Personal data processing policy.

Data controller

MARA Limitada, a company with Colombian Tax ID (NIT) 800.020.156-8, engaged in public civil works and construction in protected areas, founded on November 26, 1987, is the data controller for the personal data governed by this policy.

Registered address: Carrera 8 # 16-61, Office 202, Tunja, Boyacá, Colombia. Phone: +57 311 244 5992. Website: maraltda.com.

Dedicated channel for personal data matters: protected email. General institutional contact channel: protected email.

Scope and legal framework

This policy applies to all databases containing personal information for which MARA Limitada acts as data controller, both those fed through the maraltda.com website and those arising from its contractual, employment and construction activities.

The applicable legal framework is Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Single Decree 1074 of 2015), Decree 886 of 2014 on the National Database Registry, and Decree 090 of 2018, which defined who is required to register. Should MARA Limitada be required to register its databases with the National Database Registry (RNBD) administered by the Superintendence of Industry and Commerce, it will register them and keep the registration up to date as those rules provide.

Processing and purposes by type of data

Website contacts. The contact form collects: name, organization, role, email address, phone number, country, subject and message. Purposes: responding to institutional, business and press inquiries; managing invitations and public or private procurement processes in which the company takes part; and keeping a traceable record of correspondence received. The site has no e-commerce, user registration or open comments; besides the form, it uses only the platform’s technical cookies (WordPress and Cloudflare) and the functional language cookie and, since October 20, 2026, the Google Analytics 4 analytics cookies, as described in the Cookie Policy.

Suppliers and contractors. Identification, contact, tax and banking details of suppliers, subcontractors and their representatives or liaison staff. Purposes: supplier selection and evaluation, execution and performance of contracts, invoicing and payments, and compliance with legal, accounting and contractual obligations.

Employees and job applicants. Data contained in résumés, hiring documents, social security enrollment records and occupational health and safety records. Purposes: recruitment, management of the employment relationship, compliance with the employer’s legal obligations and responses to requests from competent authorities. Résumés of applicants who are not selected are kept only for a reasonable period for possible future recruitment processes, unless deletion is requested.

Photographic and audiovisual records of construction work. Images in which workers, contractors or third parties appear may be captured at work sites for technical and contractual documentation, progress reports, the company’s historical records and the publicizing of its projects. Where an image allows a person to be identified, it is captured and used with the data subject’s prior consent, which the data subject may revoke through the channels set out in this policy.

Prior and informed authorization

MARA Limitada requests the data subject’s authorization in a prior and informed manner, no later than at the time of collection, stating which data are collected and all the specific purposes of the processing. Authorization may be given in writing, orally or through unequivocal conduct of the data subject from which it can reasonably be concluded that it was granted; silence is in no case deemed to be unequivocal conduct. The company keeps proof of the authorizations granted.

On the website’s contact form, authorization is obtained through an acceptance checkbox that is not pre-checked, with a link to this policy and to the Privacy Notice.

Authorization is not required in the cases set out in Article 10 of Law 1581 of 2012, including: information required by a public entity in the exercise of its legal functions or by court order, data of a public nature, cases of medical or health emergency, processing for historical, statistical or scientific purposes, and data related to the Civil Registry of persons.

Sensitive data and data of minors

Sensitive data are those that affect the data subject’s privacy or whose misuse may lead to discrimination: racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions or in social or human rights organizations, and data concerning health, sex life and biometrics. Their processing is prohibited, except under the exceptions set out in Article 6 of Law 1581 of 2012, including the data subject’s explicit authorization.

MARA Limitada does not collect sensitive data through its website contact form. If any sensitive data were ever required in a process — for example, in employment or occupational health and safety management — the company will inform the data subject that they are not obliged to authorize its processing, will state explicitly and in advance which data are sensitive and the corresponding purpose, and no activity will be made conditional on the provision of sensitive data.

MARA Limitada’s website and services are not directed at minors, and the company does not knowingly collect their data. Should any processing involve minors’ data, it will be carried out only in the cases permitted by law, respecting their prevailing rights and with the authorization of their legal representative.

Rights of the data subject

Under Article 8 of Law 1581 of 2012, you have the right to: (a) know, update and rectify your personal data with respect to MARA Limitada or anyone processing them on its behalf, including data that are partial, inaccurate, incomplete, fragmented or misleading, or whose processing is prohibited or has not been authorized; (b) request proof of the authorization granted, except where the law provides otherwise; (c) be informed, upon request, of the use made of your data; (d) file complaints with the Superintendence of Industry and Commerce for violations of the law; (e) revoke the authorization and/or request the deletion of your data when constitutional and legal principles, rights and guarantees are not respected; and (f) access, free of charge, your personal data that have been processed.

Revocation of the authorization and deletion of data will not be granted where you have a legal or contractual duty to remain in the relevant database.

Inquiry procedure

MARA Limitada’s administrative department is responsible for handling petitions, inquiries and claims concerning personal data. You may exercise your rights free of charge by writing to protected email, identifying yourself as the data subject or providing evidence of your status as successor in interest or attorney-in-fact.

Inquiries about personal information held in the company’s databases are answered within a maximum of ten (10) business days from the date of receipt. If an inquiry cannot be answered within that period, you will be informed of the reasons for the delay and of the date on which it will be answered, which in no case will be more than five (5) business days after the initial period expires (Article 14, Law 1581 of 2012).

Claims, deletion and revocation procedure

If you believe that your information should be corrected, updated or deleted, or that the company has breached any of its legal duties, you may submit a claim to protected email including: your identification as the data subject, a description of the facts giving rise to the claim, your contact address and any documents you wish to rely on.

If the claim is incomplete, the company will ask you, within five (5) days of its receipt, to remedy the deficiencies; if two (2) months pass from the date of that request without you providing the required information, you will be deemed to have withdrawn the claim. If the company is not competent to resolve it, it will forward the claim to the appropriate party within no more than two (2) business days and will inform you accordingly. Once the complete claim is received, a “claim in process” notation and the reason for the claim will be entered in the database within no more than two (2) business days, and will remain until the claim is decided.

The maximum period for addressing the claim is fifteen (15) business days from the day following its receipt. If it cannot be addressed within that period, you will be informed of the reasons and of the new response date, which in no case will be more than eight (8) business days after the initial period expires (Article 15, Law 1581 of 2012).

Requests for deletion of data and for revocation of the authorization follow this same procedure and these same time limits, in accordance with Article 9 of Decree 1377 of 2013. MARA Limitada maintains this free and easily accessible channel for handling them.

Complaints to the Superintendence of Industry and Commerce

If the company does not respond within the legal time limits, or if you are not satisfied with its response, you may file a complaint with the Superintendence of Industry and Commerce (SIC), Colombia’s personal data protection authority.

Under Article 16 of Law 1581 of 2012, a complaint to the SIC may be filed only after the inquiry or claim procedure has been exhausted directly with MARA Limitada; when filing it, you must attach a copy of the claim previously submitted to the company and its supporting documents.

Security measures, transfers and transmissions

MARA Limitada keeps personal information under security conditions designed to prevent its tampering, loss, or unauthorized or fraudulent consultation, use or access, and complies with the other duties set out in Article 17 of Law 1581 of 2012: guaranteeing the exercise of habeas data, keeping proof of the authorization, informing data subjects of the purpose of the collection, keeping information truthful, complete, accurate and up to date, handling inquiries and claims within the legal time limits, having internal procedures for doing so, reporting to the Superintendence of Industry and Commerce any violations of security codes and any risks in the management of the information, and complying with its instructions.

The company does not sell or assign its databases to third parties. It may transmit data to data processors acting on its behalf — such as the technology providers that host and secure the website — subject to confidentiality and security duties, and may provide information to public authorities when they require it in the exercise of their legal functions or by court order. Should any international transfer or transmission of data take place, it would be carried out only in the cases and with the safeguards provided for in the applicable regulations.

Effective date of the policy and term of the databases

This policy takes effect upon its publication on the maraltda.com website, with an update date of July 2026, and supersedes any previous version. Substantial changes will be published on this same page and communicated to data subjects through the available means before they take effect.

Databases are kept for as long as the processing purposes described in this policy remain in effect and, in addition, for the periods required by the applicable accounting, tax, employment and contractual rules. Once those periods have elapsed, the data will be deleted or anonymized, unless there is a legal or contractual duty to retain them.