Personal Data Processing Policy

THE FULL PACKAGE S.A.S, a commercial company incorporated under the laws of the Republic of Colombia, identified with a valid NIT, domiciled at Carrera 25 #68-42, Barrio Alcázares, Localidad Barrios Unidos, Bogotá, Colombia, Postal Code 111211.

Email: commercial@thefullpackage.com.co

Phone and WhatsApp: +57 311 546 2347

Hereinafter "THE CONTROLLER", it shall be the entity responsible for the collection, storage, use, circulation and deletion of personal data in accordance with Law 1581 of 2012 and its regulatory decrees.

This policy is governed by the following Colombian regulations:

• Political Constitution of Colombia, Article 15: Right to privacy and habeas data.

• Statutory Law 1581 of 2012: General provisions for the protection of personal data.

• Decree 1377 of 2013, which partially regulates Law 1581 of 2012, and Decree 886 of 2014, on the National Database Registry, both compiled in Single Regulatory Decree 1074 of 2015.

The Superintendence of Industry and Commerce (SIC) is the authority responsible for enforcing personal data protection legislation in Colombia.

Personal Data: Any information linked to or that can be associated with a specific or determinable natural person.

Sensitive Data: Data that affects the privacy of the data subject or whose misuse may lead to discrimination, such as racial or ethnic origin, political orientation, religious beliefs, union membership, health data, sexual life data and biometric data.

Data Subject: Natural person whose personal data is subject to processing.

Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the processing of data.

Data Processor: Natural or legal person, public or private, who by itself or in association with others, processes personal data on behalf of the controller.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Privacy Notice: Verbal or written communication generated by the controller, addressed to the data subject regarding the processing of their personal data.

Transmission: Processing of personal data that involves communicating it within or outside Colombia so that a processor carries out processing on behalf of the controller.

Transfer: Sending personal data to a recipient that is itself a data controller, inside or outside the country.

Principle of Legality: Personal data processing shall be carried out in accordance with current and applicable provisions.

Principle of Purpose: Processing shall serve a legitimate purpose in accordance with the Constitution and the law, which shall be communicated to the data subject.

Principle of Freedom: Processing may only be carried out with the prior, express and informed consent of the data subject.

Principle of Truthfulness: Information subject to processing must be truthful, complete, accurate, up-to-date, verifiable and understandable.

Principle of Transparency: The right of the data subject to obtain information about their data from the controller must be guaranteed at all times.

Principle of Restricted Access and Circulation: Processing is subject to the limits derived from the nature of the personal data.

Principle of Security: Information subject to processing must be handled with the necessary technical, human and administrative measures to ensure the security of records.

Principle of Confidentiality: All persons involved in the processing of personal data are obligated to guarantee the confidentiality of the information.

THE CONTROLLER collects and processes personal data for the following purposes:

• Manage quotation requests and commercial communications related to textile manufacturing services.

• Manage requests for diagnosis, consulting, technology development, automation and artificial intelligence, and prepare the corresponding proposals.

• Record and follow up on commercial opportunities received through the website, including the page the request came from.

• Send information about services, promotions and company news, only to those who have expressly and separately authorized it.

• Manage contractual relationships with clients, suppliers and strategic partners, including access to the client portal.

• Comply with applicable legal, accounting and tax obligations.

• Conduct internal analysis for service and process improvement.

• Address petitions, complaints, claims and suggestions (PQR).

• Contact data subjects through email, WhatsApp, telephone or other communication channels.

Data will not be used for purposes other than those described here without a new authorization from the data subject.

THE CONTROLLER may collect the following types of personal data:

• Identification data: full name, identification document number, mailing address.

• Contact data: email address, phone number, WhatsApp number.

• Commercial data: brand or company name, industry, size of the operation, type of service required, described needs, tools in use and estimated production volumes.

• Request data: originating page, language, source campaign, date and proof of the authorization granted.

• Browsing data: IP address, browser type, pages visited on the website, cookies.

We do not collect sensitive data unless with the express prior authorization of the data subject, when strictly necessary for the provision of the service. Answering questions about sensitive data is optional: the data subject is not required to do so.

Our services are intended for companies and adults. We do not intentionally collect data from children and adolescents; answering questions about them is optional and, if required, such data will be processed respecting their best interests and fundamental rights.

THE CONTROLLER requests the data subject's authorization in a prior, express and informed manner. On the website it is granted by ticking the authorization box before submitting a form or by voluntarily sending information through the contact channels.

THE CONTROLLER keeps as proof the date of the authorization and the version of this policy that was accepted.

Authorization to receive commercial communications is optional, is granted in a separate box and may be revoked at any time by writing to commercial@thefullpackage.com.co.

To fulfill the purposes of this policy, THE CONTROLLER relies on providers that process personal data on its behalf, as data processors. These providers do not decide on the data and may not use it for their own purposes:

• Brevo (Sendinblue SAS, France): sending emails, including those from the customer service agent, and managing the contacts received through the website forms.

• Railway Corp. (United States): hosting of the website and of the WhatsApp customer service agent, through which form and conversation data travels.

• GoDaddy (United States): corporate email.

• Google LLC (United States): website visit measurement through Google Analytics.

• Meta Platforms (United States): WhatsApp customer service.

• Anthropic (United States): artificial intelligence that supports WhatsApp customer service and document preparation, always reviewed by a person before sending.

• Microsoft (Azure and Microsoft 365): storage of the management system and the client portal, and scheduling of client meetings.

• AssemblyAI (United States): transcription of the audio of client meetings, when they are recorded.

Some of these providers store or process information outside Colombia, mainly in the United States and the European Union. This is an international transmission of data to processors, carried out with the data subject's authorization and under each provider's data processing terms, in accordance with Law 1581 of 2012 and Decree 1074 of 2015.

THE CONTROLLER requires these providers to apply security and confidentiality measures consistent with this policy. THE CONTROLLER does not sell or transfer personal data to third parties.

Data will be kept for as long as necessary to fulfill the purposes for which it was collected and the applicable legal, accounting and tax obligations.

Data from requests that do not lead to a commercial relationship will be kept for a maximum of twenty-four (24) months from the last communication with the data subject, and then deleted.

The data subject may request deletion of their data at any time, except where there is a legal or contractual duty to keep it.

In accordance with Article 8 of Law 1581 of 2012, personal data subjects have the following rights:

• Know, update and rectify their personal data before the controller or processors.

• Request proof of the authorization granted to the controller.

• Be informed by the controller or processor, upon request, regarding the use given to their personal data.

• File complaints with the Superintendence of Industry and Commerce for violations of the applicable law.

• Revoke authorization and/or request data deletion when processing principles, rights and guarantees are not respected.

• Access their personal data that has been subject to processing free of charge.

THE CONTROLLER commits to:

• Guarantee the data subject the full and effective exercise of the right of habeas data at all times.

• Request and retain a copy of the respective authorization granted by the data subject.

• Properly inform the data subject about the purpose of collection and their rights.

• Maintain information under the necessary security conditions to prevent alteration, loss, unauthorized or fraudulent consultation, use or access.

• Rectify information when incorrect and communicate the pertinent information to the processor.

• Process inquiries and claims as stipulated by law.

• Inform the data protection authority when security code violations occur.

The commercial area of THE FULL PACKAGE S.A.S is responsible for handling inquiries, petitions and claims from data subjects. Data subjects, their successors or their representatives may exercise their rights through the following channels:

Email: commercial@thefullpackage.com.co

Phone and WhatsApp: +57 311 546 2347

Address: Carrera 25 #68-42, Barrio Alcázares, Localidad Barrios Unidos, Bogotá, Colombia, Postal Code 111211

Inquiries: will be addressed within a maximum of ten (10) business days from the date of receipt. When this is not possible, the requester will be informed of the reason for the delay and the date on which it will be addressed, which may not exceed five (5) business days after the first term expires.

Claims: the claim must include the identification of the data subject, a description of the facts giving rise to it, the address and any supporting documents. If the claim is incomplete, the requester will be asked within five (5) days of receipt to correct it. If two (2) months pass from that request without the information being provided, the claim will be deemed withdrawn.

Once the complete claim is received, the legend "claim in process" and its reason will be added to the database within two (2) business days and kept until the claim is decided. The maximum term to address the claim is fifteen (15) business days from the day after receipt. When this is not possible, the requester will be informed of the reasons for the delay and the date on which it will be addressed, which may not exceed eight (8) business days after the first term expires.

The data subject may only file a complaint with the Superintendence of Industry and Commerce after exhausting the inquiry or claim procedure with THE CONTROLLER.

THE CONTROLLER implements reasonable technical, human and administrative measures to protect personal data against unauthorized access, loss, alteration, destruction or misuse.

Security measures implemented include:

• Data encryption in transit via HTTPS/SSL protocol.

• Restricted access to databases limited to authorized personnel only.

• Internal policies for confidential information handling.

• Periodic backups of stored information.

In the event of any security incident compromising personal data, THE CONTROLLER will inform affected data subjects and the Superintendence of Industry and Commerce within the terms established by law.

This version of the Personal Data Processing Policy takes effect on November 2, 2026 and replaces the version of March 27, 2026. It shall remain in effect as long as THE FULL PACKAGE S.A.S maintains the need to process personal data.

THE CONTROLLER reserves the right to modify this policy. Any substantial change will be duly communicated and published on the website, indicating the new version and its date.

Databases managed by THE CONTROLLER shall remain valid for as long as the information is maintained and used for the purposes described in this policy, without prejudice to the retention periods in section 9.

For any inquiry, request or claim related to the processing of personal data, you may contact us through the following channels:

THE FULL PACKAGE S.A.S

Address: Carrera 25 #68-42, Barrio Alcázares, Localidad Barrios Unidos, Bogotá, Colombia, Postal Code 111211

Email: commercial@thefullpackage.com.co

Phone and WhatsApp: +57 311 546 2347

Business hours: Monday to Friday, 8:00 a.m. to 5:00 p.m. (Colombia time, GMT-5)