PERSONAL DATA
PROCESSING POLICY

CH MAC Abogados

PERSONAL DATA PROCESSING POLICY

RESPONSIBLE

CH MAC ABOGADOS S.A.S. (“CH MAC Abogados”), a Colombian company identified with NIT 901.137.873-0, with its main address in Bogotá DC, adopts this Personal Data Processing Policy (the “ Policy ”) to regulate the collection, storage, use, circulation, transmission, transfer, updating, deletion and, in general, any operation it carries out on personal data in the development of its corporate purpose, the provision of its professional services and its administrative, commercial, labor, contractual and compliance activities.

Contact details of the Data Person Responsible:

  • Physical address: Calle 93 # 12 – 14 Ofc. 404, Edificio Tempo 93, Bogotá D.C., Colombia
  • Website: www.chmac.legal
  • Email personal data protection: contacto@chmac.legal
  • Responsible area: Administrative Area or whoever acts in its place as internal person responsible for personal data protection.

TABLE OF CONTENTS

1. Aim
2. Scope
3. Legal framework
4. Definitions
5. Applicable principles
6. Roles of CH MAC Abogados
7. Headlines, databases and information categories
8. Purposes of the Treatment
9. Authorization for Treatment
10. Sensitive data and data of children and adolescents
11. Rights of the Holders
12. Duties of CH MAC Abogados as Responsible
13. Duties of CH MAC Abogados as Manager
14. Data transfers, transmissions and circulation
15. Security, confidentiality and professional secrecy
16. Security incident management
17. National Database Registry
18. Procedure for inquiries and complaints
19. Information retention and deletion
20. Publication, modifications and validity

Annex 1. Purposes by stakeholder group
Annex 2. Special guidelines for emails, website, technological tools and communications

1. AIM

The purpose of this Policy is to establish the rules, guidelines and procedures applicable to the Processing of personal data carried out by CH MAC Abogados, in order to guarantee the fundamental right to habeas data, privacy, good name, the right to information and the rights of the Holders to know, update, rectify, delete and revoke the authorization regarding the personal information that is held in the databases or files of CH MAC Abogados.

Additionally, this Policy develops measures of demonstrated responsibility, privacy by design and by default, information security, professional confidentiality, proper management of Processors, handling of queries and complaints, document preservation and management of risks associated with the Processing of personal data.

2. SCOPE

This Policy applies to all personal data recorded in databases, physical files, digital files, information systems, document repositories, emails, technological platforms, files, working documents, communications and other means managed by CH MAC Abogados, provided that they are susceptible to Processing by CH MAC Abogados as Responsible person or person in charge.

The Policy covers the processing of data of clients, potential clients, suppliers, contractors, socios, correspondents, employees, interns, candidates, visitors, event attendees, recipients of communications, legal representatives, administrators, shareholders, final beneficiaries, agents, counterparties, witnesses, experts, third parties related to legal matters, website users and other natural persons whose data is processed by CH MAC Abogados.

This Policy is understood without prejudice to confidentiality agreements, contracts, professional secrecy obligations, ethical standards applicable to the practice of law, duties of confidentiality, procedural rules, orders of authorities or contractual restrictions that may be applicable to the information processed by CH MAC Abogados.

3. LEGAL FRAMEWORK

This Policy is based, among others, on the following provisions and guidelines:

  • Political Constitution of Colombia, especially articles 15 and 20.
  • Law 1581 of 2012, which establishes general provisions for the protection of personal data.
  • Law 1266 of 2008 and its amending regulations, insofar as it is applicable to financial, credit, commercial, service information and information from third countries.
  • Law 1273 of 2009, related to the protection of information and data against computer-related conduct.
  • Decree 1074 of 2015, Single Regulatory Decree of the Commerce, Industry and Tourism Sector, especially the provisions that compile the regulatory regime for the protection of personal data and the National Registry of Databases.
  • Single Circular of the Superintendence of Industry and Commerce, Title V, and other instructions issued by the national authority for the protection of personal data.

4. DEFINITIONS

Term

Definition

Authorization

Prior, express and informed consent of the Data Subject to carry out the Processing of their personal data, except for the events exempted by law.

Privacy Notice

Verbal or written communication addressed to the Data Subject informing them of the existence of the Policy, how to access it and the purposes of the Processing.

Database

An organized set of personal data that is subject to processing, in physical, electronic, digital or any other format.

Personal Data

Any information linked to or that may be associated with one or more specific or identifiable natural persons.

Public Data

Data that is not semi-private, private or sensitive, including, among others, data relating to the civil status of persons, their profession or occupation and their status as a merchant or public servant, in the terms of the law.

Private Data

Information that, due to its intimate or confidential nature, is only relevant to the Data Subject.

Semi-private data

Data that is not of an intimate, reserved or public nature and whose knowledge may be of interest to the Holder and a certain sector or group of people, such as financial or credit data, when appropriate.

Sensitive Data

Data that affects the privacy of the Holder or whose misuse may generate discrimination, such as health data, biometric data, political orientation, religious or philosophical beliefs, union membership, racial or ethnic origin, sexual life, among others.

Data Person Responsible

Natural or legal person, public or private, who alone or in association with others carries out the Processing of personal data on behalf of the person responsible.

Data Person Responsible

Natural or legal person, public or private, who alone or in association with others decides on the database or the processing of personal data.

Holder

Natural person whose personal data is subject to Processing.

Treatment

Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, transfer, transmission, updating or deletion.

Transferencia

Envío de datos personales a un tercero que, dentro o fuera de Colombia, actúa como Responsable del Tratamiento.

Transmission

Communication of personal data within or outside of Colombia so that a Processor can carry out Processing on behalf of the Person Responsible.

Demonstrated Responsibility

Management principle according to which the Person Responsible or Processor must implement appropriate, effective and verifiable measures to comply with the personal data protection regime and demonstrate such compliance to the Data Subjects and competent authorities.

5. APPLICABLE PRINCIPLES

CH MAC Abogados will process personal data in accordance with the principles set forth in the applicable regulations and market standards regarding privacy, security and compliance.

In particular, it will apply the following principles:

  • Legality: The processing will be carried out in accordance with current and applicable regulations.
  • Purpose: The processing will be for legitimate, informed, specific purposes compatible with the activity of CH MAC Abogados.
  • Freedom: The Processing will require prior, express and informed authorization from the Holder, unless there is a legal exception.
  • Truthfulness or quality: The information must be truthful, complete, accurate, up-to-date, verifiable and understandable.
  • Transparency: Data Subjects may obtain information about the existence and use of their personal data.
  • Restricted access and circulation: The data will be processed by authorized persons and will not be available on mass access media without adequate controls.
  • Security: The information will be protected with reasonable measures against alteration, loss, consultation, use, access or unauthorized or fraudulent circulation.
  • Confidentiality: Those involved in the Processing must guarantee the confidentiality of the information, even after their relationship with CH MAC Abogados has ended.
  • Necessity and proportionality: Only data that is adequate, relevant and limited to what is necessary for the authorized or legally permitted purposes will be processed.
  • Time frame: The data will only be kept for the time necessary to fulfill the purpose, legal, contractual, evidentiary or defense obligations.
  • Demonstrated responsibility: CH MAC Abogados will endeavor to adopt appropriate, effective and verifiable measures to demonstrate compliance with the personal data protection regime.
  • Privacy by design and by default: In new processes, tools, contracts or services, CH MAC Abogados will seek to incorporate data protection measures from their design and ordinary operation.

6. ROLES OF CH MAC ATTORNEYS

CH MAC Abogados may act as the Data Person Responsible when it decides on the purposes and means of the processing of personal data, for example, with respect to its clients, suppliers, employees, candidates, visitors, recipients of communications and users of its channels.

CH MAC Abogados may also act as a Data Processor when processing personal data on behalf of a client, partner, entity, or third party that decides on the database and the purposes of the processing. In such cases, CH MAC Abogados will process the data in accordance with the instructions of the Data Person Responsible, the corresponding contract, applicable law, and professional confidentiality obligations.

When CH MAC Abogados holds the positions of Responsible and Manager, it will fulfill the duties provided for each role, as appropriate.

7. DATA SUBJECTS, DATABASES AND CATEGORIES OF INFORMATION

CH MAC Abogados may manage physical or digital databases related to, among others, the following categories of Data Subjects:

  • Clients, potential clients, representatives, administrators, shareholders, ultimate beneficiaries, agents, authorized contacts and third parties related to the provision of legal services.
  • Counterparties, witnesses, experts, officials, authorities, court officers, third parties interested and other persons related to judicial, arbitral, administrative, contractual or transactional matters.
  • Suppliers, contractors, consultants, partners, correspondents, external advisors and their authorized contacts.
  • Workers, former workers, interns, candidates, collaborators, partners, consultants and professional service providers.
  • Visitors, attendees of events, training or meetings, recipients of publications, website users and people who interact with physical or digital channels of CH MAC Abogados.

Depending on the purpose, CH MAC Abogados may process identification data, contact information, location, employment, academic, professional, financial, accounting, tax, commercial, contractual, corporate, patrimonial, judicial, administrative, disciplinary, immigration, compliance, social security, occupational safety and health information, information contained in documents, powers of attorney, contracts, files, evidentiary support, images, recordings, access records, browsing data or digital interaction and, exceptionally, sensitive data or data of minors when strictly necessary and legally appropriate.

8. PURPOSES OF THE PROCESSING

CH MAC Abogados will process personal data for the following general and specific purposes, without prejudice to the specific purposes stated in each authorization, contract, form, channel or specific notice:

  • Manage pre-contractual, contractual, commercial, professional, labor, administrative, accounting, tax and compliance relationships.
  • To provide advisory, consulting, representation, support, defense, structuring, negotiation, litigation, arbitration, procedures, document reviews, training and other professional services specific to CH MAC Abogados.
  • Manage physical and digital files, documents, communications, concepts, reports, evidence, powers of attorney, contracts, minutes, requests, memorials, resources, claims, responses to authorities and support materials necessary for the proper provision of services.
  • Identify and contact account holders, confirm information, update data, handle requests, coordinate meetings, send service communications, respond to inquiries, and manage service channels.
  • Verify conflicts of interest, advance processes of knowing customers, suppliers, partners or contractors, perform due diligence and manage risks of fraud, corruption, money laundering, terrorist financing, breaches of contract or legal conflicts, when applicable.
  • To comply with legal, contractual, accounting, tax, labor, corporate, administrative, regulatory, archiving, social security, occupational safety and health, risk prevention and response to requests from authorities.
  • Perform invoicing, quotes, payments, collections, reconciliations, accounting, treasury, tax reports, declarations, exogenous information, tax supports and portfolio management.
  • Manage relationships with suppliers, contractors, partners, correspondents, experts, notaries, chambers of commerce, financial entities, insurers, technology platforms, logistics operators, couriers and other third parties necessary for the operation.
  • Develop processes for selection, hiring, personnel hiring, payroll, compensation, social security, benefits, training, evaluation, disciplinary management, termination, references, work certifications, labor document management and compliance with obligations as an employer or contractor.
  • Implement physical, logical, and administrative security measures; manage access controls, users, passwords, backups, traceability, audits, business continuity, prevention of data loss, and security incidents.
  • Send legal newsletters, regulatory alerts, invitations, publications, academic, commercial or informational content, satisfaction surveys and relationship communications, provided there is legal authorization or enablement and allowing exclusion mechanisms where applicable.
  • Managing the website, social media, forms, cookies, analytics, digital requests, electronic interactions and technological tools used by CH MAC Abogados.
  • To exercise, defend or protect the rights of CH MAC Abogados, its clients, employees, allies or third parties, including the preparation of evidence, claims, responses, legal, arbitral, administrative actions or proceedings before authorities.
  • Retain information for evidentiary, historical, statistical, archival, internal control, auditing, professional responsibility, continuity of legal matters or compliance with legal and contractual deadlines.

9. AUTHORIZATION FOR TREATMENT

CH MAC Abogados will request prior, express, and informed authorization from the Data Subject for the Processing of personal data when required. Authorization may be obtained through physical, electronic, digital, telephone, or audiovisual means, through unambiguous conduct, or by any other mechanism that allows for verification of its granting and subsequent verification.

The authorization must inform, at a minimum, of the purposes of the Processing, the rights of the Data Subject, the channels of attention, the identification of the Person Responsible and, when it comes to sensitive data, the optional nature of its provision and the specific purpose of the Processing.

CH MAC Abogados will retain proof of the authorizations granted by the Holders, as well as the notices, records, forms, logs, electronic evidence, contracts or mechanisms through which the authorization was obtained, in accordance with the law and its internal procedures.

Authorization will not be necessary when dealing with information required by a public or administrative entity in the exercise of its legal functions or by court order; data of a public nature; cases of medical or health emergency; processing authorized by law for historical, statistical or scientific purposes; data related to the Civil Registry of Persons; or other events excepted by the applicable regulations.

10. SENSITIVE DATA AND DATA OF CHILDREN AND ADOLESCENTS

The processing of sensitive data is restricted and will only proceed when the Data Subject has given explicit authorization, when it is necessary to safeguard their vital interest and they are physically or legally incapacitated, when it involves legitimate activities with adequate guarantees, when it is necessary for the recognition, exercise or defense of a right in a judicial process, when it has a historical, statistical or scientific purpose with suppression of identity, or in other cases permitted by law.

When CH MAC Abogados requests sensitive data, it will inform the Data Subject that they are not obliged to authorize its Processing or to answer questions about this type of data, will indicate which data are sensitive, explain the specific purpose and obtain explicit authorization when required.

CH MAC Abogados may process sensitive data, including health data, biometric data, images, social security information, information on special conditions of workers, data included in judicial or administrative files, family information, beneficiary data or data of third parties linked to legal matters, only when it is necessary, proportionate and legally appropriate.

The processing of personal data of children and adolescents will be carried out respecting their best interests, their fundamental rights, the principle of progressive autonomy, and with the authorization of their legal representatives where applicable. Under no circumstances will CH MAC Abogados condition any activity on the provision of sensitive data that is not essential for the corresponding purpose.

11. RIGHTS OF THE HOLDER(S)

  • To know, update, rectify and access your personal data in relation to CH MAC Abogados.
  • Request proof of the authorization granted, unless it is a case excepted by law.
  • To be informed, upon request, about the use that CH MAC Abogados has made of your personal data.
  • Submit inquiries and complaints related to your personal data.
  • Request the deletion of your data or revoke the authorization when there is no legal or contractual obligation that prevents the deletion or revocation.
  • Refrain from answering questions about sensitive data or from authorizing its processing, unless there is an applicable legal obligation.
  • File complaints with the Superintendency of Industry and Commerce for violations of the personal data protection regime, once the consultation or claim process with the Responsible party has been exhausted when applicable.
  • Access your personal data subject to processing free of charge, under the terms established by law.

12. DUTIES OF CH MAC ABOGADOS AS RESPONSIBLE PARTY

  • To guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.
  • Request and keep proof of the authorization granted by the Holder, when required.
  • Inform the Data Subject of the purpose of the collection and the rights they have.
  • Keep the information under secure conditions that prevent its alteration, loss, unauthorized or fraudulent access, use or disclosure.
  • Ensure that the information provided to Managers is truthful, complete, accurate, up-to-date, verifiable and understandable.
  • Update, rectify or delete information when appropriate and communicate updates to the Managers when appropriate.
  • Provide the Processor only with data whose processing is authorized or legally permitted.
  • Require those in charge to ensure security, confidentiality, and privacy of information.
  • Process inquiries and claims from Data Subjects within the legal terms.
  • Inform the Data Person Responsible when certain information is under discussion by the Data Subject.
  • Inform the Data Subject, upon request, about the use given to their personal data.
  • Inform the data protection authority when security code violations occur and there are risks in the management of the information of the Holders, in the applicable terms.
  • Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

13. DUTIES OF CH MAC ABOGADOS AS MANAGER

  • To process personal data in accordance with the instructions of the Data Person Responsible , the applicable contract, the law and this Policy, as relevant.
  • Guarantee the Holder’s right to habeas data in coordination with the Responsible Party, as appropriate.
  • Keep the information under the necessary security conditions to prevent alteration, loss, consultation, use, access or unauthorized or fraudulent circulation.
  • Update, rectify or delete data in a timely manner in accordance with the instructions of the Data Person Responsible and applicable regulations.
  • To process or forward to the Data Person Responsible the queries and complaints of Data Subjects, as provided for in the contract or the law.
  • Include legends of “claim in process” or “information under judicial discussion” where appropriate.
  • Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the competent authority.
  • Inform the Data Person Responsible and, where appropriate, the competent authority, of any security incidents that may pose risks to the Data Subjects.
  • Maintain confidentiality regarding the personal data processed, even after the contractual or professional relationship has ended.
  • Return, delete, anonymize or retain personal data in accordance with the instructions of the Person Responsible, the law and applicable archiving, professional secrecy or defense obligations.

14. DATA TRANSFERS, TRANSMISSIONS AND CIRCULATION

CH MAC Abogados may share, transmit, or transfer personal data when necessary to fulfill the stated purposes, execute a contractual relationship, provide professional services, comply with legal obligations, act before authorities, manage suppliers, or exercise rights. This sharing will be limited to the necessary information and will be subject to duties of confidentiality, security, necessity, and restricted access.

Personal data may be received by, among others, technology providers, cloud services, email, videoconferencing platforms, document repositories, management tools, accounting, tax, administrative, payroll, social security providers, banks, insurance companies, courier services, archiving, document destruction, auditors, experts, correspondents, allied firms, external lawyers, notaries, chambers of commerce, judicial, administrative, tax, regulatory, inspection, surveillance and control authorities, clients or counterparties when necessary within a legal process.

When personal data is transferred to Processors, CH MAC Abogados will endeavor to enter into contracts, annexes or transfer clauses that include, at a minimum, Processing instructions, confidentiality duties, security measures, restrictions on use, duty to support in inquiries and complaints, rules for sub-processors, incident management, return or deletion of information and other applicable obligations.

When international transfers of personal data are made, CH MAC Abogados will verify the existence of authorization, legal authorization, a country with an adequate level of protection or contractual, organizational or legal mechanisms that allow the protection of the rights of the Data Subjects, in accordance with current regulations and the instructions of the Superintendency of Industry and Commerce.

15. SECURITY, CONFIDENTIALITY AND PROFESSIONAL SECRECY

CH MAC Abogados will adopt reasonable and proportionate administrative, human, physical, technical, contractual and organizational measures, taking into account the risk, the nature of the data, the context of the Processing and the available resources, in order to protect personal data against loss, alteration, unauthorized or fraudulent access, use, consultation, disclosure or circulation.

Among other measures, CH MAC Abogados will be able to implement access controls by profiles, passwords, authentication, permission restrictions, backups, security tools, contractual confidentiality, training, internal policies, document management, information classification, filing rules, secure destruction, access traceability and supplier evaluation.

Information processed by CH MAC Abogados in the course of providing legal services may be protected by attorney-client privilege, legal confidentiality, contractual confidentiality, litigation strategy, privilege, or procedural rules. Therefore, those who access such information must maintain strict confidentiality and may only use it for authorized, contractual, or legally permitted purposes.

CH MAC Abogados does not sell or rent personal data databases. Any use of information for communications, newsletters, events, or relationship building must be carried out respecting the data subject’s authorization, their reasonable expectation, applicable regulations, and available opt-out mechanisms.

16. SECURITY INCIDENT MANAGEMENT

CH MAC Abogados will adopt internal procedures to identify, report, assess, contain, investigate, document, and mitigate security incidents involving personal data. When an incident may pose risks to data subjects, CH MAC Abogados will evaluate notification measures for data subjects, Personas Responsables, processors, relevant authorities, or third parties, in accordance with applicable law, contracts, and guidelines.

Employees, collaborators, contractors, and suppliers who know of or suspect a security incident must immediately report it to the Administrative Area or the internal person responsible for personal data protection, without disclosing additional information or taking actions that could aggravate the risk.

17. NATIONAL DATABASE REGISTRY

When CH MAC Abogados is legally required to register its databases in the National Database Registry administered by the Superintendency of Industry and Commerce, it will carry out the registration, updating, reporting of changes and other actions that correspond in accordance with Decree 1074 of 2015, the Single Circular and the current instructions of the competent authority.

Unless otherwise required by applicable thresholds, nature or regulatory conditions, CH MAC Abogados will internally retain the inventories, maps or records necessary to demonstrate the reasonable management of its databases and compliance with the obligations that may be required of it.

18. PROCEDURE FOR INQUIRIES AND COMPLAINTS

18.1. Area and channels enabled

Holders, successors, representatives, agents or authorized persons may exercise their rights by submitting a request to:

  • Responsible area: Administrative Area or internal person responsible for personal data protection.
  • Email personal data protection: contacto@chmac.legal
  • Physical address: Calle 93 # 12 – 14 Ofc. 404, Edificio Tempo 93, Bogotá D.C., Colombia.
  • Website: www.chmac.legal , when the respective channel is enabled.

18.2. Legitimation

Applications may be submitted by the Holder proving their identity; their successors, proving such status; representatives or agents, proving the representation; or by stipulation in favor of another or for another, when the corresponding condition is proven.

18.3. Minimum content of the application

The application must include, at a minimum: the applicant’s name and identification; the capacity in which they are acting; a clear description of the facts, data, or rights they intend to exercise; contact information for a response; documents that support their application; and, where applicable, a power of attorney, authorization, or proof of representation.

18.4. Consultations

Inquiries will be addressed within a maximum of ten (10) business days from the date of receipt. If it is not possible to address the inquiry within this period, CH MAC Abogados will inform you of the reasons for the delay and the date on which it will be addressed, which in no case may exceed five (5) business days following the expiration of the initial period.

18.5. Complaints

When the Data Subject believes that the information should be corrected, updated, deleted, revoked, or that there is an alleged breach of the personal data protection regulations, they may file a complaint with CH MAC Abogados. If the complaint is incomplete, CH MAC Abogados will request the interested party to remedy the deficiencies within five (5) business days of receiving it. If two (2) months elapse from the date of the request without the applicant submitting the required information, it will be understood that they have withdrawn the complaint.

Once a complete claim is received, a note indicating «claim in process» and the reason for the claim will be entered into the corresponding database within two (2) business days and will remain until a decision is reached. The maximum time to address the claim will be fifteen (15) business days from the day after receipt. If it is not possible to address the claim within this timeframe, the reasons for the delay and the response date will be provided, which may not exceed eight (8) business days following the expiration of the initial timeframe.

18.6. Suppression and revocation

The Data Subject may request the deletion of their data or the revocation of their authorization. These requests will be granted when there is no legal, contractual, professional, accounting, tax, labor, evidentiary, judicial, or administrative obligation that obliges or authorizes CH MAC Abogados to retain or process the information. When deletion is warranted, CH MAC Abogados may delete, anonymize, block, or restrict the processing of the data, as appropriate.

19. RETENTION AND DELETION OF INFORMATION

Personal data will be kept for the time necessary to fulfill the authorized or legally enabled purposes, and for the additional terms required by legal, contractual, accounting, tax, labor, corporate, evidentiary, archiving, judicial defense, professional responsibility or attention to requirements of authorities.

Once the retention periods have expired or the purpose has been fulfilled, CH MAC Abogados will delete, anonymize, return, block or restrictively retain the data, as appropriate and in accordance with its internal procedures, applicable law, orders from authorities, professional obligations and information security requirements.

20. PUBLICATION, MODIFICATIONS AND VALIDITY

This Policy is effective upon publication and supersedes all previous versions of CH MAC Abogados Information Processing Policy. Databases will remain in effect as long as the purpose for which they were collected remains valid, as long as there is a legal, contractual, professional, or evidentiary obligation justifying their retention, or as long as necessary for the defense of the rights of CH MAC Abogados or legitimate third parties.

CH MAC Abogados may modify this Policy to adapt it to legal, regulatory, jurisprudential, doctrinal, technological, contractual, commercial, or operational changes. Substantial changes will be communicated through the website, email, physical or digital notices, or any other means that CH MAC Abogados deems appropriate.

ANNEX 1. PURPOSES BY STAKEHOLDER GROUP

Stakeholder group

Main specific purposes

Clients and potential clients

Provision of legal services; file management; verification of conflicts of interest; due diligence; service communications; billing; collection; defense of rights; compliance with legal and contractual obligations; sending publications or invitations when applicable.

Third parties involved in legal matters

Analysis of facts; structuring of strategies; preparation of documents; presentation of evidence; handling of judicial, arbitration, administrative or contractual processes; responding to requests from authorities; defense of rights.

Suppliers, contractors and partners

Contracting; service order management; payments; evaluation; accounting and tax administration; reporting; quality control; security; compliance; auditing; operational contact.

Workers, interns and collaborators

Selection; hiring; payroll; benefits; social security; occupational health and safety; training; evaluation; references; access controls; legal compliance; disciplinary management; employee records.

Candidates

Profile evaluation; information verification; interviews; tests; references; communications; storage in resume databases when authorized.

Visitors and event attendees

Access control; security; attendance registration; logistical coordination; sending certificates, materials, invitations or related communications.

Web users and recipients of communications

Handling requests; managing forms; analytics; cookies; sending newsletters, legal alerts, publications, events or communications of interest, with opt-out mechanisms where appropriate.

ANNEX 2. SPECIAL GUIDELINES FOR EMAILS, WEBSITE, TECHNOLOGICAL TOOLS AND COMMUNICATIONS

1. Emails and professional communications

Emails sent by CH MAC Abogados may contain confidential, proprietary, or data protected by personal data protection laws. Recipients must use this information only for authorized purposes. If an email is received in error, the recipient must refrain from using, copying, or disclosing its contents, notify the sender, and delete it from their systems.

2. Website, forms and cookies

CH MAC Abogados may collect data through its website, forms, event logs, analytics tools, cookies, or similar technologies. When necessary, it will inform users of the purposes, categories of cookies or technologies used, and the mechanisms available for managing, blocking, or deleting them, in accordance with the browser or tool settings.

3. Technological tools, cloud and artificial intelligence

CH MAC Abogados may use technology providers, cloud tools, document management systems, email, videoconferencing, security measures, automation, or data analytics. Before using any tools that involve the processing of personal data, it will assess their necessity, purpose, security, confidentiality, location of the information, contractual conditions, and usage restrictions. When using artificial intelligence or automation tools, CH MAC Abogados will avoid entering unnecessary personal data, sensitive information, or confidential client information into tools that do not guarantee adequate levels of security, confidentiality, and contractual control.

4. Commercial or informational communications

The sending of newsletters, legal alerts, invitations, publications, or other communications of interest will be based on the data subject’s authorization, the existing relationship, or applicable legal authorization. Data subjects may request to be removed from distribution lists through the channels provided by CH MAC Abogados or through the opt-out mechanisms included in the communications, where available.