Data processing policy

P-CM-01 PERSONAL DATA PROCESSING POLICY

This Personal Data Processing Policy ("Policy") applies to all Personal Information Holders whose information is processed and/or stored in the Databases of AZUL & BLANCO MILLONARIOS FC S.A., which acts as the Data Controller. The purpose of this Policy is to describe the practices and standards followed by AZUL & BLANCO MILLONARIOS FC S.A. during the processing of Databases and the Personal Data included therein, with the aim of promoting the protection of this information and ensuring the protection of the rights of its Holders. Likewise, this Policy allows the Holder to know how and for what purposes their personal information is processed. Additionally, this Policy aims to ensure that the Processing of Personal Data fully complies with the Colombian Personal Data Protection Regulation ("RPD").

The guidelines established in this Policy are mandatory for AZUL & BLANCO MILLONARIOS FC S.A., as the Controller, as well as all its employees and all third parties acting as Data Processors on behalf of AZUL & BLANCO MILLONARIOS FC S.A.

Both the Controller and its Processors, as well as their employees, contractors, and third parties, must observe and respect these Policies in the performance of their duties and/or activities, even after the termination of legal, commercial, labor, or any other type of relationship. Likewise, they undertake, among other things, to maintain strict confidentiality regarding the data processed.

1. Information of the company responsible for processing personal information.

The company responsible for the Processing will be as indicated below, unless expressly stated otherwise:

Company name: AZUL & BLANCO MILLONARIOS FC S.A.
Domicile and address: Calle 90 No. 19-41, Office 802, Bogotá D.C., Colombia.
NIT. 900.430.878-9
E-mail: contacto@millonarios.com.co

2. Definitions

For the application of this Policy, and in accordance with the provisions of the RPD, the following definitions will be taken into account:

Authorization: Prior, express, and informed consent given by the Holder to the Controller to carry out the Processing of their Personal Data.
Privacy Notice: The verbal or written communication that the Controller makes available to the Holders, by which it informs them about the existence of the applicable Policy, how to access it, and the purposes to which their Personal Data will be subject.
Database: An organized set of Personal Data that is subject to Processing, found in physical or digital form, under the responsibility of AZUL & BLANCO MILLONARIOS FC S.A.
Inquiry: The request made by a Holder, their successor, or their representative to the Controller or Processor, to know their personal information stored in the Databases and to be provided with all the information contained in the individual record or linked to the identification of the Holder in any of the Databases.
Cookies: These are automated files and/or tools that AZUL & BLANCO MILLONARIOS FC S.A.'s website installs on the Digital User's device to collect information, including personal information.
Personal Data: Any information linked or that can be associated with one or more specific or determinable natural persons.
Public Data: Data that is not semi-private, private, or sensitive. Public Data includes, among others, data related to the civil status of individuals, profession or occupation, and the status of merchant or public servant.
Sensitive Data: Those that affect the Holder's privacy or whose improper use may lead to discrimination, such as those revealing racial or ethnic origin, political orientation, religious, moral, or philosophical convictions, membership in unions, social organizations, human rights organizations, or those promoting interests of any political party or guaranteeing the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
Data Processor: The natural or legal person, public or private, who, alone or in association with others, performs the Processing of Personal Data on behalf of the Data Controller.
Policy: Refers to this Personal Data Processing Policy of AZUL & BLANCO MILLONARIOS FC S.A.
Data Controller: Natural or legal person, public or private, who, alone or in association with others, decides on the Database and/or the Processing of Personal Data.
Complaint: The request submitted by the Holder, their successor, or representative, to the Controller or Processor, in cases where they consider that the information contained in a Database should be subject to correction, update, or deletion; or, in cases where they identify an alleged breach of a duty under the RPD.
Colombian Personal Data Protection Regulation - RPD: Refers to the regulations governing the protection of Personal Data in Colombia, which includes Statutory Law 1266 of 2008, Statutory Law 1581 of 2012, Law 2300 of 2023, Decree 886 of 2014, Single Regulatory Decree 1074 of 2015, Decree 255 of 2022, Title V of the Single Circular of the Superintendency of Industry and Commerce, and any other norms that supplement or modify them.
Holder: Natural person whose Personal Data is subject to Processing.
Transfer: Data Transfer occurs when the Controller and/or Processor of Personal Data, located in Colombia, sends the personal data information to a recipient, who in turn is a Data Controller and is located inside or outside the country.
Transmission: Processing of Personal Data that involves the communication of data within or outside the territory of the Republic of Colombia when its purpose is to carry out processing by the Processor on behalf of the Controller.
Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation, or deletion.

3. Personal Data collected and/or processed

The Processing of Personal Data will be contained in the Privacy Notice or in the Authorization for each of the types of Holders to whom they apply, for example, customers, suppliers, employees, shareholders, academy students, etc. AZUL & BLANCO MILLONARIOS FC S.A. and/or its Processors will collect different Personal Data based on the context of their interactions with the Holders, future requests made by the Holders regarding the Processing of their information, projects and/or activities developed by AZUL & BLANCO MILLONARIOS FC S.A., their location, and applicable legislation. Among the Personal Data that AZUL & BLANCO MILLONARIOS FC S.A. may collect are:

a) Name, type, and identification number.

b) Contact details (i.e., phone number and email address).

c) Physical address

d) Position or profession

e) Demographic, social, and/or geolocation data

f) Credit, asset, tax, or financial information

g) Interests or preferences

h) Voice data, images, and/or videos

i) Electronic identification data or web credentials and Website information, including technical information about connection means or Internet service provider number.

j) Data on people's morphology (weight, height, eye color, among others)

k) Data related to health status, physical condition, and others

l) Data related to sexual orientation

m) Biometric data

n) Statistical data on physical performance, sports performance, etc.

o) Data on vulnerability status or belonging to ethnic minorities

The Personal Data indicated in letters j), k), l), m), n) and o) are considered Sensitive Data, so their Processing will follow what is indicated for this type of information according to numeral 6 of this Policy.

4. Collection of Personal Data

AZUL & BLANCO MILLONARIOS FC S.A., whenever it needs to collect and/or Process the Personal Data of any Holder, will carry out said Processing only when it has been authorized by the Holder in a prior, express, and informed manner, or when, in accordance with what is expressly established in the RPD, the Holder's Authorization is not required. Authorization may be granted in writing, verbally, or by means of unequivocal conduct on the part of the Holder and must be recorded in any medium, such as a physical document, electronic document, or in any format that allows for its subsequent consultation.

The Authorization described in the preceding paragraph will not be necessary in the following cases:

a) The Processing involves the delivery of information required by a public or administrative entity in the exercise of its legal functions or by judicial order.

b) The Processing is carried out on Public Data.

c) The Processing is carried out in cases of medical or health emergency.

d) The Processing is carried out for historical, statistical, or scientific purposes.

e) The Processing is carried out on information related to the civil registry of persons.

Personal Data will be obtained directly from the Holder, through manual or automated mechanisms, or from publicly accessible sources, without prejudice to what is established in this Policy regarding Authorization.

AZUL & BLANCO MILLONARIOS FC S.A., in its capacity as Controller of the collected and Processed Personal Data, as well as its Processors (when applicable), will keep proof of the Authorization issued by the Holder and/or their representative, which must be available at all times for their consultation.

At the time the Holder grants their Authorization, AZUL & BLANCO MILLONARIOS FC S.A. will inform them of the purposes and the Processing to which their Personal Data will be subjected, their rights, and the means by which they can exercise them. The Holder may revoke their Authorization and request the immediate deletion of their Personal Data through the channels established in this Policy, unless there is a contractual or legal duty to remain in the Database.

5. Processing to which Personal Data will be subjected and its purpose

The Processing of Personal Data by AZUL & BLANCO MILLONARIOS FC S.A. will be carried out with the purpose of fulfilling the following purposes:

FOR YOUTH FOOTBALL PLAYERS AND PROFESSIONAL TEAMS

· Carry out recruitment processes for youth football players and/or professional teams, which may include activities such as statistical, physiological, medical, psychological, sports, and/or any other type of information analysis, as well as the development of live trials at the facilities of AZUL & BLANCO MILLONARIOS FC S.A. or other facilities contracted by it.

· Perform the necessary activities for the development of the relationship with youth football players and professional teams, and the fulfillment of the obligations arising from the existing relationship, as well as enabling the organization to comply with its social, corporate, credit, or any other type of obligations.

· Register players for local, regional, national, and/or international tournaments in which they will participate as high-performance athletes.

· Submit information for processing by entities related to the Social Security and Health Management System.

· Carry out the necessary activities for managing player travel, including arrangements associated with proper nutrition, transportation, and lodging for the Data Subjects during the corresponding trip.

· Conduct occupational medical tests, as well as specific medical tests related to the performance of duties and activities as high-performance athletes.

· Disclose the Data Subject's health status to the media, particularly regarding injuries they may suffer in the performance of their duties and the evolution of the corresponding injury.

· Refer medical records and other information associated with the Data Subject's health status to hospitals, clinics, and medical institutions of any kind, so that they can address the Data Subject's medical needs.

· Allow the Data Subject to enter the "Casa Hogar" (Youth Academy House) administered by AZUL & BLANCO MILLONARIOS FC S.A., and carry out all procedures related to the management of the property, as well as the players' food and lodging.

· Allow access to AZUL & BLANCO MILLONARIOS FC S.A.'s platforms and systems, manage the creation of user profiles and passwords.

· Issue certifications, diplomas, or similar or related documents.

· Implement and manage incentives, benefits, and wellness programs for Employees and/or their families.

· Collect images, audio, and/or videos of the Data Subject for the purpose of preparing texts, visual, or audiovisual materials, to be used in internal and/or external corporate communications, including the website, social media, and other publications for commercial, advertising, or promotional purposes.

· Conduct statistical and data analytics studies, including those using artificial intelligence and big data tools, to develop tactical and performance analysis of the players. This includes performance information from matches and training, as well as statistical information collected directly by AZUL & BLANCO MILLONARIOS FC S.A. or a third party.

· Notify family members in case of emergencies during their stay at the facilities.

· Transmit Personal Data to third parties, located outside or inside the country, who will process the Data as Processors for the stated purposes.

· Transfer or transmit Personal Data to third parties, located outside or inside the country, for the development of the relationship with the Data Subject or within the framework of strategic transactions, including the commercial relationship with Partners and Sponsors. Similarly, information may be transferred to governing bodies of Colombian Professional Football, such as DIMAYOR and the Colombian Football Federation, as well as to other professional football teams, so that they may develop, as Controllers, the stated purposes.

FOR SHAREHOLDERS

· Maintain efficient communication with information that is useful for the development and fulfillment of existing obligations with Shareholders, including all those related to corporate governance.

· Communicate, record, archive, organize, process, and manage the actions, strategies, and activities in which the Shareholders of AZUL & BLANCO MILLONARIOS FC S.A. are involved.

· Consult and report information to restrictive lists, risk bureaus, and/or other information operators; and, make the corresponding reports to these information operators.

· Verify compliance with the regime of disqualifications and incompatibilities provided for in the law and in the internal rules established by AZUL & BLANCO MILLONARIOS FC S.A.

· Carry out the registration procedures required before the respective Chamber of Commerce and, where applicable, the swearing-in before the competent authorities.

· Carry out all administrative, accounting, and tax activities that allow AZUL & BLANCO MILLONARIOS FC S.A. to comply with its social, corporate, credit, or any other type of obligations.

· Present ultimate beneficial owner information in tax procedures, present information to authorities, support auditing processes, and conduct statistical studies or accounting processes.

· Verify and update Personal Data, as well as inform about changes in the Policy and/or the purposes of Processing.

· Transmit Personal Data to third parties, located outside or inside the country, who will process the Data as Processors for the stated purposes.

FOR BOARD OF DIRECTORS MEMBERS

· Maintain efficient communication with information that is useful for the development and fulfillment of existing obligations with Board of Directors Members, including all those related to corporate governance.

· Communicate, record, archive, organize, process, and manage the actions, strategies, and activities in which the Board Members of AZUL & BLANCO MILLONARIOS FC S.A. are involved.

· Consult and report information to restrictive lists, risk bureaus, and/or other information operators; and, make the corresponding reports to these information operators.

· Verify compliance with the regime of disqualifications and incompatibilities provided for in the law and in the internal rules established by AZUL & BLANCO MILLONARIOS FC S.A.

· Carry out the registration procedures required before the respective Chamber of Commerce and, where applicable, the swearing-in before the competent authorities.

· Carry out all administrative, accounting, and tax activities that allow AZUL & BLANCO MILLONARIOS FC S.A. to comply with its social, corporate, credit, or any other type of obligations.

· Present ultimate beneficial owner information in tax procedures, present information to authorities, support auditing processes, and conduct statistical studies or accounting processes.

· Verify and update Personal Data, as well as inform about changes in the Policy and/or the purposes of Processing.

· Transmit Personal Data to third parties, located outside or inside the country, who will process the Data as Processors for the stated purposes.

FOR CANDIDATES AND EMPLOYEES

· Carry out the necessary activities for the development of the relationship with Employees or with the Educational Institution that provides interns, and the fulfillment of the obligations arising from the existing relationship, as well as enabling the organization to comply with its social, corporate, credit, or any other type of obligations.

· Carry out personnel selection processes, in accordance with the selection policies of AZUL & BLANCO MILLONARIOS FC S.A., which includes conducting security studies (such as polygraph tests or home visits), maintaining efficient communication of information that is useful for the development of these processes, and knowing and evaluating information related to their academic, professional, and work activities.

· Contact you for future selection processes that match your professional profile, up to one year after your original application.

· Submit information for processing by entities related to the Social Security and Health Management System.

· Conduct occupational medical tests.

· Allow access to AZUL & BLANCO MILLONARIOS FC S.A.'s platforms and systems, manage the creation of user profiles and passwords.

· Implement and manage incentives, benefits, and wellness programs for Employees and/or their families.

· Notify family members in case of emergencies during their stay at the facilities.

· Conduct monitoring, scheduled or unscheduled, of the technological tools used by the Data Subject for the performance of their duties.

· Transmit Personal Data to third parties, located outside or inside the country, who will process the Data as Processors for the stated purposes.

FOR STORE CUSTOMERS, CORPORATE CUSTOMERS, PARTNERS AND SPONSORS

· Provide the contracted products and/or services, execute the partnership or sponsorship, and carry out all necessary activities to execute the commercial relationship with the Data Subject.

· Advance commercial agreements, events, or business programs directly or in association with third parties, as well as selection processes, invitations to submit offers, among others, for the signing of such agreements.

· Conduct satisfaction campaigns and monitor the quality of products and/or the provision of services by AZUL & BLANCO MILLONARIOS FC S.A.

· Implement loyalty programs.

· Send communications by physical mail, email, text message, call, instant messaging applications, or through any other means of communication with commercial, advertising, or promotional information about the products, services, events, promotions, and/or commercial or advertising contests related to AZUL & BLANCO MILLONARIOS FC S.A. Also, send communications through the indicated mechanisms to carry out collection or portfolio recovery tasks.

· Verify information in credit bureaus or restrictive lists, for the purpose of using it as an element of analysis in the commercial relationship and reporting information to credit bureaus, restrictive lists, and/or any other information operator.

· Certify the commercial relationships generated between the parties.

· Make phone calls, send emails, conduct verification visits, send communications, and verify references.

· Comply with legal information obligations to administrative entities, as well as to competent authorities that may require it.

· Conduct market, statistical, and data analytics studies, and marketing, commercial, and business intelligence activities, including those that use artificial intelligence and big data tools, to analyze the feasibility of new products or services, improve service delivery, and enhance the development of AZUL & BLANCO MILLONARIOS FC S.A.'s commercial strategies.

· Carry out all administrative, accounting, tax due diligence, and invoicing activities that enable AZUL & BLANCO MILLONARIOS FC S.A. to fulfill its social, corporate, credit, or any other obligations.

· Verify and update Personal Data, as well as inform about changes in the Policy and/or the purposes of Processing.

· Process orders, requests, or any type of petition, claims, or inquiries made by the Data Subject.

· Transmit Personal Data to third parties, located outside or within the country, who will carry out the Processing as Processors for the mentioned purposes.

· Transfer or transmit Personal Data to third parties, located outside or within the country, for the development of the relationship with the Data Subject or within the framework of strategic transactions, including the commercial relationship with Partners and Sponsors.

FOR SUPPLIERS

· Carry out all necessary activities to properly execute existing contracts and/or any other relationship with the Data Subject.

· Enter into commercial agreements, events, or business programs directly or in association with third parties, as well as selection processes, invitations to submit bids, among others, for the signing of such agreements.

· Maintain communications with information that is useful for the development of the legal or commercial relationship.

· Verify and update Personal Data, as well as inform about changes in the Policy and/or the purposes of Processing.

· Issue certificates, diplomas, or similar or related documents.

· Transmit Personal Data to third parties, located outside or within the country, who will carry out the Processing as Processors for the mentioned purposes.

FOR SUBSCRIBERS AND EVENT ATTENDEES

· Carry out all necessary activities to properly execute existing contracts and/or any other relationship with the Data Subject.

· Send communications by physical mail, email, text message, call, instant messaging applications, or through any other means of communication with commercial, advertising, or promotional information about products, services, events, promotions, and/or commercial or advertising contests, related to AZUL & BLANCO MILLONARIOS FC S.A. Also, send communications through the indicated mechanisms to carry out collection or portfolio recovery efforts.

· Collect images, audio, and/or videos of the Data Subject for the purpose of preparing texts, visual or audiovisual materials, to be used in internal and/or external corporate communications, including the website, social networks, and other publications for commercial, advertising, or promotional purposes. This includes, in particular, the collection of images, audio, and/or videos of attendees at sporting events in which AZUL & BLANCO MILLONARIOS FC S.A. participates.

· Conduct statistical and data analytics studies, and marketing, commercial, and business intelligence activities, including those that use artificial intelligence and big data tools, to analyze the feasibility of new products or services, improve service delivery, and enhance the development of AZUL & BLANCO MILLONARIOS FC S.A.'s commercial strategies.

· Allow the Data Subject to participate in and/or attend sporting, corporate, advertising, commercial, wellness, and any other events that are developed (totally or partially) or sponsored by AZUL & BLANCO MILLONARIOS FC S.A.

· Verify and update Personal Data, as well as inform about changes in the Policy and/or the purposes of Processing.

· Process orders, requests, or any type of petition, claims, or inquiries made by the Data Subject.

· Transmit Personal Data to third parties, located outside or within the country, who will carry out the Processing as Processors for the mentioned purposes.

FOR ACADEMY STUDENTS AND THEIR GUARDIANS

· Carry out all necessary activities to properly enroll the Student and their Guardians within the framework of AZUL & BLANCO MILLONARIOS FC S.A.'s operations, as well as the execution of said relationship, including payment management, collection management, and student enrollment in sports tournaments.

· Register the minor as an athlete with AZUL & BLANCO MILLONARIOS FC S.A.

· Verify medical information and health status to confirm that the Student can perform the sports activities of AZUL & BLANCO MILLONARIOS FC S.A.

· Use personal and affiliation information for the occupational health and safety management system.

· Conduct video surveillance recordings to ensure security management in our facilities, carry out corresponding investigations in case of risk situations or security breaches, manage risks or accidents within the facilities/venues, and preserve the security of assets and people.

· Disclose Personal Data, as well as audiovisual materials incorporating this data, for institutional advertising purposes in audiovisual media, radio, photography, internet, social networks, screens at public/sporting events, newspapers, pamphlets, public roads, and/or any other support.

· Provide the products and/or services contracted to AZUL & BLANCO MILLONARIOS FC S.A. and its Partners.

· Conduct satisfaction campaigns, statistical studies, data analytics, and monitoring of the quality of sports activities developed and, in general, of the products and/or services provided by AZUL & BLANCO MILLONARIOS FC S.A.

· Process orders, requests, or any type of petition, claim, or inquiry made through any of the contact forms made available to the public.

· Carry out accounting, fiscal, administrative, due diligence, invoicing, and other activities inherent to the commercial relationship.

· Send communications by physical mail, email, mobile device, instant messaging applications, communication networks, or through any other means of communication with commercial, advertising, or promotional information about products, services, events, promotions, and/or commercial or advertising contests, related to AZUL & BLANCO MILLONARIOS FC S.A.

· Verify and update Personal Data, as well as inform about changes in the Policy and/or the purposes of Processing.

· Send communications inherent to the development of the Academy's activities with information useful for the relationship's development.

· Maintain attendance and activity performance records, tracking activities carried out within the framework of AZUL & BLANCO MILLONARIOS FC S.A.'s sports activities and initiatives.

· Maintain historical records of payments and performance specific to the activities.

· Transmit Personal Data to third parties, located outside or within the country, who will carry out the Processing as Processors for the mentioned purposes.

FOR DIGITAL USERS AND FPQRS APPLICANTS

· Develop promotional activities such as games, contests, and raffles, related to the Controller's products and services.

· Process orders, requests, or any type of petition made by the User through any of the contact forms made available to them.

· Send communications by physical mail, email, text message, call, instant messaging applications, or through any other means of communication with commercial, advertising, or promotional information about products, services, events, promotions, and/or commercial or advertising contests, related to AZUL & BLANCO MILLONARIOS FC S.A., which implies recognizing the User's device on future visits to the website, locating the User's geographical location, knowing browsing activity on the website; and ensuring the security and reliability of the website.

· Submit information to control and surveillance authorities, as well as support internal or external audit processes and accounting processes.

· Verify and update Personal Data, as well as inform about changes in the Policy and/or the Purposes of Processing.

· Transmit Personal Data to third parties, located outside or within the country, who will carry out the Processing as Processors for the mentioned purposes.

FOR PARTICIPANTS IN ADVERTISING MATERIALS

· Carry out all necessary activities to properly execute any contractual, commercial, and/or any other relationship that arises between AZUL & BLANCO MILLONARIOS FC S.A. and the Data Subject.

· Collect images, audios and/or videos of the Data Subject for the purpose of preparing texts, visual or audiovisual materials, to use them in internal and/or external corporate communications, including the website, social media and other publications for commercial, advertising or promotional purposes.

· Conduct statistical studies, data analytics, and marketing, commercial, and business intelligence activities, including those that use artificial intelligence and big data tools, to develop analyses on the viability of new products or services, improve the provision of services, and improve the development of the commercial strategies of AZUL & BLANCO MILLONARIOS FC S.A.

· Transmit Personal Data to third parties, located outside or within the country, who will process it as Data Processors for the mentioned purposes.

FOR VISITORS

· Control access and stay at the different headquarters of AZUL & BLANCO MILLONARIOS FC S.A.

· Use Video Surveillance Systems to maintain the security of AZUL & BLANCO MILLONARIOS FC S.A. facilities.

· Verify if the Data Subject is authorized to enter the facilities of AZUL & BLANCO MILLONARIOS FC S.A. and the areas where they can circulate.

· Comply with legal information obligations to administrative entities, as well as to competent authorities that so require.

· Ensure the security of the facilities and the adequate provision of services and products of AZUL & BLANCO MILLONARIOS FC S.A. or any other third party directly or indirectly linked to AZUL & BLANCO MILLONARIOS FC S.A.

· Carry out all administrative activities that allow AZUL & BLANCO MILLONARIOS FC S.A. to comply with its social, corporate, credit or any other kind of obligations.

· Present information to judicial, administrative and/or control and surveillance authorities, support internal or external audit processes, and conduct statistical studies or accounting processes.

· Serve as evidence in cases of claims by the Data Subject regarding situations that occur within the facilities of AZUL & BLANCO MILLONARIOS FC S.A.

· Transmit Personal Data to third parties, located outside or within the country, who will process it as Data Processors for the mentioned purposes.

FOR JOURNALISTS

· Provide information of interest or for public knowledge with the purpose of supporting the communication strategy of AZUL & BLANCO MILLONARIOS FC S.A.

· Convene spaces for the delivery of public messages, the development of press conferences, events, sessions and meetings.

· Carry out the accreditation process for journalists who intend to access press conferences and other communication events held by AZUL & BLANCO MILLONARIOS FC S.A.

· Deliver tickets or other goods or services related to AZUL & BLANCO MILLONARIOS FC S.A., within the framework of the relationship with Journalists.

· Issue certifications, diplomas or similar or related documents.

· Transmit Personal Data to third parties, located outside or within the country, who will process it as Data Processors for the mentioned purposes.

FOR “HINCHA EMBAJADOR DORADO (HED)” AFFILIATES

· Develop the necessary activities to allow the Data Subject's affiliation to the "Hincha Embajador Dorado" loyalty program, as well as to adequately execute the relationship with the Data Subject.

· Provide the contracted products and/or services, as well as generate and manage promotional activities, incentives, benefits and wellness programs aimed at Data Subjects and/or their families.

· Conduct satisfaction campaigns and monitor the quality of products and/or the provision of services by AZUL & BLANCO MILLONARIOS FC S.A.

· Send communications by physical mail, email, text message, call, instant messaging applications, or through any other means of communication with commercial, advertising or promotional information about the products, services, events, promotions, and/or commercial or advertising contests, related to AZUL & BLANCO MILLONARIOS FC S.A.

· Conduct market studies, statistical studies, data analytics, and marketing, commercial, and business intelligence activities, including those that use artificial intelligence and big data tools, to develop analyses on the viability of new products or services, improve the provision of services, and improve the development of the commercial strategies of AZUL & BLANCO MILLONARIOS FC S.A.

· Carry out all administrative, accounting, tax due diligence and invoicing activities that allow AZUL & BLANCO MILLONARIOS FC S.A. to comply with its social, corporate, credit or any other kind of obligations.

· Carry out the verification and updating of Personal Data, as well as inform about changes in the Policy and/or in the purposes of the Processing.

· Process orders, requests or any type of petition, Claims or Consultations made by the Data Subject.

· Transmit Personal Data to third parties, located outside or within the country, who will process it as Data Processors for the mentioned purposes.

6. Processing of Special Categories of Personal Data (Sensitive Data, Children's Data and Unsolicited Data)

SENSITIVE DATA

In cases where it is absolutely necessary, AZUL & BLANCO MILLONARIOS FC S.A. will collect and/or process Sensitive Data. If applicable, AZUL & BLANCO MILLONARIOS FC S.A. will inform Data Subjects of the Sensitive Data that would be subject to Processing, the specific purposes of its Processing, and that they are not obliged to provide it, except in cases where there is a legal duty that so requires.

AZUL & BLANCO MILLONARIOS FC S.A. reserves the right to collect Personal Data, including Sensitive Data such as health data and biometric data, for the purpose of complying with the purposes indicated in this Policy.

MINORS (CHILDREN AND/OR ADOLESCENTS)

The Processing of Personal Data of children and/or adolescents will respond to and respect the best interests of minors; it will guarantee respect for their fundamental rights and will be carried out only for the purposes informed in the previous section.

In these cases, AZUL & BLANCO MILLONARIOS FC S.A. will request the corresponding Authorization from the legal representative of the child or adolescent; and will do its best to verify that the person acting as the legal representative of the child or adolescent indeed holds this capacity. However, it will assume the good faith of the person granting the Authorization and stating that they have the capacity of legal representative.

The remote contact channels enabled by AZUL & BLANCO MILLONARIOS FC S.A., such as its website, instant messaging platforms, and telephone lines, are exclusively intended for adults, i.e., those over eighteen years of age. Therefore, AZUL & BLANCO MILLONARIOS FC S.A. does not deliberately collect Personal Data from children and/or adolescents through these channels.

UNSOLICITED DATA

Prior to the formal initiation of commercial, labor, or any other type of relationship with AZUL & BLANCO MILLONARIOS FC S.A., Personal Data may be sent without the Authorization granted by the Data Subject. In these cases, the Data Subject accepts that, by their unequivocal conduct consisting of sending their information to AZUL & BLANCO MILLONARIOS FC S.A., they authorize the latter to process their Personal Data for the purpose strictly related to the procedure or request made. Authorization by unequivocal conduct will apply, including, but not limited to, sending information from:

a) Individuals who wish to work at AZUL & BLANCO MILLONARIOS FC S.A.

b) Individuals who wish to become Suppliers, Corporate Clients, Partners, Sponsors, Subscribers, Academy Students, Journalists or HED Affiliates of AZUL & BLANCO MILLONARIOS FC S.A.

c) Individuals who submit requests, complaints or claims of any nature to AZUL & BLANCO MILLONARIOS FC S.A.

d) Information collected through video surveillance systems.

Notwithstanding the foregoing, and only if the relationship with these third parties is formalized, the corresponding Authorization will be requested to continue with the Processing of Personal Data for other purposes.

7. Processing of Personal Data using Website Cookies

AZUL & BLANCO MILLONARIOS FC S.A. may implement Cookies to collect and process Personal Data of Digital Users. AZUL & BLANCO MILLONARIOS FC S.A. will act as the Data Controller for the information collected through its own Cookies and will subject its Processing to the protection standards established in the RPD and the provisions of this Policy. Likewise, AZUL & BLANCO MILLONARIOS FC S.A. acts as the Data Processor for Personal Data collected through third-party Cookies.

On its website, AZUL & BLANCO MILLONARIOS FC S.A. may implement the following Cookies:

COOKIE TYPE (ACCORDING TO WHO MANAGES THEM)

a) First-party: are sent/installed on the Digital User's device from the equipment/domain managed by AZUL & BLANCO MILLONARIOS FC S.A. and from which the service requested by the User is provided. In this case, AZUL & BLANCO acts as the Controller.

a) Third-party: Are sent/installed on the User's device from the equipment/domain managed by a third party, other than AZUL & BLANCO MILLONARIOS FC S.A. This third party is the one who processes the Personal Data and, therefore, acts as the Data Controller.

COOKIE TYPE (ACCORDING TO ITS PURPOSE)

a) Necessary: These are implemented to enable essential functions for the basic operation of the website, without which it cannot operate properly.

b) Statistical: These are implemented with the purpose of understanding how Digital Users interact with the website and thus perform statistical analysis of the services provided.

c) Preference: These are implemented with the purpose of remembering information about the Digital User's decisions/choices during previous access to the website, which may differentiate their browsing experience from that of other Digital Users. For example, language, the region from which the service is accessed, among others.

d) Advertising or Marketing: These are implemented with the purpose of collecting and storing information related to the behavior of Digital Users, particularly their browsing habits, to develop a specific profile of the Digital User and send/display advertising based on this profile.

COOKIE TYPE (ACCORDING TO WHO MANAGES THEM)

a) Session: These are used to collect, store, and process information only while the Digital User accesses the Website. They disappear/are deleted from the Digital User's device once the session ends.

b) Persistent: These are used to collect, store, and process information for periods longer than the Digital User's session time (the time can vary between a few minutes and several years, depending on the particular purpose). They remain stored on the Digital User's device after the session ends.

8. Transmission, Transfer, and Circulation of Personal Data

AZUL & BLANCO MILLONARIOS FC S.A. may send the Personal Data under its responsibility to Allies/Sponsors or any other third party, domiciled in Colombia or abroad, acting as Processors, who provide services to AZUL & BLANCO MILLONARIOS FC S.A. and who will process the personal information for the purposes established in this Policy and in the Authorizations granted by the Data Subjects. The Processing of Personal Data under these circumstances will be carried out on behalf of and in the name of AZUL & BLANCO MILLONARIOS FC S.A. as the Controller.

Additionally, AZUL & BLANCO MILLONARIOS FC S.A., with prior Authorization from the Data Subjects, may transfer Personal Data to third parties, including its Allies and Sponsors, domiciled in Colombia or abroad (including jurisdictions that do not have adequate levels of Personal Data protection, as defined by the DPR and the Superintendence of Industry and Commerce), for them to process as independent or co-controllers. This may be done within the framework of alliances and strategic businesses, asset sale operations involving Personal Data, database commercialization operations, development of technological platforms or applications, development of information/content dissemination portals, among other activities related in the Authorization obtained from the Data Subject.

9. Rights of the Data Subjects

In accordance with the provisions of Article 8 of Law 1581 of 2012 and Decree 1074 of 2015, the Data Subject has the following rights with respect to AZUL & BLANCO MILLONARIOS FC S.A.:

a) To know, update, and rectify their Personal Data with AZUL & BLANCO MILLONARIOS FC S.A. and/or its Data Processors. This right may be exercised, among others, with respect to partial, inaccurate, incomplete, fragmented, misleading data, or those whose Processing is expressly prohibited or has not been authorized;

b) To request proof of the Authorization granted to AZUL & BLANCO MILLONARIOS FC S.A. unless expressly exempted as a requirement for Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012;

c) To be informed by AZUL & BLANCO MILLONARIOS FC S.A. and/or its Data Processors, upon request, regarding the use made of their Personal Data;

d) To file complaints with the Superintendence of Industry and Commerce for infringements of the provisions of the DPR;

e) To revoke the Authorization and/or request the deletion of the data;

f) To access their Personal Data that has been subject to Processing free of charge.

10. Person or area responsible for handling requests, inquiries, and complaints to whom the Data Subject may exercise their rights.

AZUL & BLANCO MILLONARIOS FC S.A. has an administrative infrastructure, among other functions, to ensure due attention to requirements, requests, inquiries, complaints, and claims related to Personal Data protection, in order to guarantee the exercise of rights. For this purpose, the Personal Data Protection Officer has been designated as the internal person responsible for attending to and managing the Inquiries and Complaints received by AZUL & BLANCO MILLONARIOS FC S.A.

For inquiries, complaints, grievances, or requests for the exercise of your rights as a Data Subject, you may contact the Personal Data Protection Officer of AZUL & BLANCO MILLONARIOS FC S.A. by sending an email to: contacto@millonarios.com.co

11. Procedure for the Data Subject to exercise their rights.

In principle, for the exercise of the Data Subjects' rights by them, their representatives or their successors, the Inquiry or Complaint must be addressed to the channel established in the previous section of this Policy. The Data Subject must clearly describe their request for Inquiry, correction, update or deletion. In the event that the Complaint relates to a possible breach by AZUL & BLANCO MILLONARIOS FC S.A. or its Processors of any of their duties, the reason for the breach must be indicated in detail.

INQUIRIES

AZUL & BLANCO MILLONARIOS FC S.A. guarantees the right of Inquiry, providing to individuals acting in exercise of this right, all the information contained in the individual record or that is linked to the identification of the Data Subject. At the time of submitting the Inquiry, the Data Subject or applicant must fully identify themselves and clearly describe their Inquiry. In case they are not acting as the Data Subject, they must indicate the capacity in which they are acting and attach the document that authorizes them to make the request or Inquiry, be it a power of attorney, civil registry, among others.

In any case, Inquiries will be answered within a maximum period of ten (10) business days from the date of receipt. When it is not possible to answer the Inquiry within this period, the applicant will be informed before the expiration of the 10 business days, stating the reasons for the delay and indicating the date on which their Inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first period.

COMPLAINTS

When the Complaint is based on a possible breach by AZUL & BLANCO MILLONARIOS FC S.A. or its Processors of any of its duties, the applicant must indicate in detail the reason for the breach.

If the Complaint received does not contain complete information that allows it to be processed, in accordance with what is indicated in this Policy, the applicant will be required, within five (5) days following its receipt, to correct the deficiencies. If two (2) months have passed since the date of the request without the applicant providing the required information, it will be understood that the Complaint has been withdrawn.

The maximum term to address the Complaint will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to address it within said term, the applicant will be informed before the expiration of the referred term of the reasons for the delay and the date on which their Complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

The Complaint must be submitted through the means enabled by AZUL & BLANCO MILLONARIOS FC S.A. for this purpose, indicated in this document, and must contain, at a minimum, the following information:

a) The Data Subject's name and contact information for receiving a response, such as, among others, telephone, email, residential address.

b) Documents proving the Data Subject's identity or their status as representative or successor of the Data Subject.

c) A clear and precise description of the Personal Data concerning which the Data Subject seeks to exercise any of their rights.

d) The facts on which the Complaint is based.

e) If applicable, other elements or documents that facilitate the location of the Personal Data.

Data Subjects may revoke their Authorization at any time, provided that a legal provision or contractual obligation does not prevent it. Therefore, if the Complaint requests the deletion of Personal Data and/or revocation of the Authorization, AZUL & BLANCO MILLONARIOS FC S.A. will proceed accordingly, unless there is a legal or contractual duty for the Data Subject to remain in the Database. Nevertheless, AZUL & BLANCO MILLONARIOS FC S.A. will keep a copy of the Complaint, including the information contained therein, for documentary purposes in eventual administrative and/or judicial processes.

There will be two modalities in which the revocation of consent can occur. The first, regarding all consented purposes, meaning that AZUL & BLANCO MILLONARIOS FC S.A. must completely stop processing the Data Subject's data. The second, may be about certain types of Processing, such as for market research. Therefore, it will be necessary for the Data Subject, when filing the Complaint, to indicate whether the revocation they intend to make is total or partial. In the case of partial revocation, they must indicate which type of Processing or purposes the Authorization is being revoked for. If no mention is made regarding this particular, AZUL & BLANCO MILLONARIOS FC S.A. will assume that the Complaint refers to a total revocation.

12. Effective date of the Policy and validity period of the Database

This Policy came into effect on June 10, 2022. This version of the Policy has been in effect since March 10, 2025. The Databases under the responsibility and/or administration of AZUL & BLANCO MILLONARIOS FC S.A. will be valid for the same period that the Personal Data is used for the purposes described in this Policy; and, the Personal Data included therein will be retained for that term, unless the Data Subject requests its deletion and there is no legal or contractual duty to retain the information.

AZUL & BLANCO MILLONARIOS FC S.A. informs that any substantial change in the Policy will be communicated timely through its Website.

Sincerely, (Originally signed)

LILIANA DEL PILAR MÉNDEZ PEÑA

Legal Representative (ad interim)

Language

Language

Your cart is empty

Data processing policy