Personal Data Processing Policy

RAPPI S.A.S. is a leading company in Colombia whose main activity is to connect consumers with vendors through a virtual platform comprised of a website and a mobile application, so that consumers can log in, learn about the consumer products on display, and carry out purchase and sale transactions directly with vendors electronically, and in general all kinds of complementary activities.

RAPPI S.A.S., in order to strictly comply with the regulations in force on the protection of Personal Data, in accordance with the provisions of Law 1581 of 2012, Decree 1074 of 2015, and other provisions that amend, add to, or supplement them, presents the following PERSONAL DATA PROTECTION AND PROCESSING POLICY (hereinafter the "Processing Policy") with the purpose of protecting the personal information provided by the Data Subjects who have a relationship with RAPPI S.A.S., such as partners, suppliers, clients, employees, collaborators, and any other natural person from whom RAPPI S.A.S. obtains, collects, processes, or handles personal data, whether such processing is carried out by RAPPI S.A.S. or by third parties acting on its behalf.

The purpose of the Processing Policy is to protect the constitutional right of Habeas Data that all individuals have to access, update, and rectify the information that has been collected and stored in the various databases of RAPPI S.A.S., and in fulfillment of that right it only collects and processes Personal Data when previously authorized by its Data Subject, implementing for that purpose clear measures regarding the confidentiality and privacy of Personal Data. It also details the general corporate guidelines taken into account in order to protect the Personal Data of Data Subjects, the purposes of processing the information, the area responsible for handling complaints and claims, and the procedures that must be followed to access, update, rectify, and delete information, along with the respective channels through which they may be exercised.

As established in Title II of Statutory Law 1581 of 2012, the protection of personal data shall be governed by the harmonious and integral application of the following principles:

• Principle of legality in the processing of personal data: The processing of personal data referred to in Statutory Law 1581 of 2012 is a regulated activity that must comply with the provisions established therein and in the other provisions that develop it.
• Principle of purpose: The processing of personal data must serve a legitimate purpose in accordance with the Constitution and the law, which must be communicated to the Data Subject.
• Principle of freedom: The processing of personal data may only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that overrides consent.
• Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up to date, verifiable, and comprehensible. The Processing of partial, incomplete, fragmented, or misleading data is prohibited.
• Principle of transparency: In the Processing of personal data, the right of the Data Subject to obtain from the data controller or the data processor, at any time and without restrictions, information about the existence of data concerning them must be guaranteed.
• Principle of security: The information subject to processing by the Data Controller or data processor referred to in Statutory Law 1581 of 2012 must be handled with the technical, human, and administrative measures necessary to provide security to the records, preventing their alteration, loss, unauthorized or fraudulent consultation, use, or access.
• Principle of confidentiality: All persons involved in the processing of personal data that is not of a public nature are obligated to guarantee the confidentiality of the information, even after their relationship with any of the tasks comprising the processing has ended, being able to supply or communicate personal data only when this corresponds to the development of the activities authorized in Statutory Law 1581 of 2012 and under its terms.
• Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of the personal data, the provisions of Statutory Law 1581 of 2012, and the Constitution. In this sense, processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for in the aforementioned law.

In compliance with the fundamental guarantees enshrined in the Constitution and the law, and without prejudice to the provisions of the other rules governing the matter, the Data Subjects of personal data may exercise the following rights free of charge and without limitation:

• The right to access their personal information subject to processing.
• The right to update the personal data subject to processing.
• The right to rectify the personal data subject to processing.
• The right to object to the personal data being subject to processing.
• The right to request the deletion of personal data when the processing does not respect the constitutional and legal principles, rights, and guarantees.
• The right to request proof of the authorization granted for the processing.
• The right to revoke consent for the processing of personal data.
• The right to file complaints and claims with the Superintendency of Industry and Commerce for breaches of the provisions of Statutory Law 1581 of 2012 and the other rules that amend, add to, or supplement it.
• The right to be informed by the Controller and/or Processor of the use and processing that will be given to the personal data, as well as of the modifications and updates to the protection policies, security measures, and purposes.

The Personal Data collected by RAPPI S.A.S. is included in a Database accessible to the authorized personnel of RAPPI S.A.S. in the exercise of their functions, with the warning that under no circumstances is the Processing of the information authorized for purposes other than those described herein, and which are communicated directly to the Data Subject no later than at the time of collection.

Consent and authorization by the Data Subject of the information is a constitutional and legal requirement that must be met by the persons responsible for processing personal data. Consent must meet the following requirements:

• Prior: Authorization must be given by the Data Subject of the information prior to any type of Processing of personal data.
• Express: Authorization must be granted in an unequivocal, clear, and specific manner.
• Informed: The Data Subject must clearly understand for what purpose their personal data will be processed and the purposes that may arise from the Processing thereof.

All visitors to the platforms must register and authorize the processing of personal data in order to use the services offered. Therefore, in each of the systems there is a checkbox that says "Privacy and Personal Data Processing Policy" which must be read and accepted in order to continue using the services of RAPPI S.A.S.

In development of the constitutional guarantee of Habeas Data regarding the rights of access, update, rectification, and deletion by the Data Subject of personal data, their successors, legal representatives, and/or attorneys-in-fact, RAPPI S.A.S. will enable access channels for the Data Subjects.

All communications, inquiries, complaints, and/or claims must be addressed to the Personal Database Protection Officer or to the CUSTOMER CARE AREA/CUSTOMER SERVICE of RAPPI S.A.S., through any of the following means:

• Electronic service: The Data Subject must submit their request through the help center available on the virtual platform.
• Written service: The Data Subject must submit their formal request to the address: Calle 71A # 14-36 in Bogotá, Colombia.

RAPPI S.A.S. will not collect, store, or process sensitive data unless strictly necessary. Should such a situation arise, it will not carry out any processing without the proper prior, informed, and express authorization of the Data Subject of the information, except in cases where, by law, such authorization is not required.

Responses to questions about sensitive data are optional and therefore not mandatory. In any case, RAPPI S.A.S. will strictly observe the legal limitations on the Processing of Sensitive Data. RAPPI S.A.S. will not, under any circumstances, condition any activity on the provision of Sensitive Data. Sensitive Data will be processed with the utmost diligence possible and with the highest security standards.

RAPPI S.A.S. will endeavor not to carry out any processing of data of children and adolescents under 18 years of age. Use of the platform is only for adults. However, in the event that minors under 18 years of age with legal capacity wish to use the service, they must have the express authorization of their legal representative.

Should the processing of data of minors occur, RAPPI S.A.S. will guarantee, as Data Controller, that such personal data will be processed appropriately, applying the principles and obligations established in Law 1581 of 2012 and other provisions on the protection of personal databases in force.

RAPPI S.A.S. may share personal data information with those third parties as necessary for the development of its activities and corporate purpose, always protecting the rights and information of the data subject.

The Transmission or Transfer of Personal Data carried out will observe the rules established for that purpose by the applicable regulations and the control authority, especially the following:

• In the case of national transmissions or transfers of personal data, RAPPI S.A.S. will ensure compliance with the requirements of the data protection legislation in force and the protection measures by the processor or new controller, as the case may be.
• In the case of an international transfer, it must be ensured that the country receiving the personal data provides adequate levels of protection, in the manner established by the Control Authority in Colombia, so that it issues the declaration of conformity referred to in the first paragraph of article 26 of Law 1581 of 2012.

The Personal Data that is stored, used, or transmitted will remain in the databases of RAPPI S.A.S. for as long as necessary to fulfill the purposes set out in this manual or for the Company to comply with its legal duties.

However, the information will be reviewed annually to verify the accuracy of the data and the purpose of continuing its processing. If necessary, RAPPI S.A.S. reserves the right to unilaterally modify this Policy.