OBJECTIVE AND SCOPE OF THE PERSONAL DATA PROCESSING POLICY

AGYBO S.A.S. (hereinafter "AGYBO" or the "Company"), in strict compliance with the current regulations on Personal Data protection, as established in Law 1266 of 2008, Law 1581 of 2012, Decree 1074 of 2015, and other provisions that modify, add, or complement them, presents the Personal Data Processing Policy (hereinafter the "Policy") of AGYBO. This Policy sets forth general provisions for the protection of information related to, or that may be associated with, one or more identified or identifiable natural persons (the "Personal Data"), based on the prior authorization granted by the Data Subjects.

This Policy applies to all Data Subjects who have a relationship with AGYBO and/or whose Personal Data has been collected and processed in any way as a consequence of or in connection with a relationship established with the Company, whether such Processing is carried out by AGYBO or by third parties acting on its behalf.

This Policy applies to all Processing carried out in the territory of the Republic of Colombia by AGYBO and, as applicable, by those third parties with whom it agrees to perform any activity related to, or associated with, the Processing of Personal Data.

In this Personal Data Processing Policy, AGYBO details the general corporate guidelines considered to protect the Personal Data of the Data Subjects, the purposes of the information Processing, the rights of the Data Subjects, the area responsible for handling complaints and claims, and the procedures to be followed to know, update, rectify, and delete the information.

AGYBO, in compliance with the constitutional right to Habeas Data enshrined in Article 15 of the Political Constitution, only collects and processes Personal Data when previously authorized by its Data Subject, implementing clear measures on confidentiality and privacy of Personal Data. In cases where authorization for the Processing of Personal Data is not required, the Company will also implement the necessary measures to process the information in accordance with the applicable regulations.

DEFINITIONS

For the purposes of this Policy, the definitions stated in Law 1581 of 2012 and Decree 1074 of 2015 will be considered, as transcribed below:

• Personal Data: Any information linked to or that can be associated with one or more identified or identifiable natural persons.
• Data Subject: Natural person whose Personal Data is subject to Processing.
• Sensitive Data: Data that affects the privacy of the Data Subject or whose misuse can lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or organizations promoting the interests of any political party or guaranteeing the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
• Data Processor: The natural or legal person, public or private, who, alone or in association with others, processes Personal Data on behalf of the Data Controller.
• Personal Data Processing Policy: Refers to this document.
• Data Controller: The natural or legal person, public or private, who, alone or in association with others, decides on the Database and/or the Processing of Personal Data. In this case, it is AGYBO.
• Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation, or deletion, as well as its Transfer and/or Transmission to third parties through communications, queries, interconnections, assignments, data messages.
• Transfer: The Transfer of Personal Data occurs when the Data Controller and/or Data Processor, located in Colombia, sends the Personal Data to a recipient, who in turn is the Data Controller and is located inside or outside the country.
• Transmission: Processing of Personal Data that involves communication to a third party within or outside the territory of the Republic of Colombia, when such communication aims at performing Processing by the Data Processor on behalf and for the account of the Data Controller, to fulfill the latter's purposes.

INFORMACIÓN Y MECANISMOS DISPUESTOS POR AGYBO COMO RESPONSABLE DEL TRATAMIENTO DE DATOS PERSONALES.

Legal entity name:  AGYBO S.A.S.

NIT: 901.410.235-1

City: Bogotá DC

Address: Calle 56a #3c-05

Phone Number: + 57 3052366849

AUTHORIZATION, PROCESSING, AND STORAGE OF PERSONAL DATA

Since the entry into force of this Policy, AGYBO, at the time of collecting Personal Data, will request prior authorization from the Data Subjects, informing them about the specific purposes of the Processing for which such consent is obtained, unless one of the exceptions contained in Article 10 of Law 1581 of 2012 applies.

AGYBO will proceed with the Processing of Personal Data voluntarily provided by the Data Subject. In general, the Company will collect, store, use, circulate, transmit, and transfer the Personal Data it processes. In any case, AGYBO, upon request from the Data Subject, will provide complete information about the authorized persons and/or third parties who carry out the Processing of their Personal Data.

AGYBO will retain proof of such authorizations appropriately, respecting the principles of confidentiality and privacy of the information.

PURPOSES OF PERSONAL DATA PROCESSING

The Personal Data collected by AGYBO is included in a Database accessible to authorized personnel of AGYBO in the exercise of their functions, warning that in no case is the Processing of information authorized for purposes other than those described herein, which will be communicated to the Data Subject directly at the time of collection at the latest.

The purposes of collection and Processing of AGYBO's Personal Data are as follows:

• Verify your identity and ensure compliance with legal, contractual, technical, and financial requirements to use our website to prevent fraud.
• Perform actions for the execution of the contractual relationship and processing of orders and payments, and send you information about the same, including information about the status of the order, product delivery, and issuance of invoices.
• Collect information for commercial and marketing research purposes, related to your preferences and purchase history, in order to provide you with better information and offer products that may be of interest to you.
• Send you information about our products, offers, loyalty program, and benefits, through emails, SMS and MMS messages, social networks, and the website.
• Record comments and feedback on our products on the website.
• Conduct service surveys.
• Send notifications regarding updates to our policies.
• Provide after-sales services related to the products purchased.
• Conduct audits and manage our systems and databases.
• Carry out processes of transmission and transfer of databases through mergers, strategic alliances, reorganizations, assignments, or asset sales.
• Conduct the economic and accounting management of AGYBO.

The information provided by the Data Subject will only be used for the purposes stated herein.

If AGYBO requests sensitive data, it is reminded that providing this information will not be mandatory in any case, and in case of non-authorization by the Data Subject, AGYBO will not retaliate. This data will be treated with the utmost diligence and the highest security standards.

AGYBO may transmit and/or transfer your Personal Data to third parties located in Colombia or abroad, even if they are located in countries that do not provide adequate levels of protection, provided that prior express authorization from the Data Subject of the Personal Data is obtained.

PERSONAL DATA OBTAINED THROUGH COOKIES AND OTHER MONITORING TECHNOLOGIES

Cookies, web beacons, and other monitoring technologies are used for the following purposes:

• Ensure the proper functioning of our website.
• Improve the content of our website.
• Provide you with a better user experience, for example, by saving information about products in the shopping cart.
• Collect information for commercial and marketing research.
• Establish and store your preferences when using our website.
• Display ads on the website and on affiliated third-party websites.
• Recognize you when you return to our website.
• Speed up your searches on our website.
• Automatic data collection will only be carried out in an aggregated form for statistical purposes.

RIGHTS OF THE DATA SUBJECT

In accordance with Article 8 of Law 1581 of 2012, the Data Subject has the following rights:

• Know, update, and rectify their Personal Data against the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, misleading data, or data whose Processing is expressly prohibited or has not been authorized.
• Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.
• Be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been given to their Personal Data.
• File complaints with the Superintendence of Industry and Commerce for violations of Law 1581 of 2012 and other regulations that modify, add to, or complement it.
• Revoke the authorization and/or request the deletion of the data, provided there is no legal or contractual obligation that requires the Data Subject to remain in the database.
• Access their personal data free of charge, which have been subject to Processing, at least once every calendar month and each time there are substantial modifications to the Processing policies.

According to Article 2.2.2.25.4.1 of Decree 1074 of 2015, the aforementioned Rights may be exercised by:

• The Data Subject, who must sufficiently prove their identity through the various means made available by the Data Controller.
• Their successors in title, who must prove such status.
• The representative and/or attorney-in-fact of the Data Subject, upon accreditation of representation or power of attorney.

PROCEDURES FOR DATA SUBJECTS TO EXERCISE THEIR RIGHTS OVER PERSONAL DATA

The Data Subject may exercise their rights regarding their Personal Data provided through the designated area for handling requests, inquiries, and claims regarding Personal Data within the Company. The Data Subject may exercise their rights as listed below:

• Via electronic communication, through the email address info@agybo.com.
• By telephone communication, at the phone number (+57) 3052366849.

Procedure for making inquiries (request proof of authorization, know the data that have been collected, and know the Processing that has been given to them):

The Data Subject may make inquiries about the Personal Data held in AGYBO's Databases, in accordance with the following rules:

• The request will be analyzed to verify the identification of the Data Subject. If the request is made by a person other than the Data Subject and it is not proven that they act on behalf of the Data Subject in accordance with applicable laws, the request will be rejected.
• All inquiries will be answered within a maximum period of ten (10) business days from the date of receipt thereof. If it is not possible to respond to the inquiry within this period, the interested party will be informed of the reasons for the delay and the date on which the inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first term.

Procedure for filing claims for updating, correction, deletion, revocation of authorization:

The Data Subject or their successors, who consider that the information contained in AGYBO's Databases should be corrected, updated, or deleted, or who notice the alleged non-compliance with any of the duties, may file a claim in accordance with the following rules:

• The request will be analyzed to verify the identification of the Data Subject. If the request is made by a person other than the Data Subject and it is not proven that they act on behalf of the Data Subject in accordance with applicable laws, the request will be rejected.
• The claim must contain the following information: (i) Identification of the Data Subject; (ii) Contact information (physical and/or electronic address and contact numbers); (iii) Documents proving the identity of the Data Subject or representation; (iv) Clear and precise description of the Personal Data regarding which the Data Subject seeks to exercise any of the rights; (v) Description of the facts giving rise to the claim; (vi) Documents that they wish to assert; (vii) Signature and identification number.

If the claim is incomplete, AGYBO will require the interested party within five (5) days following the receipt of the claim to correct the deficiencies. If two (2) months have passed since the date of the requirement without the applicant providing the required information, it will be understood that they have withdrawn the claim.

If the area receiving the claim is not competent to resolve it, it will be forwarded to the appropriate authority within a maximum period of two (2) business days, and the interested party will be informed of the situation.

Once the complete claim is received, a legend stating "claim in process" and the reason thereof will be included in the database within a maximum period of two (2) business days. This legend must be maintained until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days from the day following the date of its receipt. If it is not possible to address the claim within this period, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

The Data Subject has the right, at any time, to request the deletion of their Personal Data. Deletion involves the total or partial elimination of Personal Data from the Databases, according to what is requested by the Data Subject. The right to deletion is not absolute, and AGYBO may deny its exercise in the following events: (i) The Data Subject has a legal or contractual duty to remain in the Database or the Data Controller has a legal obligation or contractual requirement to maintain the Personal Data; (ii) The deletion of Personal Data obstructs judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions; (iii) The Personal Data is necessary to protect legally protected interests of the Data Subject, to perform an action in the public interest, or to comply with a legal obligation acquired by the Data Subject or the Data Controller.

EFFECTIVENESS OF THE DATA PROCESSING POLICY

This Policy is effective from 16/11/2022.

The Personal Data included in the Databases subject to Processing will remain and be processed based on the temporality criterion for the contractual term of the product or service, during the period in which the purpose for which they were collected persists, plus the term established by law.

This Policy may be modified by AGYBO as required without prior notice, provided that they are non-substantial modifications. Only modifications regarding the purposes of Processing and the data of the Data Controller, or any other substantial modification, will be communicated to the Data Subjects in advance