Data Treatment Policy

Code: PT-CM-01

Version: 3

Date (D/M/Y): 07/24/2024

Prepared by: Legal Management

Reviewed: Internal Control Director

Approved: General Management

This document contains the Policy of Treatment of Personal Data processed by RACAFÉ & CÍA S.C.A. identified with NIT. 860.000.996-0 which regulates the collection, storage, use, circulation, transfer, transmission and deletion of data collected by RACAFÉ & CÍA S.C.A (hereinafter the “Company”) in accordance with the provisions contained in the Statutory Law 1581 of 2012 and Decree 1377 of 2013, through which general provisions for the protection of personal data are issued:

1.Information of the person responsible for the Processing of personal information.

The Company responsible for the processing of personal data is:

Company name: RACAFÉ & CÍA S.C.A.

Address: Bogotá

Address: Carrera 11 No. 82-01

Email: atencionusuario@racafe.com

Phone number: (601) 6118700

2.Treatment to which personal data will be submitted and its purpose

The personal data that you provide us are collected, stored, organized, used, circulated, transmitted, transferred, updated, rectified, deleted, and managed in accordance with the following purposes:

To carry out the pertinent steps for the fulfillment of the purpose of the contract entered into with the Owner of the information and to manage PQR's procedures.

Verification and reporting in risk centers and statistical, tax, accounting, financial and legal use of the Company.

Publish your image in videos or physical or digital publications of RACAFÉ & CÍA S.C.A., as well as in the different headquarters, on the website, social networks or corporate publications.

Personalize and improve products and services, extend marketing offers that could be of interest to you through electronic media, website, WhatsApp and social networks.

Personalize and improve products and services, extend marketing offers that might be of interest to you through phone calls, email and text messages.

Conduct satisfaction surveys and extend marketing offers regarding products and services directly or through relationship marketing companies.

Transfer and/or transmit my personal data for statistical, commercial, informational, product tracking, marketing, customer notification and contact, relationship marketing and/or similar purposes through authorized channels.

Transmit and/or transfer my personal data and the information that I have provided to the company or that it has registered regarding the activity that I develop, including, but not limited to, the geographical location of the coffee crops that I own or those crops that I represent or legally own, to clients or strategic allies of RACAFÉ & CÍA S.C.A to comply with the voluntary sustainability standards promoted by RACAFÉ & CÍA S.C.A and/or to comply with other international standards.

All information you provide will be treated in accordance with the applicable regulations and will only be used in accordance with the limits set out in this document.

3. Processing of sensitive data

The Company will strictly observe the legal limitations to the treatment of sensitive data, so it will ensure that:

a) The Data Subject has given his/her explicit authorization to such processing, except in cases where the granting of such authorization is not required by law. b) The processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization. c) The Processing is carried out in the course of legitimate activities and with the due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, as long as the processing is carried out by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, as long as the processing is carried out in the course of legitimate activities and with the due guarantees. In these events, the data may not be provided to third parties without the authorization of the Data Subject. d) The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process. e) The Processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted.

4. Channels and Schedules Authorized by the Company to make contact

Personal data owners are informed that the company will have the following communication channels:

Phone Call

E-mail

Personalized Attention

The contact hours will be Monday through Friday from 7:00am to 7:00pm and Saturdays from 8:00am to 3:00pm, in accordance with the provisions of Law 2300 of 2023.

5. Video Surveillance

The Company uses video surveillance in different parts of its facilities. The information collected and stored will be used for security purposes of people, property and facilities. This information may be used as evidence in any process and before any authority.

6. Processing of personal data of children and/or adolescents

The processing of personal data of children and/or adolescents shall comply with the following requirements:

a) That it respects the best interests of children and adolescents. b) That it ensures respect for their fundamental rights. c) Assessment of the child's opinion when he/she has the maturity, autonomy and capacity to understand the matter.

Once the above requirements have been met, the legal representative of the child or adolescent may grant authorization for the processing of such data.

7. Rights you have as Data Owner

In accordance with the provisions of Article 8 of Law 1581 of 2012, Decree 1377 of 2013, Law 2300 of 2023 and other concordant rules, the Holder of the personal data has the following rights:

a) To know, update and rectify their personal data against the Company, in its capacity as Data Controller. This right may be exercised against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized. b) Request proof of the authorization granted to the Company, in its capacity as Data Controller, except when expressly exempted as a requirement for the Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012 (or in the rules that regulate, add, supplement, amend or repeal it), or when the continuity of treatment has been presented as provided in paragraph 4 of Article 10 of Decree 1377 of 2013. c) To be informed by the Company, upon request, regarding the use it has given to their personal data. d) File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012, once you have exhausted the process of consultation or complaint to the Company. e) Revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees. f) Access free of charge to your personal data that have been subject to processing. g) To be contacted through the authorized communication channels and schedules.

8. Area responsible for the attention of requests, queries and claims.

The Customer Service Area of the company will be responsible for the attention of requests, inquiries, claims, complaints for the exercise of the rights of the Holder of personal information.

9. Procedure for exercising the Data Subject's rights

9.1 Access, consultation and contact through the channels of communication

The Data Subject or his/her assignees may consult the information contained in the Company's databases, for which purpose they shall submit the corresponding request to the Area in charge, in accordance with the previous paragraph, from Monday to Friday from 8:00 AM to 5:00 PM at Carrera 11 No. 82-01 in the city of Bogota or by e-mail to atencionusuario@racafe.com.

When a request is made for consultation and / or access to personal data contained in the databases, the Company will verify that the request comes from the owner of the data.

When a request is made for consultation and/or access to personal data contained in the databases, the Company will verify that the request comes from the owner of the personal data. In the event that the ownership of the personal data is not accredited or that the applicant does not have the authorization of the owner of the personal data to carry out this procedure, it will be considered as not submitted.

Once the request is admitted, it will be dealt with within a maximum term of ten (10) working days from the date of receipt. When it is not possible to attend the consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term.

9.2 Updating, correction, modification, deletion and/or revocation of the authorization for the processing of personal data

The Data Subject or his/her assignees, who consider that the information contained in the Company's databases and in the authorization granted for the processing of personal data should be subject to update, correction, modification, deletion and/or revocation or when they notice the alleged breach of any of the duties contained in the law or in this policy, may submit a request to the Area in charge of the Company from Monday to Friday from 8:00 AM to 5:00 PM at Carrera 11 No. 82-01 in the city of Bogota or by email to . 82-01 in the city of Bogotá or to the email atencionusuario@racafe.com, which will be processed under the following rules in accordance with Article 15 of Law 1581 of 2012:

(a) The request must contain at least the following information:

The identification of the Holder:
The contact details (physical and/or electronic address and contact telephone numbers).
The documents proving the identity of the Holder, or the representation of its representative.
A clear and precise description of the personal data with respect to which the Data Subject seeks to exercise any of the rights.
The description of the facts that give rise to the request.
The documents to be asserted.
Signature, identification number.
Original filing.

b) When a request is made for consultation and/or access to personal data contained in the databases, the Company will verify that the request comes from the owner of the personal data. In the event that the ownership of the personal data is not accredited or that the applicant does not have the authorization of the owner of the personal data to carry out this procedure, it will be considered as not submitted. c) If the request is incomplete, the Company shall require the interested party within five (5) days following its receipt to correct the faults. After two (2) months from the date of the requirement, if the applicant has not submitted the required information, it shall be understood that the application has been withdrawn. d) For the modification of the communication channels, the holder may, through e-mail, define the channel or channels through which he/she wishes to be contacted; if he/she does not choose one, the company shall understand that he/she has authorized to be contacted by any means, in accordance with the provisions of the applicable laws on the matter. e) In the event that the Area that receives the request is not competent to resolve it, it shall forward it to the appropriate person within a maximum term of two (2) business days and shall inform the interested party of the situation. f) Once the request is received, a legend will be included in the database stating “claim in process” and the reason for the claim, within a term not to exceed two (2) business days. Said legend shall be maintained until the request is decided. g) The maximum term to attend the request shall be fifteen (15) business days counted from the business day following the date of its receipt. When it is not possible to attend it within such term, the interested party shall be informed of the reasons for the delay and the date on which it will be attended, which in no case may exceed eight (8) business days following the expiration of the first term.

10. Proceeding of the request for deletion and revocation of personal data

The right to suppression of personal data is not absolute and the Company may deny the exercise of this right when:

a) The request for deletion of information does not proceed when the Data Subject has a legal or contractual duty to remain in the database. b) The deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions. c) The data is necessary to protect the legally protected interests of the Data Subject, to carry out an action in the public interest, or to comply with an obligation legally acquired by the Data Subject. d) Once the request is received, a legend will be included in the database stating “claim in process” and the reason for the claim, within a term not to exceed two (2) business days. Such legend shall be maintained until the request is processed. e) The Holder of the personal data may revoke the consent to the Processing of his/her personal data at any time, as long as it is not prevented by a legal provision.

11. Validity of the Policy and databases

The Policy is effective as of its publication. The term of the authorizations on the use of personal data, as well as the validity of the Databases is understood for the term of the exercise of the Company's corporate purpose, as long as the purposes for which the processing of personal data was authorized subsist and in accordance with the special rules that regulate the matter.

12. Modifications to the Personal Data Processing Policies.

The Company reserves the right, at its sole discretion, to modify, alter, add or delete parts of these Personal Data Processing Policies at any time, for which it will give notice on the website or at the Company's headquarters.