2L B

FABRICA DE ENVASES S.A. FADESA PRIVACY
NOTICE AND DATA POLICY

FABRICA DE ENVASES S.A. FADESA hereinafter “FADESA”, in accordance with Ecuadorian regulations, gives timely notice to the user of its personal data treatment policy that it has created the FADESA platform (including website, social networks and any contracts that are signed with FADESA or its subsidiaries), which will be in charge of handling the user’s personal data, hereinafter “The Platform”.

1. AUTHORIZED DATA

By accessing and interacting with the FADESA Platform, the user gives free, express, voluntary, specific, unequivocal, and informed acceptance that the data entered by the user in the FADESA databases are collected, processed, and stored for the uses set forth below:

a) Collect personal data, incorporate, and store them in our database in order to use the data provided for commercial purposes such as offering our products and services, providing quotes, or informing of communication

b) Sort, catalog, classify, divide, or separate the information

c) Use the data provided in communication campaigns, disclose, and promote or offer products, activities or services developed as part of the company’s internal

d) Use the data for internal administrative or commercial purposes such as: credit studies, elaboration and presentation of quotations, expertise commercial references, market research, statistical analysis, conducting satisfaction surveys, offering, or recognizing benefits of our loyalty program, and after-sales

e) Verify, check, or validate the data

f) Study or analyze the information provided for the follow-up and improvement of its products, services, and customer

g) Provide the information collected to third parties with whom the company outsources the storage and management of personal data, under the principles of quality and data legitimacy established in the Personal Data Protection Policies of FADESA, as well as the security and confidentiality provisions to which the company is bound according to the contents of the relevant laws. Therefore, the user acknowledges, and through the acceptance of the terms and conditions of the Platform, also consents to the transfer of their personal data to third parties in order to fulfill the purpose detailed in paragraph a).

h) Collect, store, handle, and use the information received by the user to perform the affiliation as a policyholder.

i) Collect, store, handle, and use the information to carry out controls and prevention over fraud, money laundering, and terrorism

j) Celebrate, execute, renew, and extend

k) In accordance with the law, submit reports to credit bureaus for cases of noncompliance of financial obligations derived from the commercial relationship, if necessary

2. DATA QUALITY PRINCIPLES

The foregoing shall be subject to the enforcement of the following principles:

a) The data will be handled in a transparent, loyal, and legal

b) The data will be collected for the legal and express purposes established herein, and they will not be handled later in a manner which is incompatible with those

c) The data collected will be appropriate, exact, pertinent, and non-excessive with relation to the topic that they were collected for and for which they will be destined

d) The data provided by the User must be exact, and when necessary, updated. All reasonable steps should be taken to ensure that data that is inaccurate or incomplete, related to the purposes for which it was collected or for which it was further processed, is deleted or

e) The data will be kept in a way which allows for data identification on behalf of the interested party for a period of time which does not exceed the time necessary for the purposes that it was collected

f) Data shall be processed in such a way as to ensure adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by implementing appropriate technical or organizational measures.

3. DATA PROCESSING LEGITIMACY

FADESA may process users’ personal data only under the following circumstances:

a) When the user has given their free, express, voluntary, specific, unequivocal, and informed acceptance for their data to be processed for one or more specific

b) When it is necessary in order to fulfill a purpose stated in section 1, paragraph a of this

c) When it is necessary in order to comply with a legal obligation that the data processors are bound to

d) When it is necessary to protect the user’s vital interest.

e) When it is necessary to satisfy the legitimate interest pursued by the party responsible for the processing or for the third party or parties that receives the data. Provided that the interest or fundamental rights and freedoms of the data subject that require protection under the preceding paragraph do not prevail.

f) The user may withdraw their consent at any moment. Withdrawal of consent will not affect the legality of the data processing based on the consent given prior to its The user will be informed that they are giving their consent prior to being asked. The process of withdrawing consent will be as easy as the process of granting consent.

g) The user will have the right to access, rectify, suppress, or limit the treatment and transfer of the processed data.

4. DATA HOLDER RIGHTS:

a) Know, update, access, eliminate, and rectify their personal data which has been collected by FADESA. This right may be exercised, among others, against partial, inaccurate, outdated, incomplete, fractioned, or misleading

b) Request the limitation of the processing of their personal data, in the event that such limitation is contrary to the purpose of data processing, FADESA reserves the right to terminate the relationship with the User, with any effect that this may

c) Request the transferability of their personal data, in the event that such transferability is contrary to the purpose of data processing, FADESA reserves the right to terminate the relationship with the User, with any effect that this may

d) Request proof of the authorization granted to

e) Be informed by FADESA, prior request, of the use that the holder’s data has

f) To file complaints before the competent entities for violations of the provisions of the applicable

g) To revoke the authorization granted to process the data in question, at any time, considering the legal limits necessary for this

h) Access to the holder’s data stored in FADESA’s database, free of charge, in a reasonable manner and within a period of no less than twelve

i) The User may exercise his or her right to know, update, modify, and delete personal data existing in the databases associated with the Platform. To do so, the inquiry, claim or deletion must be sent to fadesa@fadesa.com detailing the modifications to be made and providing the supporting documents.

5. PARTY RESPONSIBLE FOR DATA TREATMENT

The Operator is responsible for the handling of personal information collected through the web portal, responsibility that may be delegated to a third party. In a capacity as responsible or in charge of the information, the Operator shall contractually ensure adequate handling of the aforementioned data.

6. COMMUNICATION

a. Electronic channel: The User may submit formal requests related to the handling of their data to the following email: fadesa@fadesa.com. To do so, the requester must appear in one of the following capacities:

• (i) Be the holder of the information, with sufficient proof of identity through any means that FADESA establishes for that
• (ii) Be the successor in title, with sufficient proof of this capacity.
• (iii) Be the representative/proxy of the owner of the information, with sufficient proof of this
• (iv) Be an accredited person to represent the holder or holders of data, with sufficient proof of this capacity.

The rights held by minors will be executed by their representatives or guardians. This will also require sufficient proof of this capacity.

b. Written channel: The user must submit their formal request to the following address: Calle Novena 109 y Domingo Comín, Guayaquil -Ecuador, prior to having fulfilled the legitimation requisites required from the holder, according to what is described in paragraph a of this section, which must be fulfilled through a written letter specifying the address where the user wishes to receive any notification or

c. Verbal channel: The data holder must submit their verbal request to the following address: Calle Novena 109 y Domingo Comín, Guayaquil -Ecuador, prior to having fulfilled the legitimation requisites required from the holder, according to what is described in paragraph a of this

d. Telephone channel: The data holder must submit their request to the following telephone number: 04 2492929, prior to having fulfilled the legitimation requisites required from the holder, according to what is described in paragraph a of this section.

7. DOMICILE AND APPLICABLE LEGISLATION

These Terms and Conditions of Use of the Platform are accepted in the Ecuadorian territory, according to its general and sectoral regulations. Its adoption implies the exercise of your free will and that the relationship arising from this document shall be governed in all its effects by its content and in its absence by Ecuadorian law and in compliance with the precepts of the Organic Law on Personal Data Protection, complementary legislation, and other provisions of the Data Protection Authority in force at the date.