POLICY AND PROCEDURES MANUAL FOR THE TREATMENT OF PERSONAL DATA FIRE WORK WEAR SAS

Fire Work Wear SAS, hereinafter referred to as the Company, is committed to complying with the right to the protection of personal data and the right that all people have to know, update, and rectify the information that has been collected about them in databases or files, and other constitutional rights, freedoms, and guarantees.

1. DEFINITIONS

Authorization: Prior, express, and informed consent of the data subject to carry out the processing of personal data. Privacy notice: Verbal or written communication generated by the person responsible, addressed to the Data Subject for the Processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, the way to access them and the purposes of the Processing intended for the personal data. Database: An organized set of personal data that is subject to processing. Personal data: Any information linked or that can be associated with one or several identified or identifiable natural persons. Public data: Is the data that is not semi-private, private or sensitive. Public data includes, among others, data related to the marital status of individuals, their profession or trade, and their status as a merchant or public servant. By their nature, public data may be contained, among others, in public registers, public documents, gazettes and official bulletins, and judicial decisions duly executed that are not subject to confidentiality. Sensitive data: Refers to those data that affect the privacy of the Data Subject or whose improper use can generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, union membership, social organizations, human rights or that promote the interests of any political party or guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data. Data processor: Natural or legal person, public or private, who by itself or in association with others, carries out the processing of personal data on behalf of the data controller. Data controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the processing of data. Data subject: Natural person whose personal data are subject to processing. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion. Habeas data: Fundamental right of every person to know, update, rectify and/or cancel information and personal data that has been collected and/or processed in public or private databases, in accordance with the provisions of the law and applicable regulations. Transfer: Data transfer takes place when the Data Controller and/or Data Processor, located in Colombia, sends the information or personal data to a recipient, who is in turn responsible for the processing and is located inside or outside the country. Transmission: Processing of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia when it aims to carry out processing by the Processor on behalf of the Controller. Tacit authorization: It will be understood that the Data Subject has granted authorization for the processing of their personal data when their behavior allows to reasonably conclude that they have granted authorization.

2. GUIDING PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

The Company will apply the following principles harmoniously and integrally when processing personal data:

Principle of legality in data processing: The processing of personal data

must comply at a minimum with the current laws that regulate the matter and the provisions that develop them. Principle of purpose: The processing must obey a legitimate purpose according to the Constitution and the law, which must be informed to the data subject. Principle of freedom: Processing can only be carried out with the consent, prior, express, and informed of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent. Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. Partial, incomplete, fragmented, or misleading data should not be processed. Principle of transparency: In processing, the right of the data subject to obtain from the data controller or the data processor, at any time and without restrictions, information about the existence of their personal data must be guaranteed. Principle of access and restricted circulation: The processing is subject to the limits derived from the nature of the personal data, the provisions of the Constitution, and the law. In this sense, processing can only be carried out by persons authorized by the data subject and/or by persons enabled by the law or judicial authority. Principle of security: The information subject to processing must be handled with the necessary technical, human, and administrative measures to give security to the records, avoiding their adulteration, loss, consultation, unauthorized or fraudulent use or access. Principle of confidentiality: All those involved in the processing of personal data that do not have the nature of public are obliged to guarantee the reservation of the information, even after ending their relationship with any of the tasks that comprise the processing, being able to only perform the supply or communication of personal data when the law permits it and in the terms that it stipulates.

3. RIGHTS OF THE DATA SUBJECTS

The Company in any processing of personal data will respect the rights of the data subjects. For the purposes of this manual, the data subject will have the following rights:

To know, update, and rectify their personal data against the data controllers or data processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented data that leads to error, or those whose processing is expressly prohibited or has not been authorized. To request proof of the authorization granted to the data controller except when expressly exempted by law. To be informed by the data controller or the data processor, upon request, regarding the use given to their personal data. To submit complaints to the Superintendence of Industry and Commerce or the competent authority for violations of the law that regulates the protection of personal data and other norms that modify, add to, or complement it. To revoke the authorization and/or request the deletion of the data when the processing does not respect the principles, rights, and legal and constitutional guarantees. The revocation and/or deletion will proceed when Fire Work Wear SAS, or the competent authority, has determined that in the processing, the controller or processor has incurred conducts contrary to the current regulations. To access their personal data that has been subject to processing for free.

4. DUTIES OF THE DATA CONTROLLERS AND DATA PROCESSORS

The data controllers must comply with the following duties, without prejudice to other provisions set forth in this manual and in the regulations that regulate their activity:

4.1. Duties of the data controllers To guarantee the data subject, at all times, the full and effective exercise of the right to the protection of their personal data under the terms established in the current regulations applicable to this matter. To request and keep a copy of the authorization granted by the data subject for the time required according to the current regulations. To inform the data subject about the purpose of the collection and the rights that assist them by virtue of the authorization granted. To conserve the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access. To ensure that the information provided to the

data processor is truthful, complete, accurate, updated, verifiable, and comprehensible, in the form and terms authorized by the Data Subject. To update the information, communicating in a timely manner to the data processor, all the new developments regarding the data that the data subject previously provided and adopt the other necessary measures so that the information provided to this remains up-to-date. To rectify the information when incorrect and communicate the pertinent to the data processor. To provide the data processor only with data whose processing has been previously authorized in accordance with the provisions of the applicable current regulations on this matter. To demand from the data processor at all times, respect for the security and privacy conditions of the data subject’s information. To process the queries and claims made in the terms indicated in this manual and in the applicable current regulations on this matter. To inform the data processor when certain information is under discussion by the data subject, once the claim has been presented and the respective procedure has not been completed. To inform the data subject upon request about the use given to their data. To inform the data protection authority when there are violations of the personal data protection law. To comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

4.2 Duties of the data processors The data processors must comply with the following duties, without prejudice to other provisions set forth in this manual and in the regulations that regulate their activity:

To guarantee the data subject the protection of their personal data at all times, the full and effective exercise of the right of habeas data. To conserve the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access. To carry out timely updating, rectification, or deletion of the data in the terms of this manual or in accordance with what is established in the applicable current regulations. To update the information reported by the data controllers within five (5) business days following the receipt of their request. To process the queries and claims made by the data subjects in the terms indicated in the applicable regulations. To register in the database the legend “claim in process” in the form that is regulated by the applicable regulations. To insert in the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of the personal data. To refrain from circulating information that is being contested by the data subject and whose blocking has been ordered by the SUPERINTENDENCE OF INDUSTRY AND COMMERCE or any other competent authority. To allow access to the information only to people who can have access to it. To inform the SUPERINTENDENCE OF INDUSTRY AND COMMERCE or the competent authority when there are violations of personal data protection. To comply with the instructions and requirements issued by the SUPERINTENDENCE OF INDUSTRY AND COMMERCE or the competent authority in this matter.

5. PROCESSING AND PURPOSES OF THE DATA PROVIDED

The personal data collected will be included in a database and will be used directly or through the controllers or processors in the terms established in the applicable regulations on this matter, for direct and indirect purposes related to the object and purposes of the Company. The general purposes are indicated by way of illustration, without prejudice that in each authorization the particular purposes regarding each relationship with the Data Subject are included:

Operational activities and registration. Capturing, recording,

transmission, storage, preservation, or subsequent reproduction of images by video surveillance systems, access controls, closed-circuit television to ensure the security of goods and people in the facilities or premises of the Company. Statistical analysis, referencing, consultation in public databases, verification, and audits. Achieving efficient communication related to our services and other activities associated with the functions of the Company. Maintaining efficient communication of information that is useful in the contractual or commercial links in which the Data Subject is a party. For statistical, control, supervision, and commercial information purposes. As a result of the authorization, the Company may collect information about commercial relationships with other entities, consult financial data in risk centers that manage financial information databases, and the data required to manage the contractual or commercial relationship with the Data Subject. To comply with the obligations undertaken by the Company with the Data Subjects. Use in communication campaigns, dissemination, and promotion of products, activities, or services.

6. PROCESSING OF SENSITIVE DATA

For the purposes of this manual and as established by the applicable regulations, sensitive data are understood to be those that affect the privacy of the data subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, union membership, social organizations, human rights, or that promote the interests of any political party or guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.

6.1. Processing of sensitive data In general terms, the Company will refrain from processing sensitive data according to the limitations imposed by the applicable current regulations. It is understood that the processing of this type of data may be carried out when one of the following circumstances occurs:

The data subject has given explicit authorization for such processing, except in cases where, in accordance with the provisions of the current regulations, the granting of authorization is not required. The processing is necessary to safeguard the vital interest of the data subject and they are physically or legally incapacitated. In these events, the legal representatives must grant their authorization. The processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association, or any other non-profit organization, whose purpose is political, philosophical, religious, or union, provided that they refer exclusively to their members or to people who maintain regular contact for the reason of their purpose. In these events, the data may not be provided to third parties without the authorization of the data subject. The processing refers to data that is necessary for the recognition, exercise, or defense of a right in a judicial process. The processing has a historical, statistical, or scientific purpose. In this event, measures aimed at suppressing the identity of the data subjects must be adopted.

6.2 Processing of personal data of children and adolescents The processing of this type of personal data requires special respect for the prevailing rights of children and adolescents.

The use of personal data of children and adolescents is prohibited in the Company except in cases permitted by the applicable current regulations in this matter.

7. PROCEDURES

RESPONSIBLE FOR ATTENDING PETITIONS, CONSULTATIONS, AND CLAIMS

The Data Subject may at any time request the Company to access the personal data registered, as well as request the correction, update, or deletion of their personal data, revoke the authorization granted for the processing of the same, and in general exercise the rights granted by the law through the submission of queries and claims through the following instances or means:

Customers: send a request to the email address contacto@fireworkwear.com or through the Contact Us service on our page www.fireworkwear.com or through our website service www.fireworkwear.com, or by calling the number 057 1 3168303447 or through communication addressed to Customer Service Address Calle 40 Sur Nº 52 B 10 Office 201, Bogotá D.C., Colombia.

7.1 Consultations

Data subjects or their successors may consult the personal information of the data subject that is stored in the Company’s database. The person responsible or in charge of processing must provide all the information contained in the individual record or that is linked to the identification of the data subject.

The query will be formulated by email as indicated in the previous point or by the means enabled by the Company for this purpose, provided that it can be proven.

The query will be answered within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend to the query within this term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their query will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.