Ayvens and Privacy

Ayvens is a provider of mobility services, including operational vehicle leasing, fleet management and remarketing activities. This privacy policy explains our practices with respect to the personal data of users of our carmarket.ayvens.com ("you").

We respect your privacy and therefore we process your personal data in accordance with Law 1581/2012 and the regulatory framework applicable to AyvensColombia.

Ayvens understands your concerns regarding the protection of your personal data. Below we describe how we acquire and use that information and outline your rights. Please read this carefully, so that the process is as fair, transparent and secure as possible.

1. General principles

The following principles are central to how we process your personal information:

Legality: Processing of Personal Data is a regulated activity and as such shall comply with applicable Colombian regulations.

Limitation of the purpose: Processing of Personal Data must pursue a legal and legitimate purpose that must be prior and duly notified to the Data Subject. Additionally, the collection of data must be limited to those Personal Data that are relevant and appropriate for the purpose for which they are collected or required.

Freedom: Processing of Personal Data may not be carried out without the prior, explicit, free, voluntary and informed consent of the Data Subject.

Accuracy or quality: The Personal Data must be accurate, complete, updated, verifiable and understandable. It is explicitly forbidden to process Personal Data if the information provided is partial and/or incomplete.

Transparency: The Responsible and Responsible for the treatment must guarantee the full access of the Holder to their Personal Data contained in the Databases.

Access and restricted circulation: Personal Data must not be accessible through the Internet or any other means of communication, unless they are by naturaliza public.

Security: Data Controllers and Processors must implement appropriate technical, human and administrative measures to prevent the deletion, modification, violation and/or unauthorized access to Personal Data.

Confidentiality: Any person involved in Processing of Personal Data that is not public must guarantee absolute confidentiality of the same. On this point, there are no explicit obligations regarding the anonymization or pseudonymization of the data, however, these measures may be adopted by the Responsible and Responsible for the treatment to guarantee the confidentiality and security of the Personal Data object of the Treatment.

Demonstrated responsibility: consists of the Controller and / or Processor for the processing of personal data at the request of the competent authority (Superintendence of Industry and Commerce), must demonstrate that it has implemented the obligations required by Colombian legislation on the protection of personal data, according to the legal nature, the services offered and the structure, establishing: (i) an internal policy and manuals for the proper processing of personal data, (ii) procedures for the collection, processing and deletion of data, (iii) sufficient mechanisms to maintain the confidentiality and security of information, (iv) an administrative structure responsible for the adoption and implementation of the policy, and (v) an effective system for the attention and response of PQR (requests, complaints and claims) in accordance with legal requirements.

Privacy by design and by default: Necessary and appropriate technical and organizational measures to guarantee the protection and privacy of the data of the interested parties before carrying out the processing of said data.

Temporality of the data, according to which exhausted the purpose for which the personal data was collected and / or processed, Ayvens must cease its use and therefore adopt the relevant security measures for this purpose. For this purpose, the obligations of commercial law regarding the conservation of trade books and correspondence of the merchant will be taken into account.

2. About Us

Ayvens is the Controller of your personal data.

Our contact details:

Transversal 22 #98-82 Oficina 903, Edificio Porta 100, BogotÃ¡ D.C., Colombia
Email: soporte.carmarket@aldautomotive.com

The Data Subjects can contact our Data Protection Officer (DPO) through the following email: protecciondedatoscolombia@aldautomotive.com.

3. How we use your personal data and which personal data is used

PROCESSING	LEGAL BASIS	DATA SUBJECTS CONCERNED	DATA COLLECTED
Assessment and identification of the customer in order to conclude a sales contract	Consent	Legal representatives	Identity document of the legal representative; CERL of the Chamber of Commerce.
Management of the contractual relationship between car dealers and dealers (B2B)	Consent	Legal representatives	Surname; name; position; e-mail address; telephone and mobile phone number Identification card representative of the employed company and / or representative of the identification company; Power of attorney with signature; CERL; Proof of tax identification; Bank account details
Management of the contractual relationship car dealers and traders (B2C and small B2B)	Consent	Individual Legal Representatives for Small Businesses	Individuals: ID card and proof of address, driver's license and social security number/tax identification number; e-mail address; phone number comparisons: CERL.
Anti-money laundering and fighting the financing of terrorism	Legal obligation	Legal representatives; Members of the company; UBO; individual customers	Name; First name of legal representatives; Identity document; CERL Certificate; Full name (first and last names); Gender; Title of the function; Date of birth; Full residential address.
PROCESSING	LEGAL BASIS	DATA SUBJECTS CONCERNED	DATA COLLECTED
Marketing or promotional activities; Sending newsletters, surveys or satisfaction surveys	Consent	customers \| Traders	Name; Name; Postal address; Email address; Phone Number
Pick-up Services	Consent	Responsible	Driver's name; address and postal code of the driver's pick-up address; driver's phone number; driver's email address
Driver's handover of the Vehicle	Consent	Drivers	Driver's name; Driver's phone number; Driver's email address
Sales through the auction platform to traders (i.e. legal entities or companies)	Consent	Natural person acting on behalf of your company; (pseudo-) UBO(s); Director(s) and, if applicable, Counterparty Representatives	Full name (first and last names); Gender; Private residential domicile; Date of birth; Identification number; Selection results / For directors and counterparty representatives: Full name (names and surnames); Gender; Title of the function; Date of birth; Full residential address
Defleeting	Consent	Drivers	Vehicule; vehicle papers
Pricing	Consent	Contact person in a garage	Name; Professional phone number; Professional email address
Vehicle refurbishment	Consent	Drivers	deletion of personal data contained in the car
Retail (B2C and small B2B)	Consent	Individuals, small businesses	Individuals: Identity document and proof of address, driving license and tax identification number Companies: CERL Extract.

4. How long we keep your personal information

Personal data are kept by Ayvens for the period necessary to provide services and / or the conservation period established by colombian law, for evidentiary purposes. At the end of the conservation period, the personal data are:

Anonymized;
Archived;
Deleted.

5. With whom Ayvens may share your personal data

As a general rule, we do not share your personal data with third parties. However, as part of the execution of the sales contract, we may share company information and personal data with Ayvens/SG Group affiliates to perform the KYC process.

6. Export of personal data outside the country

All Ayvens Colombia databases are located within the national territory. However, we may transfer your personal data to third parties, as long as these are located in countries that have adequate levels of personal data protection with the Colombian standard.

7. Your rights

The Data Subjects have the following rights, in order to guarantee the proper handling of personal data by Ayvens. :

Right of the Data Subject	Description of the right	Article of Law 1581/2012
Right to be informed	Be informed by Ayvensof the treatment, upon request, on the use made of the d atos personales.	Article 8
Right of access	Toaccess your public data free of charge at least once a month, as long as there are nosubstantial modifications to the privacy notice that motivate new queries.	Article 8
Right to rectification	It can be exercised, among others, against partial, inaccurate, incomplete, fractional, misleading data, or those whose processingis expressly prohibited or has not been authorized.	Article 8
Right to erasure	Request the elimination of the documents once the corresponding processing has been completed and/or when the Data Subject requests it, as long as there is no legal obligation to keep them.	Article 8
Right to request proof of consent	Request proof of consent granted to Ayvens. , except when expressly excepted as a requirement for the Treatment.	Articles 8 and 16
Right to withdraw consent	Withdraw or revoke consent to Ayvens. when the Treatment does not comply with the principles, rights and constitutional and legal guarantees.	Article 8
Right to file a complaint to the SIC	File complaints with the Superintendencia de Industria y Comercio â€œSICâ€) for infractions of the provisions of Law 1581/2012. However, theHolder may only file a complaint with the SIC once he has exhausted the consultation or claim procedure before Ayvens.	Article 16

8. Security and storage of personal data

Ayvens. protects your data through technical and organizational security measures, including:

Up-to-date policies and work instructions and regular verification of compliance;
Segregation of duties and roles, so that our employees only have access to your personal data if it is necessary for their function and role;
Effective training of our employees on the rules, issues and risks involved;
Physical security of the premises where we process your personal data (e.g. access control and video surveillance cameras);
Numerous IT security measures (secure servers, firewalls and encryption).

Only those teams and employees who need to know your information within our company can access it. Ayvens. makes sure to implement management rights and policies within the company, we take all measures to ensure that employees, customers and suppliers keep their files confidential.

9. Cookies and Websites Policy

Ayvens may collect data through cookies to improve the user's browsing experience on its web pages. Cookies are used, among other trackers, to store preferences and settings in order to save time, allow login, combat fraud, analyze website performance and compile visit statistics.

In addition, if you use our mobile app, we may collect your GPS location, subject to your consent when required. We might also look at how often you use the app and where you downloaded it.

For more details you can consult our Cookie policy by following this link: https://carmarket.ayvens.com/cookiepolicy/.

10. Updates of this Privacy Policy

We may amend this Privacy Policy from time to time to comply with new regulation, so please review it regularly. If we change this Privacy Policy, we will notify you by means of a notice on the home page of our website. This Notice was last amended on September 20th, 2022.

11. How to contact us

To exercise the rights set forth in section 7 of this document, you can write and/or send us an email to the following address: Transversal 22 #98-82 Oficina 903, Edificio Porta 100 - BogotÃ¡, Colombia or contact our Data Protection Officer via email: protecciondedatoscolombia@aldautomotive.com , and we will handle your request.

Kind regards,

Ayvens