Personal Data Processing Policy

THE FULL PACKAGE S.A.S, a commercial company incorporated under the laws of the Republic of Colombia, with registered address at Carrera 25 #68-42, Barrio Alcázares, Localidad Barrios Unidos, Bogotá, Colombia — Postal Code 111211.

Email: commercial@thefullpackage.com.co

WhatsApp: +57 311 546 2347

Hereinafter "THE CONTROLLER" shall be the entity responsible for the collection, storage, use, circulation and deletion of personal data in accordance with Law 1581 of 2012 and Decree 1377 of 2013.

This policy is governed by the following Colombian legal provisions:

• Political Constitution of Colombia, Article 15 — Right to privacy and habeas data.

• Statutory Law 1581 of 2012 — General provisions for the protection of personal data.

• Decree 1377 of 2013 — Partial regulation of Law 1581 of 2012.

• Decree 886 of 2014 — Regulation of the National Database Registry.

The Superintendence of Industry and Commerce (SIC) is the authority responsible for ensuring compliance with personal data protection legislation in Colombia.

Personal Data: Any information linked to or that can be associated with a specific or determinable natural person.

Sensitive Data: Data that affects the privacy of the data subject or whose misuse may lead to discrimination, such as racial or ethnic origin, political orientation, religious beliefs, union membership, health data, sexual life data and biometric data.

Data Subject: Natural person whose personal data is subject to processing.

Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the processing of data.

Data Processor: Natural or legal person, public or private, who by itself or in association with others, processes personal data on behalf of the controller.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Privacy Notice: Verbal or written communication generated by the controller, addressed to the data subject regarding the processing of their personal data.

Principle of Legality: Personal data processing shall be carried out in accordance with current and applicable provisions.

Principle of Purpose: Processing shall serve a legitimate purpose in accordance with the Constitution and the law, which shall be communicated to the data subject.

Principle of Freedom: Processing may only be carried out with the prior, express and informed consent of the data subject.

Principle of Truthfulness: Information subject to processing must be truthful, complete, accurate, up-to-date, verifiable and understandable.

Principle of Transparency: The right of the data subject to obtain information about their data from the controller must be guaranteed at all times.

Principle of Restricted Access and Circulation: Processing is subject to the limits derived from the nature of the personal data.

Principle of Security: Information subject to processing must be handled with the necessary technical, human and administrative measures to ensure the security of records.

Principle of Confidentiality: All persons involved in the processing of personal data are obligated to guarantee the confidentiality of the information.

THE CONTROLLER collects and processes personal data for the following purposes:

• Manage quotation requests and commercial communications related to textile manufacturing services.

• Send information about services, promotions and company news.

• Manage contractual relationships with clients, suppliers and strategic partners.

• Comply with applicable legal, accounting and tax obligations.

• Conduct internal analysis for service and process improvement.

• Address petitions, complaints, claims and suggestions (PQR).

• Contact data subjects through email, WhatsApp, telephone or other communication channels.

THE CONTROLLER may collect the following types of personal data:

• Identification data: full name, identification document number, mailing address.

• Contact data: email address, phone number, WhatsApp number.

• Commercial data: brand or company name, type of service required, estimated production volumes.

• Browsing data: IP address, browser type, pages visited on the website, cookies.

• Data voluntarily provided through the website contact form.

We do not collect sensitive data unless with the express prior authorization of the data subject, when strictly necessary for the provision of the service.

In accordance with Article 8 of Law 1581 of 2012, personal data subjects have the following rights:

• Know, update and rectify their personal data before the controller or processors.

• Request proof of the authorization granted to the controller.

• Be informed by the controller or processor, upon request, regarding the use given to their personal data.

• File complaints with the Superintendence of Industry and Commerce for violations of the applicable law.

• Revoke authorization and/or request data deletion when processing principles, rights and guarantees are not respected.

• Access their personal data that has been subject to processing free of charge.

THE CONTROLLER commits to:

• Guarantee the data subject the full and effective exercise of the right of habeas data at all times.

• Request and retain a copy of the respective authorization granted by the data subject.

• Properly inform the data subject about the purpose of collection and their rights.

• Maintain information under the necessary security conditions to prevent alteration, loss, unauthorized or fraudulent consultation, use or access.

• Rectify information when incorrect and communicate the pertinent information to the processor.

• Process inquiries and claims as stipulated by law.

• Inform the data protection authority when security code violations occur.

Personal data subjects may exercise their rights by contacting THE CONTROLLER through the following channels:

Email: commercial@thefullpackage.com.co

WhatsApp: +57 311 546 2347

Address: Carrera 25 #68-42, Barrio Alcázares, Localidad Barrios Unidos, Bogotá, Colombia — Postal Code 111211

Requests must include: full name of the data subject, identification number, description of the facts giving rise to the claim, address and contact information.

Inquiries will be addressed within a maximum of ten (10) business days from the date of receipt. Claims will be addressed within a maximum of fifteen (15) business days from the day following the date of receipt.

THE CONTROLLER implements reasonable technical, human and administrative measures to protect personal data against unauthorized access, loss, alteration, destruction or misuse.

Security measures implemented include:

• Data encryption in transit via HTTPS/SSL protocol.

• Restricted access to databases limited to authorized personnel only.

• Internal policies for confidential information handling.

• Periodic backups of stored information.

In the event of any security incident compromising personal data, THE CONTROLLER will inform affected data subjects and the Superintendence of Industry and Commerce within the terms established by law.

This Personal Data Processing Policy becomes effective on March 27, 2026 and shall remain in effect as long as THE FULL PACKAGE S.A.S maintains the need to process personal data.

THE CONTROLLER reserves the right to modify this policy at any time. Any changes will be duly communicated and published on the website.

Databases managed by THE CONTROLLER shall remain valid for as long as the information is maintained and used for the purposes described in this policy.

For any inquiry, request or claim related to the processing of personal data, you may contact us through the following channels:

THE FULL PACKAGE S.A.S

Address: Carrera 25 #68-42, Barrio Alcázares, Localidad Barrios Unidos, Bogotá, Colombia — Postal Code 111211

Email: commercial@thefullpackage.com.co

WhatsApp: +57 311 546 2347

Business hours: Monday to Friday, 8:00 a.m. to 5:00 p.m. (Colombia time, GMT-5)