TENNIS FILA DISRUPTOR II LAB BLACK/FRED/BLACK 1FM00705-014 (2023)

1. RESPONSIBLE FOR TREATMENT: BIGFOOT COLOMBIA S.A.S, a company legally incorporated under the laws of Colombia and headquartered in the city of Bogotá D.C. and identified with the NIT. 900.469.230-6 (hereinafter “DAFITI” or “Responsible”).

2. GENERAL DESCRIPTION: DAFITI,In accordance with the provisions of the Political Constitution of Colombia, Law 1581 of 2012, Decree-Law 1377 of 2013, Decree 1074 of 2015 and other complementary provisions, adopts the following personal data processing policy, which will be applied byDAFFITISin everything related to the collection, conservation, use, disclosure, cancellation and, in general, with all the different activities that constitute or may constitute processing of personal data, in accordance with the legislation in force.

3. THE DEFINITION:For the application of the provisions of this Policy, the following is understood:

Trade allies:

Any individual or legal entity that advertises, offers or markets its own or third-party products and/or services with whichDAFFITISmaintains a commercial relationship for the development and breadth of its portfolio.

To allow:

Prior, express and informed consent of the Holder to carry out the processing of Personal Data in accordance with this Personal Data Processing Policy.

Authorized:

Refers to all persons who, under the responsibility of the company or those in charge, may process personal data.

Note on data protection:

Oral, written or broadcast communications through current technological means, prepared by the person in charge or a third party designated by him for the purposes and addressed to the holder for the processing of his personal data, through which he will be informed of the existence of the policies applicable to the processing of personal data, the way in which they are accessed and the purposes of the treatment to be given to the personal data provided.

Data base:

Indicates the organized set of personal data subject to processing, whether electronic or not, whatever the method of formation, storage, organization and access. (hereinafter referred to as "Databases")

Advice:

It means the request of the holder of the personal data, of the persons authorized by him or of the legal authorities to know the information that about him is stored in the databases of the controller.

Personal information):

Any information that is linked or may be linked to one or more identified or identifiable natural persons. For the purposes of this Policy, the following Personal Data shall include, but are not limited to: first name, last name, age, gender, marital status, email address, mailing address, identification number, date of birth, telephone number and profession (hereinafter the “Personal Data”).

Private data:

These are data that, due to their confidential or reserved nature, are only relevant to the holder.

Useful data:

Sensitive data means those that compromise the privacy of the holder or whose misuse can lead to discrimination, such as promoting the interests of a political party or guaranteeing rights and guarantees of opposition parties, as well as data related to health, sex life and biometric data. (hereinafter "sensitive data").

Head of treatment:

It is the natural or legal person who processes personal data based on delegation, making them responsible and receiving instructions on how to manage the data (hereinafter “manager”).

Claim:

It refers to requesting the holder of personal data or persons authorized by him or by law to correct, update or delete his personal data, or to notify him that there is an alleged violation of the data protection regime.

Responsible for the treatment:

Natural or legal person governed by public or private law who, alone or jointly with others, decides on the purpose of the databases and/or their treatment. (advance"Dafit"or the “Responsible”).

Titular:

It is the natural person whose personal data are being processed.

Transfer:

This is the operation carried out by the person responsible or responsible for the processing of personal data when sending the information to another national or international recipient, who in turn becomes responsible for this data.

Streaming:

Processing of personal data involving their transfer, within or outside the territory of the Republic of Colombia, when the purpose is to carry out processing by the manager on behalf of the person responsible.

Processing of personal data:

Any operation or series of operations involving personal data, such as B. Collection, storage, use, disclosure or deletion. Treatment can be national or international. (hereinafter the “Treatment”)

4. PRINCIPLES: DIFFICULTIESwill define its personal data processing policy taking into account the following principles:

purpose principle:

The processing of personal data must serve a legitimate purpose in accordance with the political constitution of Colombia and the law, which must be communicated to the holder.

Freedom Principle:

The treatment can only be carried out with the prior, express and informed consent of the owner. Personal data cannot be obtained or disclosed without prior authorization or in the absence of a legal or judicial order that exempts consent.

Principle of veracity or quality:

The information to be processed must be true, complete, accurate, current, verifiable and understandable. The processing of partial, incomplete, fragmentary or misleading data is prohibited.

Principle of transparency:

The processing must guarantee the right of the holder to obtain, at any time and without limitation, information about the existence of data concerning him.

Principle of restricted access and distribution:

Personal data, except public information, cannot be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide limited knowledge only to the owner or third parties authorized under the law.

Safety principle:

The information to be processed must be treated with the necessary technical, human and administrative measures to guarantee the security of the records and prevent their falsification, loss, inspection, unauthorized or fraudulent use or access.

Principle of confidentiality:

All persons involved in the processing of personal data are obliged to ensure the confidentiality of the information even after the end of their relationship with one of the tasks involving the processing, and may only provide or transfer personal data if this corresponds to the development of activities that are expressly allowed by law.

Data processing policy:

Refers to the terms contained in this Data Processing Policy. (hereinafter the “Policy”)

5. PROCESSING AND PURPOSE OF COLLECTING PERSONAL DATA:

5.1 DIFFERENCE

will process personal data to carry out the activities of its corporate purpose, all in accordance with the provisions of Law 1581 of 2012, Decree-Regulation 1377 of 2013, Decree 1074 of 2015 and other complementary provisions. The treatment can be carried out through electronic, physical, automated means and/or using known or still known digital means, which may vary depending on the way in which the information is collected.

5.2

the purpose for whatDAFFITIScollects, stores, uses, cleans, analyzes, processes, discloses, transmits or transmits, directly or indirectly, Personal Data of the Holder, is:

i) The proper development of its corporate purpose, including the use of data for the implementation of the existing contractual, commercial or commercial relationship with its customers, contractors, suppliers, allies, users, employees and third parties.

ii) advertise its services and products and those of its affiliates, affiliates, subsidiaries, third party business partners and their allies.

iii) transfer or send your personal information to affiliates, affiliates, subsidiaries and third party business partners and their allies who need the information for the purposes described herein.

iv) Achieve efficient communication about its products, services, studies, offers, as well as its affiliates, subsidiaries, related parties, third-party business partners and their allies, in order to facilitate general access to the information collected.

v) send advertising, promotional and marketing information of its own, its affiliates, affiliates, subsidiaries, third-party commercial allies or its allies through any means of communication created or to be created; the implementation of a global marketing strategy aimed at promotional and promotional events for its products, services, offers, promotions, invitations, discounts, prizes, loyalty programs, campaigns, sweepstakes and others.

vi) Disclosure of information to third parties or business partners with which BIGFOOT COLOMBIA S.A.S. are in a contractual relationship and their delivery is necessary to fulfill the object of the contract.

vii) contact, manage procedures (PQRs) and carry out quality assessments of products and services and, more generally, update data and other marketing and administrative activities necessary for the full development of its corporate purpose, as well as its affiliates and parties related, affiliated, third-party business partners or their allies.

viii) Denunciation of new products or services related to the development of the corporate purpose of the Company, its affiliates, affiliates, subsidiaries, third-party commercial partners or their allies.

ix) disclosure, transfer and/or transfer of personal data within and outside the country to the parent companies, affiliates or subsidiaries ofDAFFITISor to third parties by virtue of contract, law or legal relationship that requires it, or to implement storage or computing services in the "Cloud".

x) Conducting internal studies on consumption habits.

xi) order, classify or separate the information provided; as well as verify, confirm, validate, examine and compare the information provided by the Holder with all information obtained legally.

xii) Security and improvement of the service and experience of the Holder through the Portal.

xiii) Carry out the necessary tax, accounting, tax and invoicing procedures.

xiv) Fulfill the contractual obligations ofPIE GRANDE KOLUMBIEN S.A.S.with the holder of information regarding the payment of wages, social benefits and other remuneration provided for in the employment contract or provided for by law (in the case of employees of the organization).

First paragraph:The personal data provided by the Holder will be treated and used only for the purposes provided herein and for a period from the moment the authorization is granted until the period established for the company's term.PIE GRANDE KOLUMBIEN S.A.S.

Second paragraph:The information provided by the Holder may be shared with agencies, information managers, service providers, business partners, their allies and third parties in general that provide servicesDAFFITISor to third parties in the name and on behalf ofDAFFITIS

Third paragraph: DAFITIdoes not request or carry out any processing of sensitive data.

Fourth paragraph: DAFITIguarantees that the mechanisms through which personal data are used are safe and confidential, having computer security mechanisms and the appropriate technological means to ensure that they are stored in order to prevent unwanted access by third parties.

6. APPROVAL:The collection, storage, use, purification, analysis, disclosure, transmission or transfer, disclosure or deletion of personal data byDAFFITISalways requires the prior, express and informed consent of the owner. According to current legislation,DAFFITISimplemented the following mechanisms to obtain authorization or ratification from the holder of personal data:

6.1The authorization may consist of a physical, electronic or any other document that guarantees subsequent consultation, or through an appropriate technical or technological mechanism that allows verifying that the Holder has given his authorization for the storage of his data in our database. For these purposes, authorization means authorization granted through technological mechanisms such as B., but not limited to, a “click” to accept our Terms and Conditions and Personal Data Processing Policy at the time you enter your data for sending emails, electronically or “newsletters”; Filling out forms on the websitewww.dafiti.com.coand/or by subscribing through third party applications such as but not limited to Facebook, Instagram or LinkedIn.

6.2This approved authorization procedure expressly guarantees that the holder of the personal data knows and accepts thisDAFFITIScollects, stores, uses, cleans, analyzes, distributes, transmits, transmits, updates or deletes the information as required by law for the purposes communicated to you prior to the granting of authorization and for the purposes contained herein.

6.3Permission requested byDAFFITISAt a minimum, the following will be established: (i) Full identification of the individual from whom Personal Information is collected; (ii) the authorization referred to in clause 7.2 above; (iii) the purpose of processing personal data and; (iv) The right to access, rectify, update or delete the personal data provided by the Holder.

6.4It is the responsibility ofDAFFITIStake the necessary steps to keep a record of when and how authorization was obtained from holders.

6.5The holders of personal data may, at any time and without limitation, request the deletion of their data and/or revoke the authorization granted for their treatment.

6.6From the data obtained before the adoption of Decree 1,377 of 2013, d. H. on June 27, 2013, an email will be sent to all individuals about whom DAFITI has personal data to inform them about the implementation of the data processing policy. Personal informationDAFFITISand how to exercise your rights. This email contains the privacy policy, which contains at least: i) Name or corporate name and contact information ofDAFFITIS. ii) The access mechanisms through which the holder can access the data registered in the databaseDAFFITIS, in which the personal data processing policy ofDAFFITISand the main changes that occur in it.

If the Holder has not responded or communicated in any way within 30 (thirty) business days from the date of sending the notificationDAFFITISTo request the deletion of your personal data, you can continue processing the data.

Likewise, and to ensure that the privacy policy reaches all employees, suppliers, customers, users and third parties related in any way to DAFITI, it is published on the website:www.dafiti.com.co

UNIT VOLUME:will be the obligationDAFFITISand, in particular, the marketing area, to keep records and support any authorizations issued by the Holder or, failing that, to send the communication referred to in this article. All supports must be available at all times while the processing of personal data is being carried out and five (5) years thereafter. for storageDAFFITISmay use computer, electronics or other technology.

7. TRANSFER AND INTERNATIONAL TRANSFER OF DATA:The owner authorizesDAFFITIScarry out the international transfer or transfer of personal data, ensuring an adequate level of protection and compliance with the requirements set out in Law 1581 of 2012 and its regulations; also authorizedDAFFITISto carry out the international transfer and/or transfer of personal data to one or more managers within or outside the national territory for the processing of personal data, in accordance with the provisions of Law 1581 of 2012 and its regulations.

8. RIGHTS OF THE INFORMATION HOLDERThe holder of personal data has the following rights:

Know, update and correct your personal information againstDAFFITIS. This right can be exercised, inter alia, against partial, inaccurate, incomplete, fragmentary, misleading data or whose processing has been expressly prohibited or unauthorized;

If necessary, request proof of the power of attorney grantedDAFFITIS.

be informed byDAFFITISor the controller regarding the use of your personal data;

Presentation of complaints to the Inspection of Industry and Commerce for violation of the provisions of Law 1581 of 2012, after exhausting the complaints procedure provided for in the Personal Data Processing Policy;

Revoke the authorization and/or request the deletion of personal data when the treatment does not respect the constitutional and legal principles, rights and guarantees. Likewise, if the Inspectorate of Industry and Commerce finds that the directors or managers have practiced conduct contrary to this Law and the Constitution, the revocation and/or suppression will occur.

Free access to your processed personal data.

9. DAFITI OBLIGATIONS:As responsible for the processing of personal data,DAFFITISits contractors and employees undertake to comply with the following obligations:

Guarantee the holder of the information the full and effective exercise of the right of habeas data at all times.

Keep a copy of the notice and any permission given by the owner.

Adequately inform the owner of the purpose of the collection and the rights that underpin it based on the permission granted.

Keep the information in the security conditions necessary to prevent its falsification, loss, consultation, unauthorized or fraudulent use or access.

In case of disclosing and/or updating information to a treatment manager, make sure that the authorization given by the holder is sufficient and that the information itself is true, complete, accurate, up-to-date, verifiable and understandable.

Process the Owner's queries and complaints in accordance with the terms of this manual and the DAFITI Policy on the processing of personal data.

Correct the information if it is incorrect.

Deal with the Owner's requests and complaints in accordance with the terms of this Personal Data Processing PolicyDAFFITIS.

If requested by the holder, inform about the use of your data.

Inform the data protection authority in case there are violations of security codes and risks in the management of data subjects.

Follow the instructions and requirements of the labor inspection.

Comply with other provisions of law and regulations.

If necessary, enter the comment "Claim in progress" in the database.

Insert the caption “Information on hearing” in the database once the competent authority has informed about legal proceedings related to the quality of personal data;

Refrain from disclosing information contested by the holder and whose blocking has been decreed by the Inspection of Industry and Commerce;

Grant access to information only to those who can have access to it;

Check the website ofDAFFITISthe new mechanisms it implements so that data subjects can exercise their rights, as well as any changes to the personal data processing policy.

In compliance with the express prohibition of article 12 of Decree 1,377 of 2013,DAFFITISrefrains from collecting personal data of children and young people in its databases.

10. RESPONSIBLE AREA AND PROCEDURES FOR THE EXERCISE OF THE HOLDER'S RIGHTS:The Owner, its representative or legal successor may submit requests, requests and/or claims at any time and free of chargeDAFFITISKnow, update, rectify, request the deletion and/or revoke the authorization of your personal data. Therefore, it is the responsibility of the entire team of direct and indirect employeesDAFFITIS, complying without exception with the Information Handling Policy and, in particular, paying due attention to the requests, claims and complaints that the Holder presents to the Company for this concept.

In order to exercise their rights, the owner or whoever acts on his behalf and on his behalf may previously submit their petitions, claims and/or complaintsDAFFITISIn the following way:

i) By email: info@dafiti.com.co

ii) Telephone: 508 2244 in Bogota 018000 942 434 nationally

iii) Written communication electronically through the website ofDAFFITIS.

The area responsible for managing and processing the databases, depending on the case, is always responsible for the Customer Support Department, responsible for handling the Holder's requests, complaints and claims, for the exercise of their rights.

Inquiries, requests, complaints or claims (PQR) received in writing, by email, electronically, by telephone or orally will be processed according to the following procedure:

ADVICE:The main demand is the consultation, that is, the holder's personal data, which are dormant in the database of theDAFFITIS, the procedure will be as specified here:

The query is formulated by filling in the PQR formatsDAFFITISincluded on the website or by email: info@dafiti.com.co.

Upon receipt of the request, the Holder must respond within 10 (ten) business days from receipt of the request.

If it is not possible to process the request within this period, the Holder will be notified, informing the reasons for the delay and the date on which the request will be answered, which cannot exceed 5 (five) business days after the end of the first term.

CLAIM:If the main claim is a claim, that is, if the holder considers that the data contained in the databases of theDAFFITISneeds to be corrected, updated or deleted, or if it detects a violation of any of the obligations contained in Law 1581 of 2012DAFFITIS, the procedure will be as specified here:

(i) The complaint is made by means of a request addressed to the person responsible or responsible for the information, with the identification number of the holder, a description of the facts that justify the complaint, the address and the documents considered necessary.

(ii) If the Claim is incomplete, the Rightholder, or a person acting on its behalf, must correct the errors within five (5) business days of receipt of the Claim.

(iii) If, after 2 (two) months from the date of the request for rectification, the holder or whoever does so does not provide the required information, it is considered that the claim has been withdrawn.

(iv) Once a claim is received with all the requirements, it must be entered into the database within no more than two (2) business days, marked with a caption that says "Claim Pending" and the reason is this. This caption must be maintained pending a decision on the claim.

(v) If, after 2 (two) months have elapsed from the date of the request for rectification, the holder or whoever in that capacity does not provide the required information, the complaint is deemed to have been withdrawn.

(vi) The maximum period for processing the complaint is 15 (fifteen) business days from the day following receipt. If it is not possible to process the complaint within this period, the affected party will be informed of the reasons for the delay and the date on which their complaint will be processed, which cannot exceed eight (8) business days after the Expression period.

(vii) StayDAFFITISreceives a complaint and is not authorized to resolve it, it will, where possible, forward it to the appropriate person within a maximum period of 2 (two) business days and inform the affected party of the situation.

(viii) If the request is made by a person other than the Holder and it is not proven that he or she is acting on behalf of the Holder, it will be deemed not to have been made.

11. CORRECTION, UPDATE AND DELETION OF PERSONAL DATA:Pursuant to clause 10 above,DAFFITISrectify, update or delete, at the request of the holder, any type of information in accordance with the procedure and conditions indicated in the previous article. In case of correction and/or update, the proposed corrections must be duly justified.

unit volume:The holder of the information has the right, at any time, to request the total or partial erasure of his personal data and for this purpose the procedure set out in point 10 above will be followed.DAFFITISYou can only refuse deletion if: i) the holder is legally and/or contractually obliged to remain in the database; ii) the deletion of data harms ongoing judicial or administrative proceedings and; iii) In other cases provided for in article 10 of Law 1,581 of 2012, as the case may be.

12. INFORMATION SECURITY MEASURES: DAFITItake the necessary technical, human and administrative measures to protect records and prevent their corruption, loss, interrogation, unauthorized or fraudulent use or access; These measures comply with the minimum requirements of the legislation in force.

13. NAME: DAFITIdesignates the Customer Service Department or the person who acts in its place to fulfill the function of protecting personal data and process the requests of the Holders to exercise the rights of access, consultation, rectification, update, cancellation and revocation under the terms of the Law 1581 of 2012, Decree 1377 of 2013 and the Personal Data Processing PolicyDAFFITIS

14. VALIDITY:This Personal Data Processing PolicyDAFFITISIt is valid for a period equal to that specified in the Articles of Association for the duration of the Company or its renewals.

Likewise, we remind you that you have the right to know, update, rectify and request the deletion of your personal data at any time, for which we ask you to send your choice to the email account above or through the website to sharewww.dafiti.com.co

The databases in which personal data are registered have a validity corresponding to the time in which the information is kept and used for the purposes described in this policy. Once these purposes have been fulfilled and provided that there are no legal or contractual storage obligations, your data will be deleted from our databases.

Carefully,

PIE GRANDE KOLUMBIEN SAS