1. General objective and specific objectives

1.1. General objective

Through this Manual, BMI Colombia reports on the existence of the Information Processing Policies and the purposes of the Processing adopted by the Company.

1.2. Specific objectives

• To inform Data Subjects of the principles to which BMI Colombia subjects the processing of personal data.
• To inform Data Subjects of their rights regarding data protection.

• To establish and communicate the procedure in place for Data Subjects to consult their information or request its correction, update or deletion.

   

2. Scope

The provisions of this Manual shall apply to the personal data of our consumers (customers, potential customers, users), intermediaries, employees and suppliers. All BMI Colombia staff are covered by this policy.

Likewise, our business partners, suppliers and contractors who, in the course of their work, have access to personal data of data subjects, whether because they have provided such data to BMI Colombia or received it from it, are required to comply with the law and with this Policy.

3. Legal framework

• Article 15 of the Political Constitution of Colombia.
• Law 1581 of 2012.
• Decree 1074 of 2015.
• Decree 1377 of 2013.
• Decree 886 of 2014.
• Circular 002 of 2015.

• Any others that implement and/or amend them.

   

4. Definitions

• Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of personal data.
• Database: Organized set of personal data subject to Processing.
• Personal data: Any information linked to, or that may be associated with, one or more specific or identifiable natural persons.
• Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person's marital status, profession or occupation, and status as a merchant or public servant. By its nature, public data may be contained, among others, in public registries, public documents, official gazettes and bulletins, and duly enforceable court rulings that are not subject to confidentiality.
• Sensitive data: Data that affects the privacy of the Data Subject or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data.
• Data Processor: Natural or legal person, public or private, who, alone or in association with others, carries out the Processing of personal data on behalf of the Data Controller.
• Data Controller: Natural or legal person, public or private, who, alone or in association with others, makes decisions about the database and/or the Processing of the data.
• Data Subject: Natural person whose personal data is subject to Processing.
• Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation or deletion.
• Data transmission: Processing of personal data that involves communicating such data within or outside the territory of the Republic of Colombia when its purpose is the performance of Processing by the Processor on behalf of the Controller.
• Data transfer: A data transfer takes place when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient who is in turn a Data Controller and is located inside or outside the country.

6. PRINCIPLES 

• Principle of freedom: The data Processing carried out by BMI Colombia may only be performed with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent. 

• Principle of truthfulness or quality: The information subject to Processing must be truthful, complete, accurate, up to date, verifiable and understandable. The Processing of partial, incomplete or fragmented data, or data that is misleading, is prohibited

• Principle of transparency: Processing must guarantee the right of the Data Subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of data concerning them; - Principle of restricted access and circulation: Processing may only be carried out by persons authorized by the Data Subject. Personal data, except for public information or information required by regulation, may not be made available on the Internet or other means of mass disclosure or communication, unless access is technically controllable so as to provide restricted knowledge only to the Data Subjects or authorized third parties in accordance with this law

• Principle of security: The information subject to Processing by the Data Controller or Data Processor referred to in this law must be handled with the technical, human and administrative measures necessary to provide security to the records, preventing their alteration, loss, consultation, use or unauthorized or fraudulent access

• Principle of confidentiality: All persons involved in the Processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks comprising the Processing has ended, and may only supply or communicate personal data when this corresponds to the performance of the activities authorized in this law and under its terms. 

   

7. RIGHTS OF THE DATA SUBJECT 

To contact BMI Colombia, through the channels established for that purpose, to access, update and rectify their personal data. 

This right may be exercised, among others, with respect to partial, inaccurate, incomplete or fragmented data, data that is misleading, or data whose Processing is expressly prohibited or has not been authorized; 

• To request from BMI Colombia, through the channels established for that purpose, proof of the authorization granted to the Data Controller, except when it is expressly exempted as a requirement for Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.

•  To be informed by BMI Colombia, upon request, of the use it has made of their personal data. 

• To file complaints with the Superintendencia de Industria y Comercio for violations of the provisions of the regulations governing the fundamental right to Habeas Data.

• To revoke the authorization and/or request the deletion of the data when the Processing does not respect constitutional and legal principles, rights and guarantees. The revocation and/or deletion will proceed when the Superintendencia de Industria y Comercio has determined that, in the Processing, the Controller or Processor has engaged in conduct contrary to this law and to the Constitution. To access, free of charge, their personal data that has been subject to Processing. 

   

8. AUTHORIZATION 

Without prejudice to the exceptions provided for in the Law, Processing requires the prior and informed authorization of the data subject, which must be obtained by any means that can be subject to later consultation. Such authorization is not necessary in the case of: 

• Information required by a public or administrative entity in the exercise of its legal functions or by court order.

•  Data of a public nature. - Cases of medical or health emergency. 

• Processing of information authorized by Law for historical, statistical or scientific purposes. 

• Data related to the person's civil registry. 

  In addition to the foregoing, the data subject authorizes: 

• The transmission of their personal data to processors located in Colombia or abroad, under the security and confidentiality conditions set forth herein

• The transfer of their personal data to third parties located in countries that the Superintendencia de Industria y Comercio has recognized as having an adequate level of personal data protection, in accordance with Article 26 of Law 1581 of 2012 and its implementing regulations. 

  • Paragraph: In cases where the destination country does not have such recognition, the data subject authorizes BMI Seguros Colombia to enter into model contractual clauses or adopt binding corporate rules, ensuring that their personal data maintains the same level of protection required in Colombia.

• The sharing of their information with suppliers, business partners and other authorized third parties, solely for the purposes described in this Policy and under conditions of confidentiality and security. - The Data Subject acknowledges having been informed about:

  • The rights they have regarding personal data protection (to access, update, rectify, delete, revoke the authorization, among others). 

  • The channels provided by BMI Seguros Colombia to exercise those rights. 

  • The specific purposes of the processing of their personal data. 

9. PURPOSE 

9.1. General Purpose. 

The general purposes for which BMI Colombia will process personal data include the following, which will apply to financial consumers, intermediaries, suppliers, contractual counterparties and employees alike: 

• Processing applications to become a financial consumer, contractual counterparty, employee and/or supplier. 

• The process of negotiating contracts with BMI Colombia, including the determination of premiums and the selection of risks. 

•  Fraud control and prevention. 

• Verifying compliance with the requirements for access to the Comprehensive General Social Security System 

• The preparation of technical-actuarial studies, statistics, surveys, market trend analyses and, in general, insurance technical studies. 

• Conducting satisfaction surveys on the services provided by BMI Colombia and/or the insurance intermediary. 

• Sending financial information on U.S. taxpayers to the Internal Revenue Service (IRS), under the terms of the Foreign Account Tax Compliance Act (FATCA), 

• Exchange of tax information under international treaties and agreements signed by Colombia. 

• The prevention and control of money laundering and terrorist financing. 

• In general, the comprehensive management of the contracts entered into with BMI Colombia, whether insurance contracts, intermediation contracts, supplier contracts, employment contracts, or business agreements or alliances. 

9.2. Purpose of Financial Consumer data. 

The purpose is to use this information for the proper provision of the service or product acquired by the data subject. Likewise, BMI Colombia may inform the data subject about its products and services, and announce improvements or changes to its service channels and to the complementary services and products offered. Its purpose will also be to send the data subject information about offers developed with business partners. Similarly, its purpose will be the settlement and payment of claims and everything involved in the comprehensive management of the insurance purchased, as well as sending information related to financial education, customer satisfaction surveys and commercial insurance offers, and other services inherent to the insurance business. 

9.3. Purpose of data of suppliers, intermediaries and contractual counterparties. 

The processing of this data seeks to have up-to-date, sound and sufficient information about the persons who are, or wish to become, suppliers, intermediaries and contractual counterparties. Likewise, its purpose is to verify the various suitability requirements for maintaining a contractual relationship with BMI Colombia. 

9.4. Purpose of employee data. 

The processing of employee data seeks to keep staff information up to date so that the employment relationship can proceed properly. Their contact details may be shared with the legal entities that are affiliates, subsidiaries or related companies, or the parent company of BMI Colombia, so that our employees have access to the benefits of purchasing products and services from the organization's companies. Likewise, the data of former employees will be retained in order to make their information available to the authorities and to the data subjects themselves for the period established in labor law. 

9.5. Processing of sensitive data. 

BMI Colombia will not collect, incorporate or store sensitive data of its financial consumers, employees or third parties unless there is prior authorization from the data subject. The aforementioned authorization will only be requested when it is necessary and proportionate for the performance of the contractual relationship with the data subject, provided that the law requires or allows access to their sensitive information. Authorization for the processing of sensitive data will be requested prior to its incorporation, and it will state the purpose for which the data is incorporated, indicate that answering questions about sensitive data is optional, and include the other elements described in this policy for obtaining authorization to process the information. Sensitive data may not be processed for purposes other than those authorized by the data subject. Access to, circulation and processing of sensitive data will be restricted and limited to what is expressly authorized by the data subject and to what is stipulated by law. 

10. PROCEDURES 

10.1. Inquiries. 

Data Subjects or their successors in title may consult the Data Subject's personal information held by BMI Colombia. Accordingly, BMI Colombia must provide them with all the information contained in the individual record or linked to the identification of the Data Subject. Inquiries must be submitted by email to notificaciones@bmicos.com Inquiries will be answered within a maximum period of ten (10) business days from the date of receipt. When it is not possible to answer the inquiry within that period, the interested party will be informed, stating the reasons for the delay and indicating the date on which their inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first period. 

10.2. Claims. 

The Data Subject or their successors in title who consider that the information contained in a database should be corrected, updated or deleted, or who notice an alleged breach of any of the duties under the regulations governing the fundamental right of Habeas Data or this Manual, may file a claim with BMI Colombia, which will be processed under the following rules: 

10.2.1. The claim must be submitted by means of a request sent to the email address notificaciones@bmicos.com, with the identification of the Data Subject, a description of the facts giving rise to the claim, the address, and any supporting documents. If the claim is incomplete, the interested party will be asked within five (5) days of receipt of the claim to remedy the deficiencies. If two (2) months pass from the date of the request without the applicant submitting the required information, the claim will be deemed withdrawn. If the person receiving the claim is not competent to resolve it, they will forward it to the appropriate party within a maximum period of two (2) business days and will inform the interested party of the situation. 

10.2.2. Once the complete claim has been received, a notation reading «claim in process» and the reason for it will be added to the database within a period of no more than two (2) business days. This notation must remain until the claim has been decided. 

10.2.3. The maximum period to address the claim will be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within that period, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first period. 

11. INTERNATIONAL TRANSMISSION OF PERSONAL DATA. 

In order to have the information necessary for the management, maintenance and logistics of the products marketed, BMI Colombia Compañía de Seguros de Vida S.A. may transmit and transfer each data subject's personal data nationally or internationally in compliance with security and confidentiality conditions that guarantee the protection of the information. In order to provide better service, and to carry out the purposes described in this Policy, the Data Subjects' personal data may be transmitted to servers hosted in foreign countries, under security conditions that will guarantee compliance with the provisions of Law 1581 of 2012, Regulatory Decree 1377 of 11.1. Transmission of personal data Clients' personal data may be transmitted to processors acting on behalf of BMI Seguros Colombia that are located in other countries, in accordance with the following instructions: 

11.1.1. The receiving processor will be contractually bound to comply with the same security and confidentiality measures that we apply in Colombia. 

11.1.2. The information will be transmitted solely to fulfill the purposes of the insurance contract and those set forth in this Policy. 

11.2. Transfer of personal data The transfer of your personal data to third parties located in other countries will only be made to jurisdictions that the Superintendencia de Industria y Comercio (SIC) has recognized as having an adequate level of personal data protection. BMI Seguros Colombia will not transfer personal data to countries that are not recognized as having an adequate level of protection, except in the cases expressly provided for in Law 1581 of 2012 (prior authorization of the data subject, legal or judicial mandate, medical or health emergencies, statistical or scientific purposes, public information, among others). 

11.3. Additional protection mechanisms In the event that the transfer country does not have the levels of personal data protection required in Colombia, BMI Seguros Colombia may enter into model contractual clauses approved by the Superintendencia de Industria y Comercio (External Circular 002 of 2025) or adopt binding corporate rules (Decree 255 of 2022), as applicable, in order to guarantee adequate safekeeping of the data. These mechanisms do not constitute an independent authorization, but rather additional safeguards that apply when the transfer is permitted by Law. 

12. DELIVERY OF PERSONAL INFORMATION TO SERVICE PROVIDERS. 

In order to fulfill the contractual relationship that BMI Colombia maintains with the Data Subject, the information may be delivered to or shared with suppliers for the purposes authorized by the data subject or those provided for by law, such as claims adjusters, investigators, healthcare institutions and/or professionals, call centers, distributors and prevention professionals, insurance intermediaries, and individuals or legal entities that provide their professional services to produce statistics, actuarial calculations, software development and any other activity to carry out the corporate purpose of BMI Colombia and properly provide the service. Whenever information is delivered to or shared with suppliers, BMI Colombia will ensure that conditions are established binding the supplier to this Policy, so that clients' personal information is protected. Likewise, confidentiality agreements will be established for the handling of the information, as well as controller-processor obligations when the type of delivery warrants it. 

13. DUTIES OF THE DATA CONTROLLER. 

BMI Colombia, as Data Controller, must comply with the following duties, without prejudice to the other provisions set forth in the law and in other regulations governing its activity: - Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data. - Request and retain, under the conditions set forth in the law and this Manual, a copy of the respective authorization granted by the Data Subject. - Duly inform the Data Subject of the purpose of the collection and the rights they have by virtue of the authorization granted. - Retain the information under the security conditions necessary to prevent its alteration, loss, consultation, use or unauthorized or fraudulent access. - Ensure that the information provided to the Data Processor is truthful, complete, accurate, up to date, verifiable and understandable. - Update the information, promptly communicating to the Data Processor all changes regarding the data previously provided and adopting the other measures necessary to keep the information provided to it up to date. - Rectify the information when it is incorrect and communicate the relevant changes to the Data Processor. - Provide the Data Processor, as the case may be, only with data whose Processing has been previously authorized in accordance with the provisions of this law. - Require the Data Processor at all times to respect the security and privacy conditions of the Data Subject's information. - Process inquiries and claims submitted under the terms set forth in this law. - Adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, for handling inquiries and claims. - Inform the Data Processor when certain information is under dispute by the Data Subject, once the claim has been filed and the respective procedure has not been completed. - Inform the Data Subject, upon request, about the use made of their data. - Inform the data protection authority when there are violations of security codes and risks in the management of the Data Subjects' information. - Comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio. 

14. CONTROLLER DETAILS 

Company Name: BMI Colombia Compañía de Seguros de Vida S.A. N.I.T. 901061386-7 Address: Carrera 11 No. 84-09, Costado sur | Oficina 903, Bogotá, Colombia Email: notificaciones@bmicos.com 15. EFFECTIVE DATE AND AMENDMENTS BMI Colombia reserves the right to amend this Policy at any time, which will be duly announced on the website through the Company's website. 16. APPENDICES - Political Constitution of Colombia - Law 1581 of 2012 - Decree 1074 of 2015. - Decree 1377 of 2013 - Decree 886 of 2014 - Circular 002 of 2015