Privacy and personal data processing policy

This is an English translation for reference. The Spanish version is the legally binding text.

1. INTRODUCTION

Grupo SAKA S.A.S., identified with tax ID (NIT) 830.106.416-8 and domiciled at Cl. 24 #19-52, Bogotá D.C., Colombia, as data controller and in compliance with Law 1581 of 2012, Decree 1377 of 2013 and other complementary regulations, adopts this Privacy and Personal Data Processing Policy (hereinafter, the “Policy”), applicable to the processing of information that may be collected through its institutional website www.marathon.com.co, corresponding to its Marathon brand.

2. PURPOSE

This Policy aims to inform data subjects about how Grupo SAKA S.A.S. collects, stores, uses, transmits, shares or deletes their information, guaranteeing respect for their fundamental rights and compliance with current legislation.

3. SCOPE

This Policy applies to all databases and/or files containing personal data processed by Grupo SAKA S.A.S., as controller or processor, as applicable.

It applies to employees, suppliers, corporate clients, partners and institutional visitors, as well as to any third party whose data is processed within the company's activities.

4. DEFINITIONS

• Personal data: any information linked or that may be associated with a specific or identifiable natural person.
• Sensitive data: information that affects the data subject's privacy or whose misuse may lead to discrimination.
• Processing: any operation on personal data such as collection, storage, use, circulation or deletion.
• Data controller: whoever decides on the database and/or the processing.
• Data processor: whoever processes data on behalf of the controller.
• Data subject: the natural person whose data is processed.

5. PURPOSES OF PROCESSING

Grupo SAKA processes personal data for the following purposes:

• Administrative and operational management of employment, commercial and contractual relationships.
• Institutional communication with partners, suppliers, entities and interested users.
• Handling of requests, contacts, petitions or complaints submitted through the website or customer service channels.
• Compliance with legal, tax and accounting obligations.
• Security and access control to physical facilities through video surveillance.
• Record keeping for internal audits or legal proceedings.
• Sending institutional information about the company, when required.

Grupo SAKA does not sell products through its website nor collect financial or payment information.

6. PROCESSING OF SENSITIVE DATA

Grupo SAKA refrains from collecting or processing sensitive data unless strictly necessary and the data subject grants express authorization. In such cases, enhanced protection measures will be guaranteed.

7. RIGHTS OF DATA SUBJECTS

Data subjects have the following rights:

• To know, update, rectify and delete their information.
• To access their personal data free of charge.
• To request proof of the authorization granted.
• To be informed about the use of their data.
• To revoke the authorization when the processing does not respect legal principles.
• To file complaints with the Superintendence of Industry and Commerce (SIC), once the inquiry or complaint process before Grupo SAKA S.A.S. has been exhausted.

8. AUTHORIZATION

The processing of personal data by Grupo SAKA requires the prior, express and informed authorization of the data subject, except in the cases permitted by law.

Such authorization may be granted verbally, in writing or through unequivocal conduct.

9. SECURITY MEASURES

Grupo SAKA S.A.S. implements the technical, administrative and human measures necessary to guarantee the confidentiality, integrity and availability of personal data, and to prevent its loss, misuse, unauthorized access or alteration.

However, it acknowledges that no transmission over the internet is completely secure, so users assume a reasonable risk when interacting digitally.

10. DATA TRANSFER AND TRANSMISSION

Grupo SAKA may transfer or transmit personal data to third-party processors within or outside the country, exclusively to fulfill the purposes authorized by the data subject. In such cases, confidentiality and regulatory compliance agreements will be signed.

In particular, information sent through the contact form is stored on web hosting servers located in the United States, and conversations started on WhatsApp are handled on the Meta Platforms, Inc. platform, which are also subject to their own privacy policies.

11. COOKIES AND SIMILAR TECHNOLOGIES

The Site does not use its own cookies or any analytics or advertising tools. Some third-party services embedded in the Site, such as the Google Maps map on the contact page and the Google Fonts typefaces, may set cookies or log technical browsing data (such as the IP address) under their own policies. Users can set their browser to reject or delete them, although this may limit how those services work.

12. PROCEDURES TO EXERCISE RIGHTS

Data subjects may exercise their rights through a written request addressed to:

Grupo SAKA S.A.S.
Email: contacto@marathon.com.co
Address: Cl. 24 #19-52, Bogotá D.C., Colombia

Grupo SAKA S.A.S. is responsible for handling inquiries and complaints, through the email address above.

The request must include:

• Full name and identification document
• A clear description of the right you wish to exercise
• Contact details
• Supporting documents (if applicable)

Response times:

• Inquiries: up to 10 business days, extendable by up to 5 additional business days, informing the data subject of the reasons for the delay.
• Complaints: up to 15 business days, extendable by up to 8 additional business days, informing the data subject of the reasons for the delay.

13. CHANGES TO THE POLICY

Grupo SAKA S.A.S. may modify this Policy. Substantial changes will be communicated to data subjects before they are implemented, by publishing them on the Site with their update date. When a change concerns the purposes of processing, a new authorization will be requested from the data subject.

14. DATABASE RETENTION

Personal data will be kept for as long as the purposes of processing, contractual, legal or regulatory obligations remain, or while there is a relationship with the data subject.

Once the purpose has been fulfilled, the data will be deleted or anonymized in accordance with applicable regulations.

15. FINAL STATEMENT

Grupo SAKA S.A.S. reaffirms its commitment to the protection of personal data and respect for the rights of data subjects. This Policy reflects our institutional responsibility regarding privacy, security and legal compliance.

Grupo SAKA S.A.S.
Owner of the Marathon brand
www.marathon.com.co
Cl. 24 #19-52, Bogotá D.C., Colombia
contacto@marathon.com.co