General Considerations

ASTEROID LLC, with legal domicile at 2999 NE 191st St. Ste 608. Miami, FL. 33180, tax identification number 384197487 (hereinafter "Asteroid Assistance"), is an international travel assistance organization whose object is to provide, among others, medical, legal, and personal assistance services in emergency situations during the course of a trip. For purposes of this Policy, it acts as the data controller for personal data collected through its digital channels and during the provision of its travel assistance services.

In order to guarantee the best travel assistance service, Asteroid Assistance may obtain, collect, and/or store information and personal data from its clients (hereinafter, "Personal Information") as long as they are essential and necessary for the provision of said services. As responsible for the correct use and administration of such personal information, Asteroid Assistance has sufficient security, technical, and administrative measures aimed at maintaining the required level of safeguard and protection and thus being able to guarantee its clients due reliability and security in the handling of the same.

Asteroid Assistance guarantees the privacy and confidentiality of the Personal Information provided by its clients through any of the Asteroid Assistance websites, email, sales channels, or by any other means of communication, in accordance with the provisions of the applicable regulations on the matter. In order to respect the interests and expectations of its Clients to the maximum, Asteroid Assistance has a serious commitment linked to the respect and observance of this Privacy, Confidentiality, and Personal Data Protection Policy (hereinafter, the "Privacy Policy" or "Policy"), in relation to the collection, use, storage, protection, and disclosure of data.

What personal information is collected?

Asteroid Assistance collects and stores personal information provided by its clients in order to contact and/or identify them, through the various channels enabled for this purpose.

In turn, Asteroid Assistance obtains and stores the Personal Information that Clients provide when performing the following actions: (i) contracting travel assistance services, (ii) browsing the Asteroid Assistance Website and/or when registering as a user in MY POLICY, (iii) using the various online services, (iv) participating in promotions, contests, raffles and/or promotional and/or marketing campaigns, (v) contacting via email, (vi) using the application for mobile phones and tablets, (vii) requesting –by telephone in our service center and/or through any of the channels enabled to do so– any of the assistance services provided by Asteroid Assistance. Personal information collected may include –among others– first and last name, postal address, nationality, phone number, tax identification key, email address, emergency contact, date and/or destination of travel.

Asteroid Assistance only collects personal information provided freely and voluntarily by the Client, not storing any other information that is not provided in that way.

The Client may choose not to provide certain personal information when they so consider, to the extent that the failure to provide said personal information does not prevent the provision of the services that interest the Client. Asteroid Assistance may also store recordings of telephone calls in order to be able to carry out quality and operational audits and guarantee the correct provision of the assistance service requested by the Client. Call recordings will be retained for as long as reasonably necessary and subsequently deleted. With the reservations specified in this Policy and being a guiding principle in personal information matters, confidentiality, protection, and security in processing, the Client expressly accepts that such Information may be transferred to Asteroid Assistance's external service providers (such as, for example, medical providers, hospitals, clinics, legal advisors, airlines, etc.) that are necessary for the provision of the contracted assistance services. In all cases in which Asteroid Assistance exceptionally supplies personal information to providers for the provision of the requested service; they will be required to be treated with confidentiality, in accordance with the regulations governing the protection of personal data and to be destined for the sole and exclusive effect of performing the requested assistance services.

What do we do with the collected Personal Information?

Asteroid Assistance will store any Personal Information provided by the Client, for a satisfactory provision of the assistance they may require and by granting it, they expressly give their consent so that:

• a) Asteroid Assistance stores all Personal Information it may have obtained for, during, and/or as a consequence of the requested assistance, in the Records duly declared before the Control Authority.
• b) Asteroid Assistance can assign and/or transfer and/or provide the Personal Information that is necessary to: (i) the external providers linked to Asteroid Assistance, who contribute to the fulfillment of the object of the requested provision; (ii) third parties with whom Asteroid Assistance has signed confidentiality contracts, provided that said third parties are linked, related, and/or connected with the fulfillment of the requested assistance and require such Personal Information for the provision of the service; (iii) companies belonging to the ASTEROID LLC Group, its parents and subsidiaries, provided that this is necessary to complete the purpose for which they were obtained. Asteroid Assistance may offer them better services or provide information related to products already acquired.
• c) Asteroid Assistance can contact them in order to: (i) Improve commercial and promotional initiatives, personalize content, its presentation, and services; (ii) send information or messages by email about new services, advertisements or promotions, banners of interest, news about Asteroid Assistance; (iii) send notices about contests and/or raffles that Asteroid Assistance organizes.
• d) Asteroid Assistance can share Personal Information with business partners, with whom they could jointly offer products or services. These providers and business partners will be subject to confidentiality contracts that prohibit the unauthorized use or disclosure of Personal Information to which they have access. Third-party access to Personal Information will be governed by the opt-out policy described below. How to access, update or correct your personal information.

Definitions:

• a. Habeas Data Right: It is a set of rights that allow you, as the information owner, to ensure that your data is collected and processed in accordance with legal norms and in line with the purpose informed by us. These rights allow you, among other things, to consult, update and request the deletion of your information from our database, provided there is no contractual or legal obligation that prevents us from doing so.
• b. Authorization: Represents your clear and explicit consent for Asteroid Assistance to process your data in accordance with the principles and objectives detailed in this policy.
• c. Data Subject: Refers to you when you grant us permission to process your personal data. This always implies the information of individuals.
• d. Processing: Refers to any activity involving your data. This can include collection, storage, use, circulation, or deletion of personal information.
• e. Database: It is the structured set of personal data that are processed.
• f. Personal Data: Is any information that can identify or make an individual identifiable. These data are categorized into public, private, semi-private, and sensitive.
• g. Public Personal Data: Are data that refer to general interest. Normally, they are found in public records, official documents, bulletins, and judicial rulings that are not under reserve. Examples of these data include your name, identification, and profession.
• h. Private Personal Data: Is information that is relevant only to you as the owner and that is considered intimate and reserved.
• i. Semi-private Personal Data: Are private data that could be relevant to certain groups under certain circumstances. An example is information related to credit and financial history.
• j. Sensitive Personal Data: Information that affects privacy and whose misuse could generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data (fingerprints, photographs, DNA, among others).
• k. Special Data: Refer to the processing of information of children and adolescents, and the processing of sensitive data.
• l. Data Controller: Person who decides on, among others, the collection and purposes of the processing.
• m. Data Processor: Person who carries out the processing of the data on behalf of the Data Controller.
• n. Transmission: Processing of personal data that implies communication by the processor, on behalf of or in the name of the controller.
• o. Transfer: Sending of personal data carried out by the controller or the processor from Colombia to a controller that is located within national transfer or outside the country (international transfer).
• p. Website: Means the website www.asteroidassistance.com
• q. Application (APP): Means the Asteroid Assistance mobile application.

Principles of Information Processing

When Asteroid Assistance processes your data, it always does so observing the following principles:

• a. Principle of legality in data processing: The processing of personal data is a regulated activity that must be subject to the provisions of current legislation on personal data protection and the rules that complement or develop it.
• b. Principle of purpose: The processing must obey a legitimate purpose in accordance with the Constitution and the law, which must be informed to the holder.
• c. Principle of freedom: The processing can only be exercised with the prior, express, and informed consent of the holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.
• d. Principle of truthfulness or quality: The information subject to processing must be true, complete, exact, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented information or information that induces error is prohibited.
• e. Principle of transparency: In the processing, the right of the holder to obtain from Asteroid Assistance or the data processor, at any time and without restrictions, information about the existence of data concerning them must be guaranteed.
• f. Principle of access and restricted circulation: The processing is subject to the limits derived from the nature of personal data, the provisions of the law, and the Constitution. In this sense, processing can only be done by persons authorized by the holder and/or by the persons provided for in the law.
• g. Principle of security: The information subject to processing by Asteroid Assistance or a data processor must be handled with the technical, human, and administrative measures that are necessary to provide security to the records, avoiding their alteration, loss, consultation, unauthorized or fraudulent use or access.
• h. Principle of confidentiality: All persons involved in the processing of personal data that do not have a public nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks comprised in the processing has ended, being only able to provide or communicate personal data when it corresponds to the development of the activities authorized in the law.

Collected data and purpose of processing

The personal data that you voluntarily provide to Asteroid Assistance may belong to the following categories:

• a. Identification data such as: Name, domicile, telephone, email, national identity document, place and date of birth, age, nationality, photograph, country of residence, signature, sex, marital status, among others.
• b. Third-party data such as: First and last names of family members and/or emergency contacts, age, telephone, email, mobile phone, and relationship, among others.
• c. Employment data such as: salary, salary type, social security system affiliations, position, work domicile, telephone, fax, employment history, employment certificates, among others.
• d. Education data such as: school history, professional title, study certificates, and degree dates, among others.
• e. Banking data such as: bank account number, billing data, financial statements, tax identification number (TIN), unique tax registry (UTR), credit card data, among others.
• f. Health data such as: health status, test results, laboratories, studies, medical diagnoses, medications, treatments, among others.
• h. If you are a partner or shareholder, we may use your data for: (i) the development of the company's corporate object; (ii) maintaining constant communication regarding activities, decisions and changes in the organization; (iii) the execution of the contractual and fiduciary relationship; (iv) the collection of financial and accounting records; (v) reports to control and supervision authorities; (vi) invitations and coordination of general assemblies and/or shareholders' meetings; (vii) other administrative, historical, and statistical purposes.
• i. If you are a researcher or external collaborator, we may use your data for: (i) the development of joint projects; (ii) the coordination of activities and events; (iii) the execution of the contractual and collaboration relationship; (iv) the management of payments and fees; (v) the generation of reports and documentation related to research or collaborations; (vi) other administrative, historical, and statistical purposes.
• j. If you are a participant in events or training organized by us, we may use your data for: (i) the coordination and logistics of the event or training; (ii) the management of registrations and confirmations; (iii) sending related informational or educational material; (iv) generating certificates or proofs of attendance; (v) conducting satisfaction surveys; (vi) conducting attendance and evaluation reports; (vii) other administrative, historical, and contact purposes.
• k. If you are a user of our forums or social networks, we may use your data to: (i) manage your participation and moderate comments; (ii) attend to your queries, comments or concerns on the platforms; (iii) the development of community activities and promotion of interaction; (iv) carry out analyses and statistics on user trends and behaviors; (v) other administrative and contact purposes.
• l. If you are a media collaborator or influencer, we may use your data for: (i) the development of joint communication or marketing strategies; (ii) the coordination of interviews, events or special participations; (iii) sending press material, releases or relevant information; (iv) managing agreed payments or compensations; (v) other administrative, historical, and contact purposes. You acknowledge and accept that you are not obliged to grant authorization for the processing of sensitive personal data.

In accordance with the purposes described, the scope of processing to which Asteroid Assistance is subject is as follows:

• i. Know, store, and process all information provided by the holders in one or several databases, in the format deemed most convenient.
• ii. Verify, corroborate, check, validate, investigate, or compare the information provided by the holders with any information legitimately available.
• iii. Access, consult, compare, and evaluate all holder information stored in the databases of any credit, financial, judicial background, or security risk center, legitimately constituted, of a state or private, national or foreign nature.

Sensitive Data

In the development of our activities, we may require data of a sensitive nature, such as your health data, which will be treated in accordance with the principles set forth in law, maintaining the confidentiality that the right to privacy imposes on us and, in particular, avoiding encouraging discrimination with this data. You, as the owner of the information, are not obliged to provide us with data of this nature. However, it is 重要 inform you that there are procedures and processes for which the processing of this data will be necessary.

Processing of Personal Data of Minors

Asteroid Assistance does not process personal data of minors without the prior consent of their parents or legal representatives. The processing of personal data of minors will be carried out in accordance with data protection regulations, always observing their fundamental rights. Exchange, Transfer, and Transmission of Information: Asteroid Assistance may supply the information and personal data collected to subsidiary, affiliate, or associated companies of ASTEROID LLC, or to companies or natural persons abroad in whom Asteroid Assistance trusts to carry out the processing of the information. International transmissions and transfers may be made to any country, regardless of the schemes and levels of protection adopted in each country.

Information Security

Collected data is stored on our own servers located in Argentina. Currently, your personal data is protected by reasonable computer security measures that adjust to industry standards and protect the system against third-party attacks.

Rights of Information Owners

You, as the owner of the information, have the right to know, update, rectify and delete personal data.

In case of doubts, queries or claims in relation to the processing of information, we thank you, as the information owner, to send a request to the telephone service centers and/or via email addressed to: info@asteroidassistance.com

Procedures for Exercising Your Rights

• a. Queries: You may consult your personal data free of charge once every calendar month and every time there are substantial modifications to the Personal Data Processing Policy. To do this, you must send a request to the previously mentioned channels, which must contain the following information: (i) name and domicile of the owner (or whoever is authorized for this purpose) or any other means to receive a response to the request; (ii) documents proving the identity of the owner or whoever is authorized; (iii) the description and purpose of the query. Asteroid Assistance must respond to the request within ten (10) business days following receipt of the request. Likewise, it must inform if the request has any cost. In case of not being able to respond to the request within the previously mentioned term, Asteroid Assistance must inform the applicant about the reasons for the delay and must indicate a new term to respond, which may not exceed five (5) additional business days beyond the expiration of the first term.
• b. Claims: You can present, through a claim, complaints for non-compliance with the General Policy for Personal Data Processing and/or applicable law, or you can request the correction, update, or deletion of your personal data. To do this, you must send a claim to the previously mentioned service channels, which must contain the following information: (i) name and domicile of the owner (or whoever is authorized for this purpose) or any other means to receive a response to your request; (ii) documents proving the identity of the owner or whoever is authorized; (iii) the description and purpose of the query; (iv) if applicable, other documents or elements intended to be asserted. If the claim is incomplete, Asteroid Assistance will require you to rectify the information within five (5) business days following receipt. If after two (2) months from the date of the request you do not comply with the indicated rectification, it will be understood that you withdrew the claim. If the claim is complete, Asteroid Assistance must respond within fifteen (15) business days following receipt. In case of not being able to respond to the claim within the previously mentioned term, Asteroid Assistance must inform about the reasons for the delay and must indicate a new term to respond, which may not exceed eight (8) additional business days beyond the expiration of the first term. In the event that Asteroid Assistance is not competent to handle your claim, it will be transferred to whoever corresponds within a maximum term of two (2) business days and you will be informed of this situation.

Use of cookies and similar technologies

Asteroid Assistance may use Cookies and similar technologies on its websites to offer and optimize its services and collect information. "Cookies" are small information files sent by the website and stored in the user's browser, in such a way that the website can consult the user's previous activity. If you do not wish to receive cookies, you can configure your browser to reject them or to notify you when a site is trying to send you cookies. However, it is possible that some areas of Asteroid Assistance websites may not function correctly if you reject cookies.

Contact Us

ASTEROID LLC, with legal domicile at 2999 NE 191st St. Ste 608. Miami, FL. 33180, is the company responsible for the collection, use and disclosure of your Personal Information under this Privacy Policy.

If you have any questions about this Privacy Policy, contact us at email info@asteroidassistance.com