DATA PROCESSING POLICY
PERSONAL DATA

1. LEGAL REGULATIONS AND SCOPE OF APPLICATION:

This personal data processing policy is prepared in accordance with the provisions of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other complementary provisions and will be applied by MODA CONSCIENTE SAS. regarding the collection, storage, use, circulation, deletion and all those activities that constitute the processing of personal data.

2. DEFINITIONS:

For the purposes of the execution of this policy and in accordance with legal regulations, the following definitions will apply: a) Authorization: Prior, express and informed consent of the owner to carry out the processing of personal data; b) Privacy notice: Physical, electronic or any other format document generated by the controller that is made available to the owner for the processing of his or her personal data. The privacy notice informs the owner of the information regarding the existence of information processing policies that will be applicable to him or her, how to access them and the purpose of the processing that is intended to be given to the personal data; c) Database: Organized set of personal data that is the object of processing; d) Personal Data: any information linked to or that can be associated with one or more specific or identifiable natural persons; e) Public Data: is the data classified as such according to the mandates of the law or the political constitution and that which is not semi-private, private or sensitive. The following are public data, among others, relating to a person's marital status, profession or occupation, status as a merchant or public servant, and any other data that may be obtained without reservation. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins; f) Private Data: is data that, due to its intimate or reserved nature, is only relevant to the owner; g) Sensitive Data: is understood to be data that affects the privacy of the owner or whose improper use may lead to discrimination, such as data that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life and biometric data; h) Data processor: natural or legal person, public or private, who alone or in association with others, processes personal data on behalf of the data controller; i) Data controller: natural or legal person, public or private, who alone or in association with others, decides on the database and/or the processing of data; j) Data subject: natural person whose personal data is processed; k) Processing: any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion thereof.

3. PURPOSE FOR WHICH PERSONAL DATA IS COLLECTED AND PROCESSED:

MODA CONSCIENTE SAS may use personal data to: a) Execute the existing contractual relationship with its customers, suppliers and employees, including the payment of contractual obligations; b) provide the services and/or products required by its users; c) inform about new products or services and/or changes thereto; d) Evaluate the quality of the service; e) conduct internal studies on consumer habits; f) Send to physical, electronic, cell phone or mobile device, via text messages (SMS and/or MMS) or through any other analogous and/or digital means of communication, created or to be created, commercial, advertising or promotional information about the products and/or services, events and/or promotions of a commercial or non-commercial nature, in order to promote, invite, direct, execute, inform and in general, carry out campaigns, promotions or contests of a commercial or advertising nature, advanced by MODA CONSCIENTE SAS and/or by third parties; g) Develop the selection, evaluation and employment relationship process; h) Support internal or external audit processes; i) Register the information of employees and/or pensioners (active and inactive) in the MODA CONSCIENTE SAS database. j) Those indicated in the authorization granted by the data owner or described in the respective privacy notice, as the case may be; k) Provide, share, send or deliver your personal data to subsidiaries, affiliates or subordinate companies PERSONAL DATA PROCESSING POLICY of MODA CONSCIENTE SAS. Located in Colombia or any other country in the event that said companies want the information for the purposes indicated herein. Regarding the data (i) collected directly at security checkpoints, (ii) taken from the documents that people provide to security personnel and (iii) obtained from video recordings made inside and outside the MODA CONSCIENTE SAS facilities. these will be used for the security purposes of the people, property and facilities of MODA CONSCIENTE SAS. And they may be used as evidence in any type of process. If personal data is provided, such information will be used only for the purposes stated herein and therefore, MODA CONSCIENTE SAS. will not sell, license or transmit, or disclose it, unless (i) there is express authorization to do so; (ii) it is necessary to allow contractors or agents to provide the services entrusted; (iii) it is necessary in order to provide our services and/or products; (iv) it is necessary to disclose it to entities that provide marketing services on behalf of MODA CONSCIENTE SAS. Or to other entities with which they have joint market agreements; (v) information that is related to a merger, consolidation, acquisition, divestiture, or other restructuring process of the company; (vi) it is required or permitted by law. MODA CONSCIENTE SAS. may subcontract third parties to process certain functions or information. When the processing of personal information is actually subcontracted to third parties or personal information is provided to third party service providers, MODA CONSCIENTE SAS warns said third parties about the need to protect said personal information with appropriate security measures, the use of the information for their own purposes is prohibited and it is requested that the personal information not be disclosed to others.

4. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA:

The processing of personal data at MODA CONSCIENTE SAS. shall be governed by the following principles: a) Principles of purpose: The processing of personal data collected must obey a legitimate purpose, which must be informed to the owner; b) Principles of freedom: The processing may only be carried out with the prior, express and informed consent of the owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent; Principle of truthfulness or quality: the information subject to processing must be truthful, complete, accurate, up-to-date, verifiable and understandable. Partial, incomplete, fractional or comprehensible data or data that may lead to error will not be processed; d) Principle of transparency: The processing must guarantee the right of the owner to obtain from MODA CONSCIENTE SAS. at any time and without restrictions, information about the existence of data that concerns him; e) Principle of restricted access and circulation: The treatment is subject to the limits derived from the nature of the personal data, the provisions of this law and the constitution. Personal data, except for public information, and the provisions of the authorization granted by the data owner, may be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the owners or authorized third parties; f) Principle of security: The information subject to treatment by MODA CONSCIENTE SAS. must be protected through the use of the technical, human and administrative measures that are necessary to grant security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access; g) Principle of confidentiality: All persons involved in the treatment of personal data are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks that comprise the Treatment has ended. FIRST PARAGRAPH: In the event that sensitive personal data is collected, the owner may refuse to authorize its treatment.

5. RIGHTS OF THE OWNERS OF PERSONAL DATA PROCESSED BY MODA AVANAZADA SA.

The holders of personal data, either themselves or through their representative and/or agent or their successor in title, may exercise the following rights with respect to the personal data that is processed by MODA CONSCIENTE SAS. a) Right of access: By virtue of which you may access the personal data that is under the control of MODA CONSCIENTE SAS. in order to consult it free of charge at least once each calendar month, and each time there are substantial modifications to the information processing policies that motivate new consultations; b) Right to update, rectification and deletion: By virtue of which you may request the update, rectification and/or deletion of the personal data that is being processed, in such a way that the purposes of the processing are met; c) Right to request proof of authorization: except in events in which, according to current legal regulations, authorization is not required to carry out the processing; d) Right to be informed regarding the use of personal data; e) Right to file complaints with the Superintendency of Industry and Commerce: for violations of the PERSONAL DATA PROCESSING POLICY MODA CONSCIENTE SAS. provisions of the current regulations on the processing of personal data; f) Right to request compliance with orders issued by the Superintendency of Industry and Commerce. FIRST PARAGRAPH: For the purposes of exercising the rights described above, both the owner and the person representing him must prove their identity and, if applicable, the capacity by virtue of which he represents the owner. SECOND PARAGRAPH: The rights of minors will be exercised through the persons who are authorized to represent them.

6. DUTIES OF CONSCIOUS FASHION SAS.:

All those required to comply with this policy must bear in mind that MODA CONSCIENTE SAS. is obliged to comply with the duties imposed by law in this regard. Consequently, the following obligations must be fulfilled: A. Duties when acting as responsible: (i) Request and keep, under the conditions provided in this policy, a copy of the respective authorization granted by the owner. (ii) inform the owner in a clear and sufficient manner about the purpose of the collection and the rights that assist him by virtue of the authorization granted. (iii) inform the owner at his request about the use given to his personal data (iv) process the queries and claims made in the terms indicated in this policy (v) ensure that the principles of truthfulness, quality, security and confidentiality in the terms established in the following policy (vi) keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (vii) Update the information when necessary. (viii) rectify personal data when appropriate. B. Duties when acting as the person in charge of processing personal data. If you process data on behalf of another entity or organization (data controller), you must comply with the following duties: (i) establish that the data controller is authorized to provide the personal data that you will process as the person in charge. (ii) Guarantee the owner, at all times, the full and effective exercise of the right to habeas data. (iii) keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access. (iv) carry out timely updates, rectifications or deletion of data. (v) update the information reported by the data controllers within five (5) business days from its receipt. (vi) Process the queries and claims made by the owners in the terms indicated in this policy. (vii) Register in the database with the legend “claim in process” in the manner established in this policy. (ix) insert the legend “information under judicial discussion” into the database once notified by the competent authority about judicial proceedings related to the quality of personal data. (x) Refrain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendency of Industry and Commerce. (xi) allow access to the information only to persons authorized by the owner or empowered by law for that purpose. (xii) inform the Superintendency of Industry and Commerce when violations to security codes occur and there are risks in the administration of the information of the owners. (xiii) comply with the instructions and requirements issued by the Superintendency of Industry and Commerce. C. Duties when processing through a person in charge (i) provide the person in charge of processing only with personal data whose processing is previously authorized. For the purposes of national or international data transmission, a personal data transmission contract must be signed or contractual clauses agreed upon as established in article 25 of decree 1377 of 2013. (ii) guarantee that the information provided to the data processor is true, complete, accurate, updated, verifiable and understandable. (iii) communicate in a timely manner to the data processor all new developments regarding the data previously provided and adopt the other necessary measures so that the information provided to the data processor remains updated. (iv) inform in a timely manner the data processor of any corrections made to personal data so that the data processor can make the relevant adjustments. (v) require the data processor, at all times, to respect the security and privacy conditions of the owner's information. (vi) inform the data processor when certain information is being disputed by the owner, once the claim has been submitted and the respective process has not been completed. D. Duties with respect to the Superintendency of Industry and Commerce (i) inform it of any possible violations of security codes and the existence of risks in the management of the information of the holders. (ii) comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

7. REQUEST FOR AUTHORIZATION FROM THE OWNER OF THE PERSONAL DATA:

Prior to and/or at the time of collecting personal data, MODA CONSCIENTE SAS. will request the owner of the data for authorization to collect and process the data, indicating the purpose for which the data is requested, using for these purposes automated technical means, written or oral, that allow for the preservation of proof of the authorization and/or the unequivocal conduct described in article 7 of decree 1377 of 2013. Said authorization will be requested for as long as is reasonable and necessary to satisfy the needs that gave rise to the request for the data and, in any case, in compliance with the legal provisions governing the matter.

8. PRIVACY NOTICE:

In the event that MODA CONSCIENTE SAS is unable to make this information processing policy available to the owner of the personal data, it will publish the privacy notice attached to this document, the text of which will be kept for later consultation by the owner of the data and/or the Superintendence of Industry and Commerce.

9. TEMPORARY LIMITATIONS ON THE PROCESSING OF PERSONAL DATA.

MODA CONSCIENTE SAS may only collect, store, use or circulate personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the processing, taking into account the provisions applicable to the subject matter in question and the administrative, accounting, tax, legal and historical aspects of the information. Once the purpose of the processing has been fulfilled and without prejudice to legal regulations that provide otherwise, it will proceed to delete the personal data in its possession. Notwithstanding the foregoing, personal data must be retained when required to comply with a legal or contractual obligation.

10. AREA RESPONSIBLE AND PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF THE OWNERS OF PERSONAL DATA:

THE ADMINISTRATIVE AREA OF ORGANIZATIONAL DEVELOPMENT of MODA CONSCIENTE SAS. will be responsible for addressing the requests, complaints and claims made by the data owner in exercising the rights contemplated in numeral 5 of this policy, except for that described in literal e) for such purposes, the owner of the personal data or whoever exercises his representation may send his request, complaint or claim from Monday to Friday from 8:00 AM to 5:00 PM to the email info@proyectocrudo.com the request, complaint or claim must contain the identification of the owner, the description of the facts that give rise to the claim, the address, and accompanying the documents that they wish to assert. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim. In the event that the person who receives the claim is not competent to resolve it, he/she will forward it to the appropriate person within a maximum period of two (2) business days and will inform the interested party of the situation. Once the complete claim has been received, a legend stating “claim in process” and the reason for it will be included in the database, within a period of no more than two (2) business days. This legend must be maintained until the claim is decided. The maximum period to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said period, the interested party will be informed of the reasons for the delay and the date on which his/her claim will be addressed, which in no case may exceed (8) business days following the expiration of the first period.

11. DATA COLLECTED BEFORE THE ISSUANCE OF DECREE 1377

FROM 2013: In accordance with the provisions of numeral 3 of article 10 of regulatory decree 1377 of 2013, MODA CONSCIENTE SAS will publish a notice on its official website www.proyectocrudo.com addressed to the holders of personal data in order to publicize this information processing policy and the manner of exercising their rights as holders of personal data stored in the MODA CONSCIENTE SAS database.

12. SECURITY MEASURES:

Pursuant to the security principle established in Law 1581 of 2012, MODA CONSCIENTE SAS. will adopt the technical, human and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access. The personnel who process the personal data will execute the established protocols in order to guarantee the security of the information.

13. EFFECTIVE DATE:

This personal data policy was created on October 15, 2016 and is effective as of the same date. Any changes to this policy will be reported via email. 14. CONTACT INFORMATION: Questions about the Terms of Service should be sent to info@proyectocrudo.com. Last update of this terms and conditions document: 10/27/2024