Personal Data Protection Policy - AMCHAM GT

Personal Data Protection Policy AMCHAM (hereinafter also referred to as the “Organization”) is responsible and in charge of protecting the personal data of persons about whom it receives and compiles information, hereinafter referred to as “Data Owners”. As such, AMCHAM undertakes to establish adequate and relevant standards and the necessary security measures for the compilation, processing and management of personal information conducted by the Organization through any means, and to require their compliance from system operators, information storage organizations and any other third party who may have contact with or has a relationship with the Organization, all of it as provided for and defined in the following personal data privacy and protection policy.

There are two types of data owners: a) Third Party: a party who provides personal and sensitive personal information, as provided by the Law and this policy, which information is used by AMCHAM to create linkages with AMCHAM Members; and b) Member: an AMCHAM member Company or Individual who receives or benefits from the information provided by AMCHAM. AMCHAM compiles and stores information on Data Owners when they 1) apply to be or are a member of the Organization; 2) ask to participate or participate in its events or services; 3) request to be or are a supplier; 4) use its website, or establish any other interaction or communication with the Organization. The use of information is outlined in this policy in abidance with the principle of use objective and limitation.

The Owner, or the person authorized by it, of the data it provides, is solely responsible for the accuracy and truthfulness of the data included, exonerating AMCHAM from any liability in this regard 1. Data Owners guarantee and respond in all cases on the accuracy, validity and authenticity of the personal data provided, and undertake to keep them duly updated in case they are modified 2. Data Owners agree to provide full and accurate information in the registration or subscription form, as well as to notify AMCHAM of any update when the information provided has undergone a modification that could materially have an effect on the data. AMCHAM is not responsible for the truthfulness of the information that is not produced by it or which is identified in a source other than AMCHAM and therefore, does not assume any responsibility for hypothetical damages that may be caused by the use of such information.

Every authorization shall be explicit through the appropriate forms, which will have the possibility to opt-in, which is the acceptance mechanism by Data Owners regarding the Minors and persons with disabilities will need the consent of their legal representatives.

The fact that AMCHAM has outdated information because its owner did not inform of it to AMCHAM shall not result in liability for AMCHAM.

1 2

use that AMCHAM makes of all the information provided by them. Said opt-in mechanisms may be: to tick a box or IT key or place an acceptance mark or sign next to the text, which indicates and explains what information is delivered and what use will be given to that information, as assurance of the use that AMCHAM will make of the information. If that explicit authorization is not provided, AMCHAM shall eliminate that information and assure that it will not use it.

1. WHAT TYPE OF INFORMATION DOES THE ORGANIZATION HAVE ACCESS TO, AND WHAT INFORMATION DOES IT COMPILE AND STORE? (a) Personal Information: general data on the person, including his/her legal name, age, place of residence, civil status, sex, nationality and identification number, as well as images of the latter. (b) Sensitive Personal Information: Data which refer to the physical or moral characteristics of persons, or to facts or circumstances of their private life or activity, such as personal habits, racial or ethnic origin, nationality, personal preferences, work information, ideologies and political opinions, religious creed or convictions, physical or psychic health conditions, moral and family status, all of these data pertaining to Data Owners. a. Confidential Information: all types of private information whose knowledge is held only by authorized persons and who are under the obligation to keep that information secret.

2. WHAT INFORMATION DOES THE ORGANIZATION USE, HOW DOES IT USE IT AND FOR WHAT PURPOSE DOES THE ORGANIZATION USE THE INFORMATION STORED? (a) Treatment and use of personal information: (i) AMCHAM maintains the data obtained on all the members of the Organization for the purpose of identifying all the persons that enjoy and use the services of AMCHAM, as an organization that generates commercial links between the United States and Guatemala. The lists of Data Owners are used to produce guest lists for the events organized by AMCHAM according to sector and linkages that it seeks to create. Said information allows keeping control of the active participation of members and thus measure the impact and effects generated as a result of them. (ii) All the information of this type which is compiled may be used by AMCHAM with the authorization from Data Owners, and that information may be transferred or sold, in AMCHAM’s discretion, as provided for in paragraph “c” of Section Two herein.

(b) Treatment and use of sensitive personal information and confidential information related to Data Owners: (i) AMCHAM is under the obligation to store and preserve all this type of information under strict confidentiality and is authorized only to share and provide this information to Data Owner members, provided that it has the explicit authorization of Data Owners. There are two types of information or data: a. Sensitive Personal Information: It is information whose ownership belongs to Data Owners.

(A) Information on Data Owners is provided to Data Owner members to give them access to a data base whose list is selected

by AMCHAM, resulting from internal classifications that it generates or after specific requests by Data Owner members; and (B) The information of Data Owner members about their Executives and/or employees may not be shared unless written authorization is received from the Data Owner regarding the information obtained and whose purpose of use shall be defined clearly and precisely by AMCHAM. For these purposes, Data Owners recognize and accept that AMCHAM is authorized to share the information indicated above, respectively. b. Confidential Information: The information provided by Data Owners shall be stored to ensure its confidentiality at all times, unless Data Owners provide explicit authorization for AMCHAM to use it, in which case it shall be for a clearly and accurately defined objective. (ii) All the information of these two types which is compiled by AMCHAM shall be kept confidential and may only be used for the objectives and uses described in this paragraph “b” of the Second Section herein. The use of said information for the following cases is, however, excepted: a) when AMCHAM obtains clear and specific explicit authorization of Data Owners; b) when information is processed in such a way that it is metadata and whose content represents merely statistical data, as defined in paragraph “c” of this Section Two herein. (c) Data transfer and sale: AMCHAM has the right to: i. Sell data authorized by its owners, based on the scope and limitations contained in legislation applicable in Guatemala for that purpose. Without said authorization, AMCHAM shall not use the information in question. ii.

The full use of metadata generated from the information obtained in compliance with the scope and limitations provided for by the legislation applicable in

Guatemala for that purpose. To that end, AMCHAM understands metadata to be all the information whose specific content is not subject to processing to reidentify a Data Owner. Therefore, all the information generated from specific information but whose content represents only general or statistical information in the sense that no person can be identified as belonging to or being a part of that database, AMCHAM has the right and may use said information for purposes related to the mission of the Organization. iii.

The transfer to third parties foreign to AMCHAM, of the metadata generated from the information, in compliance with the scope and limitations provided for by legislation applicable in Guatemala for those purposes. Said transfer may be made to any organization or entity associated to AMCHAM, both in Guatemala as abroad, provided that there is an objective related to AMCHAM’s mission, and applicable laws are abided by.

iv.

Selling metadata generated from the information obtained in compliance with the scopes and limitations provided for by legislation applicable in Guatemala for those purposes to third parties foreign to AMCHAM. Said marketing may be performed so long as the contracts have the purpose of attaining the objectives of the Organization.

(d) Customer Relationship Management (CRM) consists of internal self-use of information by AMCHAM to attain its objectives. (e) COOKIES: Browsing activity: The website www.amchamguatemala.com uses cookies to streamline browsing by the user throughout the portal and to show customized advertisement through Remarketing of Google™ Adwords™. At any rate, the user is able to set the browser in a way that prevents the installation of these files. You may find information of how to disable Google™ cookies in the Ads Preference Managers. You can also find information on how to remove DoubleClick™ cookies from the DoubleClick™ removal page. (f) AMCHAM reserves the right to update, modify or eliminate information contained in its webpages, and may even limit or disallow access to said information. AMCHAM is excluded from liability for any loss or damage that the user may suffer as a result of errors, defects or omissions, in the information provided by AMCHAM, whenever it comes from sources outside of AMCHAM.

SCOPE OF APPLICATION: The data privacy and protection policy herein is valid exclusively in the territory of the Republic of Guatemala, under Guatemalan Laws. Therefore, all data provided by any person, national or foreigner, which is obtained, compiled and stored by AMCHAM in Guatemala shall be governed by this policy and subject to competent Guatemalan Laws and Courts.

VALIDITY: This policy shall be valid as of November 2017 henceforth, subject to any amendment made by AMCHAM that shall be notified to Data Owners and for which the explicit consent from Data Owners is necessary for AMCHAM to be able to continue to use said information.