Privacy Policy applicable to the website www.reforestpeace.org

In accordance with the Colombian data protection regime contained in Law 1581 of 2012, and Decree 1377 of 2013 along with other regulations that complement, modify or add on to them, this privacy policy (hereinafter “The Policy”) establishes the way in which the owners of the website reforestpeace.org (hereinafter “RP”), domiciled in Colombia, with email [email protected], collects and processes your personal data (hereinafter “Personal Data”) through the website [www.reforestpeace.org] (hereinafter “web page”)).

1. Personal data collected, purpose of collection and processing

RP may collect, through its website, Personal Data from people who access it without being registered (“unregistered users”) and from people who carry out the registration process, either as a potential donor (“donor”) or as a prospective purchaser (“Buyer”) (collectively “Registered Users”).

RP may collect, through the use of cookies (a cookie is defined as a data package that a browser stores on the user’s computer when the user enters the web page, in order to identify past user activity and facilitate future navigation on said page), the following Personal Data, both of non-registered users and registered users: IP address, browsing history, previous selections and other data that will be collected through cookies.

RP may collect the following Personal Data from registered users: name, date of birth, identification number, marital status, sex, email address, home address, residence address, phone numbers, and financial information. Additionally, RP may collect information on the farm(s) that the donor registers and that can be directly linked to the donor; this information includes the name of the land, its location, commercial value, information about the ownership of the land, boundaries, area, purchase dates, forest characteristics, and cadastral information.

RP collects and treats your Personal Data to comply with the services offered through its website www.reforestpeace.org, for the normal development of its corporate purpose and the ordinary course of its business, as well as to comply with the legal and contractual obligations that it has acquired with its clients. The purposes for which RP processes your Personal Data are the following:

  1. 1.1  Allow the correct functioning of the web page enabled by RP.
  2. 1.2  Allow the use of secure areas, personalized options and to remember previous selections within the web page enabled by RP.
  3. 1.3  Carry out analysis and studies on the use, navigation and performance of the website, in order to improve its operation.
  4. 1.4  Create navigation profiles.
  5. 1.5  Know and obtain information on the properties with a forestry vocation that are available for sale.
  6. 1.6  Advertise on your website the properties with a forestry vocation that are available for sale.
  7. 1.7  Maintain contact with their clients in the development of the commercial relationship that exists between them and RP.
  8. 1.8  Verify and corroborate the veracity of the information provided by customers.

Privacy Policy applicable to the website www.reforestpeace.org

1

  1. 1.9  Check the background of users, including verifications in the Clinton List and in the Office of Foreign Assets Control (OFAC for its acronym in English).
  2. 1.10  Carry out credit studies on the properties registered on its website.
  3. 1.11  Transmit Personal Data to third parties so that they carry out due diligence processes.
  4. 1.12  Provide information and/or answer questions regarding the services offered by RP to its clients.
  5. 1.13  Put potential buyers and potential donors in contact with each other for planting in properties with protective forest vocation.
  6. 1.14  Carry out studies and statistical analysis, marketing activities, promotion, offering of RP services or companies with which it has or maintains commercial relations.

Third parties may be involved in the commercial activities carried out by RP. Therefore, the client or user accepts and expressly authorizes RP to transfer and make available to its business partners and suppliers in Colombia and abroad the Personal Data of its clients or users.

2. Rights of the holders of Personal Data

In accordance with article 8 of Law 1581 of 2012, the holders of Personal Data that are processed by RP have the following rights:

  1. 2.1  Know, update, and rectify your Personal Data before RP. This right can be exercised, among others, against information that is partial, inaccurate, incomplete, divided, misleading information or whose treatment is prohibited or has not been authorized.
  2. 2.2  Request proof of the consent granted to RP for the collection and processing of your Personal Data.
  3. 2.3  Have free access to your Personal Data that is subject to treatment by RP, and in general, be informed of the treatment that RP is giving to your Personal Data. For this, it is important that the procedures established in section 5 of this Policy are met.
  4. 2.4  Revoke the authorization granted to RP and/or request the deletion of their Personal Data when clients consider that RP is not respecting the constitutional and legal principles, rights and guarantees. In these cases, RP will inform you about the implications that the revocation of the authorization or the deletion of your Personal Data from the database may have.
  5. 2.5  If the owner of the Personal Data is not satisfied with the way in which RP treats his Personal Data or has any complaint or claim, he may submit a communication to the RP data protection officer by email [email protected].
  6. 2.6  If the RP data protection officer does not resolve the concerns or does not address the complaints made, the holders of personal data can contact the Superintendence of Industry and Commerce to present their concerns, complaints or claims if they consider that RP has violated their rights. of habeas data or the provisions of Law 1581 of 2012, Decree 1377 of 2013 and other regulations that modify, add, or complement them.

Privacy Policy applicable to the website www.reforestpeace.org

2

3. Persons or area responsible for responding to queries, requests or claims related to the processing of your Personal Data

If you have questions, queries or claims related to your Personal Data, you can contact the Data Protection Officer from RP to the email [email protected]. The holders of Personal Data can exercise their right to know, update, rectify or delete their Personal Data and revoke the consent granted to RP for the treatment of their Personal Data before this person or area.

4. RP security measures regarding the Personal Data processed

RP takes effective, appropriate, and reasonable measures to protect the Personal Data for which it is responsible, against loss, misuse, unauthorized access, disclosure, alteration and destruction of these.

5. Procedure for the holders of Personal Data to exercise their rights

Any question or query regarding the Personal Data collected and processed by RP will be received by the RP Data Protection Officer. For this, you must send a written description of your inquiry to [email protected]

The RP Data Protection Officer will resolve the questions or queries within fifteen (15) business days following the date the question or query is received. If it is not possible for the RP Data Protection Officer to respond to the claim within the term, the RP Data Protection Officer will let you know the situation and explain the reason for the delay. In any circumstance, the RP Data Protection Officer will respond within ten (10) business days following the expiration of the term of the initial fifteen (15) business days.

The consent granted to RP may be revoked at any time, by prior, written and signed notice addressed to the RP Data Protection Officer, at the electronic address, in the terms established by Law.

If the owner of Personal Data considers that the information contained in the database of RP is subject to correction, update or deletion or if you believe that RP is not complying with its obligations established in Law 1581 of 2012, the owner of the Personal Data must submit a complaint to RP, addressed to Data Protection Officer, which will be treated in accordance with the procedure established in article 15 of Law 1581 of 2012.

6. Effective date of the Policy and expiration date of the database

This privacy policy will come into effect with the public launch of the web page www.reforestpeace.org and your Personal Data will remain in the RP database until they fulfil the purpose for which they were collected or at the end of the period of time established when there is a legal provision.