Personal Data Processing Policy

1. Data controller

Velvet Aura is the data controller, which means it is the entity that decides on the purpose and conditions of processing the personal information we collect through our customer service channels.

Our physical address is Carrera 16A # 79-19, Unilago, Bogotá, Colombia, and our contact telephone number is 3151281818. For any matter related to this policy, you may contact us through the indicated channels.

This policy applies to the website, the online store, and the clinic's in-person services, and it regulates the collection, storage, use, circulation, deletion, and, in general, any operation on the personal data of our users, patients, and customers.

2. Regulatory framework

The processing of personal data by Velvet Aura is governed by the following provisions:

• Colombian Law 1581 of 2012, "which issues general provisions for the protection of personal data".
• Decree 1377 of 2013, which partially regulates Colombian Law 1581 of 2012.
• Decree 1074 of 2015, Book 2, Part 2, Title 2, Chapter 25, which compiles and updates the regulatory rules.
• Decree 886 of 2014, regarding the National Database Registry (RNBD).

The supervising authority responsible for ensuring compliance with these rules is the Superintendence of Industry and Commerce (SIC).

3. Prior, express and informed authorization

In accordance with Article 9 of Colombian Law 1581 of 2012, the processing of personal data requires the prior, express and informed authorization of the data subject, obtained by any means that allows for its subsequent consultation.

By granting your authorization, you declare to have been informed in a clear and sufficient manner about the purpose of the processing, the rights you hold, and the mechanisms to exercise them. It is important to note that silence never equates to authorization, as provided by Article 7 of Decree 1377 of 2013.

4. Purposes of the processing

The personal data collected by Velvet Aura is processed for the following purposes:

• The provision of medical, aesthetic, and dermatological services.
• The management of appointments, the medical record, and patient care.
• Billing and collection of services and products.
• Handling inquiries, requests, complaints, and claims.
• Sending information about news, promotions, and content of Velvet Aura.
• Managing the online store, including orders, shipments, and payments.
• The continuous improvement of service quality.

5. Sensitive and health data

Data relating to health, sexual life, and biometric data are considered sensitive data in accordance with Articles 5 and 6 of Colombian Law 1581 of 2012.

Their processing is optional and requires additional, express, and prior authorization from the data subject, in which the specific purposes of the processing are clearly informed. No clinic activity is conditioned upon the data subject providing this type of data.

The medical record is a private document subject to confidentiality, in accordance with Article 34 of Law 23 of 1981, and may only be consulted by third parties with the patient's authorization or by legal provision.

6. Rights of the data subject

In accordance with Article 8 of Colombian Law 1581 of 2012, the holder of the personal data has the following rights:

• To know, update, and rectify their personal data.
• To request proof of the authorization granted for the processing of their data.
• To be informed, upon prior request, regarding the use that has been made of their personal data.
• To file complaints with the Superintendence of Industry and Commerce (SIC).
• To revoke the authorization and/or request the deletion of the data.
• To access their personal data free of charge.

7. Duties of the controller

Velvet Aura, as the data controller, complies with the duties of Article 17 of Colombian Law 1581 of 2012, among which the following stand out:

• To request and keep a copy of the authorization granted by the data subject.
• To clearly inform the purpose of the processing and the rights of the data subject.
• To keep the information under security conditions that prevent its alteration, loss, consultation, use, or unauthorized access.
• To guarantee the truthfulness, integrity, and updating of the data.
• To timely process the queries and claims formulated by the data subjects.
• To inform the Superintendence of Industry and Commerce of any breaches of security codes.

8. Procedure to exercise rights

The data subject may exercise their rights through the telephone number 3151281818, indicating their identification data and the right they wish to exercise.

Queries will be answered within a maximum term of 10 business days, extendable by 5 additional days when it is not possible to attend to them within said term, in accordance with Article 14 of Colombian Law 1581 of 2012.

Claims will be answered within a maximum term of 15 business days, extendable by 8 additional days when the circumstances so require, in accordance with Article 15 of Colombian Law 1581 of 2012.

9. Privacy notice

In accordance with Articles 14 and 15 of Decree 1377 of 2013, when it is not possible to make this policy fully available to the data subject, they will be informed of its existence and the means to access it.

When sensitive data is collected, the data subject will be informed of the optional nature of its provision and the purposes for which it will be used.

10. Information security

Velvet Aura adopts reasonable administrative, technical, and human measures to protect personal data against loss, alteration, unauthorized access, or use, in accordance with applicable regulations.

The information is processed solely by authorized personnel and is retained for the time necessary to fulfill the purposes of the processing and the applicable legal obligations.

11. Databases

Velvet Aura's databases are registered or in the process of registration in the National Database Registry (RNBD) administered by the Superintendence of Industry and Commerce, in accordance with Decree 886 of 2014, and are updated in accordance with applicable regulations.

12. Term

This policy is in force as of its publication date. Personal data will be retained as long as necessary for the purposes of the processing and, in any case, during the document retention and medical record periods required by Colombian regulations, in accordance with Article 13 of Decree 1377 of 2013.

13. Contact and authority

For any inquiry about this policy, the data subject may contact the telephone number 3151281818.

The Superintendence of Industry and Commerce (SIC) is the supervising authority in matters of personal data protection, before which data subjects may file their complaints once the direct proceedings with the data controller have been exhausted.