This Personal Data Processing Policy (hereinafter the "Policy") aims to implement the provisions contained in Law 1581 of 2012 and Decree 1074 of 2015, and other related regulations, with regard exclusively to databases, files and information containing personal data susceptible to processing, and explains how MOUNTAIN FOOD SAS 90086521-1 collects, stores, uses, circulates and processes information that you provide to us through different means, as well as the purposes for which said personal information is used, in order to protect them through mechanisms and tools that guarantee the authenticity, confidentiality and integrity of the information. MOUNTAIN FOOD SAS may contact the data owner by any means it deems appropriate, including, but not limited to, by text message (SMS), web application messaging, social networks, emails or commercial or advertising calls. Likewise, the owner of the personal data authorizes MOUNTAIN FOOD SAS to be contacted outside of the hours established in Law 2300 of 2023, in accordance with the purposes established in this policy.

REGULATORY FRAMEWORK OF THE POLICY

MOUNTAIN FOOD SAS complies with the Colombian legal framework for the processing of personal data, especially:

• Political Constitution of Colombia, article 15.

• Law 1266 of 2008, which establishes the general provisions of habeas data and regulates the handling of information contained in personal databases, especially financial, credit, commercial, service, and third-country information, and establishes other provisions.

• Statutory Law 1581 of 2012, now Decree 1074 of 2015, and other regulatory decrees that define the scope of application of the rights to privacy, good name, and informational self-determination.

• Judgment C-1011 of 2008 – Definition of the nature of the data recorded in the Public Registries of the Chambers of Commerce, as public data.

• Judgment C – 748 of 2011 – Constitutionality of the Statutory Bill on Personal Data Protection.

• And the instructions issued by the Superintendency of Industry and Commerce in the exercise of the function established in Article 21 of Law 1581.

CONTACT DETAILS OF THE CONTROLLER -AREA RESPONSIBLE FOR HANDLING QUERIES, REQUESTS AND COMPLAINTS

MOUNTAIN FOOD. NIT. 90086521-1, a private entity, with its main address at Autop. Medellín Km 1.5 south side, La Florida Industrial Park, Warehouse 23 – Bogotá, Colombia. (hereinafter, the "Data Controller"). For the purposes of this Policy, the area responsible for handling requests, queries, complaints, and claims is the Compliance Officer and may be contacted via email at info@chocofood.com.co

• MOUNTAIN FOOD SAS restricts the processing of sensitive personal data and that of minors to what is strictly necessary and requests prior and express consent from the owners (legal representatives, attorneys, successors in title), informing them of the exclusive purpose of their processing.

• MOUNTAIN FOOD SAS incorporates respect for the protection of personal data in all its actions and will request authorization from the moment the data is entered, where applicable, for the use of the information it receives for the purposes inherent to its mission.

• Likewise, MOUNTAIN FOOD SAS will clearly and expressly inform the data collected, the purpose of the collection, and the processing it will give to the data subject in its privacy notices.

OBLIGATIONS

They are mandatory and strict compliance by directors, officials, contractors, suppliers and third parties who work or have a direct relationship with MOUNTAIN FOOD SAS, in addition to the legal and regulatory provisions that regulate the matter, the processes, procedures and instructions that develop the policy for the protection and processing of personal data of MOUNTAIN FOOD SAS, compiled in the "Management Information System",

MOUNTAIN FOOD SAS will take all necessary actions to disseminate and complement this policy.

DATA PROCESSING AND PURPOSE

The Data Controller, with prior authorization from the data subjects (if required), may obtain information from natural persons (employees, clients, suppliers, etc.), who may choose to provide us with personal information when accessing and/or browsing the website https://cocoafusion.com/, or in connection with a contractual, commercial, or service relationship with the Data Controller. The types of personal data we collect are public, semi-private, private, and financial data. Sensitive data or data from minors that are not public will not be collected, unless required in accordance with current regulations to comply with our legal obligations and/or authorization from their parents or legal representatives exists, if this is required in accordance with the nature of the personal data.

Personal Data may be processed through physical, automated, or digital means, depending on the type and method of information collection.

The personal data provided to the Data Controller will be collected, stored, used, analyzed, circulated, updated and reported for the following purposes, as established in the respective authorization, The Company may also process the Personal Data, among others, for the following purposes: (i) as an element of analysis to establish and maintain an employment, contractual or commercial relationship, whatever its nature, (ii) as an element of analysis to carry out market studies or commercial or statistical research, (iii) as a tool for offering its own or third-party products or services, (iv) for the advancement of any procedure before a public authority or a private person or entity, regarding which the information is relevant, (v) so that all information referring to credit, financial, commercial, service behavior and data of the same nature from third countries is consulted, supplied, reported, processed or disclosed, (vii) for compliance with any other legal obligation on the part of the Data Controller, including, but not limited to, SARLAFT obligations and (viii) for the information to be transmitted to third parties located within or outside the Republic of Colombia, for any of the purposes set forth herein. (ix) Exercise its right to sufficiently know the Owner with whom it intends to establish relations, provide services, and assess the present or future risk of said relations and services. (x) Carry out the pertinent procedures for the development of the pre-contractual, contractual and post-contractual stages with the Company, regarding any of the products or services offered by it, whether or not it has acquired or regarding any underlying business relationship it has with it, as well as comply with Colombian or foreign law and with the orders of judicial or administrative authorities; (xi) Carry out marketing, sales and promotional activities, telemarketing (telephone marketing), customer service, brand activation activities, prizes and promotions, directly or through third parties derived from commercial alliances or any link; (xii) Implement relationship strategies with clients, suppliers, shareholders and other third parties with whom the Company has contractual or legal relationships; (xiii) Make invitations to events, improve products and services or offer new products, and all those activities associated with the commercial relationship or existing link with the Company, or any that may exist; (xiv) Manage procedures (requests, complaints, claims), carry out satisfaction surveys regarding the goods and services offered by the Company, or related companies and its business partners; (xv) Disclose, transfer and/or transmit Personal Data within and outside the country to the parent companies, subsidiaries or affiliates of MOUNTAIN FOOD SAS. or to third parties as a result of a contract, law or legal link that requires it or to implement cloud computing services.

RIGHTS OF THE HOLDERS

The owner of the personal data has the following rights vis-à-vis the data controller:

• Know, update and rectify your personal data

• Request proof of the authorization granted

• Be informed by the Data Controller upon request, regarding the use that has been given to your personal data

• Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and Decree 1074 of 2015, once you have exhausted the consultation or claim process with the Data Controller.

• Revoke authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights and guarantees.

• Access free of charge to your personal data that has been processed

PROCEDURE FOR EXERCISING THE RIGHT TO HABEAS DATA

Data subjects may exercise their rights to access, update, correct, revoke authorization, and request deletion of data by sending a communication to the address and department indicated in this Policy. This communication must contain at least the following:

• The name, address of the owner, and means of contact to receive the response, such as telephone number, email address, and residential address.

• Documents that prove the identity or representation of your representative.

• A clear and precise description of the personal data in respect of which the owner seeks to exercise any of the rights.

• If applicable, other elements or documents that facilitate the location of personal data.

Once the communication has been received by the data controller, a response will be provided within the terms established in the applicable regulations.

MODIFICATION AND/OR UPDATE OF THE POLICY

Any substantial changes to the processing policies will be communicated to data subjects in a timely manner through the usual means of contact and/or by email sent to the contact addresses registered with the Data Controller.

VALIDITY OF THE POLICY

These policies are effective as of July 15, 2019, the date on which they were approved and published in the offices of the Data Controller.