Personal Data Processing Policy

OWARI S.A.S., a simplified joint-stock company incorporated under the laws of the Republic of Colombia, identified with NIT 901.855.171-9, with its principal place of business at Carrera 56 # 29-42, Medellín, Antioquia, Colombia, Email: info@owariagro.com, Phone: +57 324 637 5665 (hereinafter, “OWARI”), issues this Personal Data Processing and Protection Policy (hereinafter, the “Policy”), in compliance with the Political Constitution of Colombia (article 15), Law 1581 of 2012, Decree 1377 of 2013 (incorporated into Single Decree 1074 of 2015), Law 1266 of 2008 and other applicable regulations.

1. PURPOSE AND SCOPE

The purpose of this Policy is to establish the criteria, principles, rights, duties and procedures that OWARI will apply to the processing of the personal data of Users, customers, suppliers, employees, contractors and other data subjects with whom it maintains any type of relationship, guaranteeing the fundamental rights to privacy, good name and habeas data.

This Policy applies to the processing of personal data recorded in any database managed by OWARI in Colombian territory.

2. DEFINITIONS

For the purposes of this Policy, the following definitions contained in Law 1581 of 2012 are adopted:

Authorization: The prior, express and informed consent that the Data Subject gives the Controller to carry out the Processing of personal data.

Database: The organized set of personal data, whether on physical or electronic media, which is subject to Processing by its owner or by third parties designated by it.

Personal Data: Any information linked or that may be associated with one or more specific or identifiable natural persons.

Sensitive Data: Data that affect the privacy of the data subject or whose improper use may lead to discrimination, in the terms defined by law.

Processor: A natural or legal person who carries out the Processing on behalf of the Controller. For the purposes of this Policy, when it comes to Personal Data entered into Owari’s products or services, Owari acts as the Processor of the Personal Data. This means that the User is the Controller, since Owari processes the personal data on its behalf.

Controller: A natural or legal person who decides on the Database and/or the Processing. For the purposes of this policy, Owari acts as controller when it comes to personal data collected through the website, forms, social networks or service channels.

Data Subject: A natural person whose personal data are subject to processing.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Transfer: The sending of personal data by a controller or processor located in Colombia to another controller located inside or outside the country.

Transmission: The communication of personal data for the purpose of processing by a processor on behalf of the controller.

User: The natural or legal person who acquires the license to use the Software under any of its plans or modalities.

3. GUIDING PRINCIPLES

OWARI will apply the following principles to the processing of personal data, in accordance with article 4 of Law 1581 of 2012:

Legality: Processing is subject to the provisions of the law and other applicable regulations.

Purpose: Processing will serve a legitimate purpose, which will be communicated to the Data Subject. Freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that dispenses with consent Truthfulness or quality: The information subject to Processing must be truthful, complete, accurate, up to date, verifiable and understandable.

Transparency: The Data Subject’s right to obtain information about the existence of data concerning them is guaranteed.

Restricted access and circulation: Processing is subject to the limits derived from the nature of the data and the constitutional and legal provisions.

Security: Technical, human and administrative measures will be implemented to secure the records and prevent their tampering, loss, consultation, use or unauthorized access.

Confidentiality: All persons involved in the Processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information.

4. PERSONAL DATA COLLECTED

OWARI may collect the following categories of personal data:

4.1. Identification data

• Full first and last names.
• Type and number of identity document.
• Nationality.

4.2. Contact data

• Physical and mailing address.
• Mobile phone number.
• Email address.

4.3. Socioeconomic and professional data

• Occupation or profession.
• Information about the farm or property (location, size, type of crop, agricultural activity).
• Commercial and financial information necessary for invoicing.

4.4. Transaction and payment data

• History of transactions carried out on the Platform.
• Information on payment methods (processed directly by the payment gateway; OWARI does not store full card data).
• Electronic invoices issued.

4.5. Browsing and usage data

• IP address, device type, operating system, browser.
• Geolocation information (when authorized by the Data Subject).
• Activity and usage logs of the Platform.
• Cookies and similar technologies (see Cookie Policy).

4.6. Sensitive data

OWARI does not ordinarily collect sensitive data. If it needs them for a specific purpose, it will request express and informed authorization from the Data Subject, warning that the Data Subject is not obliged to provide them.

5. PURPOSES OF THE PROCESSING

The personal data collected by OWARI will be processed for the following purposes:

• 1. To create and manage the User’s account on the Platform.
• 2. To provide the contracted services, including the management of farms and agricultural inventories.
• 3. To process payments through the integrated payment gateways.
• 4. To issue electronic invoices in accordance with tax regulations.
• 5. To verify the User’s identity and prevent fraud.
• 6. To provide technical support and handle inquiries, petitions, complaints and claims.
• 7. To send operational and transactional communications related to the services.
• 8. To send commercial, advertising and promotional information about (i) the services of OWARI or its partners, (ii) news, (iii) updates, (iv) changes in administrative processes, (v) other information that Owari considers relevant to the Data Subject.
• 9. To carry out statistical analyses, market research, satisfaction surveys and service improvement.
• 10. To provide information and/or training about the software.
• 11. To comply with legal, accounting, tax and regulatory obligations.
• 12. To respond to requests from competent judicial or administrative authorities.
• 13. To guarantee the security of the Platform and prevent unlawful activities.
• 14. To keep the information for the time necessary to comply with legal and contractual obligations.
• 15. To transfer or transmit the information to third-party processors or strategic partners when necessary for the provision of the services, under the guarantees required by law.
• 16. To send communications related to commercial activities, news, information about products or services of Owari and its Strategic Partners, offers, benefits, updates, event invitations, advertising and usability surveys.
• 17. For administrative purposes (quotations, invoicing, collection, orders, purchases, payment management).
• 18. To comply with the obligations contained in the conditions of use of Owari’s services.
• 19. To manage the risk of money laundering, terrorist financing or other risks identified by Owari.
• 20. To request additional information that benefits the operation, support, maintenance, updates and warranty of Owari’s products or services in the event of incidents, problems, requests or failures.
• 21. To transmit this information abroad, if the hosting used by Owari is not located in Colombia, within the legal guidelines and those determined by the supervisory authority.
• 22. To keep evidence of telephone conversations and to store emails or communications from instant messaging systems.

6. AUTHORIZATION OF THE DATA SUBJECT

The collection and processing of personal data by OWARI requires the prior, express and informed authorization of the Data Subject, which will be obtained through:

• Express acceptance in the registration form of the Platform.
• Ticking the check-boxes enabled for this purpose.
• Acceptance through a physical or electronic document.
• Any other unequivocal conduct from which it can reasonably be concluded that the Data Subject gave consent.

OWARI will keep evidence of the authorization given by the Data Subject, in accordance with article 9 of Law 1581 of 2012.

7. RIGHTS OF THE DATA SUBJECT

In accordance with article 8 of Law 1581 of 2012, the Data Subject has the following rights:

• 1. To know, update and rectify their personal data before the Controllers or Processors. This right may be exercised, among others, with respect to partial, inaccurate, incomplete or fragmented data, data that are misleading, or data whose Processing is expressly prohibited or has not been authorized.
• 2. To request evidence of the authorization given to the Controller, except when it is expressly exempted as a requirement for the Processing, in accordance with the law.
• 3. To be informed by the Controller or the Processor, upon request, about the use that has been made of their personal data.
• 4. To file complaints with the Superintendence of Industry and Commerce (SIC) for violations of data protection regulations.
• 5. To revoke the authorization and/or request the deletion of the data when the Processing does not respect constitutional and legal principles, rights and guarantees.
• 6. To access free of charge their personal data that have been subject to Processing.
• 7. To exercise the other rights established by law.

8. DUTIES OF OWARI

As Controller, OWARI undertakes to:

• 1. Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
• 2. Request and keep a copy of the respective authorization given by the Data Subject.
• 3. Duly inform the Data Subject about the purpose of the collection and the rights they have.
• 4. Keep the information under the security conditions necessary to prevent its tampering, loss, consultation, use or unauthorized access.
• 5. Guarantee that the information is truthful, complete, accurate, up to date, verifiable and understandable.
• 6. Update the information, promptly communicating all changes to the Processors, in cases where Owari acts as Controller.
• 7. Rectify the information when it is incorrect.
• 8. Provide the Processor, in cases where Owari acts as Controller, only with data whose Processing has been previously authorized.
• 9. Require the Processor to respect the security and privacy conditions.
• 10. Handle inquiries and claims made by the Data Subjects.
• 11. Inform the Data Subject when there are breaches of the security codes and risks in the administration of the information.
• 12. Inform the SIC when there are breaches of the security codes.
• 13. Comply with the instructions and requirements issued by the SIC.

9. PROCEDURE FOR EXERCISING THE DATA SUBJECT’S RIGHTS

9.1. Service channels

The Data Subject may exercise their rights through the following channels:

• Email: info@owariagro.com
• Physical address: Carrera 56 # 29-42, Medellín, Antioquia, Colombia.
• Phone line: +57 324 637 5665
• Form available on the Platform.

9.2. Inquiries

Inquiries will be answered within a maximum of ten (10) business days from the date of receipt. When it is not possible to answer the inquiry within that period, the interested party will be informed of the reasons for the delay and the date on which it will be answered, which may not exceed five (5) business days following the expiry of the first period.

9.3. Claims

The claim must be submitted with the following information: identification of the Data Subject, description of the facts giving rise to the claim, address, and the documents to be relied upon. If the claim is incomplete, the interested party will be asked within five (5) days following receipt of the claim to correct the deficiencies. If two (2) months pass without the applicant submitting the required information, the claim will be deemed withdrawn.

The maximum period to handle the claim will be fifteen (15) business days from the day following the date of its receipt. When it is not possible to handle the claim within that period, the interested party will be informed of the reasons for the delay and the date on which the claim will be handled, which in no case may exceed eight (8) business days following the expiry of the first period.

9.4. Procedural requirement

In accordance with article 16 of Law 1581 of 2012, the Data Subject or successor in title may only file a complaint with the Superintendence of Industry and Commerce once the inquiry or claim procedure before the Controller has been exhausted.

10. SUMMARY OF RESPONSE TIMES

11. TRANSFER AND TRANSMISSION OF DATA

OWARI may transfer or transmit the Data Subject’s personal data to third parties, inside or outside the national territory, when this is necessary for the provision of the contracted services, including, among others:

• Providers of hosting, cloud storage and data processing services.
• Payment gateways and financial institutions.
• Messaging and communications service providers.
• Legal and accounting advisors and auditors.
• Judicial or administrative authorities in compliance with legal obligations.

In all cases, OWARI will require third parties to comply with the applicable personal data protection provisions through the signing of the corresponding transmission agreements.

For international transfers, it will be verified that the receiving country provides adequate levels of data protection, in accordance with the standards of the Superintendence of Industry and Commerce.

12. SECURITY MEASURES

OWARI implements reasonable technical, human and administrative measures to protect personal data against tampering, loss, consultation, use or unauthorized or fraudulent access. These measures include, without limitation:

• Encryption of sensitive information in transit (HTTPS/TLS protocols).
• Authentication and access control systems.
• Periodic backups.
• Training of staff with access to personal data.
• Confidentiality agreements with employees, contractors and suppliers.
• Periodic audits of information systems.

13. RETENTION OF THE DATABASES

Personal data will be kept for the time necessary to fulfill the purposes of the Processing, as well as for the applicable legal periods (especially those provided for in commercial, tax, accounting and labor matters). Once those periods have expired, the data will be securely deleted or anonymized.

14. PROCESSING OF DATA OF MINORS

OWARI’s services are aimed at persons of legal age. In the event that data of minors are collected, such Processing will be carried out respecting the prevailing rights of the minor and with the prior authorization of the legal representative, who will prove such capacity. The authorization will be subject to compliance with the principles of the best interests of the minor and respect for their fundamental rights, in accordance with Decree 1377 of 2013.

15. IDENTIFICATION OF THE CONTROLLER

Company name: OWARI S.A.S.

NIT: 901.855.171-9 Address: Carrera 56 # 29-42, Medellín, Antioquia, Colombia Phone: +57 324 637 5665 Email for Habeas Data: info@owariagro.com Website: www.owariagro.com Data Protection Officer / Controller: Legal Representative of OWARI S.A.S.

16. TERM AND CHANGES TO THE POLICY

This Policy is effective from its date of issue and for as long as OWARI carries out its corporate purpose. Any substantial change will be communicated promptly to the Data Subjects through the usual means (registered email or notice on the Platform) at least ten (10) days before it takes effect.

The databases managed by OWARI will remain in force for as long as the information is kept and used for the purposes described herein.

17. DATA PROTECTION AUTHORITY

The competent authority for the protection of personal data in Colombia is the Superintendence of Industry and Commerce (SIC), through the Delegation for the Protection of Personal Data:

• Address: Carrera 13 No. 27-00, Floors 3, 4, 5, 6, 7 and 10, Bogotá D.C., Colombia.
• Website: https://www.sic.gov.co
• Email: contactenos@sic.gov.co

Document issued by OWARI S.A.S. in compliance with Law 1581 of 2012 and Decree 1074 of 2015. Accepted electronically by the Data Subject at the time of registration and/or use of the Platform.