DORAL GROUP S.A. HEREBY DISCLOSES ITS DATA PROCESSING POLICY TO ALL ITS CUSTOMERS, EMPLOYEES, AND SUPPLIERS.

Pursuant to the enactment of Law 1581 of 2012 and its implementing decrees, compiled in the Single Regulatory Decree of the Industry, Commerce, and Tourism Sector (Decree 1074 of 2015), and in order to comply with the provisions developing individuals' right to know, update, rectify, or delete personal information collected about them in any database or file, this policy sets out the manner in which DORAL GROUP S.A., identified with NIT 900.581.479-0, acting as Data Controller, processes the personal data of its employees, suppliers, customers, and users/visitors of its venues.

To ensure the protection of personal data, DORAL GROUP S.A. discloses that it is domiciled at Carrera 15 # 36 – 38, in the city of Bucaramanga – Santander, and provides the following email address as a contact channel: protecciondedatos@doralgroup.com.

This Policy governs all organizational processes of DORAL GROUP S.A. involving the processing of personal data, and generally informs all individuals who have provided, or who may in the future provide, their personal data to the company, of the Policy applicable to all databases and personal data contained therein.

For purposes of implementing this policy and in accordance with applicable law, the following definitions shall apply:

1. Authorization: The Data Subject's prior, express, and informed consent to carry out the Processing of personal data.
2. Privacy Notice: A verbal or written communication issued by DORAL GROUP S.A. to the Data Subject, informing them of the existence of this Policy, how to access it, and the purpose of the intended processing of their personal data. The Privacy Notice is used solely when DORAL GROUP S.A. is unable to make this Policy available to the public.
3. Database: An organized set of personal data that is subject to Processing.
4. Personal Data: Any information linked to, or that may be associated with, one or more identified or identifiable individuals.
5. Public Data: Data classified as such under the mandates of the law or the Political Constitution, and any data that is not semi-private, private, or sensitive. Public data includes, among others, information relating to an individual's civil status, profession or occupation, and status as a merchant or public servant, as well as any data that may be obtained without restriction. By its nature, public data may be found, among other sources, in public records, public documents, official gazettes, and bulletins.
6. Private Data: Data which, by its intimate or confidential nature, is relevant only to the Data Subject.
7. Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use may result in discrimination, such as data revealing racial or ethnic origin, political affiliation, religious or philosophical beliefs, membership in unions, social organizations, or human rights organizations, or that promotes the interests of any political party or guarantees the rights of opposition political parties, as well as data relating to health, sex life, and biometric data.
8. Data Processor: An individual or legal entity, public or private, who, either alone or jointly with others, carries out the Processing of personal data on behalf of the Data Controller.
9. Data Controller: An individual or legal entity, public or private, who, either alone or jointly with others, decides on the database and/or the Processing of the data.
10. Data Subject: The individual whose personal data is subject to Processing.
11. Processing: Any operation or set of operations performed on personal data, such as the collection, storage, use, circulation, or deletion thereof.
12. Transfer: Occurs when the Data Controller, located in Colombia, sends personal information to a third-party recipient, located within or outside the country, who in turn acts as Data Controller of such information.
13. Transmission: Occurs when the Data Controller, located within or outside the country, shares personal information for processing by the Data Processor, located within or outside the country.

The processing of personal data at DORAL GROUP S.A. is governed by the following principles:

1. Principle of Legality: Processing is a regulated activity subject to compliance with the law and any other provisions developing it.
2. Principle of Purpose: The Processing of collected personal data must serve a legitimate purpose, which must be disclosed to the Data Subject.
3. Principle of Freedom: Processing may only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate releasing such consent.
4. Principle of Accuracy and Quality: Information subject to Processing must be truthful, complete, accurate, up to date, verifiable, and understandable. Processing of partial, incomplete, fractioned, or misleading data is not permitted.
5. Principle of Transparency: Processing must guarantee the Data Subject's right to obtain from the Data Controller or Data Processor, at any time and without restriction, information regarding the existence of data concerning them, in accordance with the rules governing such access.
6. Principle of Restricted Access and Circulation: Processing is subject to the limits arising from the nature of personal data, the provisions of this law, and the Constitution. Accordingly, Processing may only be carried out by persons authorized by the Data Subject and/or by persons authorized by law. Personal data, except for public information, and subject to the terms of the authorization granted by the Data Subject, may not be made available on the Internet or other means of mass disclosure or communication, unless access is technically restricted to provide controlled knowledge solely to Data Subjects or authorized third parties.
7. Principle of Security: Information subject to Processing by the Data Controller or Data Processor must be handled using the technical, human, and administrative measures necessary to ensure the security of records, preventing their adulteration, loss, unauthorized or fraudulent consultation, use, or access.
8. Principle of Confidentiality: All individuals involved in the Processing of personal data that is not public in nature are required to safeguard the confidentiality of such information, even after their relationship with any of the activities comprising the Processing has ended, and may only disclose or communicate personal data when necessary for the performance of authorized activities.

The collection, storage, use, circulation, or deletion of personal data by DORAL GROUP S.A. requires the free, prior, express, and informed consent of the data subject.

• Means of Granting Authorization. Authorization may be given through a physical or electronic document, a data message, voice recordings, the Internet, websites, or through a suitable technical or technological mechanism enabling consent to be expressed or obtained via click or double-click, or through any other format that allows for subsequent verification.
• Proof of Authorization. DORAL GROUP S.A. uses the mechanisms currently available to it, and will continuously implement and adopt the actions necessary to maintain records or suitable technical or technological mechanisms for preserving the authorization granted by data subjects for the processing of their data.
• Cases in Which Authorization Is Not Required. The Data Subject's authorization shall not be required in the following cases:
  1. Information required by a public or administrative entity in the exercise of its legal functions or by court order;
  2. Data of a public nature;
  3. Cases of medical or public health emergency;
  4. Processing of information authorized by law for historical, statistical, or scientific purposes;
  5. Data related to the Civil Registry of Persons.

In all cases, the processing of personal data that does not require prior authorization from DORAL GROUP S.A. shall be carried out in compliance with all provisions set forth in this law.

DORAL GROUP S.A. carries out the Processing of personal information with the main objective of fulfilling its functions, always acting in accordance with the purposes established in the Law governing its operations, in this Policy, and in the authorizations granted in advance and expressly by the Data Subjects of the information.

To carry out such purposes, DORAL GROUP S.A. may collect, use, share, and store the personal information of Data Subjects, related to:

1. Identification data
2. Contact data
3. Sensitive data
4. Employment and educational data
5. Financial and credit data

In all cases, if necessary, at the time of collecting personal data, DORAL GROUP S.A. will inform the Data Subject, prior to obtaining their authorization, of the purposes for the specific Processing, which will fall within the following:

DORAL GROUP S.A. may carry out the Processing of personal data of a public nature without the Data Subject's prior authorization, collecting such data from public records, public documents, official gazettes, bulletins, and/or duly enforceable court rulings.

This does not imply that the necessary measures to ensure compliance with the principles and obligations set forth in Law 1581 of 2012 and its implementing decrees will not be adopted.

Through the various communication channels made available for this purpose, by means of which the recruitment and/or selection process is initiated or the employment relationship is formalized, personal data is collected and stored from candidates interested in working at DORAL GROUP S.A. and/or from its employees.

This information is provided directly by the Data Subjects and is processed in accordance with this Policy, within the framework of Law 1581 of 2012 and its implementing regulations, as well as under the purposes set out in the authorizations granted, which include the following:

1. Carrying out personnel promotion, recruitment, and selection processes;
2. Verifying data related to educational background and work experience through the professional and personal references provided by the Data Subject and/or through public and/or private sources;
3. Conducting psychometric tests, knowledge assessments, security clearances, home visits, medical examinations, and other activities aimed at validating the candidate's profile;
4. Carrying out processes and activities related to hiring and employment relationship management;
5. Acknowledging and processing salary payments and social benefits;
6. Training employees;
7. Conducting administrative and/or disciplinary investigations when applicable;
8. Complying with legal obligations regarding social security enrollment, accounting, and record-keeping;
9. Sharing this information with third-party Data Processors for the fulfillment of these same authorized purposes by the Data Subject.

This information will be stored in physical and digital form in the database(s) created for the purposes requiring its collection, which are included in DORAL GROUP S.A.'s internal database inventory, and its Processing shall be carried out:

1. For as long as the purposes that gave rise to its collection remain valid; and/or
2. For as long as the contractual relationship remains in effect; and/or
3. For as long as the legal accounting and record-keeping obligations remain in effect for DORAL GROUP S.A.

Through the various communication channels or documents made available for this purpose, by means of which the engagement of suppliers and contractors is formalized, personal data is collected and stored from suppliers providing services to DORAL GROUP S.A.

Additionally, DORAL GROUP S.A. uses the personal information collected specifically from its suppliers or contractors to carry out activities related to invoicing and accounting processes, risk control and management of its day-to-day operations, as well as to comply with record-keeping legal obligations.

This information is provided directly by the Data Subjects or their legal representatives, and is processed in accordance with this Policy, within the framework of Law 1581 of 2012 and its implementing regulations, under the purposes set out in the authorizations granted.

Where the data of suppliers and contractors corresponds to legal entities, and although such data is not considered personal data under national legislation, it will be processed by DORAL GROUP S.A. under all applicable security and confidentiality measures.

By authorizing, through any means, the use of their information, suppliers and contractors accept that DORAL GROUP S.A. may use, retain, transfer, collect, store, and process their information for the purpose of:

1. Carrying out all activities related to the selection, hiring, and evaluation of their performance and compliance with their legal and contractual obligations;
2. Entering their information into DORAL GROUP S.A.'s supplier database; DORAL GROUP S.A.;
3. Verifying the financial, legal, and commercial viability of a potential business relationship, and/or maintaining an existing one;
4. Verifying the information provided by potential and/or contracted suppliers and contractors against risk databases, private and/or public sources, and any other lists deemed relevant to confirm their suitability;
5. Executing and/or ensuring compliance with contractual obligations;
6. Complying with legal obligations regarding accounting and record-keeping;
7. Providing information to government or judicial entities that request it;
8. Supporting external and internal audit processes;
9. Sharing this information with third-party Data Processors for the fulfillment of these same purposes.

This information will be stored in physical and digital form in the database(s) created for the purposes requiring its collection, which are included in DORAL GROUP S.A.'s internal database inventory, and its Processing shall be carried out:

1. For as long as the purposes that gave rise to its collection remain valid; and/or
2. For as long as the contractual relationship remains in effect; and/or
3. For as long as the legal accounting and record-keeping obligations remain in effect for DORAL GROUP S.A.

DORAL GROUP S.A. collects and stores personal data from the users and customers of its venues.

This information is provided directly by the Data Subjects and is processed in accordance with this Policy, within the framework of Law 1581 of 2012 and its implementing regulations, under the purposes set out in the authorizations granted by users and/or customers.

By authorizing, through any means, the use of their information, users and customers accept that DORAL GROUP S.A. may use, retain, transfer, collect, store, and process their information for the purpose of:

1. Storing it in DORAL GROUP S.A.'s physical and/or digital databases;
2. Carrying out administrative management;
3. Promoting and offering events, raffles, partnerships, tournaments, surveys, and any other activity related to the company's ordinary business;
4. Encouraging customers to take part in the entertainment offered through the games of chance that may be promoted from time to time at our venues;
5. Fulfilling the legal duty to report to Coljuegos, UIAF, Supersalud, and other supervisory and oversight authorities, the transactions carried out and prizes paid, in compliance with such authorities' resolutions;
6. Providing customers with access to the venues' free Wi-Fi;
7. Retaining it for statistical and historical purposes and/or maintaining it in compliance with legal record-keeping obligations;
8. Handling petitions, complaints, and/or claims, as well as requests from authorities in the exercise of their functions;
9. Sending, through digital, physical, or data messaging means, communications and advertising related to DORAL GROUP S.A.'s various projects and information related to the company's corporate purpose.

All this information will be stored in physical and digital form in the database(s) created for the purposes requiring its collection, which are included in DORAL GROUP S.A.'s internal database inventory, and its Processing shall be carried out:

1. For as long as the purposes that gave rise to its collection remain valid; and/or
2. For as long as the contractual relationship remains in effect; and/or
3. For as long as the legal accounting and record-keeping obligations remain in effect for DORAL GROUP S.A.

DORAL GROUP S.A., for the sole purpose of keeping the company's shareholder ownership records up to date, stores the data of its shareholders with their authorization for its Processing.

This information is stored in the database(s) created for the purposes requiring its collection, and its Processing will continue for as long as the purposes of its collection and/or the legal obligation to retain such data remain in effect.

DORAL GROUP S.A., in the ordinary course of its operations, does not carry out the Processing of sensitive data; however, in cases where this becomes necessary (such as the processing of medical leave records for its employees), it will obtain the corresponding authorizations, having previously informed the Data Subject that: i) they are not required to authorize the Processing of sensitive data; ii) it is optional to answer questions concerning sensitive data; iii) the sensitive data subject to Processing; and iv) the Processing and its purposes.

As an exceptional case, pursuant to the biosecurity protocols established by DORAL GROUP S.A. in compliance with any regulations establishing mandatory measures related to COVID-19 or other viruses that may affect the public, the Processing of health-related data of its employees, suppliers, contractors, and/or users/customers of its venues will be carried out, for which their authorization will be requested prior to the collection of such data through the entry forms or check-in sheets implemented; and they will be informed of matters relating to its Processing through a privacy notice published in a location visible to the Data Subjects.

This information will be stored in the database(s) created for the purposes requiring its collection, and its Processing will continue for as long as the purposes of its collection and/or the legal obligation to retain such data remain in effect.

As part of its wellness, advertising, and marketing activities, DORAL GROUP S.A. may, in certain cases, take photographs and/or videos of its employees and/or customers.

These images are collected with the prior express authorization of the Data Subject, or of their legal representative in the event the Data Subject is a minor, in order to keep a record of the activities carried out, as well as to use them in the company's own publications, whether through internal corporate media, social networks, communication channels, or any other known or future medium, for informational, advertising, and institutional purposes.

These images will be stored in the database(s) created for the purposes requiring their collection, and their Processing will continue for as long as the purposes of their collection and/or the obligations related to monitoring the activities carried out remain in effect.

Likewise, images collected through the recording and video surveillance systems located within DORAL GROUP S.A.'s offices and venues are processed solely for the purpose of providing security in its offices and commercial establishments, as well as to conduct disciplinary or criminal investigations and to share them with competent authorities that request them in the exercise of their functions.

The Processing of these images will be stored in the database(s) created for the purposes requiring their collection, and their Processing will continue for the length of time permitted by the recording and video surveillance systems, which will not exceed fifteen (15) days, and/or until any investigation of which the photographic or video image forms part has concluded.

DORAL GROUP S.A. does not, as a general matter, collect or process the data of minors. However, should this occur, and in compliance with the personal data protection regulations currently in force in Colombia, it will provide all the safeguards necessary for minors to exercise their right to freedom of expression, free personal development, and access to information.

Accordingly, where information concerning a minor child must be obtained, its provision by the minor's legal representative or guardian will be optional.

DORAL GROUP S.A. reserves the right to notify the relevant authorities of any situation that, in its assessment, may endanger or does endanger the well-being of a minor.

This information will be stored in the database(s) created for the purposes requiring its collection, and its Processing will continue for as long as the purposes of its collection and awareness remain in effect.

For the purposes of Customer Service and the handling of petitions, complaints, and claims, DORAL GROUP S.A. collects and stores personal information of its users, customers, and third parties in general.

The information received by the company is provided by the Data Subjects and will be processed in accordance with this Policy, within the framework of Law 1581 of 2012 and Law 1755 of 2015 (governing the fundamental right of petition) and their implementing regulations, as well as under the purposes set out in the authorizations granted by the Data Subject, which include the following:

1. Processing the petition, complaint, or claim;
2. Responding to requests from authorities in the exercise of their functions;
3. Generating semi-annual reports in compliance with applicable legal obligations;
4. Retaining it for statistical, historical, or control purposes.

This information will be stored in the database(s) created for the purposes requiring its collection, and its Processing will continue for as long as the purposes of its collection and awareness remain in effect.

In carrying out its corporate purpose, DORAL GROUP S.A. may rely on third parties that assist in the development of its activities, and to that extent will instruct them to ensure that the collection and processing of personal information, whatever its nature, is always preceded by all relevant authorizations and carried out under all necessary security and confidentiality measures appropriate to its nature.

However, in the event of non-compliance with these obligations by such third parties, the obligation will not be assumed by the company, which acts as a third party in good faith, on the understanding that such third parties hold the authorizations necessary to process the information in accordance with the purposes for which it was provided, and that they maintain the data over which they act as Data Processor under special security and confidentiality measures, in accordance with legal and contractual guidelines.

DORAL GROUP S.A., as Data Controller, must comply with the following obligations, without prejudice to any other provisions set forth in Law 1581 of 2012 and other regulations governing its activity:

1. Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data;
2. Request and retain, under the terms established by law, a copy of the corresponding authorization granted by the Data Subject;
3. Duly inform the Data Subject of the purpose of the collection and the rights afforded to them under the authorization granted;
4. Retain the information under the security conditions necessary to prevent its adulteration, loss, unauthorized or fraudulent consultation, use, or access;
5. Ensure that the information provided to the Data Processor is truthful, complete, accurate, up to date, verifiable, and understandable;
6. Update the information, promptly informing the Data Processor of any changes regarding the data previously provided, and adopt any other measures necessary to keep the information provided to the Data Processor up to date;
7. Rectify information when it is incorrect and communicate this to the Data Processor accordingly;
8. Provide the Data Processor, as applicable, solely with data whose Processing has been previously authorized in accordance with the law;
9. Require the Data Processor, at all times, to respect the security and privacy conditions of the Data Subject's information;
10. Process inquiries and claims submitted under the terms set forth by law;
11. Adopt an internal manual of policies and procedures to ensure proper compliance with the law, and in particular, the handling of inquiries and claims;
12. Inform the Data Processor when certain information is under dispute by the Data Subject, once a claim has been filed and the corresponding process has not yet concluded;
13. Inform the Data Subject, upon request, of the use given to their data, at least once a month and free of charge;
14. Report to the data protection authority when security code violations occur and there are risks in the administration of Data Subjects' information.

In accordance with Article 8 of Law 1581 of 2012, the Data Subject shall have the following rights:

1. To know, update, and rectify their personal data held by DORAL GROUP S.A. as Data Controller. This right may be exercised, among other cases, with respect to partial, inaccurate, incomplete, or fractioned data, data that is misleading, or data whose Processing is expressly prohibited or has not been authorized;
2. To request proof of the authorization granted to DORAL GROUP S.A., except where such proof is expressly exempted as a requirement for Processing, in accordance with Article 10 of the law;
3. To be informed by DORAL GROUP S.A., as Data Controller, upon request, of the use given to their personal data;
4. To file complaints with the Superintendency of Industry and Commerce for violations of the provisions set forth in the law and other regulations amending, supplementing, or complementing it;
5. To revoke the authorization and/or request the deletion of data where the Processing fails to respect the constitutional and legal principles, rights, and guarantees. Revocation and/or deletion shall apply once the Superintendency of Industry and Commerce has determined that, in carrying out the Processing, DORAL GROUP S.A., as Data Controller, has engaged in conduct contrary to the law and the Constitution;
6. To access, free of charge, their personal data that has been subject to Processing.

Inquiries. In accordance with Article 14 of Law 1581 of 2012, inquiries will be addressed within a maximum term of ten (10) business days from the date of receipt.

Where it is not possible to address the inquiry within that term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the inquiry will be addressed, which may in no case exceed five (5) business days following the expiration of the first term.

Claims. The Data Subject or their successors who believe that information contained in a database should be corrected, updated, or deleted, or who become aware of an alleged breach of any of the duties set forth in this law, may file a claim with the Data Controller or the Data Processor, which will be handled under the following rules:

1. The claim shall be filed by means of a request addressed to the Data Controller or the Data Processor, identifying the Data Subject, describing the facts giving rise to the claim, providing an address, and attaching any supporting documents. Where the claim is incomplete, the interested party will be requested, within five (5) days of receipt of the claim, to remedy the deficiencies. If two (2) months elapse from the date of the request without the applicant providing the required information, the claim will be deemed withdrawn.
2. Where the party receiving the claim lacks jurisdiction to resolve it, it will forward the claim to the appropriate party within a maximum term of two (2) business days and will inform the interested party of this action.
3. Once the complete claim has been received, a notation stating "claim in process" and the reason therefor will be included in the database within a term not exceeding two (2) business days. This notation will remain until the claim has been resolved.
4. The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. Where it is not possible to address the claim within that term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which may in no case exceed eight (8) business days following the expiration of the first term.

The ADMINISTRATIVE AREA and the Privacy Officer of DORAL GROUP S.A. will be responsible for handling the petitions, complaints, and claims filed by the Data Subject in exercise of the rights described in this Policy.

For such purposes, the Data Subject or their representative may submit their petition, complaint, or claim Monday through Friday, from 9:00 a.m. to 5:00 p.m., by email to protecciondedatos@doralgroup.com, by phone at (+57) (+607) 6916067, or in person at Carrera 15 # 36-38, Centro, Bucaramanga, Colombia.

Our Data Processing Policy has been in effect since November 8, 2016.

Personal data processed by DORAL GROUP S.A. will remain in the corresponding databases safeguarded by the Company for as long as necessary for the purposes described in this Policy, as its Processing is directly linked to the purposes for which the personal data was collected.

DORAL GROUP S.A. reserves the right to make any amendments it deems relevant and necessary to this Policy, and in the event of any substantial change, this will be published on our website in order to notify the Data Subjects.