Firefly Energy SAS The following presents the personal data treatment and protection policy applied by Firefly Energy SAS, within the framework of development and application of Colombian regulations on data protection.

Legal framework

Political Constitution of Colombia, article 15.
Law 1581 of 2012.
Regulatory Decree 1377 of 2013.

1. Objective

Establish the general guidelines in accordance with Law 1581 of 2012, article 18 literal f, for the collection, storage, use, circulation or deletion of personal data of collaborators, suppliers and clients of Firefly Energy SAS.

2. Reach

The Personal Data Treatment and Protection policy contained herein is applicable to Firefly Energy SAS, by virtue of the contractual relationships carried out to comply with its corporate purpose and satisfy its needs, in order to apply current legislation on protection. of personal data.

The principles and provisions contained in Law 1581 are applicable to personal data registered in any database that makes them susceptible to processing by entities of a public or private nature.

Therefore, the data processing carried out by Firefly Energy SAS is subject to the personal data protection regime established by this law, its regulatory decrees and other regulations that complement, modify or repeal it.

3. Validity

Permanent as of July 27, 2013.

This policy will be in force as of July 27, 2013 and the period of validity of the database will be five (5) years from the date of termination of the last contractual relationship, so that allows compliance with legal and/or contractual obligations under the responsibility of Firefly Energy SAS, especially in accounting, fiscal and tax matters.

In the event of substantial changes in the content of the Treatment policies, referring to the identification of the person responsible and the purpose of the Processing of personal data, which may affect the content of the authorization, the Data Controller must communicate these changes to the Owner before or at the latest at the time of implementing the new policies. In addition, you must obtain a new authorization from the Owner when the change refers to the purpose of the Treatment.

4. Applicable regulations

This Policy is governed by the parameters set by articles 15 and 20 of the Political Constitution, Law 1581 of 2012 “By which general provisions are issued for the protection of personal data” and Chapter 25 of Decree 1074 of 2015 “ “By which Law 1581 of 2012 is partially regulated.”

5. Data and identification of the person responsible

Firefly Energy SAS, with address at Carrera 13 # 90 – 17 in the city of Bogotá, Colombia, can be contacted at that same address or at the email juridico@www.firefly-e.com

6. Description

6.1 Definitions

In order to determine the meaning of the concepts used in this Policy, we will use the following definitions, in accordance with the provisions of Law 1266 of 2008, Law 1581 of 2012 and Regulatory Decree 1377 of 2013:

• Authorization: Prior, express and informed consent of the owner to carry out the processing of personal data.
  Privacy Notice: Physical, electronic document or any other format generated by the person responsible whose purpose is to make available to the owner the policy for the processing of personal data that the company has.
• Database: Organized set of personal data that is subject to processing, which resides in physical or electronic documents.
  Personal Data: Any information linked or that can be associated with one or several specific or determinable natural persons. Those pieces of information that may become determinable to identify the owner of the personal data.
• Sensitive Data: Those that affect the privacy of the owner or whose improper use can generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, rights human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data.
• Public Data: It is data that is not semi-private, private or sensitive. Public data are considered to be, among others, data relating to the marital status of people, their profession, their status as a merchant or public servant, and in general all data that may be contained in public records, public documents, gazettes. , official bulletins and duly executed judicial rulings that are not subject to reservation.
• Semi-Private Data: This is data that is not intimate, reserved or public in nature and whose knowledge or disclosure may be of interest not only to the owner, but also to a certain sector or Firefly Energy SAS of people or society in general, such as, for example, the data financial and credit.
• Private Data: This is the data that, due to its intimate or reserved nature, identifies the owner.
• Data Processor: Natural or legal person, public or private, who, by themselves or in association with others, processes personal data on behalf of the data controller. A person internal or external to Firefly Energy SAS may have the capacity of manager.
• Processing Officer: person or area of ​​Firefly Energy SAS that is responsible for resolving complaints, queries and claims from the owners of the information, and in addition to managing and controlling the personal data contained in the databases, in compliance with the duties and responsibilities provided to guarantee the protection of the rights of the data owner. In no case will you be responsible to the owner for the quality of the data provided to you.
• Habeas Data: Fundamental right of every person to know, update, rectify and/or delete personal data that has undergone processing.
  Right to Protection of Personal Data: confers the owner powers of disposal and control over their personal data.
  Claim: Request from the Data Owner or from the persons authorized by the Data Owner or by the Law to correct, update or delete their Personal Data or to revoke the authorization in the cases established by the Law.
• Data Controller: Natural or legal person, public or private, who alone or in association with others, decides on the processing of data.
  Owner: Natural person whose personal data is processed.
• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion thereof.
• Transfer: Refers to cases in which the Controller or Processor of personal data who is located in Colombia, sends said information to a recipient who is in turn the Controller and is located inside or outside the country.
• Transmission: Refers to cases in which the Processing of personal data is carried out by the Processor on behalf of the Controller, and the communication of the information within or outside the territory of Colombia must mediate between them.

6.2 Principles on the handling of personal data

The personal data management policy of Firefly Energy SAS will harmoniously and comprehensively apply the following principles established in Law 1581 of 2012:

• Legality: Firefly Energy SAS processes personal data strictly in accordance with the legal requirements established in Statutory Law 1581 of 2012, its regulatory decrees and other legislation in force in Colombia that repeals or modifies them.
• Purpose: All data processing at Firefly Energy SAS is subject to a defined and legitimate purpose in accordance with the Constitution and the law, which must be informed to the owner. A distinction is made between the essential data to carry out the corporate purpose, which includes the data necessary to maintain contractual links with clients, collaborators and suppliers, and the optional data required to be able to offer additional services and strengthen Firefly Energy SAS. In any case, you must adequately inform the owners about the purpose of the processing of their data and about this policy.
• Freedom: All processing of personal data carried out by the company must be supported by the prior, express and informed consent of the owner.
  Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that requires consent.
• The tacit consent of the collaborator, supplier or client of Firefly Energy SAS is not permitted.
  Firefly Energy SAS clearly distinguishes, in its data collection procedures and records and databases, between essential data, sensitive data and optional data.
• Veracity or quality: The information contained in the data subject to processing must be true, complete, exact, up-to-date, verifiable and understandable. Firefly Energy SAS must regularly carry out updating activities for current data. The processing of partial, incomplete, fragmented or misleading data is legally prohibited.
• Transparency: Firefly Energy SAS will inform the holders in advance what personal data is required from them and what is the purpose for which it is required, understanding that said purpose will always be related to their work. Subsequently and at the request of the owners, Firefly Energy SAS will inform them about their personal data and the purpose thereof registered in the Firefly Energy SAS database, without prejudice to the periodic information obligations that they have (security account statements). social, payroll payment, labor certificates, reference verification, presentation of tenders, etc.). The right of the owner to obtain from Firefly Energy SAS information about the existence of data that concerns him or her must be guaranteed at all times.
• Restricted access and circulation: Personal Data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide knowledge restricted only to the Owners or authorized third parties. by the owner or authorized third party.
  Firefly Energy SAS does not use the “http” internet protocol to allow third parties access to personal data; Therefore, only their own owners can access personal data through corporate internet portals.
• Security: The security of personal data is a priority for Firefly Energy SAS when it comes to the personal data of collaborators, suppliers and customers. Firefly Energy SAS ensures the technical and administrative measures that are necessary to provide security to the personal data in its care, avoiding its adulteration, loss, unauthorized or fraudulent consultation, use or access.
  Technical measures include: Restricted access physical files; a system of central servers for electronic files; a backup system for electronic files; Access restricted by registered user and password to electronic databases.
• The administrative measures include: Definition of those responsible and in charge of processing personal data at Firefly Energy SAS; clear and restricted definition of data accesses for each Firefly Energy SAS processor; definition of administrative procedures linked to functions and positions at Firefly Energy SAS; the inclusion of data processing policies in contracts with third parties.
• In the event of loss of personal data, Firefly Energy SAS will proceed as provided by law, informing the data owner and the Superintendency of Industry and Commerce.
• Confidentiality: Firefly Energy SAS maintains the most rigorous confidentiality practices in relation to the personal data in its charge. Personal data will not be disclosed or used outside the narrow scope of its express purpose and within the limits established by law. Persons involved in the processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information until after the contractual relationship has ended.
• Temporality: When the information no longer serves the purposes for which its processing was authorized, Firefly Energy SAS will not be able to provide it to users or third parties.
• Necessity: Personal data can only be processed by Firefly Energy SAS for as long as it is required and when the purpose of its processing justifies it.

7. Form of use of information.

By accepting this Policy, clients, suppliers, active and inactive dependent workers, contractors, and, in general, any owner of the information, declare that they know and accept it, and as a consequence, they authorize in advance, voluntarily, spontaneously and informed, Firefly Energy SAS regarding the processing of your personal data, in such a way that the Companies may process the data partially or totally, including the collection, storage, use, processing, disclosure, transmission and transfer of the data provided to the execution of the purposes described above.

For their part, those who provide personal data of their clients, beneficiaries, dependents, employees, directors or shareholders declare that as data controllers they have prior authorization from them to give them such treatment.

Firefly Energy SAS may act as the person responsible or in charge of the personal data, depending on the purpose for which the data was obtained, and therefore undertakes to comply with the responsibilities that the regulations have established for each person. It will not lose its quality, despite the transmission of the information, under the restrictions indicated in this policy.

8. Treatment of data collected by Firefly Energy SAS

8.1 Collection of personal data: In accordance with the provisions of Decree 1377 of 2013, data collection must be limited to those personal data that are relevant and appropriate for the purpose for which they are collected or required in accordance with current regulations. Except in cases expressly provided for by law, personal data may not be collected without authorization from the Owner.

8.2 Authorization: In order to guarantee the rights of the owners of the information, Firefly Energy SAS, as responsible for the treatment, must obtain from them, at the time of data collection, free, prior, express and informed authorization of the Owner for such effect, by any means that allows it to be used as evidence, preferably in written form.

Authorization can be granted by any means and in any form, for example in writing, orally, or through conduct by the Owner that allows it to be reasonably concluded that the authorization was granted. In no case can silence be assimilated to unequivocal conduct.

In any case, the authorization must contain at least a description of the purpose of data processing. Thus, Firefly Energy SAS will inform the owner, before requesting authorization, at least about the following aspects:

• The processing to which your personal data will be subjected and the purpose thereof.
  Which of the data that will be processed are sensitive and the purpose of the processing, as well as the non-obligation of granting authorization for this purpose.
• The rights that assist you as the owner. Firefly Energy SAS must inform the owner of the location on the corporate website where this information can be consulted. By signing, the owner certifies that he or she has read and understood the manual in its entirety and accepts it in terms of its scope and content.
• The identification, physical or electronic address and telephone number of the person responsible for the treatment.
  Firefly Energy SAS saves the authorizations granted in a secure file and delivers a copy to the owner when requested.

Authorization will not be required for the processing of personal data found in publicly accessible sources or information contained in databases available to the general public.

8.3 Cases in which authorization is not necessary

The authorization of the owner of the information will not be necessary in the following cases:

• Information required by a public or administrative entity in the exercise of its legal functions
• The information that is required by court order;
• The data provided is public.
• Medical or health emergency cases;
• Processing of information authorized by law for historical, statistical or scientific purposes;

In any case, anyone who accesses personal data without prior authorization must comply with the provisions contained in Law 1581 of 2012 and Decree 1377 of 2013.

8.4 Sensitive data: Firefly Energy SAS may process sensitive personal data for “a historical, statistical or scientific purpose” and within the framework of processes to improve the quality process at Firefly Energy SAS, and to this end it will adopt the appropriate measures. deletion of identity of the owners.

Sensitive personal data may only be processed, without prior consent, when it is a vital emergency that requires immediate action (such as emergency medical intervention, etc.).

Third parties (Doctors, lawyers, external psychologists, etc.) will be especially careful to guarantee restricted access and maintain the security and confidentiality of sensitive personal data in their charge.

8.5 Data collected previously: Firefly Energy SAS has data whose collection is prior to the enactment of Law 1581 of 2012. Among these data are the current and essential data for carrying out the work of the Companies, as well as the inactive data resulting from concluded contractual relationships. For the continuous processing of current data, Firefly Energy SAS will obtain the express and informed consent of the owners, as long as this obligation does not represent a disproportionate burden for Firefly Energy SAS under the terms of Decree 1377 of 2013.

8.6 Revocation of authorization: The owner of the information may, at any time, revoke the authorization for the treatment or request the deletion of the information contained in the databases of Firefly Energy SAS, except when there is a legal duty or relationship. current contractual period and 5 more years from the termination of said relationship, taking into account the provisions applicable to the matter in question and the administrative, accounting, fiscal, legal and historical aspects of the information.

In any case, the Owner must indicate in his request whether it is a total or partial revocation, the latter when he only wants to eliminate one of the purposes for which the Treatment was authorized, a scenario in which the Owner must indicate the purpose that you want to delete.

9. Purposes of treatment.

The Personal Data managed by Firefly Energy SAS will be collected, used, stored, updated, transmitted and/or transferred, for the following purposes or purposes:

Regarding the Personal Data of our Clients and Suppliers:

9.1 To provide required services and products;

​ 9.2 Report changes, modifications or new products or services that are related or not to the one contracted or acquired by the Owner by any means of communication;

​ 9.3 Comply with obligations contracted with the Owner;

9.4 Evaluate the quality of the product and service, carry out market studies and statistical analyzes for internal uses and the participation of the Owners in marketing and promotional activities;

9.5 Sharing of Personal Data, including the Transfer and Transmission of Personal Data to third parties for purposes related to the operation of Firefly Energy SAS;

9.6 Carry out internal studies on compliance with commercial relations and market studies at all levels;

9.7 Carry out internal or external audit processes specific to the commercial activity that Firefly Energy SAS carries out;

9.8 Allow companies linked to Firefly Energy SAS, with which it has entered into contracts that include provisions to guarantee the security and adequate processing of the Personal Data processed, to contact the Owner with the purpose of offering it goods or services of interest. ;

​

9.9 Control access to the offices and plants of Firefly Energy SAS, including the establishment of video surveillance areas;

9.10 Respond to queries, requests, complaints and claims made by the Owners and control bodies and Transmit the Personal Data to the other authorities that, by virtue of the applicable law, must receive the Personal Data;

​9.11 Use the different services corresponding to websites, including downloads of content and formats;

9.12 Transfer the information collected to different areas of Firefly Energy SAS and related areas in Colombia and abroad when it is necessary for the development of its operations and payroll management (portfolio collection and administrative collections, treasury, accounting , among others);

9.13 Register the Holders in the Firefly Energy SAS systems and process their payments or collections;

9.14 Any other activity of a similar and/or complementary nature to those previously described that is necessary to develop the corporate purpose of the members of Firefly Energy SAS.

Regarding the Personal Data of our Collaborators and Employees:

​9.15 Develop human resources management activities within Firefly Energy SAS, such as payroll, affiliations to entities of the general social security system, occupational health and well-being activities, exercise of the employer’s sanctioning power, among others. others;

9.16 Make the necessary payments derived from the execution of the employment contract and/or its termination, and other social benefits that may be applicable in accordance with the applicable law;

​ 9.17 Contract employment benefits with third parties, such as life insurance, medical expenses, among others;

9.18 Notify authorized contacts in case of emergencies during work hours or during work;

​ 9.19 Coordinate the professional development of employees, employee access to Firefly Energy SAS IT resources and assist in their use;

​ 9.20 Plan business activities;

9.21 Transfer the information collected to different areas of Firefly Energy SAS and related areas in Colombia and abroad when this is necessary for the development of its operations and payroll management (portfolio collection and administrative collections, treasury, accounting, among others);

9.22 Control access to the offices and plants of the Companies, including the establishment of video surveillance areas;

​9.23 Conduct training;

9.24 Register the Owners in the Firefly Energy SAS systems;

9.25 Any other activity of a similar and/or complementary nature to those previously described that is necessary to develop the corporate purpose of the members of Firefly Energy SAS.

10. Rights of the Owners

The owners of the personal data and other people who, according to article 20 of Decree 1377 of 2013, are legitimate, may exercise the following rights:

• Know, update and rectify your Personal Data in front of those responsible for the Treatment or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Processing is expressly prohibited or has not been authorized.
• Request proof of the existence of the authorization, except in cases in which the Law exempts the authorization, in accordance with the provisions of article 10 of Law 1581 of 2012.
• Request and receive information about the use of your personal data.
• Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
• Revoke the Authorization and/or request the deletion of the data when the Processing does not respect constitutional and legal principles, rights and guarantees.
• The revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that in the Treatment the Controller or Processor has engaged in conduct contrary to Law 1581 of 2012 and/or the Constitution.
• Free access to your Personal Data that has been processed.

11. Person and area responsible for responding to requests, complaints or claims from information holders.

The area responsible for responding to requests for access, rectification, updating, deletion of data or revocation of consent or Authorization granted for the Processing of your Personal Data to any of Firefly Energy SAS is the Information Security area, located on Carrera 13. # 90 – 17 of the city of Bogotá D.C., Colombia, with email juridico@www.firefly-e.com

The main functions of the legal area will be to ensure the effective implementation of the policies and procedures adopted by Firefly Energy SAS to comply with the Colombian Personal Data Protection Regime, and to be responsible for the structuring, design and administration of the Comprehensive Management Program. of Personal Data.

The legal area will be responsible for:

a) Manage the appropriate processing that must be carried out for any Claim that, in accordance with the provisions of this Policy, is formulated by the Owners;

b) Verify that the information received by the Owner is sufficient to be able to respond;

c) Evaluate the need to extend the deadline to respond to the Claims;

d) Channel the claim within Firefly Energy SAS as appropriate;

e) Project the response to the Claim with support from the legal area, if necessary;

f) Send the responses to the Owners in the terms provided in the Law, in this Policy and in the Policies and Procedures Manual of Firefly Energy SAS;

g) Order the inclusion of warnings in the databases regarding claims in dispute or under judicial discussion;

h) Ensure compliance with this Policy;

i) Structure, design and manage the Comprehensive Personal Data Management Program in line with the instructions approved by the Management for this purpose;

j) Keep the Management informed of the status of progress in the implementation of the Comprehensive Personal Data Management Program, by delivering reports presenting detailed details of the activities carried out, those pending, the time in which each of them they will be carried out and the resources required for that purpose;

k) Prepare annual reports on the progress of the implementation and operation of the Comprehensive Personal Data Management Program to be presented at the General Shareholders’ Meetings of the Companies;

l) Implement a training program on Personal Data protection within Firefly Energy SAS and ensure the implementation of permanent training activities for its collaborators;

m) As part of this function, the legal area of ​​Firefly Energy SAS will supervise the training of new collaborators in the proper Processing of Personal Data and, in particular, the particular obligations that they must comply with due to their position;

n) Audit the compliance of the different areas of Firefly Energy SAS with respect to adequate compliance with the Colombian Personal Data Protection Regime, in this Policy and those derived from the implementation of the Comprehensive Personal Data Management Program;

o) Develop, with the support of the IT Area, the controls that are required to guarantee the implementation and effectiveness of the Comprehensive Personal Data Management Program and strict compliance with the obligations in charge of Firefly Energy SAS under the Colombian Protection Regime of Personal Data;

p) Coordinate and promote the definition and implementation of a Firefly Energy SAS risk management system associated with the Processing of Personal Data;

q) Coordinate and promote the definition and implementation of controls of the Comprehensive Personal Data Management Program, with the support of the IT Area;

r) Serve as a liaison and coordinate with the other areas of Firefly Energy SAS to ensure the transversal implementation of the Comprehensive Personal Data Management Program;

s) Maintain the inventory of Personal Databases of Companies permanently updated with the support of the respective areas. For this purpose, it will carry out semi-annual audits directly or with the support of the internal audit area;

t) Validate the creation of Personal Databases and register them in the National Registry of Databases of the Superintendency of Industry and Commerce;

u) Update the information in the National Registry of Databases whenever this is necessary in accordance with the applicable law; function that includes the management of security incident reports to the Superintendency of Industry and Commerce;

v) Manage contracts for the international transfer of Personal Data or manage declarations of conformity, as necessary in accordance with the National Registry of Databases, in conjunction with the Document Management Area and the legal area;

w) Respond to queries made within Firefly Energy SAS regarding the Comprehensive Database Management Program and the Colombian Personal Data Protection Regime;

x) Confirm the responsibilities of each area of ​​Firefly Energy SAS in relation to the Processing of Personal Data under their responsibility, and establish compliance indicators for periodic verification of compliance;

y) Attend visits from the Superintendency of Industry and Commerce related to the supervision of the Colombian Personal Data Protection Regime within Firefly Energy SAS.

12. Procedures so that the owners of the information can exercise their rights:

The Holders of Personal Data processed by Firefly Energy SAS have the right to access their Personal Data and the details of said Processing, as well as to rectify and update them if they are inaccurate or to request their deletion when they consider that they are excessive or unnecessary for the purposes that justified their obtaining or opposing their Treatment for specific purposes. The ways that have been implemented to guarantee the exercise of said rights through the presentation of the respective request are:

Digital mailbox: There is a digital mailbox on the institutional portal, which can be accessed through the email juridico@www.firefly-e.com by any user.

These channels may be used by the Holders of Personal Data, or third parties authorized by law to act on their behalf, in order to exercise the following rights:

12.1 Requests: The attention to requests, queries and claims from the owner of the information can be exercised at the email address juridico@www.firefly-e.com with the aim of exercising their rights to know, update, rectify and delete the data and revoke authorization. Such requests must be made in writing.

12.2 Consultations: Holders may request Firefly Energy SAS to consult their personal data free of charge. This request will be made in writing, submitted by email to the following address juridico@www.firefly-e.com, specifying the type of data you wish to consult. The person in charge will forward the query to the corresponding managers and will ensure compliance with the query deadlines.

These queries will be answered within a minimum period of 10 business days from the date of receipt and the requirements within a maximum period of 15 business days from the date of receipt. The result of the query consists of the list of all the information that is linked to the identification of the owner in the database consulted. This list is exhaustive and has no particular structure beyond the structure given by the data record.

When it is not possible to attend to the request within said term, this fact will be informed to the applicant, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case may exceed five (5) business days. following the expiration of the first term

12.3 Claims: The owners may submit a claim to Firefly Energy SAS when they consider that the information contained in a database should be corrected, updated or deleted or when it should be revoked due to the alleged breach of any of the duties contained therein. in the Law by Firefly Energy SAS, for which the claim will be processed in accordance with the following procedure:

(i) The Owner or his successors must prove his identity, that of his representative, the representation or stipulation in favor of another or for another. When the request is made by a person other than the Owner and it is not proven that the request is acting on behalf of the Owner, it will be considered not submitted.

(ii) The claim for rectification, updating, deletion or revocation must be submitted in writing, via emailjuridico@www.firefly-e.com.

(iii) The claim must contain a clear and precise description of the Personal Data with respect to which the Owner seeks to exercise any of the rights, as well as the reasons for the claim and, if applicable, the claim must be accompanied by documentation. to prove the claim. If the claim is incomplete, the interested party will be required to correct the deficiencies within five (5) days following receipt of the claim. After two (2) months from the date of the request, without the applicant presenting the required information, it will be understood that he has withdrawn the claim.  Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the Database within a period of no more than two (2) business days. Said legend must be maintained until the claim is decided. 

(iv) The maximum term to address the request or claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to attend to the request within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their request will be attended to, which in no case may exceed eight (8) business days following the expiration of the first term. 

(v) In the event that Firefly Energy SAS is not competent to resolve the claim, it will notify the appropriate party and inform the claimant of the situation within 5 business days following receipt of the claim.

First Paragraph. Rectification and updating: When the claims are intended to be rectified or updated, the Owner must indicate the corrections to be made and adopt the documentation that supports his request. 

Second Paragraph. Deletion: The deletion of Personal Data is carried out by deleting all or part of the personal information as requested by the Owner. However, Firefly Energy SAS may refuse it when the Owner has a legal or contractual duty to remain in the Database.

13. International and national transmissions of data to processors: Firefly Energy SAS, in carrying out tasks that derive from its binational nature and its international cooperation links with other countries, may transfer personal data to third countries.

Without exception, the transfer of this data is due to defined purposes, related to or derived from the work of Firefly Energy SAS and its improvement. It is only carried out when there is the corresponding authorization from the owner and, if necessary, when responding to requests from public or administrative entities in the exercise of their legal functions.

14. Duties of Firefly Energy SAS as controller of personal data:

In accordance with Law 1581 of 2012, and without prejudice to the other provisions provided on the protection of personal data, Firefly Energy SAS as the data controller must comply with the following duties,  

a) Guarantee to the Holder, at all times, the full and effective exercise of the right of habeas data;

b) Request and keep, under the conditions provided in this law, a copy of the respective authorization granted by the Owner;

c) Duly inform the Owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted;

d) Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access;

e) Guarantee that the information provided to the Data Processor is true, complete, exact, updated, verifiable and understandable;

f) Update the information, communicating in a timely manner to the Data Processor, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it remains updated;

g) Rectify the information when it is incorrect and communicate the pertinent information to the Data Processor;

h) Provide the Data Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of this law;

i) Demand that the Data Processor at all times respect the security and privacy conditions of the Owner’s information;

j) Process queries and claims formulated in the terms indicated in this law;

k) Adopt an internal manual of policies and procedures to guarantee adequate compliance with this law and, especially, to respond to queries and complaints;

l) Inform the Data Processor when certain information is under discussion by the Owner, once the claim has been submitted and the respective process has not been completed;

m) Inform at the request of the Owner about the use given to their data;

n) Inform the data protection authority when violations of security codes occur and there are risks in the administration of the Owners’ information.

o) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

15. Modifications to the Policy.

We reserve the right to make modifications or updates to this Policy at any time. However, these modifications will be available to the public through the website https://www.firefly-e.com/politica-de-datos-personales.  If the changes refer to the authorized purposes, we will proceed to obtain a new authorization for the processing of the data from the owners.  

16. Policy Consultation.

The Personal Data Protection Policy must be announced, presented and available on the official site “https://www.firefly-e.com/politica-de-datos-personales”, presenting easy consultation and access by the public in general.

17. Confidentiality and security of databases.

Firefly Energy SAS will apply the best practices for the security, discretion, protection, storage and confidentiality of the Personal Data of the owners. It will verify, when appropriate, the origin of legal exceptions to deliver personal data to the authorities and in pertinent cases. 

18. Commercial data processing.

Firefly Energy SAS will process the commercial data and financial information that it considers necessary for the fulfillment of its corporate purpose and for any conclusion of contracts with third parties. Their data will be treated with privacy, rights to privacy, the good name of the people, within the process of processing personal data, and during all activities that will have the principles of confidentiality, security, legality, access, freedom and transparency. 

For this purpose, the signing of the Confidentiality Agreement for the delivery of Data with all suppliers is regulated. 

19. Data processing of direct employees of the company.

All data provided by Firefly Energy SAS employees will be stored, compiled, used, shared, consulted, transmitted, exchanged and transferred, to comply with the obligations derived from the employment relationship and the exercise of rights as an employer. 

All information related to employees or former employees of Firefly Energy SAS will be kept so that the Company can fulfill its obligations as an employer and exercise the rights that correspond to it in that same condition, in accordance with Colombian labor legislation. .  

Upon entry to Firefly Energy SAS of new employees with an employment contract, it is a requirement that, at the start of their assigned work, they declare that they know, accept and apply the Personal Data Protection Policies. 

To complete the hiring process of a new Firefly Energy SAS employee, it is necessary to guarantee the employee’s acceptance of this policy. 

20. Treatment of photos as personal data

Firefly Energy SAS may use photographs as long as there is prior, express and informed authorization where the purpose of the use of the photographs is determined, in compliance with the provisions of Law 1581 of 2012. 

In the event that the owner of the data for the photographs is a minor, the provisions of article 20 of this Policy must be taken into account. 

21. Social networks.

Social networks such as Facebook, Instagram, WhatsApp and Twitter constitute complementary platforms for the dissemination of information (communication), which are highly interconnected with users’ digital media and are not under the responsibility of Firefly Energy SAS because they are foreign to it. 

All the information that users provide on the social networks in which Firefly Energy SAS participates as a user does not constitute or form part of the Personal Data subject to the protection of this Policy, being the total responsibility of the company that provides that platform.