DATA PROCESSING POLICY

The Barefoot Foundation (hereinafter the “Foundation”) is a Colombian non-governmental organization, created by the artist Shakira in 1997. We work for the construction of a more equitable and supportive Colombia, with greater opportunities for children. Based in the city of Bogotá D.C., its main objective is to implement a comprehensive intervention model to promote quality public education with private support for children in displaced and vulnerable communities in Colombia, where the school is seen as a center of community development.

In accordance with the provisions of Article 15 of the Political Constitution of Colombia and applicable international legislation on data protection, the Foundation assumes the firm commitment to ensure due protection of the rights of data subjects, as well as to safeguard the personal information provided by them. To achieve this, it has established a FOUNDATION DATA PROCESSING POLICY (hereinafter the “Policy”).

This Data Processing Policy shall be applicable to the processing of data collected by the Foundation through different means such as the Foundation’s Website, or by any other face-to-face mechanism. This Policy establishes the rights and responsibilities of the data owners, as well as the duties and commitments of the Foundation in the use of such information.

For such purposes, “information or personal data” is defined as the data provided by the Holders related to names and surnames, identification, age, gender, profession, addresses, e-mail, telephone numbers, and other data generally used to identify individuals.

Based on the foregoing, the Holders must previously, thoroughly and carefully read this Policy. The terms and conditions set forth herein shall apply to the data provided physically as well as through the Foundation’s Website, for which reason it is recommended to be aware of them before using or exploring the Foundation’s Website; if the Data Subject does not agree with this Policy, he/she should refrain from using the Foundation’s Website or providing his/her data to the Foundation.

DEFINITIONS: Data Subject: Natural person whose personal data is subject to Processing.

Data Controller: The Foundation or any other natural or legal person, public or private, that by itself or in association with others, decides on the processing of data.

Data Processor: Natural or legal person, public or private, who by itself or in association with others, carries out the Processing of personal data on behalf of the Data Controller.

Authorization: Prior, express and informed consent of the Data Subject to carry out the processing of personal data.

Database: Organized set of personal data that is subject to Processing.

Personal Data: Any information linked or that may be associated to one or several determined or determinable natural persons.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or suppression.

Website of the Foundation: It is the Foundation’s virtual page which is located at the virtual address: https://fundacionpiesdescalzos.com/.

I. General Aspects.

The general aspects that guide the Foundation’s Policy are the following: The present Policy of the Foundation establishes under what conditions the Foundation obtains Personal Information, how it is used, how it is protected, and the rights that the Holder of information has in relation to the treatment of such information.

The acceptance of the present Policy of the Foundation by the holders will take place when any of the following events occur: a). Provision of data in the registration forms of the Website and the use of any of the services available on the Website, b). The use of the mechanisms of acceptance, security and access to the Website established by the Foundation, c). The consultation of any content incorporated in the Foundation’s Website, d). The provision of personal data to the Foundation physically or by any other means.

By means of the authorization granted by the Holder, at the time of providing his/her data, he/she accepts this Policy in accordance with the provisions of Article 7° of Decree 1377 of 2013. Such authorization is a prerequisite for accessing or using the Foundation’s Website.

The processing of the personal data of the Holder will have as exclusive purpose: i) To provide information related to the activities of the Foundation; ii) To send the monthly newsletter; iii) To join the Godfather Plan Program according to the conditions established on the website https://fundacionpiesdescalzos.com///mayor-informacion-plan-padrino; iv) To participate in volunteering as indicated in https://fundacionpiesdescalzos.com///mayor-informacion-voluntariado; and v) To make contributions by way of donation according to the information provided in https://fundacionpiesdescalzos.com/ayudanos/donaciones.

This Policy may be modified at any time and without prior notice by the Foundation, for legal or institutional reasons, mediating, to that effect, a timely communication in which the Data Controllers will be notified of the modifications made, unless there is a substantial modification to the purposes of the Policy or a change is made in terms of those responsible for data processing, in which case such modifications will be precisely informed to the Data Controllers in the terms set forth in Law 1581 of 2012 and Decree 1377 of 2013.

II. Personal Registration Information on the Foundation’s Website.

The collection, registration, access and use of personal information is the minimum required to comply with Colombian legal standards and international practices on privacy and data protection on the Internet.

In the treatment of information, the fundamental and prevailing rights of minors and adolescents will be respected in the terms indicated by Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013 and other rules governing the matter.

For the particular case of the use of the Foundation’s Website, it is possible that the user or visitor may be asked to provide certain personal data necessary for the consultation of any information or content incorporated in said Site, the use of any of the services available therein, or to access the interactive mechanisms. Such data will be part of a file and/or database that may be used by the Foundation, within the purposes established in this document or in the respective authorization document.

III. Use of Information

The Foundation does not disclose, sell or rent to third parties the personal information provided by the Holders and/or users of its Website. Such information will be kept with the proper security and confidentiality conditions established in this Policy and in the legal regulations governing the matter and its use will be exclusively for the purposes and purposes for which it was provided. However, it is possible that the Foundation may have to share such information with other institutions or persons with whom it has some kind of relationship, or that by legal provision it is obliged to do so, as in the following cases (article 13 of Law 1581 of 2012):

That of its employees, contractors or affiliates, in order to support operations and activities tending to develop its corporate purpose.

That of financial, credit or credit risk rating entities.

Other entities that make up the Foundation’s community, such as the Treasury, Accounting or members of the Regional Teams.

That of the judicial offices or administrative authorities when so required, in accordance with the final paragraph of Article 15 of the National Constitution of Colombia.

Given the nature of the activities carried out by the Foundation, the Personal Information of a financial nature that is collected from the Holders and that they provide on the occasion of the services they use or request, may be shared with third parties that provide services to the Foundation to perform financial evaluations, all in accordance with the provisions of Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013 and other complementary rules on the management of information contained in personal databases, especially financial, credit, commercial and service information. The Foundation shall adopt the necessary measures for such third parties to apply confidentiality and security measures so that the information provided is not disclosed or used for purposes other than those established in the legal regulations and those defined in this Policy.

It is likely that as a consequence of an institutional organization process, the Foundation may allow the Personal Information provided by the Holders to be consulted or used for specific cases by other members of the Foundation, as for example by the regional teams. In these cases, it should be understood that if the Foundation so permits, it does so solely and exclusively for the purposes of the programs and projects it carries out, but always linked to the Foundation and its activities and never outside the reasons and purposes for which the information was collected. Consequently, third parties who access this information may not use it in any case to contact the Holders or other members of the Foundation for commercial, professional, service or any other purposes.

In the event that the personal information requested is susceptible to be transferred to third parties for the aforementioned purposes, such transfer shall be made based on the authorization given by the Holders in a prior, express and written manner by means of which the transfer of the personal information provided shall be authorized.

IV. Authorization.

For the Foundation, the consent of the Data Holders for the processing of their data is one of the most important elements that make up the concept of privacy. Therefore, within the present Policy, the manifestation of such consent shall be regulated by the following prescriptions:

For the processing of information, prior, express and informed authorization of the Data Subject is required, which must be obtained by any means that may be subject to subsequent consultation.

The Foundation, at the time of requesting the authorization to the Data Subject, shall clearly and expressly inform him/her of the following:

The treatment to which their personal data will be subjected and the purpose thereof.

The optional nature of the answer to the questions asked, when they deal with sensitive data or data of children and adolescents.

The rights you have as Data Subject.

The identification, physical or electronic address and telephone number of the Data Controller.

Such authorization shall empower the Foundation to collect and be responsible for the processing of the information provided by the Holders who, by any means, including the Foundation’s Website, provide information.

The Foundation’s Website has been designed for a general audience and not specifically for minors. However, the Foundation does not collect, use or disseminate data from children or adolescents. However, we are aware that in the event personally identifiable information is collected with respect to a child or adolescent, we will use such information for the sole purpose of contacting a parent or guardian of the child to obtain consent and authorization for the processing of the data. If we are unable to obtain consent after a reasonable period of time, or if when we make contact, the parent or guardian requests that we not use or maintain such information, we will delete such information from our databases.

V. Handling of Information Collected through the Foundation’s Web Site.

Please be advised that the Foundation will communicate with users of its Web Site by electronic means and it will then be their responsibility to be informed of the activities, news and decisions of the Foundation, in the event that the Holder or user chooses not to receive electronic communications, or decides not to enter the Site.

For certain communications and services, the Foundation will request the user’s explicit consent before beginning to process the requested service through its Web Site. The user may opt out of receiving our electronic communications or services by changing the notification option provided on the Web Site, or by using the link that is attached to all e-mails and communications from the Foundation, which will allow the user to unsubscribe from the e-mail list for that particular service or distribution.

VI. Rights of the Holders.

The Holder of the information shall have the following rights:

To know, update and rectify their personal data against the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.

To request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing.

Be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been made of their personal data.

File complaints before the Superintendence of Industry and Commerce for violations of the provisions of the law.

To revoke the authorization and/or request the deletion of the data when the Processing does not respect the principles, rights and constitutional and legal guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the Controller or Processor has incurred in conduct contrary to the law and the Constitution.

Access free of charge to your personal data that have been subject to Processing.

VI. Consultations.

The Data Controllers or their assignees may consult the personal information contained in any of the Foundation’s databases. The Foundation or the Data Controller or Data Processor shall provide them with all the information contained in the individual record or that is linked to the identification of the Data Subject.

The consultation shall be formulated by the Holders or their successors in title in writing, addressed to the following Contact:

[webmaster@fpd.ong], mentioning sufficient information to identify the data of the Holder required.

The foundation will record the date of receipt of the same and will be responsible for processing it.

The consultation will be answered within a maximum term of ten (10) working days from the date of receipt of the same. When it is not possible to attend the consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term.

VII. Access to review, correct and delete information provided on the Foundation’s Website.

Taking into account that the Foundation uses Personal Information only for the purposes for which it was requested, as long as its Holders have given their authorization, the Foundation will take reasonable measures to ensure that such information is used in a correct and pertinent manner according to the purpose for which it was collected. One of the aforementioned measures consists of allowing users access to the information provided through the Website, so that, from their account profile, they can review, modify or update it as they deem necessary or convenient. In order to do so, the user must use the feedback mechanisms offered on the Site, or contact the Foundation at the following address: webmaster@fpd.ong. The Foundation may, at any time, request printed information from users to verify its authenticity.

VIII. Complaints.

The Data Subject, or its assignees, who consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the law, may file a claim with the Foundation or the Responsible or Responsible for the Information, which will be processed under the following rules:

The claim shall be formulated by means of a request addressed to the Data Controller or the Data Processor, with the identification of the Data Subject, the description of the facts giving rise to the claim, the address, and accompanying the documents to be asserted. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned.

In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.

Once the complete claim has been received, a legend will be included in the database stating “claim in process” and the reason for the claim, within a term no longer than two (2) business days. Such legend shall be maintained until the claim is decided.

The maximum term to address the claim shall be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

IX. Obligations and duties of the users of the Foundation’s Website.

The obligations, duties, minimum practices and warnings that the user must comply with and take into account when accessing the Foundation’s Website are the following:

The user must provide the Foundation with true, accurate, updated and complete information when requested for the registration or processing of a service, as indicated in the corresponding form. Additionally, the user agrees to keep this information updated and complete.

The Foundation reserves the right to remove without prior notice to the user, any information that is disclosed on the Website and that it considers harmful or detrimental to its interests or the interests of third parties. However, the Foundation is not obliged to remove information that any user considers offensive or harmful, or to monitor the conversations or dialogues of users or visitors to the Website.

When providing any information to the Foundation, the user must take precautionary measures to prevent the loss or misuse of such information. If such measures are not taken, the Foundation shall not be liable for the use that third parties may make of the information that has not been duly secured and protected by the user.

The user agrees not to collect or disclose the personal data or information of other users of the Foundation’s Web Site and that are disclosed through the same, or that are stored in the Foundation’s information systems. Nor may it publish them on other Websites by any means.

The provision of false information or the omission of any obligation or duty of the user established in this Policy, grants the right to the Foundation to automatically terminate, without notice and definitively, the provision of services to the user.

X. Incorporation by referral.

Both the visitor and the user of the Foundation’s Website are advised that, pursuant to Article 44 of Law 527 of 1999, this Policy is an integral part of the terms of use of this Website and is incorporated by reference therein. Consequently, this Policy and its terms shall be legally valid as if they had been incorporated in their entirety in the text of the terms of use of the Foundation’s Web Site.

XI. Security.

The Foundation is firmly committed to protecting the personal information provided by the Holders, and reasonable security precautions have been taken to maintain such protection.

Notwithstanding the foregoing, in the case of the processing and collection of information through the Foundation’s Website, and in view of the potential dangers of the Internet, the Foundation does not guarantee that the information provided is completely safe from persons attempting to circumvent security measures or intercept Internet transmissions. Therefore, the user or visitor accepts the potential risk involved.

XII. Transfer of Data to Third Countries.

As explained in this Policy, it is possible that the collection, use and disclosure of personal information may require the transfer of such information to third parties. But when such transfer must be made to entities located in other countries where there are no standards equivalent to those of Colombia on privacy and data protection, the Foundation will ask the owner of the information consent to make such transfers, all in accordance with this Policy and subject to the requirements of Colombian law on the subject. The Foundation may entrust the processing of personal data to third parties who shall carry it out under this Policy.

XIII. Term of storage of the information.

The Personal information provided to the Foundation shall be kept and maintained for the time necessary for the efficient provision of the services requested by the Holders, unless they have given different instructions or in any case, for the retention period contemplated in the applicable laws.

XIV. Information automatically collected through the Foundation’s Website.

Non-Identifiable Information.

As is customary on many sites, the Web Site server automatically receives certain non-identifiable information concerning users of the Web Site, such as: computer Internet Protocol (IP) address, Internet Service Provider IP address, date and time you access the Web Site, Internet address of the site from which you linked directly to our Web Site, operating system you are using, sections of the Web Site visited, pages read and images viewed, and any other content you have submitted to or downloaded from the Web Site. The Foundation will use this non-identifiable information only for administrative or statistical purposes, to identify people who threaten its Site and to improve the service provided by the Website.

Cookies.

The Foundation’s Web Site uses “cookies,” a technology by which information is placed on a page user’s computer that is not visible to the visitor to enable the page to recognize future visits by that computer. Cookies increase convenience and enhance the use of the Website.

The Foundation can only read cookies placed by the Site and will not be able to access or read cookies placed by others. Cookies may also be used collectively to detect Site navigation and traffic trends. This aggregated and anonymous information will help improve the content of the Site, and may be shared with the Foundation’s partners or third parties as indicated herein.

If you are a registered user of the Foundation’s Site, when you log on to the Site, you may be presented with a cookie maintained by your browser that contains your identifier. This type of cookie, which does not provide personal information, is used to identify you and to provide you with access to certain areas of the Foundation Site that are restricted to non-registered users, such as those that allow you to view and manage your account.

You may choose to decline cookies placed on the Foundation Site if your browser permits, but this may affect your use of the site and your ability to access certain sections. However, if you choose to register and access them, you must accept them. Most browsers are set by default to accept and maintain cookies. To learn more about cookies and how to specify your cookie preferences, please search for “cookie” in your browser’s “Help” option.

Visitor Audit (Internet Signals)

In order to measure interest in and use of the Web Site, the Web Site may use visitor audits in conjunction with cookies, which may be embedded in Web-formatted e-mail messages sent by (or on behalf of) the Foundation to determine which e-mail messages were opened and to determine whether any of them resulted in an action. The user may render some of these signals unusable by rejecting the cookies with which they are associated. The Foundation does not use these signals to obtain any personal information.

Browsing trends

User clicks” or “user clickstream data” reflects the specific pages on the Internet visited by an individual user and, importantly, the manner or pattern of movement by which a user moves from one page on the Internet to another. The Foundation tracks such information only within its Site; it specifically does not track any such activity outside of the Foundation’s Internet pages.

The data obtained from the navigation trend does not contain or reveal any personal information about the user and we do not match such data with the personal information you provide to us.

XV. Changes to the Foundation’s Data Processing Policy.

This Policy may be modified at any time and without prior notice by the Foundation, for legal or institutional reasons, mediating, to that effect, a timely communication in which the Holders will be notified of the modifications made, unless there is a substantial modification to the purposes of the Policy or a change is made in terms of those responsible for data processing, in which case such changes will be reported precisely to the Holders of information in the terms set forth in Law 1581 of 2012 and Decree 1377 of 2013.

XVI. Contact Us.

The Foundation will constantly verify compliance with this Policy. If the Data Subject has any questions or concerns about this Policy, or about the collection, use and disclosure practices of personal information by the Foundation, he/she may contact us at webmaster@fpd.ong.

When contacting us, the Data Subject should indicate that he/she is requesting information as well as the nature of the information requested. The Foundation will make a reasonable effort to respond promptly to requests, questions or concerns you may have regarding the use of your personal information.

If the Holder receives an unsolicited e-mail message, or any threatening or offensive message, or considers that another user or any person is violating a right under this Policy, he/she must send the Foundation a complete and unmodified copy of the e-mail message received, with the complete headers to the e-mail address indicated above. The present Policy is governed by the Colombian legal norms that regulate the matter and any controversy that arises on the occasion of the use of the same, will be settled by the ordinary Colombian jurisdiction.

In case of using a printed copy of this document, verify that the version number is consistent with the current version available on the Barefoot Foundation Web Portal.

This Policy is effective as of June 2, 2015.