Personal Data Processing Policy

1. Data Controller

GIRALDO VELASCO ABOGADOS S.A.S., identified with NIT 900.931.438-9, domiciled in Santiago de Cali, with address at Carrera 3 No. 7-75, Edificio Alcalá, is the data controller responsible for processing the personal data submitted through this website.

Data subjects may contact analuisagiraldo@giraldovelascoabogados.com or call 310 846 3568 to submit inquiries, complaints, or requests related to the processing of their personal data.

2. Data Collected

Through the contact form, the following data is collected:

• Full name.
• Email address.
• Phone number, when provided.
• Area of interest.
• Content of the message submitted by the data subject.

The form is not designed to request sensitive data. Accordingly, it is recommended not to include information related to health, political opinions, religious beliefs, union membership, sexual life, biometric data, or other sensitive data, unless strictly necessary for the inquiry and the corresponding authorization has been obtained.

3. Purposes of Processing

The personal data collected will be processed for the following purposes:

• Receiving, recording, and managing inquiries and requests for legal advice submitted through the website.
• Contacting the data subject to respond to and follow up on their request.
• Sending internal notifications regarding the receipt of requests.
• Evaluating the possibility of establishing a professional or contractual relationship.
• Managing the relationship with clients when legal services are engaged.
• Complying with legal, contractual, accounting, administrative, and information security obligations.
• Handling inquiries, complaints, and requests related to the processing of personal data.

Submitting the form does not, by itself, constitute the execution of a legal services agreement or the automatic establishment of an attorney-client relationship.

4. Authorization for Processing

Processing is carried out based on the prior, express, and informed authorization granted by the data subject by checking the acceptance box provided on the contact form, in accordance with Ley 1581 de 2012.

The authorization may be retained through electronic means that allow its subsequent consultation.

Authorization will not be required when any of the exceptions expressly established by law is present.

5. Rights of Data Subjects

Data subjects have the right to:

• Know, update, and rectify their personal data.
• Request proof of the authorization granted, except where this requirement is legally exempted.
• Be informed about the use given to their personal data.
• Submit inquiries and complaints related to the processing of their information.
• Revoke the authorization or request the deletion of the data when the constitutional and legal principles, rights, and guarantees are disregarded, unless a legal or contractual duty requires that the data be retained.
• Access, free of charge, the personal data that has been subject to processing.
• File complaints with the Superintendencia de Industria y Comercio once the consultation or complaint procedure before the controller or processor has been exhausted.

6. Department Responsible for Handling Inquiries and Complaints

The Legal Department of GIRALDO VELASCO ABOGADOS S.A.S. will be responsible for handling the inquiries, complaints, and requests through which data subjects exercise their rights to know, update, rectify, or delete their personal data, request proof of the authorization, learn about the use given to their information, or revoke the authorization.

Requests must be sent to analuisagiraldo@giraldovelascoabogados.com.

7. Procedure for Inquiries

The data subject, their successors, representatives, or attorneys-in-fact may consult the personal information held in the databases of GIRALDO VELASCO ABOGADOS S.A.S.

The request must allow for the identification of the data subject and indicate a physical or electronic address to receive the response.

Inquiries will be addressed within a maximum term of ten (10) business days from their receipt. When it is not possible to address them within this term, the reasons for the delay and the date on which they will be resolved will be communicated, which may not exceed the five (5) business days following the expiration of the initial term.

8. Procedure for Complaints

When the data subject or their successors consider that the information should be corrected, updated, or deleted, or become aware of a suspected breach of the personal data protection regulations, they may file a complaint with the Legal Department.

The complaint must contain:

• The identification of the data subject.
• A clear description of the facts giving rise to the complaint.
• Contact details to receive the response.
• Any supporting documents to be relied upon, where applicable.

If the complaint is incomplete, the interested party will be requested to correct the information within the five (5) business days following its receipt. If two (2) months elapse from the request without the requested information being submitted, the complaint will be deemed withdrawn.

When GIRALDO VELASCO ABOGADOS S.A.S. is not competent to resolve the complaint, it will forward it to the appropriate party within the following two (2) business days and will inform the interested party of this circumstance.

Once the complete complaint is received, an annotation stating “complaint in process” and the corresponding reason will be included in the database within a maximum term of two (2) business days. This annotation will remain until the complaint is resolved.

The complaint will be addressed within a maximum term of fifteen (15) business days from the day following its receipt. When it is not possible to resolve it within this term, the reasons for the delay and the response date will be communicated, which may not exceed the eight (8) business days following the expiration of the initial term.

9. Information Security

GIRALDO VELASCO ABOGADOS S.A.S. adopts reasonable administrative, technical, and organizational measures to protect personal data against loss, misuse, unauthorized consultation or access, alteration, disclosure, or destruction.

Access to the information is limited to authorized personnel and to technology providers that must process it in order to provide hosting, storage, form management, notification, and email services, subject to obligations of security, confidentiality, and processing in accordance with the instructions of GIRALDO VELASCO ABOGADOS S.A.S.

No electronic transmission or storage system can guarantee absolute security. In the event of an incident that could compromise personal data, the management and reporting measures established under Colombian regulations will be applied.

10. Transmission of Data to Technology Providers

GIRALDO VELASCO ABOGADOS S.A.S. does not sell or provide the personal data collected to third parties for commercial purposes.

To operate the contact form, store requests, generate notifications, and manage email, data may be transmitted to technology providers acting as data processors on behalf of GIRALDO VELASCO ABOGADOS S.A.S.

Processors may only process the information to provide the contracted services, in accordance with the instructions given by the controller and subject to obligations of security, confidentiality, and personal data protection.

Some providers may process or store information using infrastructure located outside Colombia. Where a domestic or international transmission of personal data occurs, GIRALDO VELASCO ABOGADOS S.A.S. will adopt the contractual and legal measures required by Colombian law to ensure that the processor complies with the processing conditions established by the controller.

11. Cookies

This website uses cookies necessary for its operation and other technologies in accordance with the conditions described in the Cookie Policy.

12. Validity and Retention of Information

This policy takes effect on September 4, 2026.

The databases will remain in effect for the reasonable time necessary to fulfill the authorized purposes. Data will be retained while the request is being handled, while a contractual or professional relationship exists, or while legal, accounting, administrative, evidentiary, or legal defense obligations must be met.

Once the purposes have been fulfilled and provided there is no legal or contractual duty of retention, the information will be securely deleted or anonymized.

13. Modifications

This policy may be modified to reflect regulatory, technological, or personal data processing practice changes.

When substantial changes related to the identification of the controller or the purposes of processing are introduced, these will be communicated to data subjects in a timely manner through an appropriate means before their implementation and, when necessary, new authorization will be requested.