Aromas y Sabores Buenas Vida S.A.S, a commercial company duly incorporated under Colombian law, Tax ID (NIT) 900.063.450-6, domiciled in Bogotá D.C., in compliance with the provisions of Law 1581 of 2012, Decree 1377 of 2013 and other related regulations establishing general provisions for the protection of personal data, and in its capacity as Controller of Personal Data under said regulations, hereby publishes this Privacy and Personal Data Protection Policy (hereinafter, the "Policy") to govern the collection, storage, processing, administration, transfer, transmission, protection and deletion of the information received from personal data subjects or from third parties through the different data collection channels it has set up in the course of its activities.

Definitions

In accordance with the concepts and criteria of Statutory Law 1581 of 2012 and its regulatory Decree 1377 of 2013, and/or for the purposes of this Policy, the words defined below shall have the meaning assigned to them in this chapter, whether or not they are capitalized and whether they appear in the plural or the singular, and shall be developed and applied under a systematic and comprehensive interpretation of the aforementioned regulations.

• Privacy notice: Verbal or written communication issued by the Controller and addressed to the Data Subject regarding the Processing of their personal data, which informs them of the existence of the information Processing policies applicable to them, how to access those policies, and the purposes of the Processing intended for the personal data.
• Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of Personal Data.
• Database: Organized set of Personal Data subject to Processing, which may be stored and/or processed on servers located in data centers or in physical paper files, whether owned or contracted with third parties, located within the national territory or in other countries.
• Personal Data: Any information linked to, or that can be associated with, one or more specific or identifiable natural persons.
• Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person's marital status, profession or trade, and status as a merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly enforceable court rulings that are not subject to confidentiality.
• Sensitive Data: Sensitive data is data that affects the Data Subject's privacy or whose improper use may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions, social or human rights organizations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data, among others.
• Processor: Natural or legal person, public or private, who, alone or jointly with others, carries out the Processing of Personal Data on behalf of the Controller of Personal Data.
• Controller: Natural or legal person, public or private, who, alone or jointly with others, decides on the database and/or the Processing of the data. For the purposes of this Policy, the Controller is Aromas y Sabores Buenas Vida S.A.S.
• Data Subject: Natural person whose personal data is subject to Processing, and legal entity where its financial data is processed, whether they are customers, employees, suppliers or any other type of relationship with the company.
• Transfer: A data transfer takes place when the controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient who is in turn a controller of the data and is located inside or outside the country.
• Transmission: Processing of personal data that involves communicating it inside or outside the territory of the Republic of Colombia when its purpose is for the processor to carry out Processing on behalf of a single controller.
• Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

Principles

In the development, interpretation and application of Law 1581 of 2012, which sets out general provisions for the protection of personal data, and the regulations that supplement, modify or add to it, the following guiding principles shall be applied in a harmonious and comprehensive manner:

• Principle of Purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the Law, and that purpose must be communicated to the data subject.
• Principle of Freedom: Processing may only be carried out with the prior, express and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent.
• Principle of Truthfulness or Quality: The information subject to Processing must be truthful, complete, accurate, up to date, verifiable and understandable. Processing of partial, incomplete, fragmented or misleading data is prohibited.
• Principle of Transparency: Processing must guarantee the data subject's right to obtain from the controller or processor, at any time and without restriction, information about the existence of data concerning them.
• Principle of Restricted Access and Circulation: Processing is subject to the limits arising from the nature of the personal data and from the provisions of the law and the Constitution. Accordingly, Processing may only be carried out by persons authorized by the data subject and/or by the persons provided for by law. Personal data, except public information, may not be available on the internet or other means of mass dissemination or communication, unless access is technically controllable so as to provide restricted knowledge only to data subjects or authorized third parties.
• Principle of Security: Information subject to Processing by Aromas y Sabores Buenas Vida S.A.S must be handled with the technical, human and administrative measures necessary to secure the records and prevent their tampering, loss, consultation, or unauthorized or fraudulent use or access.
• Principle of Confidentiality: Aromas y Sabores Buenas Vida S.A.S is obliged to guarantee the confidentiality of information, even after its involvement in any of the tasks comprised by Processing has ended, and may only provide or communicate personal data when this corresponds to the development of the activities authorized by law.

Authorization for the Processing of Personal Data

The collection, storage, use, circulation or deletion of personal data by Aromas y Sabores Buenas Vida S.A.S requires the free, prior, express and informed consent of the data subject. Aromas y Sabores Buenas Vida S.A.S, in its capacity as controller of personal data, has put in place the necessary mechanisms to obtain the authorization of data subjects, always guaranteeing the possibility of verifying that such authorization was granted.

Form and mechanisms for granting authorization: Authorization will be requested no later than at the time the personal data is collected; it may be recorded in a physical or electronic document, or in any other format that allows it to be consulted later. Authorization may be granted by the data subject (i) in writing, (ii) orally or (iii) through unequivocal conduct by the data subject from which it can reasonably be concluded that they granted authorization. Silence may never be treated as unequivocal conduct.

The authorization forms and texts will be issued by Aromas y Sabores Buenas Vida S.A.S and made available to the data subject, prior to the Processing of their personal data, in accordance with Law 1581 of 2012 and its regulatory decrees.

So that the data subject can make informed decisions about their personal data and control the use of their personal information, the authorization forms and texts constitute a statement informing the data subject about:

• Identification, physical or electronic address and telephone number of the Controller.
• Reference to this personal data processing policy and its location on the institutional website.
• A breakdown of the personal data collected.
• The purpose of the personal data collected.
• How to exercise the rights of access, correction, updating or deletion of the personal data provided.
• Where sensitive data or data of children and adolescents is collected, an indication that providing such data is optional.

The consent-based authorization procedure ensures that the data subject has been made aware that their personal information will be collected and used for specific, known purposes, and that they have the option of learning of any change to those purposes and the specific use that has been made of the data.

Proof of authorization: The areas responsible for Processing at Aromas y Sabores Buenas Vida S.A.S must have the measures necessary to keep records of when and how authorization was obtained from data subjects for the Processing of their personal data.

Privacy Notice: This is the physical, electronic or other-format document made available to the Data Subject for the Processing of their personal data, when the privacy policy cannot be made available. This document informs the Data Subject of the existence of the Processing policies applicable to them, how to access them, and the characteristics of the Processing intended for their personal data.

To ensure in every case that the authorization includes all the elements that allow the data subject to properly exercise their rights, the Privacy Notice of Aromas y Sabores Buenas Vida S.A.S must include the following information:

• The corporate name of Aromas y Sabores Buenas Vida S.A.S and its contact details.
• The Processing to which the data will be subject and its purpose.
• The rights the data subject has.
• The mechanisms provided by Aromas y Sabores Buenas Vida S.A.S for the data subject to learn about the Processing policy.
• The optional nature of answers to the questions asked, when these concern sensitive data or data of children and adolescents.

Sensitive Data

Sensitive data is data that affects the Data Subject's privacy or whose improper use may lead to discrimination. It includes data revealing a person's racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions, social or human rights organizations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data.

Aromas y Sabores Buenas Vida S.A.S is committed to protecting privacy during the processing of your identifiable and sensitive personal data. Therefore, where data subjects expressly authorize the use of sensitive data, Aromas y Sabores Buenas Vida S.A.S undertakes to use it in accordance with the rules set out in its regulatory decrees. Whenever sensitive data is collected, at least the following actions will always be taken:

• Inform the data subject that, because the data is sensitive, they are not obliged to authorize its Processing.
• If the Data Subject is physically or legally incapacitated, it will be verified whether the Processing is necessary to safeguard their vital interest, and if so, authorization will be requested from their legal representatives.
• Inform the data subject explicitly and in advance, in addition to the general requirements for authorization to collect any type of personal data, which of the data to be Processed is sensitive and the purpose of the Processing.
• Obtain express consent for the Processing of sensitive data.
• No activity may be made conditional on the Data Subject providing sensitive personal data.

Special requirements for the processing of personal data of children and adolescents

The Processing of personal data of children and adolescents is prohibited, except for data of a public nature, in accordance with Article 7 of Law 1581 of 2012, and when such Processing meets the following parameters and requirements:

• That it responds to and respects the best interests of children and adolescents.
• That respect for their fundamental rights is ensured.

Aromas y Sabores Buenas Vida S.A.S will process the data of minors only when these conditions are met. For the purposes of authorization, the legal representative of the child or adolescent may grant it, ensuring that, as far as possible, the minor will be heard and their opinion will be taken into account considering their maturity, autonomy and capacity to understand the matter.

Rights of the data subject

The data subject has the following rights:

• To know, update and rectify their personal data with Aromas y Sabores Buenas Vida S.A.S in its capacity as controller. This right may be exercised, among others, with regard to partial, inaccurate, incomplete or fragmented data, data that is misleading, or data whose Processing is expressly prohibited or has not been authorized.
• To consult their personal data free of charge at least once every calendar month, and whenever there are substantial changes to the Processing Policies.
• To request proof of the authorization granted to Aromas y Sabores Buenas Vida S.A.S, in its capacity as controller, except where it is expressly exempted as a requirement for Processing (cases in which authorization is not necessary).
• To be informed by Aromas y Sabores Buenas Vida S.A.S, upon request, of the use it has made of their personal data.
• To file complaints with the Superintendence of Industry and Commerce for infringements of Law 1581 of 2012 and other regulations that modify, add to or supplement it.
• To revoke the authorization and/or request the deletion of the data when the Processing does not respect constitutional and legal principles, rights and guarantees.
• To access free of charge their personal data that has been subject to Processing.

Duties of data subjects

The Data Subject has the duty to keep their information up to date and to guarantee its accuracy at all times. Aromas y Sabores Buenas Vida S.A.S shall not, under any circumstances, be liable for any responsibility arising from inaccurate information.

Duties of Aromas y Sabores Buenas Vida S.A.S

By virtue of this personal data processing and protection policy, the duties of Aromas y Sabores Buenas Vida S.A.S are the following:

• Guarantee the data subject, at all times, the full and effective exercise of the right of habeas data.
• Request and keep a copy of the respective authorization granted by the data subject.
• Duly inform the data subject of the purpose of the collection and the rights they have by virtue of the authorization granted.
• Respect the security and privacy conditions of the data subject's information.
• Allow access to the information only to persons who may have access to it.
• Keep the information under the security conditions necessary to prevent its tampering, loss, consultation, or unauthorized or fraudulent use or access.
• Inform the data protection authority when security codes are breached and there are risks in the administration of data subjects' information.
• Ensure that the information is truthful, complete, accurate, up to date, verifiable and understandable.
• Inform, at the data subject's request, of the use made of their data.
• Update the information, taking into account all changes concerning the data subject's data, within 5 business days of receiving the change, implementing the measures necessary to keep the information up to date.
• Process the queries and claims submitted by data subjects.
• Record in the database the legend "claim in process" within two business days of receiving the complete claim.
• Rectify the information when it is incorrect and communicate what is relevant.
• Comply with the requirements and instructions issued by the Superintendence of Industry and Commerce on the matter.
• Identify when certain information is under dispute by the data subject.
• Insert in the database the legend "information under judicial dispute" once notified by the competent authority of judicial proceedings relating to the quality of the personal data.
• Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.
• Use only data whose Processing has been previously authorized in accordance with Law 1581 of 2012.

Cases in which the authorization of the data subject is not required

The authorization of the data subject is not required in the case of:

• Information requested by a public or administrative entity in the exercise of its legal functions or by court order.
• Data of a public nature.
• Cases of medical or health emergency.
• Processing of information authorized by law for historical, statistical or scientific purposes.
• Data related to the Civil Registry of persons.

Standing to exercise the data subject's rights

The rights of data subjects may be exercised by the following persons:

• By the data subject, who must sufficiently prove their identity by the various means made available by Aromas y Sabores Buenas Vida S.A.S.
• By the data subject's successors (where the data subject is absent due to death or incapacity), who must prove that status.
• By the data subject's representative and/or attorney, upon proof of the corresponding representation or power of attorney.
• By stipulation in favor of another or for another.

The rights of children and adolescents will be exercised by the persons authorized to represent them.

Processing to which personal data will be subject

The Processing of data collected under the provisions of this policy will be carried out and will remain in force for as long as the purpose for which the personal data was collected is maintained, and may, among other things: i) appoint one or more Processors of Personal Data; ii) transfer and/or transmit the Personal Data subject to Processing to the companies that are part of its business group — that is, parent companies, affiliates or subsidiaries — as well as to any other third party, inside or outside the national territory, whether legal or natural persons, national or foreign, even where the country in which the recipient is located has no rules establishing a data protection standard similar to the one in force in the national territory; iii) provide such Personal Data to agents, subcontractors and other third parties to achieve the purposes listed in the following section; and iv) disclose the information when so required by duly authorized public authorities by administrative or judicial order.

Personal data will be processed for pre-contractual, contractual, post-contractual, commercial, customer service, marketing, advertising, processing, research, training, accreditation, consolidation, organization, updating, reporting, statistical, survey, service and handling purposes, granting of benefits, as well as for the control and preservation of security at Aromas y Sabores Buenas Vida S.A.S, to carry out statistical, commercial, strategic, financial, social, technical and risk-rating analyses.

Likewise, to be shared with or sent to its parent company, affiliates and subsidiaries, as well as to third parties with whom it enters into alliances or contracts for commercial purposes related to carrying out the activities within its corporate purpose, or to whom it entrusts the performance of studies or the processing of data, as well as for reporting to and consulting credit risk bureaus legally established in Colombia.

All of the above includes the transfer of this data to third countries such as, but not limited to, Peru, Ecuador and Bolivia, for storage and processing purposes.

Security measures for the protection of personal data

Aromas y Sabores Buenas Vida S.A.S will adopt the security techniques necessary to secure the records, preventing their tampering, loss, consultation, or unauthorized or fraudulent use or access. These measures will meet the minimum requirements set by current legislation and their effectiveness will be assessed periodically. However, Aromas y Sabores Buenas Vida S.A.S shall not be liable in the event of a breach of its security systems caused by force majeure or an unforeseeable event.

Area responsible for handling requests, queries and claims

Aromas y Sabores Buenas Vida S.A.S has designated its Customer Service area as responsible for ensuring compliance with this policy within the institution; it will be available to handle requests, queries and claims from data subjects and to carry out any update, rectification and deletion of personal data.

Likewise, the Customer Service area or the legal area will resolve any question or concern that any of our users may have, through the email address listed in the header of this document.

Access, query and claim procedures

Right of access: The power of disposal or decision that the data subject has over the information concerning them necessarily entails the right to access and to know whether their personal information is being Processed, as well as the scope, conditions and general aspects of that Processing.

To comply with the above, Aromas y Sabores Buenas Vida S.A.S will guarantee the right of access as follows:

• The data subject may learn of the actual existence of the Processing to which their personal data is subject.
• The data subject may access their personal data held by Aromas y Sabores Buenas Vida S.A.S.
• The data subject may learn of the purposes that justify the Processing of their data.

To exercise this right, Aromas y Sabores Buenas Vida S.A.S will require prior proof of the data subject's identity or of their representative's capacity; once this is done, the details of the personal data will be made available to them free of charge through electronic means that allow the Data Subject direct access to it. For queries made more than once per calendar month, Aromas y Sabores Buenas Vida S.A.S will charge only the costs of shipping, reproduction or certification of documents.

Queries: Data subjects or those authorized under this policy may consult the personal information of the Data Subject held in any database managed by Aromas y Sabores Buenas Vida S.A.S. To handle personal data query requests, Aromas y Sabores Buenas Vida S.A.S guarantees that the following channels are enabled:

• The email address e.marketing@lrbuenavida.com, where requests will be received; they must include the documents necessary to sufficiently prove the identity of the data subject.
• The physical address Calle 2 # 11-4, Finca La Rinconada, Suesca, Cundinamarca, addressed to the customer service area, in its capacity as the area responsible for handling complaints, queries and claims, with the documents necessary to sufficiently prove the identity of the data subject.

Queries will be handled within a maximum of ten (10) business days from the date of receipt. When it is not possible to handle the query within that period, the interested party will be informed before the 10 days expire, stating the reasons for the delay and the date on which the query will be handled, which may in no case exceed five (5) business days after the expiry of the first period.

Claims: Data subjects or those authorized under this policy who consider that the information contained in one of the databases of Aromas y Sabores Buenas Vida S.A.S should be corrected, updated or deleted, or who notice an alleged breach of any of the duties contained in Law 1581 of 2012 or this policy, may file a claim with Aromas y Sabores Buenas Vida S.A.S, which will be processed under the following rules:

• The claim may be filed directly at the email address e.marketing@lrbuenavida.com.
• Or at the physical address Kilómetro 6 Vía, Suba – Cota, addressed to the customer service area, in its capacity as the area responsible for handling complaints, queries and claims.

Claims must include the documents necessary to sufficiently prove the identity of the data subject, a description of the facts giving rise to the claim, the address, and the documents the claimant wishes to rely on. The interested party will be required, within five (5) days of receipt, to correct any deficiencies; if two (2) months pass from the date of the request without the claimant providing the required information, the claim will be deemed withdrawn.

If for any reason Aromas y Sabores Buenas Vida S.A.S receives a claim about personal information whose Processing it is not responsible for, it will forward it to the appropriate party within a maximum of two (2) business days and inform the interested party of the situation.

Once the complete claim is received, a legend reading "claim in process" and the reason for it will be included in the database maintained by Aromas y Sabores Buenas Vida S.A.S within a period of no more than two (2) business days. This legend must be kept until the claim is decided.

The maximum period to handle the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to handle it within that period, the interested party will be informed before that period expires of the reasons for the delay and the date on which the claim will be handled, which may in no case exceed eight (8) business days after the expiry of the first period.

Deletion of data: The data subject has the right, at any time, to request that Aromas y Sabores Buenas Vida S.A.S delete (erase) their personal data when:

• They consider that it is not being processed in accordance with the principles, duties and obligations set out in Law 1581 of 2012.
• It is no longer necessary or relevant for the purpose for which it was collected.
• The period necessary to fulfill the purposes for which it was collected has elapsed.

This deletion entails the removal of the personal information, as requested by the data subject, from the records and databases of Aromas y Sabores Buenas Vida S.A.S.

Aromas y Sabores Buenas Vida S.A.S will not proceed with the deletion of information, and revocation of authorization will not proceed, when the Data Subject has a legal or contractual duty to remain in the database.

It is important to bear in mind that the right of cancellation is not absolute: Aromas y Sabores Buenas Vida S.A.S may refuse to honor it when:

• The data subject has a legal or contractual duty to remain in the database.
• The deletion of data hinders judicial or administrative proceedings linked to tax obligations, the investigation and prosecution of crimes, or the updating of administrative penalties.
• The data is necessary to protect the legally protected interests of the data subject, to carry out an action in the public interest, or to comply with an obligation legally acquired by the data subject.

If the cancellation of personal data is appropriate, Aromas y Sabores Buenas Vida S.A.S carries out the deletion operationally in such a way that the information cannot be recovered.

To exercise this right, a detailed request must be sent to the email address e.marketing@lrbuenavida.com or to the physical address Kilómetro 6 Vía, Suba – Cota, addressed to the customer service area.

Amendment of the Policy

Aromas y Sabores Buenas Vida S.A.S may modify or amend this Policy at its discretion. When modifications or changes are made, its date will be updated, and that modification or amendment will be effective from the update date. You are advised to review this Policy periodically to stay informed of any changes that may occur.

Term of the Policy

This Policy will enter into force upon its publication, that is, on November 9, 2022. Both the Policy and the Databases containing the information provided may remain in force for up to the duration of the company Aromas y Sabores Buenas Vida S.A.S, without prejudice to this policy being modified at any time and unilaterally by Aromas y Sabores Buenas Vida S.A.S.