takes place when the Controller and/or Processor of Personal Data, located in Colombia, sends the information or Personal Data to a recipient, which in turn is the Data Controller and is located inside or outside the country;
- Transmission: Processing of Personal Data that involves the communication of the same within or outside the territory of the Republic of Colombia when the purpose is the performance of a Processing by the Processor on behalf of the Controller;
- Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

REGULATIONS

LEGAL FRAMEWORK

- Political Constitution of Colombia
- Law 1581 of 2012 and other laws that modify or regulate it.
- Regulatory Decrees
- Rulings of the Constitutional Court C-1011 of 2008 and C-748 of 2011
- External Circulars issued by the Superintendency of Industry and Commerce

SCOPE

This policy applies to the processing of personal data recorded in the Personal Databases owned by Clubbin that contain personal information of those who are End Users, Allied Users, employees, suppliers, shareholders and, in general, third parties who have provided their Personal Data to Clubbin, as long as they are natural persons in accordance with the provisions of the law.

TREATMENT TO WHICH THE PERSONAL DATA COLLECTED BY CLUBBIN WILL BE SUBMITTED
In order to provide an excellent service and to allow users to perform operations in a fast and secure way, Clubbin requires certain personal information, which allows it to offer End Users services and functionalities that best suit their needs and to customize the Services to make their experiences in the mobile application as comfortable as possible. The Personal Data for which Clubbin is responsible are stored in Databases and will be used for the following purposes
- Sort, catalog, classify, divide or store Personal Data within Clubbin's systems and files;
- Create and manage user accounts in your proprietary mobile application;
- Develop internal studies on End Users' interests, behaviors and demographics to better understand their needs and interests and to offer better services or provide them with related information;
- To improve our commercial and promotional initiatives and to analyze the pages visited and the searches performed by End Users, to improve our offer of contents and articles, to personalize such contents, their presentation and services;
- Send information or e-mail messages about new services, publish advertising or promotions, banners and information of interest to End Users, news about the mobile application, in addition to the information expressly authorized in the End User's preferences section;
- Send information or notices by text message (SMS) to the cell phone provided by the End User to Clubbin. The text messages may contain advertising and/or promotional notices from Clubbin and/or third parties, as well as information about Clubbin's services, including in particular but without limitation, reminders of payment due dates and other obligations acquired through the use of Clubbin's Services;
- Provide commercial benefits to End Users, offer new services related to those offered in the mobile application and make invitations to events;
- Enable End Users to participate in loyalty programs with benefits, marketing and promotional activities;
- Include a bullet to talk about verifying product ownership at the time of radiation to avoid fraud.
- Conduct satisfaction surveys to evaluate the quality of products and services offered through the mobile application;
- Perform accounting, tax and administrative management of End Users, Allied Users, employees, suppliers and shareholders;
- To comply with labor obligations contracted with employees and train them on the use of the mobile application;
- Verify and obtain references of natural or legal persons provided by candidates in personnel selection processes;
- Share Personal Data with Allied Users and service providers or outsourcing companies that contribute to improve or facilitate operations through the mobile application, including, but not limited to, event management services, payment methods, insurance or intermediaries in the management of payments, call centers or loyalty programs, among others. Clubbin will ensure that certain standards are met by signing agreements aimed at maintaining the confidentiality and security of End Users' Personal Data. However, Clubbin is not responsible for the misuse of End Users' Personal Data by these companies or Internet sites.

In some cases, these service providers may collect Personal Data directly from the End User (for example, in conducting surveys or studies). In such cases, you may receive notice of a service provider's participation in such activities, and it will be at the End User's discretion as to what information he or she wishes to provide and what additional uses the service providers choose to make. In the event that the End User provides, on his or her own initiative, additional information to such service providers directly, they may use this information in accordance with their own personal data processing policies.

RIGHTS OF THE OWNERS OF THE INFORMATION CONTAINED IN CLUBBIN'S DATABASES

The Personal Data Subject has the following rights:
a. Know, update and rectify their Personal Data against Clubbin, in its capacity as Data Controller. To make any changes to the Personal Data provided at the time of registration to Clubbin App, you must enter the "My Profile" section and edit.
b. Request proof of the authorization given to Clubbin for the Treatment, in its capacity as Data Controller.
c. Be informed by Clubbin, upon request, regarding the use that has been made of your Personal Data, as well as modifications and updates of the Policy of Personal Data Processing and its purposes.
d. File complaints before the Superintendence of Industry and Commerce for violations of Law 1581 of 2012 and other regulations that modify, add or complement it, once the complaint process has been exhausted before the Data Controller, as provided in this Policy.
e. To revoke the authorization and/or request the deletion of Personal Data when the Processing does not respect the principles, rights and constitutional and legal guarantees. In certain cases in which the deletion of Personal Data has been requested, it will be kept for some time in Clubbin's databases, in order to resolve disputes or claims.
f. Access free of charge to your Personal Data that has been subject to Processing.
g. To object to the processing of your Personal Data.
E. PROCEDURE FOR ACCESS, CONSULTATION, RECTIFICATION AND UPDATING OF PERSONAL DATA
The Owners of the information have the right to access their Personal Data and the details of the Processing thereof, as well as to rectify and update them in case they are inaccurate or to request their deletion when they consider that they are excessive or unnecessary for the purposes that justified their collection or to oppose the Processing thereof for specific purposes. The channels that have been implemented to guarantee the exercise of such rights, through the presentation of the respective request, are:
- E-mail: contacto@clubbin.co
- The text and content of Clubbin's Personal Data Processing Policy can be consulted at clubbin.co.
- By physical mail: Carrera 7b # 124 - 20
- By telephone: through the number available in the Clubbin App support service or by calling 3005260629.
These channels may be used by data subjects or third parties authorized by law to act on their behalf to exercise the following rights:
- Right of Access: The Owner of the information may consult their Personal Data free of charge. To know the Personal Data that are subject to processing by Clubbin, the Owner of the information may submit a request through any of the communication channels implemented, indicating the information you want to know.
- The request will be answered within a maximum term of ten (10) working days from the day following the date of receipt thereof. When it is not possible to attend the request within such term, the applicant will be informed of this fact, stating the reasons for the delay and indicating the date on which the request will be attended, which in no case may be more than five (5) business days following the expiration of the first term.
- Petitions, queries and claims: When the Data Subject or his/her assignees consider that the information contained in a Database should be subject to correction, updating or deletion, or when it should be revoked due to the alleged breach of any of the duties contained in the law, he/she may file a claim before Clubbin, which will be processed under the following rules:

The rights of rectification, updating, suppression or revocation of consent may only be exercised by:
- The Holder or his successors in title, upon proof of identity.
- Its representative, after accreditation of the representation.
- When the request is made by a person other than the Data Subject and it is not accredited that the person is acting on behalf of the Data Subject, it will be considered as not submitted. The request for rectification, updating, deletion or revocation of consent must be submitted through the means enabled by Clubbin and contain at least the following information:
- Name and surname of the applicant and of the Holder.
- Address and e-mail address of the Holder or the information of the place where you wish to receive the response. In the absence of this information, the response will be delivered at Clubbin's facilities.
- Documents proving the identity of the applicant and, if applicable, that of his representative with the respective authorization.
- Clear and precise description of the Personal Data with respect to which the Data Subject seeks to exercise any of the rights and the specific request.
If applicable, other elements or documents that facilitate the location of the Personal Data.
The maximum term to address the request, complaint or claim will be fifteen (15) business days from the business day following the date of receipt. When it is not possible to address the claim within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

AREA RESPONSIBLE FOR HANDLING REQUESTS, QUERIES AND COMPLAINTS REGARDING PERSONAL DATA
The area responsible for handling requests for access, rectification, updating, deletion of Personal Data or revocation of consent or authorization granted for the processing of your Personal Data and claims, is the Customer Service Area of Clubbin.

MANUAL FOR THE TREATMENT OF PERSONAL DATA
This manual for the Treatment of Personal Data aims to guarantee the constitutional right of all persons to know, update and rectify the information that has been collected about them in the databases or files that Clubbin has for the purposes set forth in the respective authorization.


CHAPTER I. GENERAL PROVISIONS

ARTICLE 1. PURPOSE. This manual complies with the provisions of Article 17(k) of Law 1581 of 2012, which regulates the duties of those Responsible for the Processing of Personal Data, among which is the adoption of an internal manual of policies and procedures to ensure proper compliance with the law and especially for the attention of queries and complaints.
It also aims to regulate the procedures for the collection, handling and processing of personal data performed by Clubbin in order to guarantee and protect the fundamental right of Habeas Data within the framework of the provisions of the same law and its regulatory decrees.

ARTICLE 2. DEFINITIONS. For the purposes of applying the rules contained in this manual, the same definitions established in Chapter I - DEFINITIONS of this Policy shall be used.

ARTICLE 3. PRINCIPLES. The principles set forth below are the general parameters that will be respected by Clubbin in the processes of collection, use and processing of Personal Data.
Principle of legality: The Processing of Personal Data referred to in Law 1581 of 2012 is a regulated activity that must be subject to the provisions set forth therein and in the other provisions that develop it.
- Principle of purpose: The Processing of Personal Data collected by Clubbin obeys a legitimate purpose that the Data Subject is informed of.
- Principle of freedom: The Processing of Personal Data may only be exercised with the prior, express and informed consent of the Data Subject. Personal Data will not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves consent.
- Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.
- Principle of transparency: In the processing of Personal Data, the right of the Data Subject to obtain from Clubbin at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed.
- Principle of restricted access and circulation: Personal Data, except for public information, may not be made available on the Internet or other means of mass dissemination or communication, unless access is technically controllable to provide restricted knowledge only to Data Controllers or authorized third parties.
- Security principle: The information subject to processing by Clubbin is protected through the use of technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
- Principle of confidentiality: All persons within Clubbin involved in the Processing of Personal Data are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the Processing.


CHAPTER II. AUTHORIZATION

ARTICLE 4. AUTHORIZATION. The collection, storage, use, circulation or deletion of Personal Data by Clubbin requires the free, prior, express and informed consent of the Data Subject. Clubbin in its capacity as Responsible for the Processing of Personal Data, has provided the necessary mechanisms to obtain the authorization of the Data Subject ensuring in any case that it is possible to verify the granting of such authorization.
All visitors to the website owned by Clubbin must register and authorize the processing of their Personal Data in order to make use of the services offered. Therefore, in each of the systems there is a box that says "Personal Data Processing Policy", which must be read and accepted in order to continue with the use of Clubbin services.
Clubbin may confirm the Personal Data provided by End Users by contacting public entities, specialized companies or credit bureaus, for which the Holder expressly authorizes it. The information that Clubbin obtains from these entities will be treated confidentially.

ARTICLE 5. FORM AND MECHANISMS FOR GRANTING THE AUTHORIZATION. The authorization may be granted by the Holder in any of the following ways:
- In writing;
- Orally;
- By means of conclusive and unequivocal conduct on the part of the Holder that allows the reasonable conclusion that he/she granted the authorization. In no case shall silence be assimilated to unequivocal conduct.
- By automatically storing data of End Users, Allied Users or third parties accessing Clubbin App by the use of cookies, such as URLs, browser used and IP address, among others;
- Through the exchange of e-mails;
- Through events carried out by Clubbin;
- Through telephone calls;
- Through WhatsApp messages;
- By accessing the Clubbin App, creating an Account and Password;
- Through access to the web page.
The authorization will be issued by Clubbin and will be made available to the Data Subject, prior to the Processing of his/her Personal Data.

ARTICLE 6. PROOF OF AUTHORIZATION. The area responsible for the Treatment in Clubbin must have the necessary measures to keep records of when and how authorization was obtained by the Data Controllers for the Processing of Personal Data.

ARTICLE 7. PRIVACY NOTICE: The Privacy Notice is the physical, electronic or any other format document, which is made available to the Data Subject for the Processing of his Personal Data. This document communicates to the Data Subject the information regarding the existence of the information processing policies that will be applicable to him/her, the way to access them and the characteristics of the Processing that is intended to be given to the Personal Data.
In order to ensure in all cases that the authorization includes all the elements that allow the Data Subject to duly exercise his/her rights, Clubbin will include in the Privacy Notice, at least, the following information:
- The processing to which the Personal Data will be submitted and the purpose of such processing;
- The optional nature of the answer to the questions asked, when they deal with sensitive data or with the data of children and adolescents;
- The rights you have as Holder;
- The identification, physical or electronic address and telephone number of the Data Controller.

ARTICLE 8. SENSITIVE DATA: Sensitive data are considered to be those that affect the privacy of the Data Subject or whose improper use may generate discrimination. Among them are those that reveal a person's racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data.
Clubbin is committed to protecting privacy during the processing of identifiable and sensitive Personal Data. Therefore, in the event that the data subjects expressly authorize the use of Sensitive Data, Clubbin is obliged to make use of them in accordance with the rules established in the national regulatory decrees.
No activity may be conditioned to the provision of Sensitive Data by the Data Subject.

CHAPTER III. RIGHTS AND DUTIES

ARTICLE 9. RIGHTS OF THE OWNERS OF THE INFORMATION. The Holder of the Personal Data has the following rights:
- To know, update and rectify their Personal Data before Clubbin, in its capacity as Data Controller.
- Request proof of the authorization granted to Clubbin for the Processing, in its capacity as Data Controller.
- Be informed by Clubbin upon request, regarding the use it has made of your Personal Data.
- File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012, once the complaint process has been exhausted before the Data Controller.
- To revoke the authorization and/or request the deletion of Personal Data when the Processing does not respect the constitutional and legal principles, rights and guarantees.
- Access free of charge to your Personal Data that has been subject to Processing.
- Oppose the processing of your Personal Data.

ARTICLE 10. DUTIES OF CLUBBIN IN RELATION TO THE PROCESSING OF PERSONAL DATA. Clubbin will recognize, at all times, that the Personal Data are the property of the persons to whom they refer and that only they can decide on them. In this sense, Clubbin will use them only for those purposes for which it is duly authorized.

ARTICLE 11. RETENTION OF PERSONAL INFORMATION. Clubbin will retain personal information obtained through any of the defined means as long as necessary to provide the services and information requested by you or in accordance with the retention period contemplated by applicable law.

CHAPTER IV. ACCESS, CONSULTATION AND COMPLAINT PROCEDURES

ARTICLE 12. RIGHT OF ACCESS: The power of disposal or decision that the Data Subject has over the information that concerns him/her, necessarily entails the right to access and know if his/her personal information is being processed, as well as the scope, conditions and generalities of such processing. In this way, Clubbin guarantees the Data Subject's right of access in three ways:
- Knowledge about the effective existence of the Processing to which your Personal Data are subjected.
- Access to Personal Data held by Clubbin.
- To know the essential circumstances of the Processing of their Personal Data, which translates into Clubbin's duty to inform the Data Subject about the type of Personal Data processed and each and every one of the purposes that justify the Processing.

PARAGRAPH: Clubbin will guarantee the right of access when, prior accreditation of the identity of the Data Subject or the personality of his/her representative, the details of the Personal Data are made available to him/her, free of charge, through electronic means that allow the direct access of the Data Subject to them.
For consultations whose periodicity is greater than one (1) calendar month, Clubbin will charge only the costs of shipping, reproduction or certification of documents.

ARTICLE 13. CONSULTATIONS. The Data Subjects or their assignees may consult the personal information of the Data Subject that is contained in any Database managed by Clubbin. Consequently, Clubbin guarantees the right of consultation, providing the Data Subjects with all the information contained in our Databases that is linked to the identification of the Data Subject.
For the attention of requests for consultation of personal data, Clubbin guarantees that it has enabled means of communication such as email: contacto@clubbin.co, the website www.clubbin.co and, personally, at Carrera 7 # 124 - 20 in the city of Bogota.
Inquiries will be answered within a maximum term of ten (10) working days from the date of receipt. When it is not possible to answer the consultation within such term, the interested party shall be informed before the expiration of the ten (10) days, stating the reasons for the delay and indicating the date on which the consultation will be answered, which in no case may exceed five (5) business days following the expiration of the first term.

ARTICLE 14. CLAIMS. The Data Subject or their assignees who consider that the information contained in one of the databases held by Clubbin should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, may file a claim with Clubbin, which will be processed under the following rules:
- The complaint may be submitted directly to the e-mail address mentioned in the Personal Data Processing Policy.
- If the claim received does not have complete information that allows it to be processed, that is, with the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying documents to be asserted, the interested party will be required within five (5) days of receipt to correct the faults. After two (2) months from the date of the requirement without the applicant submitting the required information, it will be understood that the claim has been abandoned.
- If for any reason Clubbin receives a complaint about personal information for which it is not Responsible for the Processing, it will forward it to the appropriate party within a maximum of two (2) business days, if known, and will inform the interested party of the situation.
- Once the complete claim has been received, a legend will be included in the database maintained by Clubbin that reads "claim in process" and the reason for the claim, within a period not exceeding two (2) business days. Such legend shall be maintained until the claim is decided and shall refrain from processing the Personal Data on which the claim is based, unless prior and express authorization from the Data Subject.
- The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend it within such term, the interested party will be informed before the expiration of such term the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first term.
- When the request is made by a person other than the Holder and it is not accredited that such person is acting on behalf of the Holder, the request shall be deemed not to have been filed.
- The request for rectification, update or deletion must be submitted through the means enabled by Clubbin indicated in our Personal Data Processing Policy and contain, at least, the following information:
- The name and address of the Holder or any other means to receive the response.
- The documents proving the identity or the personality of its representative.
- The clear and precise description of the Personal Data with respect to which the Data Subject seeks to exercise any of the rights.
If applicable, other elements or documents that facilitate the location of the Personal Data.

ARTICLE 15. RECTIFICATION AND UPDATING OF DATA. Clubbin has the obligation to rectify and update, at the request of the Data Subject, the information about him/her that proves to be incomplete or inaccurate, in accordance with the procedure and terms outlined above. In this regard, the following will be taken into account in particular:
- In the requests for rectification and updating of Personal Data, the Data Subject must indicate the corrections to be made and provide the documentation supporting his/her request.
- Clubbin is free to enable mechanisms that facilitate the exercise of this right, as long as they benefit the Owner. Consequently, electronic or other means that it deems appropriate may be enabled.
- Clubbin may establish forms, systems and other simplified methods, which must be informed in the Privacy Notice and which will be made available on its proprietary website.

Whenever a new tool is made available to facilitate the exercise of their rights by the Holders of information or modify the existing ones, it will inform through its web page www.clubbin.co or any other suitable means for this purpose.

ARTICLE 16. DELETION OF DATA. The Data Subject has the right, at any time, to request Clubbin the deletion (removal) of his/her Personal Data when:
- Consider that they are not being treated in accordance with the principles, duties and obligations set forth in Law 1581 of 2012.
- Are no longer necessary or relevant for the purpose for which they were collected.
- The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.
This deletion implies the total or partial elimination of personal information as requested by the Data Subject in the records, files, Databases or Treatments carried out by Clubbin.
The right of cancellation is not absolute and may be denied by Clubbin when:
- The Data Subject has a legal or contractual duty to remain in the Database.
- The deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
- The data is necessary to protect the legally protected interests of the Data Subject; to carry out an action in the public interest, or to comply with an obligation legally acquired by the Data Subject.
- In the event that the cancellation of the Personal Data is appropriate, Clubbin will operationally perform the deletion in such a way that the deletion does not allow the recovery of the information.
- In the event that Clubbin proceeds with the deletion of one or more Personal Data at the request of the Data Subject, the Data Subject understands that such deletion will mean the loss of commercial or personal benefits that had as a result that this data was stored in the Databases.

ARTICLE 17. REVOCATION OF AUTHORIZATION. The Personal Data Owners may revoke their consent to the Processing of their Personal Data at any time, provided that it is not prevented by a legal or contractual provision, communicating this decision to Clubbin by any of the means defined in this Manual.
At the time of submitting the request for revocation of the consent granted to Clubbin, the Data Subject must indicate whether the revocation he/she intends to make is total or partial. In the second hypothesis, it must be indicated with which treatment the Data Subject does not agree.
There will be cases in which consent, due to its necessary nature in the relationship between the Data Subject and the Data Controller, cannot be revoked.
Notwithstanding the foregoing, in the event that Clubbin proceeds with the revocation of one or more Personal Data at the request of the Data Subject, the Data Subject understands that such deletion will mean the loss of commercial or personal benefits that had as a result that these data were stored in the Databases.

ARTICLE 18. DESTRUCTION OF DATABASES. Clubbin will proceed to the total destruction of the Databases whose purpose has ceased or terminated in a period not exceeding three (3) months from the time of termination or cessation of the purpose. The destruction of the Database will be recorded in a document signed by the person in charge of the corresponding Database.

CHAPTER V. INFORMATION SECURITY

ARTICLE 19. INFORMATION SECURITY. Clubbin has implemented the technical, human and administrative measures necessary to provide security to the records to prevent tampering, loss, consultation, use or unauthorized or fraudulent access, including, among other measures, firewalls ("firewalls") and Secure Socket Layers ("SSL"). In fact, it has a mandatory Data Security Policy for its employees and third parties who, in the course of their duties, may have access to the Personal Data Bases.
Personal information will generally be stored in Clubbin's databases. To the extent required by law, if your personal information is to be transferred abroad, you will be notified accordingly.
ARTICLE 20. IMPLEMENTATION OF SECURITY MEASURES. Clubbin will maintain security protocols of mandatory compliance for staff who have access to personal data and information systems.
The procedure shall consider, as a minimum, the following aspects:
- Scope of the procedure with detailed specification of the protected resources.
Measures, norms, procedures, rules and standards aimed at ensuring the level of security required by Law 1581 of 2012.
- Personnel functions and duties.
- Structure of the personal databases and description of the information systems that process them.
- Procedure for notification, management and response to incidents.
- Data backup and recovery procedures.
- Periodic controls to be carried out to verify compliance with the provisions of the security procedure to be implemented.
- Measures to be taken when a medium or document is to be transported, discarded or reused.
- The procedure should be kept up to date at all times and should be reviewed whenever there are relevant changes in the information system or its organization.
- The content of the procedure must at all times comply with the provisions in force regarding the security of personal data.

ARTICLE 21. SHARING OF PERSONAL INFORMATION. Clubbin may share personal information with those it hires as Processors, those third parties that provide support services. These third parties may only use the personal information shared with them to perform on behalf of Clubbin the contracted services and are obliged to maintain the confidentiality of the same.
In some cases, Clubbin may share personal information with third parties who partner with it to provide products and services to its customers. If it does so, these partners must be required to use the personal information provided in a manner consistent with the purposes for which it was originally collected (or for purposes subsequently authorized by the Data Subject) and only in the manner contemplated in this Policy and in accordance with the Privacy Notice and other applicable laws.
On certain occasions, Clubbin may also share or transfer personal information to unrelated third parties. For example, it may provide personal information to a third party (i) at the request of the Registrant; (ii) to comply with a legal requirement or court order; (iii) to investigate a possible crime, such as identity theft; or (iv) under similar circumstances. In such a case, appropriate measures must be taken to protect the personal information.

CHAPTER VI. FINAL PROVISIONS

ARTICLE 22. Clubbin has designated the customer support area to attend all matters related to the Personal Data protection regime, especially the attention of queries, claims, requests for rectification, modification or deletion, and will process the requests of the Owners, for the exercise of the rights of access, consultation, rectification, updating, deletion and revocation referred to in Law 1581 of 2012.

ARTICLE 23. VALIDITY AND MODIFICATION OF THE POLICY, MANUAL OR PRIVACY NOTICE. This Policy shall be effective as of [insert date]. Clubbin reserves the right to update or modify this Policy and Manual at any time and without prior notice, by publishing the revised version of the same in the means defined for that purpose. Clubbin also reserves the right to update or modify at any time the Privacy Notice on the Website by posting the revised Notice on the Website. In the event of a change to this Policy and Manual or the Privacy Notice, the change will only apply to personal information collected after the revised Policy, Manual or Privacy Notice is posted on the www.clubbin.co website.
If we make material changes in the way your Personal Data is managed, we will notify you by email so that you can make an informed decision as to whether or not you agree to your Personal Data being used in that way. If you do not agree to those terms, the contractual relationship with Clubbin App will be terminated and your Personal Data will not be used in any manner other than as disclosed at the time of collection.

Functionality and Product Policies

Age Restriction Policy
Clubbin App is a digital platform that can only be used by persons of legal age. If Clubbin becomes aware of any case in which the digital platform is being used by minors, it will proceed to suspend and subsequently delete the Account.

Product Policy
To understand the functionality of each of the products and services, please go to the "My Purchases" section in the Clubbin App help menu.

Product Policy: Digital Cover
Each digital cover is valid for one person only. We recommend that the cover is in the Clubbin App account of each person who is going to enter; however, a person can present several covers in their account at the entrance of the establishment.
If the cover is in your account, it is your property.
The digital cover is only valid for the establishment and for the specific date for which it was purchased, taking into account that the time of disabling or expiration of the digital cover is at 11:59 PM of the scheduled day.
If the digital cover is not used for the specific establishment, on the specific date and at the defined time (maximum until 11:59 pm), the cover and its value will be lost without any possibility of exchange or refund.
If your cell phone is not charged and at the time of presenting your digital cover you cannot log in to your Clubbin App account, you will not be allowed to enter through Clubbin App. We recommend you to be vigilant, send your cover to another person or open your account on another cell phone.
Your digital cover does not exempt you from presenting your ID when entering the establishment. You will have to present your ID if the establishment requires it.
Having this digital cover does not confirm that you will be able to enter the establishment. Each establishment reserves the right of admission, according to its own and direct criteria.
If you had your cover, followed all the admission policies and could not enter the establishment, please contact us to help you and give you a possible solution.
You can send and receive as many covers as you want. The person you sent them to can redeem them as long as they have the Clubbin App installed on their cell phone.
Clubbin App can only be used by adults of legal age.

Product Policy: Digital Ticket.
Each digital ticket is valid for only one person. We recommend that the ticket be on the cell phone of each person who will enter; however, a person may present multiple tickets on their cell phone at the entrance of the event or establishment.
If the ballot is on your cell phone, it is your property.
The digital ticket is only valid for the event and for the specific date for which it was purchased, taking into account the schedule directly established by the event.
If the digital ticket is not used for the specific event, on the specific date and at the time defined by the establishment, the ticket and its value will be lost without any possibility of exchange or refund.
If your cell phone is not charged and at the time of presenting your digital ticket you cannot log in to your Clubbin App account, you will not be allowed to enter through Clubbin App. We recommend you to be vigilant, send your cover to another person or open your account on another cell phone.
Your digital ticket does not exempt you from presenting your ID at the entrance of the event. You will have to present your ID if the event requires it.
Having this digital ticket does not confirm that you will be able to enter the event. Each event reserves the right of admission, according to its own direct criteria.
If you had your ticket and you could not enter the establishment, please contact us to help you and give you a possible solution.
You can send and receive as many ballots as you want. The person you sent them to can redeem them as long as they have the Clubbin App installed on their cell phone.
Clubbin App can only be used by adults of legal age.

Product Policy: Digital Bottle.
The number of drinks in a digital bottle depends entirely on the type of drink in the bottle and also on the volumetric content of the bottle. A 750 ml bottle of distilled spirits (whiskey, vodka, gin, tequila, mezcal, aguardiente, among others) has approximately 16 shots of 45 ml to 48 ml, a 750 ml bottle of wine has approximately 5 glasses of 150 ml to 160 ml. A 1700 ml beer mug has approximately 5 glasses of 330 ml.
For drinks the approximate standard unit of measurement we use for distillates such as whiskey, vodka, gin, tequila, mezcal, aguardiente, among others is 45ml to 48ml, for drinks such as wine it is 150ml to 160ml and for beer 330ml glasses. Keep in mind that this is an approximate measure, and that you must be aware of your drink at the bar and with your waiter.
You can redeem drinks only at Clubbin App partner establishments with this product format.
If the drink or bottle is in your Clubbin App account, it is your property.
You can send and receive the drinks and bottles you want. The person you sent them to can redeem them as long as they have the Clubbin App installed on their cell phone.
If at the time of redeeming your drink, the establishment does not have the brand you want, remember that you can order a drink of another brand of the same category and the same type of drink. To do so, you must contact the establishment directly. You can see the brands that each establishment has by entering the information of each "Site" in Clubbin App. If you have a special problem with this, please contact us directly and we will help you solve the problem as quickly as possible.
If your cell phone is not charged and at the moment of redeeming your drink you cannot access your Clubbin App account to scan the QR code, you will not be able to redeem your product. We recommend you to be vigilant, send your drink to another person or open your profile on another cell phone.
Clubbin App can only be used by adults.
Each combo or consumption package is exclusive to be redeemed and consumed in the establishment that sells it.
Each combo or consumer pack has specific expiration dates stipulated by the establishment. If you wish to enjoy your consumption package outside the dates established by the establishment, you will not be able to redeem it.
Each combo or consumption package has been structured directly by the establishment that offers it.
If the combo or consumption package is in your Clubbin App account, it is your property.
The combo or consumption package cannot be redeemed in parts, all products will be delivered by the establishment at the same time.
If at the time of redeeming your combo or consumer package the establishment does not have the brand of the products you purchased in Clubbin App, remember that you can exchange the products for another brand of the same category. To do so, you must agree directly with the establishment. If you have any special problem with the exchange, contact us directly and we will help you solve the problem as soon as possible.
If your cell phone is not charged at the time of redeeming your combo or consumer package and you cannot access your Clubbin App account to scan the QR code, you will not be able to redeem your product. We recommend you to be attentive, send your combo or consumption package to another person or open your profile on another cell phone.
You can send and receive as many combos or packages as you want. The person you sent them to can redeem them as long as they have the Clubbin App installed on their cell phone.
Clubbin App can only be used by people of legal age.

Exchange Policy
Exchanges can only be made for combos or consumption packages. If you want to change your combo you must contact us directly through our customer service chat. You can only change the redemption date of your combo, you can not change the type of combo or the establishment. In order to make the change you must do it at least 48 hours before the redemption date of the combo you want to change. The tickets and covers do not have changes because they only work for specific dates. Digital bottles have no change for the moment while we improve our technological processes.

Refund Policy
We only make refunds for withdrawal processes. To proceed to enter into a withdrawal process check the product FAQ's or terms and conditions.

Product Ownership Policy
Digital products: covers, tickets, bottles and consumer packs, which are represented in unique QR codes, are the property of the Clubbin App Account holder. If you give away or send a product or service that was in your Account, you lose ownership of it and it will become the property of the person to whom you sent it. Likewise, if a product or service is sent to you, it will become your property.

Merchant Handling Policies
The establishment reserves the right of admission, according to the establishment's own and direct criteria.
The establishment reserves the right to handle people who do not comply with the rules of behavior of the establishment.
Admission to bars and nightclubs, as well as the sale of alcoholic beverages in restaurants is prohibited for minors.
Establishments may have biosecurity protocols that you will have to follow.
The exact time of opening and closing of doors is defined directly by the establishment.
No alcoholic beverages or any type of firearms or weapons may be brought into the events.
Clubbin S.A.S. will not be responsible for any transactions made at the establishment outside of the Clubbin App.
Clubbin App may only be used by persons of legal age.

Event Management Policy
The event or establishment reserves the right of admission, according to its own conditions and restrictions.
The establishment or event reserves the right to handle persons who do not comply with the event or establishment's rules of behavior.
Events may have biosecurity protocols that you will have to follow.
The start time of the event is defined directly by the event organizers or the owners of the establishment.
We recommend arriving with enough time in advance to avoid setbacks at the entrance to the event or at the location.
No alcoholic beverages or any type of firearms or weapons may be brought into the event.
Everything you capture in audiovisual terms is for personal use and its commercial use is forbidden.
Clubbin S.A.S. will not be responsible for any transaction made at the event or establishment outside of Clubbin App.
Clubbin App can only be used by adults.