Privacy and Data Processing Policy

Part I. Information Security and Privacy Policy

1. Introduction

At COLLABORATIVE FARMING, FOOD AND INNOVATION SOLUTIONS SAS, operating under the brand Coffis.co, we understand that information is one of our most valuable assets and a fundamental pillar for building trust. This Information Security and Privacy Policy establishes the framework for protecting the data of our users (Producers and Buyers), our operational information, and the technological infrastructure that supports it.

This document is the foundation of our Information Security Management System (ISMS) and reflects our commitment to best practices and compliance with current regulations.

2. Objective

To establish the strategic guidelines to preserve the confidentiality, integrity, and availability of the information managed by the Coffis.co platform, through the identification and management of risks, the implementation of adequate controls, and the promotion of a security culture, in order to protect the interests of our users and guarantee the continuity and trust in our services.

3. Scope

This policy applies to all processes, information systems, technological infrastructure, and information assets of Coffis.co. It is mandatory for all employees, directors, contractors, suppliers, and users (Producers and Buyers) who, by reason of their relationship with the platform, access, process, generate, or safeguard information owned by the company or its users.

4. Definitions

• Information Asset: Any resource that has value for Coffis.co, including user data, software, hardware, processes, and the brand's reputation.
• Confidentiality: The property that information is not made available or disclosed to unauthorized individuals, entities, or processes.
• Integrity: The property of safeguarding the accuracy and completeness of information and processing methods.
• Availability: The property of being accessible and usable upon demand by an authorized entity.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Security Risk: The potential that a given threat will exploit vulnerabilities of an information asset or group of assets and thereby cause harm to the business.
• Data Processing: Any operation or set of operations which is performed on personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

5. Governing principles

The management of security and privacy at Coffis.co is governed by the following principles:

• Principle of Accountability: We assume responsibility for complying with regulations and being able to demonstrate such compliance.
• Principle of Legality: Data processing is subject to the provisions of Law 1581 of 2012 and other applicable regulations.
• Principle of Purpose Limitation: The purposes for processing information will be lawful, informed to the data subject, and in accordance with the Constitution and the Law.
• Principle of Security: We will implement the necessary technical, human, and administrative measures to ensure the security of records, preventing their alteration, loss, consultation, use, or unauthorized or fraudulent access.
• Principle of Transparency: We guarantee the data subject's right to obtain information about their personal data at any time and without restriction.

6. Roles and responsibilities

For the correct implementation and maintenance of the Information Security Management System (ISMS), the following roles and responsibilities are established:

General Management:

• To demonstrate leadership and commitment to information security and privacy.
• To ensure that this policy and security objectives are aligned with the company's strategic direction.
• To guarantee the availability of the necessary resources (human, technical, and financial) for the implementation, maintenance, and continuous improvement of the ISMS.
• To promote a security culture throughout the organization.

Information Security and Privacy Officer (ISPO):

• To design, implement, operate, and improve the ISMS of Coffis.co.
• To report to General Management on the performance of the ISMS.
• To lead the management of security and privacy risks, including their identification, analysis, and treatment.
• To coordinate the management of security incidents, from detection to resolution and lessons learned.
• To ensure compliance with the applicable legal and regulatory framework for security and data protection.
• To develop and execute training and awareness programs for all staff and interested parties.

Technology Department:

• To implement and manage technical security controls (firewalls, antivirus, intrusion detection systems, etc.).
• To manage access control to systems, applications, and networks, based on defined profiles and authorizations.
• To manage and periodically test backup copies and information recovery plans.
• To manage technical vulnerabilities in the infrastructure and apply necessary security patches.
• To ensure that software developments (in-house or third-party) comply with secure development principles.

All Employees and Contractors:

• To know and comply with the provisions of this policy and related security procedures.
• To make appropriate use of the company's information assets and technological resources.
• To protect the confidentiality of the information they have access to.
• To immediately report any security incident or weakness they detect to the ISPO.

Users (Producers and Buyers):

• To protect their access credentials (username and password) to the platform, which are personal and non-transferable.
• To provide truthful and up-to-date information during registration and in all operations.
• To use the Coffis.co platform exclusively for the lawful and commercial purposes for which it was designed.
• To notify Coffis.co if they suspect that the security of their account has been compromised.

7. Legal and regulatory framework

This policy is developed in accordance with the following main regulatory framework:

• Political Constitution of Colombia: Article 15 (Right to Habeas Data and privacy).
• Statutory Law 1581 of 2012: Which dictates general provisions for the protection of personal data.
• Decree 1074 of 2015 (and previous ones it compiled): Which partially regulates Law 1581.
• Law 527 of 1999: On e-commerce, digital signatures, and data messages.
• Law 1273 of 2009: On computer crimes and the protection of information and data.
• Colombian Technical Standard NTC-ISO/IEC 27001: As a framework of reference for best practices in information security management.

8. Policy guidelines

8.1. Information Asset Management

• Inventory and Ownership: All information assets (data, software, hardware, etc.) must be clearly identified, and an owner responsible for their protection must be assigned.
• Information Classification: Information will be classified according to its level of sensitivity (public, internal, confidential, restricted) to determine the appropriate security controls.
• Acceptable Use: The use of Coffis.co's information assets must be aligned exclusively with business purposes. Use for personal, illegal, or unauthorized activities is prohibited.

8.2. Access Control

• Principle of Least Privilege: Access to information and systems will be granted based on the user's strict need-to-know to perform their functions.
• User Management: Formal procedures will be followed for the registration, modification, and deletion of users and their access privileges.
• Password Management: A robust password policy will be enforced, requiring complexity, periodic changes, and protection against the use of weak or reused passwords.
• Access Review: Periodic reviews of user access rights will be conducted to ensure they remain appropriate.

8.3. Operations Security

• Protection against Malicious Code: Protection solutions (antivirus, antimalware) will be implemented and kept up-to-date on all systems and servers.
• Backups: Periodic backups of critical information will be performed. The integrity of these copies and restoration procedures will be tested regularly.
• Change Management: All changes to the technological infrastructure, systems, or applications will follow a formal change management process that includes impact analysis, authorization, and testing.

8.4. Communications Security

• Network Security: Coffis.co's networks will be protected by perimeter security controls (firewalls) and segmented to limit access between different trust zones.
• Information Transfer: All sensitive information transmitted over public networks (Internet) must be encrypted using secure protocols (e.g., TLS).
• Email Use: Corporate email is for strictly professional use. Sending confidential information to personal or unauthorized email accounts is prohibited.

8.5. System Acquisition, Development, and Maintenance

• Secure Development: Security will be an integral requirement throughout the software development lifecycle, from design to implementation and maintenance.
• Vulnerability Management: Periodic scans will be conducted to identify and remediate technical vulnerabilities in the platform's systems and applications.
• Segregated Environments: Development, testing, and production environments will be kept properly segregated to prevent the exposure of real data and the introduction of unauthorized changes into production.

8.6. Supplier and Third-Party Relationships

• Confidentiality Agreements: All suppliers, Allied Cooperatives, and third parties with access to sensitive information will be required to sign confidentiality agreements.
• Security Clauses: All contracts with third parties will include clauses obligating them to comply with Coffis.co's security and privacy policies.
• Due Diligence: A security posture assessment of critical suppliers will be conducted before establishing a business relationship.

8.7. Information Security Incident Management

A formal process for incident management has been established, which includes:

• Reporting: Clear channels for any employee or user to report a security incident or weakness.
• Containment and Eradication: Immediate actions to contain the impact of the incident and eliminate its root cause.
• Recovery and Post-Incident Analysis: Procedures to restore services and conduct a forensic analysis to identify lessons learned and apply improvements.

8.8. Business Continuity

Coffis.co will develop and maintain business continuity and disaster recovery plans to ensure the availability of the platform's critical services in the face of significant disruptions.

8.9. Compliance

• Legal and Regulatory Compliance: Continuous monitoring will be carried out to ensure compliance with all applicable laws and regulations regarding data protection, e-commerce, and cybersecurity.
• Audits: Internal and/or external security audits will be conducted periodically to verify the effectiveness of controls and compliance with this policy.

9. Management commitment

The senior management of COLLABORATIVE FARMING, FOOD AND INNOVATION SOLUTIONS SAS approves this policy and is committed to leading its implementation, providing the necessary resources, and fostering a security culture throughout the organization as a fundamental pillar for the success and sustainability of the business.

10. Review and update

This policy will be reviewed annually, or sooner if there are significant changes in the environment, operations, or regulations, to ensure its continued relevance, adequacy, and effectiveness.

Part II. Authorization for Personal Data Processing

Preamble: Acceptance of the Policy

This document describes the policy and terms under which Coffis.co processes the personal data of its users. It does not require a physical signature. By requesting the services of Coffis.co and completing the corresponding registration form, the user (whether Producer or Buyer) declares, authorizes, and unequivocally accepts the entire content of this document.

In accordance with the provisions of the current regulations on personal data protection, especially Law 1581 of 2012 and Decree 1074 of 2015 and other rules that modify or supplement them, by registering on the platform, the User freely, previously, expressly, and unequivocally authorizes COLLABORATIVE FARMING, FOOD AND INNOVATION SOLUTIONS SAS ("Coffis.co") to collect and process the personal data that they provide truthfully and completely.

1. Purpose of Processing

The data provided will be used for the following purposes:

• To manage the creation, administration, and security of the User's account on the platform.
• To facilitate the connection and communication between Producers and Buyers.
• To coordinate and manage the logistics of receiving, analyzing, preparing, and exporting the coffee.
• To process billing, payments, and financial transactions related to the services.
• To perform due diligence and security checks against control lists, in compliance with SARLAFT regulations.
• To send transactional, operational, and service-related communications regarding the use of the platform.
• To conduct statistical analysis for the improvement of our services.

2. Data Processing Policy

The User declares that they are aware that the collection and processing of their data will be carried out in accordance with the Personal Data Processing Policy of Coffis.co, which is permanently published at the link www.coffis.co/privacy-policy. Likewise, the User states that they have been clearly and sufficiently informed about the purposes of the processing and the option they had to not grant authorization for information considered sensitive.

3. Rights of the Data Subject

The User, as the owner of the information, states that they have been informed of their rights, especially to:

• Know, update, and rectify their personal information regarding partial, inaccurate, incomplete, fragmented data, data that may lead to error, or data whose processing is expressly prohibited or has not been authorized.
• Request proof of the authorization granted.
• Be informed about the use that has been made of their personal data.
• File complaints with the Superintendence of Industry and Commerce for violations of the law.
• Revoke the authorization and/or request the deletion of the data when the principles, rights, and constitutional and legal guarantees are not respected in the Processing.
• Access their personal data that has been subject to Processing, free of charge.

4. Communication Channels

The User may exercise their rights through the following channels provided by Coffis.co:

• Email: info@coffis.co
• Contact Phone: (+57) 317 538 53 53
• Mailing Address: Cl 59 Bis 8-15 APT 305 Bogotá, Colombia.

5. Electronic Acceptance and Consent

The act of checking the acceptance box on the registration form and submitting said form constitutes an electronic signature and a manifestation of free, prior, express, and informed consent. With this act, the User certifies that they have read, understood, and approved the content of this Authorization for Personal Data Processing and consents to the use of their data under the terms described herein.