Personal Data Use Policy

GRIO S.A with RUC 20602769136 (from now on, “The Company“) with address at Av. Circunvalación Golf Los Incas 134, Santiago de Surco makes its Policy available to Web Users who visit the website www.gr-am.com of Privacy, under Law 29733, Personal Data Protection Law (from now on, “LPDP”), its Regulations, approved by Supreme Decree 003-2013-JUS (from now on, “Regulations”), and its supplementary regulations and related.

The types of personal data we collect, the purposes of their treatment, the conservation period in our private data bank, the security measures implemented, and the procedure provided for web users to exercise their rights as owners of personal data.

What personal data do we collect?

The Company collects from Web Users their names and surnames, company, and email. This information will be stored in our Personal Data Bank "Users of the website" registered in the National Registry for the Protection of Personal Data for a period of 02 years or until the owner of the personal data requests The Company, through the exercise of the right of cancellation, to revoke their consent to process their information.

The Company makes it known that the information of web Users will not be commercialized, transferred, or shared without their authorization and, even less, for purposes other than those described below. However, currently, no system is completely secure or free from attacks of any kind, and it is not possible to prevent the loss, misuse, alteration, unauthorized access, and theft or theft of personal data or confidential information provided.

For what purposes do we use your data?

The personal data that Web Users provide us through the web platform will be used for the following purposes:

1. Resolve queries and provide information to web Users.
2. Follow up on the suggestions submitted by web Users.
   
   

Who can access your data?

To comply with the purposes above, The Company may transfer the personal data of web Users to third parties located within or outside the national territory. In these cases, The Company will guarantee that processing such personal data is limited to previously authorized purposes, is kept confidential, and the appropriate security measures prescribed in the LPDP and its Regulations are implemented.

The third-party recipients to whom personal data may be transferred are the following:

International transfer of personal data:

• GRAM

This information will be permanently updated in this Privacy Policy (web), being available when you need to find out about these third parties.

How can you exercise the rights the Law grants you over your data?

As the owner of their data, Web Users have the right to access their data in possession of The Company; know the characteristics of your treatment, rectify them if they are inaccurate or incomplete, and request that they be deleted or canceled when considering them unnecessary for the previously stated purposes or oppose their treatment for specific purposes.

Web Users may, at any time, revoke the expressly granted consent and limit the use or disclosure of their data.

In this sense, The Company recognizes and guarantees the exercise of the right to information and the rights of access, rectification, cancellation, and opposition ("ARCO" rights) that Web Users, as holders of their data, assist. To do this, the personal data owner must address their request to The Company at the following email address: contacto@gr-am.com.

The request must contain, at least, the following: (i) names and surnames of the owner of the personal data; (ii) specific request, clear description of the personal data linked to the exercise of the right to information and ARCO rights and the express statement of the right that you intend to exercise; (iii) documents that support the petition; (iv) email where The Company will make the corresponding communications; and, (v) date and signature.

The personal data owner must prove their identity by presenting a copy of their ID or equivalent document. If the exercise of the right to information and/or ARCO rights is carried out by a legal representative, he must attach a copy of his national identity document or document or equivalent, and of the title or document that accredits his representation.

The response period for the request to exercise the right to information is eight (8) business days; for the rights of rectification, cancellation, and opposition, it is ten (10) business days. And for the privilege of access, it is twenty (20) business days. All these deadlines, except for the one referring to the right to information, may be extended one (1) time and for an equal period, provided that the circumstances justify it. This extension and its justification must be communicated to the owner of the personal data or his legal representative within the period that is intended to be extended.

The cancellation of personal data will not proceed when they must be kept by The Company by virtue of historical, statistical, or scientific reasons, in accordance with the applicable regulations, due to contractual relations with the owner of the personal data, which justify their treatment. , or by order of the competent authority.

Suppose the right to information and/or ARCO rights are not met within the established period or are denied. In that case, web Users may appeal to the National Authority for the Protection of Personal Data by way of claim, addressing the Bureau of Parties of the Ministry of Justice and Human Rights: Calle Scipion Llona 350, Miraflores, Lima, Peru.

Can we process the personal data of minors?

The Company recognizes the possibility that web Users are over fourteen (14) but under eighteen (18) years of age and, in this circumstance, the processing of personal data may be carried out with your consent, provided that the information has been provided to said type of user using understandable language, except in cases in which the Law requires the intervention of the holders of parental authority or guardianship.

Can this Privacy Policy be modified or updated?

Due to the continuous improvement of our processes, The Company may modify and/or update this Privacy Policy, either to adapt it to future regulatory changes, implement best practices, provide a better quality of service or communicate new alternatives related to this document. Please check these terms regularly for changes that may have occurred and how they may affect you.