OBJECTIVE: To establish the criteria for the collection, storage, use, circulation, and deletion of personal data processed by MEDIAMOS F&M S.A.S., as the Data Controller. MEDIAMOS F&M S.A.S. will use the information for the following purposes:

• Conduct activities for the development of MEDIAMOS F&M S.A.S. corporate purpose in accordance with the fulfillment of the contract executed with the data subject.

• Send invitations to events and offer new products and services.

• Handle requests, complaints, or claims.

• Conduct satisfaction surveys regarding the goods and services offered by MEDIAMOS F&M S.A.S., who will act as the Data Controller.

• Provide contact information to its sales force and/or distribution network, telemarketing, market research, and any third party with which MEDIAMOS F&M S.A.S. has a contractual relationship for the development of such activities [market research, telemarketing, etc.] or for their execution.

• Contact the Data Subject via telephone to conduct surveys, studies, and/or confirm personal data necessary for the execution of a contractual relationship.

• Contact the Data Subject via electronic means [SMS or chat] to send news related to loyalty campaigns or service improvements.

• Contact the Data Subject via email to send account statements, account statuses, or invoices related to obligations arising from the contract between the parties.

• Fulfill obligations undertaken by MEDIAMOS F&M S.A.S. with the Data Subject, relating to the payment of salaries, social benefits, and other compensations provided for in the employment or service contract or as required by law.

• Offer corporate wellness programs and plan business activities for the Data Subject and their beneficiaries [children, spouse, permanent partner].

• Transfer collected personal data within the country to MEDIAMOS F&M S.A.S. affiliated companies to comply with applicable anti-money laundering regulations.

• Transmit personal data outside the country to third parties with whom MEDIAMOS F&M S.A.S. has entered into a data processing agreement, and where it is necessary to fulfill the contractual purpose.

• Provide services offered by MEDIAMOS F&M S.A.S. and accepted in the signed contract.

• Provide information to third parties with whom MEDIAMOS F&M S.A.S. has a contractual relationship and where it is necessary to fulfill the contracted purpose.

SCOPE: This policy applies to all personal information recorded in the databases of MEDIAMOS F&M S.A.S., acting as the Data Controller.

OBLIGATIONS: This policy is mandatory and strictly binding for MEDIAMOS F&M S.A.S., its administrators, employees, contractors, and collaborators in general.

DATA CONTROLLER: MEDIAMOS F&M S.A.S. is a legally constituted commercial company under the laws of the Republic of Colombia, identified with NIT No. 805.017.493-2, with its principal place of business in Cali, Colombia; website www.mediamosfym.com, telephone +57 (320) 687-8984.

RIGHTS OF THE DATA SUBJECTS: As the holder of your personal data, you have the right to: (i) Access the data provided that have been subject to processing free of charge; (ii) Know, update, and rectify your information in the case of partial, inaccurate, incomplete, fragmented data, or data that induces error, or data whose processing is prohibited or unauthorized; (iii) Request proof of the authorization granted; (iv) Submit complaints to the Superintendence of Industry and Commerce (SIC) for violations of the current regulations; (v) Revoke the authorization and/or request the deletion of the data, provided there is an explicit request; (vi) Refrain from answering questions about sensitive data. Responses regarding sensitive data or data of children and adolescents will be optional.

HANDLING REQUESTS, INQUIRIES, AND CLAIMS: The administrative area is responsible for processing requests from data subjects to enforce their rights.

PROCEDURE FOR EXERCISING THE RIGHT OF HABEAS DATA: In compliance with personal data protection regulations, MEDIAMOS F&M S.A.S. presents the procedure and minimum requirements for exercising your rights.

To submit and handle your request, please provide the following information: 1) Full name and surname; 2) Contact details [physical and/or electronic address and contact phone numbers]; 3) Means for receiving a response to your request; 4) Reason(s)/fact(s) that give rise to the claim with a brief description of the right you wish to exercise [know, update, rectify, request proof of authorization granted, revoke, delete, access information]; 5) Signature [if required] and personal identification number [citizenship ID card, identity card, foreign ID card, or passport number].

The maximum term provided by law to resolve your claim is fifteen (15) business days from the day following the date of receipt. If it is not possible to address the claim within this term, MEDIAMOS F&M S.A.S. will inform the interested party of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Once the terms established by Law 1581 of 2012 and other regulations that regulate or complement it have been fulfilled, the Data Subject who is denied, in whole or in part, the exercise of the rights of access, update, rectification, deletion, and revocation, may submit their case to the Colombian Superintendence of Industry and Commerce [Delegation for the Protection of Personal Data].

EFFECTIVE DATE: This Personal Data Processing Policy is effective from June 24, 2024.

The databases where personal data is recorded will remain in effect as long as the Data Subject does not send an express request to the Data Controller to revoke the authorization and/or request the deletion of the data, provided there is no legal obligation to retain the information.