I. OBJETIVE

Establish guidelines and general criteria for the management of personal data bases of employees, contractors, clients and suppliers of RED COLLISION ENTERTAINMENT SAS.

This is a tool to regulate the collection, storage, processing, management, transfer, transmission and protection of all information received from candidates for selection processes, direct and indirect employees, former employees, customers, contractors and suppliers, thus complying with Law 1581 of 2012, Decree 1377 of 2013, the provisions contained in Article 15 of the Political Constitution of Colombia, Regulatory Decrees 1727 of 2009 and 2952 of 2010, the judgments of the Constitutional Court C-1011 of 2008, C-748 of 2011, and other concordant rules, by which general provisions for the protection of personal data are issued.

RED COLLISION ENTERTAINMENT SAS identified with Nit. 901.126.625-3 in all its actions, through its business units and by all means in which physical, electronic, virtual, telephone access, web access, etc. is committed to respecting the rights of its customers, employees, suppliers and third parties in general. Therefore, it adopts this policy manual of mandatory application in all activities involving the processing of personal data.

II.SCOPE OF APPLICATION

Personal data registered in any database, which makes them susceptible to processing by public or private entities, carried out in the Colombian territory or in countries where the Colombian legislation is applicable.

RED COLLISION ENTERTAINMENT SAS is directly responsible for the processing of personal data, however, reserves the right to delegate such processing to a third party. RED COLLISION ENTERTAINMENT SAS requires the person in charge, the attention and implementation of the guidelines and procedures suitable for the protection of personal data and the strict confidentiality of the same. The authorization for the treatment of personal data allows RED COLLISION ENTERTAINMENT SAS to treat, collect, transfer, store, use, circulate, suppress, share, update and transmit, for the purpose of complying with the objectives established by law according to the nature of RED COLLISION ENTERTAINMENT SAS.

In any case, the Data Subject will always have the option to revoke the authorization and/or request the deletion of the data. The Data Subject previously, expressly and informedly authorizes the inclusion of his/her information in the databases administered by RED COLLISION ENTERTAINMENT SAS when using electronic media and other channels available for such purpose, as well as the processing and use of the same by RED COLLISION ENTERTAINMENT SAS

For reasons of efficiency, security and to be at the forefront of technology, the servers of RED COLLISION ENTERTAINMENT SAS where our system and database are hosted may be located outside Colombia.

Therefore, the Data Subject authorizes RED COLLISION ENTERTAINMENT SAS to send his/her personal data to the servers of RED COLLISION ENTERTAINMENT SAS in any step it deems appropriate for the purposes of the authorized treatment or for storage purposes and/or eventual hosting or cloud computing services that RED COLLISION ENTERTAINMENT SAS contracts or requires.

Likewise, and considering the business nature of RED COLLISION ENTERTAINMENT SAS, and if permitted by the rights holders, personal data may be transferred to international companies.

USE OF PERSONAL IMAGE

In the development of the activities and events organized and carried out by RED COLLISION ENTERTAINMENT SAS, photographs, videos or other captures of the personal image of the holder may be taken, who expressly authorizes RED COLLISION ENTERTAINMENT SAS to use the images for the purposes set forth in this Policy and in accordance with its activities indicated in its corporate purpose. This use includes, but is not limited to, the dissemination, printing or disclosure of images in the media; social networks; promotional material; advertising pieces and promotional activities.

III. DEFINITIONS

1. Actors in the Processing of Personal Data: These are the companies or persons who carry out the provision, collection and processing of personal data.

2. Authorization: Prior, express and informed consent of the Data Subject to carry out the processing of personal data or consultations in public databases.

3. Privacy Notice: Verbal or written communication generated by the Controller, addressed to the Data Subject for the Processing of his personal data, by means of which he is informed about the existence of the information processing policies that will be applicable to him, the way to access them and the purposes of the Processing that is intended to be given to the personal data.

4. Data Base: Organized set of personal data that is subject to Processing.

5. Substantial changes to a Database: These are those related to the purpose of the database, the Data Processor, the channels of attention to the Data Subject, the classification or types of personal data stored in each database, the information security measures implemented, the Information Processing Policy and the international transfer and transmission of personal data.

6. Channels to exercise rights: These are the means of reception and attention of requests, queries and claims that the Data Controller and the Data Processor must make available to the Data Owners, with the respective contact details, through which the Data Owner may exercise their rights to know, update, rectify and delete their personal data contained in databases and revoke the authorization granted for the Processing thereof, when possible. These channels must provide, at least, the possibility for the Data Subject to exercise his/her rights through the same means by which the information was collected, leaving a record of the receipt and processing of the respective request.

7. Unequivocal conduct: Behavior that allows a reasonable conclusion that the Data Subject has granted authorization for the processing of his or her data.

8. Consultation: Process through which the Personal Data Holder may request to RED COLLISION ENTERTAINMENT SAS, their personal information contained in the databases.

9. Causee: Person to whom the rights of another have been transferred.

10. Personal data: Any information linked or that can be associated to one or several determined or determinable natural persons.

11. Private Data: Data that, due to its intimate or reserved nature, is only relevant to the owner.

12. Semi-private data: Semi-private data is data that is not of an intimate, reserved or public nature, and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of persons or to society in general.

13. Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to the marital status of individuals, their profession or trade, and their status as merchants or public servants. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality.

14.Sensitive data: Sensitive data are understood as those that affect the privacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life, and biometric data.

15.Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller.

16. Source of Information: It is the person, entity or organization that receives or knows personal data from information holders, as a consequence of a commercial or service relationship and that, by reason of legal authorization, or from the holder, provides such data to an information operator. The information operator, in turn, will deliver personal data to the end user. If the source delivers the information directly to the users and not through an operator, it will have the dual status of source and operator, and will assume the duties and responsibilities of both. The source of the information is responsible for the quality of the data supplied to the operator, and must guarantee the protection of the data owner’s rights.

17. Data Manager: The collaborator of RED COLLISION ENTERTAINMENT SAS that carries out the treatment to the personal data.

18. External Data Manager: It is the employee of a third party (Responsible), which performs the treatment to the databases delivered by RED COLLISION ENTERTAINMENT SAS for the realization of the treatment.

19. Security Incident: Refers to the violation of security codes or the loss or theft and/or unauthorized access of information from a database managed by the Data Controller or its Processor.

20. Information Operator: It is the person, entity or organization that receives from the source personal data on several information holders, manages them and makes them known to the users. The operator, insofar as it has access to personal information of third parties, must guarantee the protection of the data owner’s rights. Unless the operator is the source of the information itself, the operator has no commercial or service relationship with the data owner, and therefore is not responsible for the quality of the data provided by the source.

21. Claim: Process by means of which the Owners of the Personal Data or their assignees, may request RED COLLISION ENTERTAINMENT SAS, its affiliates and subsidiaries to update, rectify, partially or totally delete the information, the proof of authorization or the revocation of the same.

22. National Database Registry (RNBD): Public directory of personal databases subject to processing operating in the country, administered by the Superintendence of Industry and Commerce and freely consulted by citizens.

23. Data Controller: Natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the processing of the data.

24. Terms and Conditions: General framework in which the conditions for participants in promotional or related activities are established.

25. Data Subject: Natural person whose personal data is the object of processing.

26. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

27. Transfer: The transfer of data takes place when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is the Data Controller and is located inside or outside the country.

28. Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when its purpose is the performance of a Processing by the Processor on behalf of the Controller.

29. User: It is the natural or legal person who can access personal information of one or more owners of the information provided by the operator or by the source, or directly by the owner of the information. The user must guarantee the protection of the data owner’s rights. In the event that the user in turn delivers the information directly to an operator, the latter will have the dual status of user and source, and will assume the duties and responsibilities of both.

III. PRINCIPLES

1. Principle of purpose: The Processing of Personal Data must obey a legitimate purpose that will be informed to the Data Subject.

2. Principle of freedom: The Processing of Personal Data may only be exercised with the prior, express and informed consent of the Data Subject. Personal Data may not be obtained or disclosed without prior authorization or legal or judicial mandate that relieves the consent of the Data Subject.

3. Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.

4. Principle of transparency: The right of the Data Subject to obtain from RED COLLISION ENTERTAINMENT SAS, at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed in the Processing.

5. Principle of restricted access and circulation: Personal Data, except for public information, may not be made available on the Internet or other means of disclosure or communication. access is technically controllable in order to provide restricted knowledge only to the Holders or third parties authorized by them.

6. Principle of security: The information subject to processing shall be handled with the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

8. Principle of confidentiality: All persons involved in the processing of Personal Data are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the processing.

8. Principle of Legality: For the treatment of personal data, RED COLLISION ENTERTAINMENT SAS will be subject to the provisions of the Law and other provisions.

5.1 SENSITIVE DATA

The processing of sensitive data is prohibited, except when:

a. The Data Subject has given his/her explicit authorization to such Processing, except in those cases where by law the granting of such authorization is not required.

b. The Processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.

c. The Processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided that it refers exclusively to its members or persons who maintain regular contacts for its purpose. In these events, the data may not be provided to third parties without the authorization of the Data Controller.

d. The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.

e. The processing has a historical, statistical or scientific purpose. In this event, measures must be taken to suppress the identity of the Data Subjects.

5.2 RIGHTS OF CHILDREN AND ADOLESCENTS

The processing of personal data of children and adolescents is prohibited, except in the case of data of a public nature. The areas that, due to the nature of their management, must process this type of personal data, must apply the principles for the protection of the fundamental rights of this type of Personal Data Holders.

IV. DATABASE PROCESSING

The data will be used by RED COLLISION ENTERTAINMENT SAS for the development of its corporate purpose and the contractual relationship that binds it with the Personal Data Subject, if any, and in particular for:

a. To develop RED COLLISION ENTERTAINMENT SAS’s corporate purpose.

b. Inform third parties duly authorized and supervised by RED COLLISION ENTERTAINMENT SAS on aspects that may be relevant to the daily activities of the company.

c. Perform statistical processing of your data.

e. Evaluate the quality of products or services.

f. Develop marketing and promotional activities.

g. To comply with obligations contracted with the Holder.

h. Respond to legal requirements of administrative and judicial entities.

i. Execute the employment contract.

j. Sharing, including the transfer and transmission of your personal data to third countries for purposes related to the operation of RED COLLISION ENTERTAINMENT SAS in accordance with the provisions of law and always ensuring compliance with the minimums established in the Colombian regulations.

k. Authorize the use of the image for commercial and advertising purposes.

The Data Controller and/or the Data Processor shall use the data only and exclusively for the purpose for which the Data Subject has been informed. Under no circumstances may misleading or fraudulent means be used to process data, and in cases where the use has been defined as temporary, the information may only be used for the period of time necessary for the purpose for which it was requested.

6.1. IDENTIFICATION OF THE PERSON RESPONSIBLE AND IN CHARGE

RED COLLISION ENTERTAINMENT SAS will act either as responsible or in charge of this Policy, therefore, in any of these cases, the company will be identified as follows:

Company Name: RED COLLISION ENTERTAINMENT SAS

Registered Office: Bogotá, Colombia.

Tax ID: 901.126.625-3

Address: Cll 80a No 109-23 E-mail: general@redcollisionstudios.com

Telephone: +57-313 883 01 43

Website: https://redcollisionstudios.com

6.2. RESPONSIBLE.

The company will process personal data under the terms and scope of the authorization given by the owner of the information, on the following bases:

1. Databases of the company’s employees: collection, storage, copying, delivery, updating, ordering, classification, transfer, correction, verification, use for statistical purposes and in general use and utilization of all data provided for the purpose of properly managing the employment relationship by the company with the company’s employees RED COLLISION ENTERTAINMENT SAS may share the data of the company’s employees with its current or potential customers, in the performance of its commercial and / or contractual obligations.

The data provided may be used by the company to offer and sell goods and services to its potential or current customers, which includes the storage, copying, delivery, updating, sorting, classification, transfer, correction, verification and use for statistical purposes of the data provided.

2. Databases of applicants in selection processes: collection, storage and in general use of all data provided for the purpose that the company advances as it deems appropriate in the selection process.The participation in this process does not generate any type of right or prerogative for the participant, with the mandatory understanding that any linkage will be conditioned to compliance with the rules, procedures and policies applicable to the entity on the matter.

The data provided may be used by the company to offer and sell goods and services to its potential or current customers, in the performance of its commercial and/or contractual obligations, which includes the storage, copying, delivery, updating, use, sorting, classification, transfer, correction, verification and use for statistical purposes of the data provided.

3. Databases of corporate clients and suppliers of RED COLLISION ENTERTAINMENT SAS: collection, storage, copying, delivery, updating, ordering, classification, transfer, correction, verification, use for statistical purposes and in general use and utilization of all data provided for the purpose of developing the corporate purpose of the company and as stipulated in the respective contracts and/or commercial documents signed between the parties as well as to properly manage the commercial relationship between the company and its clients and suppliers.

6.3. DUTIES OF THE DATA CONTROLLER.

Data controllers shall comply with the following duties:

a. Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.

b. Request and keep a copy of the respective authorization granted by the owner.

c. Duly inform the owner about the purpose of the collection and the rights he/she has by virtue of the authorization granted.

d. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.

e. Ensure that the information provided to the data processor is truthful, complete, accurate, upto-date, verifiable and understandable.

f. To update the information, communicating in a timely manner to the data processor, all the news regarding the data previously provided and to adopt the other necessary measures so that the information provided to the data processor is kept up to date.

g. Rectify the information when it is incorrect and communicate the pertinent to the person in charge of the treatment.

h. To provide to the data processor, as the case may be, only data whose processing has been previously authorized.

i. To require the data processor at all times to respect the security and privacy conditions of the owner’s information.

j. Process inquiries and claims formulated under the terms set forth in the law.

k. Inform the data processor when certain information is under discussion by the owner, once the claim has been filed and the respective process has not been completed.

l. Inform upon request of the owner about the use given to their data.

m. Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the owners.

n. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

o. Others provided for in the Law.

6.4. CHARGED.

The company will make the disposal of personal data in the terms and scope of the authorization given by the owner of the information:

Databases owned by customers of RED COLLISION ENTERTAINMENT SAS: collection, storage, copying, copying, delivery, updating, sorting, classification, transfer, correction, verification, use for statistical purposes of databases owned by corporate clients of the company, which shall at all times subject to the policies and instructions agreed between the parties. As far as possible, in the contracts with the company’s customers and responsible for the treatment of its customers with the obligations that such quality imposes on them.

6.5. DUTIES AS A DATA PROCESSOR:

Processors shall comply with the following duties:

a. Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.

b. To request and keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.

c. Timely update, rectification or suspension of data.

d. Update the information reported by the data controllers within five (5) business days of receipt.

e. Handle queries and claims formulated by the owners.

f. Register in the database the legend “claim in process” in the manner regulated by law.

g. Insert in the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of the personal data.

h. Refrain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce.

i. Allow access to information only to those who can access it.

j. Inform the Superintendence of Industry and Commerce when there are violations to the security codes and there are risks in the administration of the information of the owners.

k. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

In the event that the qualities of Data Controllers and Data Processor concur in the same person, he/she shall be required to comply with the duties foreseen for each of them.

VII. OF THE HOLDER

For the purposes of this policy, personal data owners are understood to be customers, suppliers, distributors, employees and in general, any natural person who is the owner of the personal data registered in the databases of RED COLLISION ENTERTAINMENT SAS

In the case of minors (children and adolescents), their legal representatives will have the power to authorize or not the processing of their personal data. In the treatment of this data, respect for the prevailing rights of minors, such as privacy and protection of personal information, will be ensured.

7.1. RIGHTS OF THE HOLDERS.

The Data Subject is informed of the rights that the laws on personal data protection offer him/her, which are listed below and that RED COLLISION ENTERTAINMENT SAS guarantees them through compliance with the defined procedures:

a. To know, update and rectify their personal data with respect to the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.

b. Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.

c. Be informed by the company, upon request, regarding the use it has made of your personal data.

d. File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it, once the consultation or complaint process has been exhausted before the Controller or the Data Processor, according to Article 16 of Decree 1377.

e. To revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that, in the Treatment, the Entity has incurred in conduct contrary to Law 1581 of 2012 and the Political Constitution of Colombia.

f. Access free of charge to their personal data that have been subject to Processing, at least once every calendar month, and whenever there are substantial modifications to the Policies established in this policy that motivate new consultations. For queries whose frequency is greater than one per calendar month, RED COLLISION ENTERTAINMENT SAS may charge the Holder the costs of shipping, reproduction and, where appropriate, certification of documents. The rights of the Holders may be exercised by the following persons:

a. By the Holder, who must prove his or her identity sufficiently by the different means available to RED COLLISION ENTERTAINMENT SAS

b. By their successors in title, who must prove their status as such.

c. By the representative and/or attorney-in-fact of the Holder, upon accreditation of the representation or power of attorney.

d. By public or administrative entities in the exercise of their legal functions or by court order.

e. By stipulation in favor of or for another.

7.2. DUTIES OF THE HOLDERS.

The holder of the personal data must keep his/her information updated and guarantee, at all times to RED COLLISION ENTERTAINMENT SAS, the veracity of the same. The company will not be responsible, in any case, for any type of liability arising from the inaccuracy of the information provided by the holder.

7.3. AUTHORIZATION.

For the processing of personal data by RED COLLISION ENTERTAINMENT SAS requires the prior, informed and express authorization of the Holder, which must be obtained by any written, physical or electronic means that may be subject to subsequent consultation; without prejudice to the exceptions provided by law RED COLLISION ENTERTAINMENT SAS at the time of requesting the authorization to the Holder, shall inform him/her in a clear and express manner the purpose for which the personal data is collected, the treatment to which his/her personal data will be submitted, the rights of the holder and the means through which he/she may exercise them. For the purposes of protection of the Habeas Data law, RED COLLISION ENTERTAINMENT SAS, will have prior authorization of the owner in order to be reported to the entities CIFIN, DATACREDITO and PROCREDITO. The authorization of the owner of the personal data is not required in the case of:

a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.

b. Personal data of a public nature.

c. Cases of medical or sanitary emergency.

d. Information authorized by law for historical, statistical or scientific purposes.

e. Data related to the Civil Registry of Persons.

f. Personal data containing information for personal or domestic use, data for the purposes of national security and defense, prevention, detection, monitoring and control of money laundering and financing of terrorism, and intelligence and counterintelligence will not be subject to protection.

The information of personal data may be provided by RED COLLISION ENTERTAINMENT SAS to the holder, its assignees, legal representative and/or attorney-in-fact, or third parties authorized by this or by law, as well as public or administrative entities in the exercise of legal functions or by court order.

If in the term of thirty (30) working days from the entry into force of this policy for the processing of personal data, and after RED COLLISION ENTERTAINMENT SAS has been notified in due form; the Holder has not contacted RED COLLISION ENTERTAINMENT SAS or the person in charge, to request the deletion of their personal data, they may continue with the processing of the data contained in their databases for the purpose indicated in this policy, without prejudice to the right of the Holder to exercise their right to exercise the right to request the deletion of their personal data. Or the person in charge, to request the deletion of their personal data, they may continue with the processing of the data contained in their databases for the purpose indicated in this policy, without prejudice to the right of the holder to exercise their right at any time and request the deletion of the data.

7.4. PRIVACY NOTICE.

RED COLLISION ENTERTAINMENT SAS has the Privacy Notice, which contains the information required by Decree 1377 of 2013, which will be communicated to the Holder of Personal Data through the company’s means of communication. To facilitate disclosure, its content may be included within the authorization.

The personal data provided by the Holders to RED COLLISION ENTERTAINMENT SAS may be stored, used, processed, analyzed, sorted, catalogued, classified, divided, circulated, verified, corroborated, checked, validated, deleted, shared, updated, transmitted and/or transferred to third parties, including sensitive data, which the Holder optionally provides, in accordance with the terms and conditions of the aforementioned Privacy Policy, mainly to enable the provision, monitoring, creation, development and/or improvement of our products and/or services, and also for administrative purposes,commercial, advertising, marketing, statistical studies, events, contests, campaigns, special benefits, promotional activities and contact. In accordance with the procedures described in Law 1581 of 2012 and Decree 1377 of 2013, the Holders may exercise their rights to know, update, rectify and delete their personal data by sending their request to RED COLLISION ENTERTAINMENT SAS or by email to geneneral@redcollisionstudios.com or through the correspondence filing window, located at Cll 80a #109-13, Bogotá D.C. in the city of Bogotá.

As of today, the Holders of the personal information to which RED COLLISION ENTERTAINMENT SAS has access have thirty (30) days to request the deletion of their personal data under the terms of Article 10 of Decree 1377 of 2013. In the event that the owners refrain from communicating, RED COLLISION ENTERTAINMENT SAS, will continue to carry out an adequate treatment of the personal data contained in its databases, without this preventing the Owners from requesting the deletion of the same at any time. Issued on the 31st day of March, 2022.

7.5. SECURITY MEASURES

RED COLLISION ENTERTAINMENT SAS will adopt the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. Such measures will respond to the minimum requirements made by current legislation and periodically evaluate their effectiveness.

VIII.PROCEDURES FOR HOLDERS TO EXERCISE THEIR RIGHTS TO KNOW, UPDATE, RECTIFY, DELETE INFORMATION AND REVOKE AUTHORIZATION.

8.1. INFORMATION REQUEST TO THE PERSON RESPONSIBLE OR IN CHARGE

In accordance with Law 1581 of 2012, the Data Controllers, their assignees, their representatives or attorneys-in-fact, may consult the personal information about them in the Databases owned by RED COLLISION ENTERTAINMENT SAS, for which the company must provide them with all the information contained in the individual record or that is linked to the identification of the Data Controller.

The consultation shall be formulated by means of written or electronic communication, addressed to the e-mail general@redcollisionstudios.com or to the address, Cll 80a #109-13, Bogotá D.C.

The consultation will be answered within a maximum term of ten (10) working days following its receipt. When it is not possible to answer the consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be answered, which in no case may exceed five (5) business days following the expiration of the first term.

8.2. HOLDER INFORMATION QUERY

Information queries filed with the Personal Data Holder, at the domicile or address authorized by the holder, the Holder will have eight (8) days to submit the query.

In the event of no response, the Holder shall have five (5) business days of extension to give due response to the applicant, attaching prior justification for the expiration of the first term.

8.3. CLAIMS

The Owners of the Personal Data or their assignees, may request the updating, rectification or total or partial deletion of data. Likewise, they may request the revocation of the authorization.

1. Revocation of authorization: The Personal Data Subject or his or her successors in title shall inform the Data Controller of the revocation of the authorization granted, in accordance with the regulations in force.

2. Suppression of Personal Data: The Data Subject may request to the Data Controller the total or partial suppression of personal data. The request for deletion of the information and the revocation of the authorization will not proceed when the Data Subject has a legal, contractual or commercial duty to remain in the database. In accordance with Article 16 of Decree 1377, the Data Subject or assignee may only file a complaint before the Superintendence of Industry and Commerce once the consultation or complaint process has been exhausted before the Controller or the Data Processor. When a claim is received from the Data Subject regarding inconsistencies in the information, or that the data is under discussion by the Data Subject, the Data Controller, and when acting on its behalf, the Data Processor, must suspend the use of the data for a period of time not less than the date of completion of the process. For this purpose, the Data Processor, responsible for the database, must ensure that there is a record where the following notes are recorded: “claim in process” or “information under judicial discussion” according to the status of the claim.

3. Term for the attention of Claims related to Personal Data: In accordance with Law 1581 of 2012, when a claim request is received from the Personal Data Holder, the Data Controller responsible for the processing, will proceed to review whether it contains sufficient information to be addressed, and, in the event that more information is required, will communicate to the Data Holder, within the following five (5) working days following the receipt of the claim, to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

Likewise, the Law indicates that the maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to deal with it within such term, the interested party will be informed before the expiration of such term the reasons for the delay and the date on which the claim will be dealt with, which in no case may exceed eight (8) working days from the date of receipt.

(8) business days following the expiration of the first term.

4. Claims before the Data Subject: The Data Controller or the person in charge of the database may file claims before the Data Subject, at his domicile or at the address of the Data Controller or the person in charge of the database, at his domicile or at the address of the Data Controller.

Therefore, there are fifteen (15) working days following the date of filing to provide a response, being extended up to ten (10) more working days, at the expiration of the first term, if such response is given within the term of extension the holder must attach justification for the expiration of the first term.

8.4. PROCEDURAL REQUIREMENT.

The Data Subject or assignee may only file a complaint before the Superintendence of Industry and Commerce once the consultation or complaint process has been exhausted before the Data Controller.

8.5. NATIONAL DATABASE REGISTRY (RNBD):

The registration process of the databases before the Superintendence of Industry and Commerce must be carried out in accordance with the definitions of the tool made available by this authority and in compliance with the provisions of Decree 886 of 2014, taking into account, among others, the following aspects:

a. Registration of current databases: This registration must be done before November 8, 2016 deadline by the Superintendence of Industry and Commerce.

b. Updating of the information contained in the National Database Registry: In accordance with External Circular No. 002 of November 3, 2015, the information contained in the RNBD shall be updated as follows:

• Within ten (10) working days of each month, as of the registration of the database. This in case substantial changes are made to the registered information.
• Annually, between January 2 and March 31, beginning in 2018.

c. Security Incidents: Security incidents must be reported to the Superintendence of Industry and Commerce through the RNBD within fifteen (15) days.

(15) working days following the moment they are detected and brought to the attention of the person or area in charge of dealing with them.

IX. MODIFICATIONS TO PERSONAL DATA PROCESSING POLICIES

RED COLLISION ENTERTAINMENT SAS reserves the right to modify, at any time, unilaterally, its policies and procedures for the treatment of personal data. Any changes will be published and announced.

Continued use of the services or failure to disengage from the services by the Data Subject after notification of the new guidelines constitutes acceptance of the new guidelines.

 X.ENTRY INTO FORCE OF THE DATABASES

This policy applies from April 2022 and the information provided by stakeholders will remain stored for a term of ten (10) years from the date of the last treatment, to allow RED COLLISION ENTERTAINMENT SAS to comply with legal and/or contractual obligations, especially in accounting, fiscal and tax matters. This policy is effective as of July 18, 2022.