**Data Processing Policy**

OBJECTIVE

This Policy establishes the general guidelines for the protection and processing of personal data within MUBLETI S.A.S, thereby strengthening the level of trust between the data controller and the data subjects concerning the processing of their information. It informs the data subjects of the purposes and transfers to which their personal data is subject and the mechanisms for exercising their rights.

SCOPE

This Personal Data Processing and Protection Policy applies to all databases and/or files containing personal data that are subject to processing by MUBLETI S.A.S, as the representative responsible for data processing.

RESPONSIBLE PARTY

COMPANY NAME: MUBLETI S.A.S., a commercial entity with NIT. No. 901629461-1, is established as a Colombian company with the corporate purpose and commercial activity of designing, manufacturing, and marketing furniture.

PHYSICAL ADDRESS: Calle 17 B No 03 ESTE–35 Piso I, Mosquera.

WEBSITE: www.mubleti.com

PHONE: (+57) 322 3983200

DEVELOPMENT

In compliance with the provisions of Statutory Law 1581 of 2012 and its regulatory Decrees, MUBLETI S.A.S establishes the General and Special Policies applicable for the processing and protection of personal data within the organization.

DEFINITIONS

For the purposes of this Privacy Policy and in accordance with Law 1581 of 2012 and other applicable regulations, the following definitions are established:

• Authorization: Prior, express, and informed consent of the Data Subject for the processing of personal data.
• Database: Organized set of personal data that is subject to processing.
• Personal Data: Any information linked to or that can be associated with one or more specific or determinable natural persons.
• Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or that promote interests of any political party or guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
• Data Processor: Natural or legal person, public or private, who, alone or in association with others, processes personal data on behalf of the Data Controller.
• Data Controller: Natural or legal person, public or private, who, alone or in association with others, decides on the database and/or the processing of data.
• Data Subject: Natural person whose personal data is subject to processing.
• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
• Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, data related to the civil status of individuals, their profession or trade, and their status as a merchant or public servant. By nature, public data may be contained in public records, public documents, official gazettes, and duly executed judicial decisions that are not subject to confidentiality.
• Transmission: Processing of personal data that involves its communication within or outside the national territory when the purpose is to carry out processing by the data processor on behalf of the data controller.
• Semi-private Data: Data that is neither intimate, reserved, nor public and whose knowledge or disclosure may interest not only its Data Subject but also a certain sector or group of people or society in general, such as financial and credit data from commercial or service activities.

RIGHTS OF DATA SUBJECTS

Data Subjects whose personal data is processed by Mubleti may exercise the following rights before the Company:

• To know, update, and rectify their personal data. This right may be exercised, among others, regarding partial, inaccurate, incomplete, fractional data that leads to error, or data whose processing is expressly prohibited or has not been authorized;
• To request proof from Mubleti of the authorization granted, except in cases exempted by Law 1581 of 2012;
• To revoke the authorization and/or request the deletion of their personal data;
• To be informed about the use given to their personal data;
• To access their personal data free of charge;
• To file complaints with the Superintendence of Industry and Commerce for possible violations of this Privacy Policy or Law 1581 of 2012 and other regulations that modify, add, or complement it. To do so, the Data Subject must have exhausted the claim procedure with Mubleti;
• To revoke the authorization and/or request the deletion of data when processing does not respect the principles, rights, and constitutional and legal guarantees.

PROCEDURE FOR EXERCISING THE RIGHTS OF DATA SUBJECTS

Inquiries and claims made by Data Subjects to Mubleti regarding their rights will be processed following the procedure established in Articles 14, 15, and 16 of Law 1581 of 2012.

To initiate the process, Data Subjects must contact Mubleti via email at [email protected].

PURPOSES OF PERSONAL DATA PROCESSING

1. Processing of personal data of Mubleti customers.

   The personal data of users who subscribe to the Mubleti.com website will be processed for the following purposes:

   • To fulfill Mubleti's corporate purpose and the functionalities of the Mubleti Platform.
   • For the development and fulfillment of the contractual purpose agreed upon between the parties.
   • For registration purposes on the Mubleti Platform.
   • To carry out billing and collection processes derived from the contractual relationship.
   • To store and classify the information provided by customers for easy identification on the Mubleti Platform.
   • To conduct statistical, commercial, strategic, financial, social, and technical analysis.
   • To carry out marketing activities, such as market studies, and promotional activities for products and services, among other similar concepts.
   • To communicate with Data Subjects for commercial, promotional, and general matters of interest related to the functionalities of the Mubleti Platform and the contractual relationship.
   • To define behavioral profiles of Mubleti Platform users, to conduct statistical analysis or improve the processes and functionalities of the Mubleti Platform.
   • To prepare and ship the products purchased through the Mubleti Platform.
   • To transmit personal data to third parties for the optimal development of the functionalities of the Mubleti Platform, such as, but not limited to, providers and payment gateways.
   • To transmit the personal data of the Data Subjects to national and/or international third parties in cases where Mubleti participates in processes of merger, integration, split, liquidation, acquisition, and/or asset disposal.
   • To verify and validate the identity and criminal, disciplinary, financial, and credit background of the data subjects.
   • To analyze, process, evaluate, and compare the information provided by customers for fraud or fraudulent activities.
   • To send information of interest.
   • To comply with the law and orders of judicial and/or administrative authorities.
   • To provide information to oversight, control, regulatory bodies, or internal or external auditors.
   • Through the use of cookies, to obtain information regarding the type of browser and operating system used, the IP address, the time spent on the Mubleti Platform, the number of visits made, the use of the Mubleti Platform, the sections visited by you, among others, for authentication, registration of activities on the Mubleti Platform, improvement of its functionality, optimization of the services offered, market trend analysis, analysis of the demographic information of those who visit the Mubleti Platform and use the services it offers, evaluation of the effectiveness of its advertising, consumption behavior of Mubleti Platform buyers, and results of the activities executed there, to determine who has opened the email sent and the format in which it is done, among others.
   • Other purposes that the data subject has authorized in accordance with legal requirements.

2. Processing of personal data of Mubleti employees

   The personal data of Mubleti employees, whether during the contractual relationship or after it, will be processed for the following purposes:

   • The administration of hiring, management of active personnel, payroll administration, and other payments, affiliations to the Integral Social Security System, and family compensation funds, payment of parafiscal contributions, affiliation to insurance and other health or life coverage contracts offered as part of the employment relationship.
   • The handling of judicial embargoes through payroll, issuance of employment certifications, salary and benefits administration, exercise of subordination over employees, and sanctioning power, employee evaluations, coordination of employee professional development, employee access to the company's IT resources, and assistance in their use, planning of business activities, and generally, for compliance with legal obligations and, in particular, the obligations of the company as an employer.
   • The preparation of the company's accounting records, the preparation of projections, and the analysis of the company's financial results, as well as the provision of information required by payroll processors and administrators, third parties responsible for preparing the company's accounting records, company auditors (whether financial, tax, labor, or other), and any other third party contracted by the company for the fulfillment of its corporate, financial, labor, and tax obligations.
   • Once the employment relationship has ended, the information will be kept in custody for the first six (6) months from the moment the employment relationship ended. This is without prejudice to the information that must be retained for the fulfillment of its functions and related to personal data protection. Mubleti will take all necessary measures to ensure the security and custody of personal data, including the signing of confidentiality agreements, and may not use this information to fulfill purposes other than those presented by the company unless there is express and written authorization from the Data Subject.

3. Processing of Personal Data of Candidates for Employment with Mubleti

   The personal data provided by those interested in participating in a Mubleti selection process will be processed for the following purposes:

   • Classification, storage, and archiving of personal data for review, analysis, and registration of participation in the selection process.
   • Verification, comparison, and evaluation of the labor and personal competencies of the candidates concerning the selection criteria established by Mubleti.
   • To consult and evaluate all information about the candidate for the position stored in lawfully constituted judicial or security databases, whether state or private (in compliance with data transmission regulations), national or foreign.

4. Processing of Personal Data of Mubleti Suppliers, Third Parties, and Partners

   The personal data of suppliers will be processed for the following purposes:

   • For the development and fulfillment of the contractual relationship.
   • To consult, compare, and evaluate all information about the supplier, partner, or third party stored in lawfully constituted judicial or security databases, whether state or private, national or foreign, or any commercial or service databases that allow for a comprehensive assessment of supplier behavior, including checks on lists for the prevention and control of money laundering and terrorist financing.
   • To analyze, process, evaluate, and compare the information provided by suppliers, partners, and third parties.
   • To send information of interest.
   • To comply with Colombian law and orders from judicial and/or administrative authorities.
   • Issuance of certifications related to the relationship between the data subject and Mubleti.
   • Provision of information to oversight, control, regulatory bodies, or internal or external auditors.
   • Coordination and execution of payments and control of taxes related to the contractual relationship.
   • Preparation of invitations to bid or quote.
   • Likewise, any supplier contracted or in the selection process must safeguard and protect the information provided by Mubleti, following the regulations governing personal data protection, as well as the provisions of this document.

TRANSMISSION OF PERSONAL DATA

Mubleti may transfer the personal data subject to processing to third parties who will act as processors. The processors will strictly apply this Privacy Policy and process the data solely for the purposes established herein. To this end, the respective contracts or data transmission clauses will be signed.

INTERNATIONAL TRANSFER OF PERSONAL DATA

Mubleti may transfer personal data outside of Colombia when using foreign servers for the storage of the personal data subject to processing. In such a case, and as required by Colombian law, Mubleti will obtain prior, express, and informed authorization for this purpose.

PERSONAL DATA TEMPORALITY

The processing of personal data carried out by Mubleti and the permanence of the data in its information systems will be determined by the purpose of such processing. Consequently, once the purpose for which the data was collected has been fulfilled, Mubleti will proceed with its destruction or return, as applicable, unless the law requires retaining it for a longer and/or additional period.

VALIDITY

This information processing policy will come into effect on March 5, 2023.