This Personal Data Processing Policy (hereinafter the "Policy") aims to implement the provisions contained in Law 1581 of 2012 and Decree 1074 of 2015, and other related regulations, with regard exclusively to databases, files and information containing personal data susceptible to processing, and explains how MOUNTAIN FOOD SAS 90086521-1 collects, stores, uses, circulates and processes information that you provide to us through different means, as well as the purposes for which said personal information is used, in order to protect them through mechanisms and tools that guarantee the authenticity, confidentiality and integrity of the information. MOUNTAIN FOOD SAS may contact the data owner by any means it deems appropriate, including, but not limited to, by express means to the owners (legal representatives, attorneys, successors in title) informing them of the exclusive purpose of their processing. • MOUNTAIN FOOD SAS incorporates respect for the protection of personal data in all its actions and will request authorization from the moment the data is entered, where applicable, for the use of the information it receives for the purposes inherent to its mission. • Likewise, MOUNTAIN FOOD SAS will clearly and expressly inform the data collected, the purpose of the collection, and the processing it will give to the data subject in its privacy notices.

OBLIGATIONS

They are mandatory and strict compliance by directors, officials, contractors, suppliers and third parties who work or have a direct relationship with MOUNTAIN FOOD SAS, in addition to the legal and regulatory provisions that regulate the matter, the processes, procedures and instructions that develop the policy for the protection and processing of personal data of MOUNTAIN FOOD SAS, compiled in the "Management Information System", MOUNTAIN FOOD SAS will take all necessary actions to disseminate and complement this policy.

DATA PROCESSING AND PURPOSE

The Data Controller, with prior authorization from the data subjects (if required), may obtain information from natural persons (employees, clients, suppliers, etc.), who may choose to provide us with personal information when accessing and/or browsing the website https://cocoafusion.com/, or in connection with a contractual, commercial, or service relationship with the Data Controller. The types of personal data we collect are public, semi-private, private, and financial data. Sensitive data or data from minors that are not public will not be collected, unless required in accordance with current regulations to comply with our legal obligations and/or authorization from their parents or legal representatives exists, if this is required in accordance with the nature of the personal data.

Personal Data may be processed through physical, automated, or digital means, depending on the type and method of information collection. of a contract, law or legal link that requires it or to implement cloud computing services.

RIGHTS OF THE HOLDERS

The owner of the personal data has the following rights vis-à-vis the data controller: • Know, update and rectify your personal data

• Request proof of the authorization granted

• Be informed by the Data Controller upon request, regarding the use that has been given to your personal data

• Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and Decree 1074 of 2015, once you have exhausted the consultation or claim process with the Data Controller.

• Revoke authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights and guarantees.

• Access free of charge to your personal data that has been processed

PROCEDURE FOR EXERCISING THE RIGHT TO HABEAS DATA

Data subjects may exercise their rights to access, update, correct, revoke authorization, and request deletion of data by sending a communication to the address and department indicated in this Policy. This communication must contain at least the following:

• The name, address of the owner, and means of contact to receive the response, such as telephone number, email address, and residential address.

• Documents that prove the identity or representation of your representative.

• A clear and precise description of the personal data in respect of which the owner seeks to exercise any of the rights.

-It's important to note that delays caused by force majeure may occur that affect delivery times. If this occurs, these updates will be notified in the tracking information for the affected order.

If no one is at home at the time of delivery, the carrier will make up to two additional delivery attempts. If delivery is unsuccessful, the product will be returned, and we will contact you to arrange a new delivery.