The company Paki & Lulu S.A.S., domiciled in Bogotá D.C. and identified with NIT 901.465. 751-7 (hereinafter, the "Company"), in compliance with the rules contained in Law 1581 of 2012, in Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and in the other concordant rules by which general provisions for the protection of personal data are issued, and in view of its capacity as Responsible for the Processing of Personal Data in accordance with the aforementioned regulations, hereby discloses this Privacy and Personal Data Protection Policy (hereinafter, the "Policy") to regulate the collection, storage, processing, administration, transfer, transmission, protection and deletion of information received from the owners of personal data or third parties through the different channels of data collection that has been arranged in the development of its activities.

1. Definitions

   For the purposes of this Policy, the words defined below shall have the meaning assigned to them in this chapter, whether or not they are capitalized, or whether they are in the plural or singular.

   1. Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of Personal Data.
   2. Data Base: Organized set of Personal Data that is subject to Processing, which may be stored and/or processed in servers located in computer centers or physical stationery, either our own or contracted with third parties, located in the national territory or in different countries.
   3. Personal Data: Any information linked or that can be associated to one or several determined or determinable natural persons.
   4. Sensitive Data: Sensitive data are understood as those that affect the privacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data, among others.
   5. Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of Personal Data on behalf of the person responsible for the Processing of Personal Data.
   6. Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the processing of data. For the purposes of this Policy, the data controller shall be the Company.
   7. Data Subject: Natural person whose personal data is the object of processing.Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.
2. Authorization to carry out the Processing of Personal Data

   Given that the Policy is available to anyone who wishes to consult it, it is hereby established that the Processing of Personal Data carried out by the Company shall have the free, prior, express and informed consent of the Holder of such data and this shall be previously authorized when so indicated verbally and/or by means of a physical document, electronic or any other format, or by any other unequivocal conduct such as the mere fact of providing their Personal Data on their own behalf or through an intermediary person, either i) directly to the Company or ii) by means of a third party, electronic or any other format, or by any other unequivocal conduct such as the sole fact of providing his/her Personal Data, on his/her behalf or through an intermediary, either i) directly to the Company or ii) to third parties who in turn have the authorization to transfer or transmit them to other persons.

   The website www.pakiandlulu.com (hereinafter, the "Website") has an informative mission, with the exception of the online shopping section and the "Contact" section, where Users may share their personal information, if they so wish. The use of the Website implies the acceptance of this privacy policy by the Owners who make use of it. Therefore, those Owners who do not agree with the terms included herein should refrain from using the Website. The Holder user of the Website acknowledges and accepts that the Company may use a tracking system through the use of cookies. The cookies used by the Website are files sent to a browser by a web server to record the user's activities on the website and allow a more fluid and personalized navigation. In any case, the user has the ability to configure your browser to prevent the entry of these, block them or, where appropriate, delete them. The above will be the sole responsibility of the User.

3. Processing of Personal Data

   The Company, in its capacity as the duly authorized Data Controller as indicated in the previous paragraph, and all those appointed by it, may carry out the Processing of the Personal Data provided, which includes the collection, storage, processing, use, updating, circulation, administration, assignment, transfer, transmission, protection and deletion of the same. The treatment that the Company performs of the personal information provided by its customers is additionally covered under the rules of professional secrecy.

   Likewise, it is emphasized that the Company may, among others, i) appoint one or several Data Processors, ii) transfer and/or transmit the Personal Data subject to Processing to the companies that are part of its corporate group, that is, to parent companies, affiliates or subsidiaries, as well as to any other third party, within or outside the national territory, whether they are legal or natural persons, national or foreign, iii) to provide such Personal Data to agents, subcontractors and other third parties for the achievement of the purposes related in the following paragraph, and iv) to disclose the information when so required by the public authorities duly empowered by administrative or judicial order.

4. Purposes of Personal Data Processing

   The Company will process Personal Data for the following specific purposes:

   1. To provide online clothing sales services to its customers.
   2. Fulfill the contracts signed with your customers, suppliers, employees and any other person with whom you enter into a legal relationship.
   3. Perform basic administrative management tasks.
   4. To provide services and products requested and to comply with the other obligations contracted with the Holder.
   5. Evaluate the quality of our services.
   6. Develop marketing or promotional activities.
   7. Inform about new services that are related to the contracted or acquired services.
   8. To advance the necessary activities to manage requests, complaints and claims submitted by customers, users and/or third parties, and direct them to the areas responsible for issuing the corresponding responses.
   9. Respond to legal requirements of administrative and judicial entities.
   10. Support external or internal audit processes.
   11. Control and prevention of fraud, money laundering and financing of terrorism.
   12. To develop selection, evaluation and employment processes.
   13. Register information of employees, former employees and/or third parties.
   14. Manage affiliations and payments to the social security system.
        
5. Rights of Personal Data Subjects

   The rights granted to the Personal Data Holders are: to know, update and request rectification or deletion of data; to request proof of the granting of the authorization; to know about the use that the Company has made of their personal data; to revoke at any time the authorization to include their personal data in the Company's databases and to request free of charge information about the personal data previously authorized.

   To exercise these rights, the Owners of Personal Data may send a communication under the terms established by Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015), to info@pakiandlulu.com or to Carrera 9 No. 80-45 Piso 4 in Bogotá, D.C.

6. Security Measures for the Protection of Personal Data

   The Company shall adopt the necessary security techniques to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. Such measures shall meet the minimum requirements set forth by the legislation in force and their effectiveness shall be periodically evaluated. However, the Company shall not be liable in the event of a violation of its security systems in the event of force majeure or fortuitous event.

7. Disclaimers

   The Company may process the Personal Data of children and adolescents, as long as they act through their parents or persons duly authorized by those who have parental authority or legal representation of the minor and their processing is permitted by law. The Company shall ensure that the best interests of children and adolescents and their prevailing rights are respected.

   The Holders shall not be obliged in any event to authorize the processing of sensitive data. Notwithstanding the foregoing, in cases where the provision of the service requires that the holders provide any sensitive personal data, the Holder must be asked to expressly consent to the processing of this information, who will be free to grant it or not.

   The Holder of the Personal Data shall have the duty to keep his/her information updated and to guarantee, at all times, its accuracy. The Company will not be responsible, in any case, for any liability arising from the inaccuracy of the information.

   The Company assumes no liability for damages of any kind that may arise from the presence of viruses or the presence of other harmful elements in the services provided by third parties through the Website that may cause alterations in the user's computer system, electronic documents or files.

8. Modification of Policy

   The Company may modify or amend this Policy at its discretion. When modifications or changes are made to this Policy, the date of the modification or amendment will be updated, and such modification or amendment will be effective as of the date of the update. You are encouraged to periodically review this Policy to be informed of any modifications that may be made.

9. Policy Validity

   This Policy shall become effective as of its publication. Both the Policy and the Databases containing the information provided may remain in force for the duration of the company. Notwithstanding the fact that this policy may be modified at any time and unilaterally by the Company.

   Cordially, Paki & Lulu S.A.S.