Code: CF PL 01
Version: 1
Foundation: Marina Orth Foundation
Date: October 16, 2025
Pages: 5

Introduction
The Marina Orth Foundation:

In compliance with Law 1581 of 2012, Decree 1377 of 2013, Law 1098 of 2006
(Code of Childhood and Adolescence) and other regulatory provisions in force in the area of
protection of personal data in Colombia, adopts this Policy for the Treatment of Personal Data.
Personal Data, with the purpose of regulating the collection, storage, use, processing, and disclosure of
the movement, transfer, transmission and deletion of the personal data of your employees.
beneficiaries, partners, volunteers, workers, donors, visitors, suppliers,
contractors and, especially, of the children and adolescents (children and adolescents) who participate in their
educational and social programs (“students”).

The Foundation guarantees the respect and safeguarding of the fundamental rights to habeas corpus.
data, privacy, good name and the integral protection of minors, observing the
principles of best interest of the child, legality, finality, freedom, truthfulness,
transparency, restricted access and circulation, security, confidentiality and temporariness.

General Objective
Establish institutional guidelines for the collection, storage, use, storage, use and disposal of
the movement, transfer, transmission and deletion of the personal data of the persons concerned.
Marina Orth Foundation's stakeholders, within the framework of its programs and projects,
initiatives and mission operations.

Specific Objectives

• To ensure compliance with current regulations in Colombia within the framework of the
  processing of personal data.
• To protect the Foundation's stakeholders with regard to the treatment of their interests.
  personal data.
• Safeguard the institutional integrity of the Marina Orth Foundation, starting with a
  proper management of the personal data being processed.

TITLE I
OF THE DATA, RIGHTS AND DUTIES OF THE DATA CONTROLLER

Article 1. Details of the person in charge

Article 2. Liability

The Foundation acts as responsible for the processing of personal data and guarantees the adoption of technical, administrative and human measures to protect the information from loss, adulteration, unauthorized access or improper use.

Article 3. Duties of the Foundation

The Marina Orth Foundation is committed to:

• To guarantee the holder the full exercise of the right to habeas data.
• To inform about the purpose of the processing and the rights of the owner of the data.
• Keep the information under adequate security conditions.
• Update and rectify the information when necessary.
• Process inquiries and claims in accordance with the legal terms.
• Allow access only to authorized personnel.
• Implement technical and administrative measures for data protection.
• Document all treatment activities.

Article 4. Database security

The Foundation will implement concrete technical and administrative measures, such as:

• Physical and electronic access control.
• Encryption of sensitive databases.
• Logging of access audits and modifications.
• Secure backup and information recovery procedures.
• Periodic training of authorized personnel.

Article 5. Purposes of processing

A. Beneficiaries

The Marina Orth Foundation will collect, store and use personal information for the following purposes:

• Sending of general communications.
• Historical, scientific or statistical record.
• Generation of internal statistics.
• Attention to citizens' rights.
• Management of extraordinary aid.
• Management of social assistance activities.
• Proof of donation.

Processing of minors' data: The protection of their prevailing rights is guaranteed, requiring authorization from parents or legal representatives.

Assignment of audiovisual rights: The holder authorizes the use of his image, voice or videos by the means permitted by law, without financial compensation.

Referred data: The holder declares to have express authorization from the third parties whose data he/she provides.

B. Altruistic donors

The Foundation will collect and use personal information for purposes of data verification, administrative management, security, legal compliance, prevention of money laundering and financing of terrorism, communications, access control, internal investigations, data update campaigns and proof of donation.

C. Workers

Includes employees, contractors and candidates. The information will be used for labor management, payroll, social security, selection, training, profile analysis, statistics, security, legal compliance and institutional use of audiovisual material.

D. Visitors

Administrative management, security, access control, rights management, communications, investigations and registration of assets.

E. Students

Educational, administrative, legal, security, safety, training, statistics, social welfare, comprehensive child protection and educational programs at all levels.

F. Suppliers or contractors

Contractual, administrative, commercial, legal, accounting, tax, security, training, statistics, marketing, education and compliance management.

G. Strategic allies

Administrative and contractual management, communications, security, legal compliance, custody of information and proof of donation.

Article 6. International transfer or transmission of data

The Foundation may transfer or transmit personal data abroad, provided that it guarantees an adequate level of protection in accordance with the law.

Article 7. Privacy Notice

The privacy notice will inform the identity of the person in charge, purpose of the treatment, rights of the holder, procedure to exercise them, transfers, duration and conservation. For minors, it will be understandable according to their age and accompanied by legal authorization.

TITLE II - RIGHTS AND DUTIES OF THE HOLDER

Article 8. Holder's rights

Holders have the right to access, update, rectify, revoke authorization, request deletion, file complaints before the SIC and access their information free of charge.

Article 9. Procedure for exercising rights

Consultations: ten (10) working days.
Claims: fifteen (15) business days.
In case of delay, the cause and the new response date will be informed.

Revocation of authorization

The owner may revoke the authorization unless there is a legal or contractual obligation to keep the data.

TITLE III - REGIME APPLICABLE TO MINORS

Article 11. Enhanced consent

Prior, express and informed authorization from the legal representatives shall be required, and evidence of such authorization shall be kept.

Article 12. Specific purpose for minors

The data will be used only for educational or social programs, communication of progress, child protection and pedagogical records.

Article 13. International transfer

Only when strictly necessary and with guarantees equivalent to Colombian regulations.

Article 14. Duration and retention of data

The data will be kept for as long as there is an active link, legal obligation or no valid request for deletion.

FINAL PROVISIONS

Article 15. Validity and updating

The Policy is effective upon publication and will be reviewed annually or whenever there are relevant changes.

Article 16. Complementarity

Law 1581 of 2012, Decree 1377 of 2013 and Law 1098 of 2006 shall prevail.

Validity of the Policy

Effective from May 2025 to May 2026.

DRAFTED
Sindy Patiño
Veronica Maya

REVISED
Henry García Gaviria
Sofia Barrios
Marlon Vargas Patiño

APPROVED
Henry García Gaviria
Chief Executive Officer
Marina Orth Foundation