PERSONAL DATA PROCESSING AND PROTECTION POLICY

OF PERSONAL DATA

JOE HAWKINS SAS

Version 2.0  ·  Update: September 2026

1. PURPOSE AND SCOPE

JOE HAWKINS SAS (hereinafter, “Joe Hawkins”) adopts this Personal Data Processing and Protection Policy in order to establish the guidelines applicable to the collection, storage, use, circulation, update, transmission, transfer, and deletion of personal data processed in the development of its commercial, labor, administrative, and e-commerce activities.

This Policy applies to the personal data of customers, users and website visitors, subscribers and business contacts, employees and former employees, candidates for selection processes, suppliers, contractors, and other natural persons whose data is processed by Joe Hawkins in its capacity as Data Controller.

2. LEGAL FRAMEWORK

• Political Constitution of Colombia, Article 15 and related regulations.

• Statutory Law 1581 of 2012, which establishes general provisions for the protection of personal data.

• Decree 1074 of 2015, Single Regulatory Decree for the Commerce, Industry, and Tourism Sector, especially Chapter 25 of Title 2 of Part 2 of Book 2, and regulations that modify, supplement, or replace it.

• Single Circular of the Superintendency of Industry and Commerce, Title V, and other current instructions from the personal data protection authority that may be applicable.

3. DEFINITIONS

Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of personal data, except for exceptions provided by law.

Database: Organized set of personal data subject to processing.

Personal data: Any information linked or that may be associated with one or several identified or identifiable natural persons.

Sensitive data: Data that affects the intimacy of the Data Subject or whose improper use may lead to discrimination, under the terms of Law 1581 of 2012.

Data Processor: Natural or legal person who performs the processing of personal data on behalf of the Controller.

Data Controller: Natural or legal person who decides on the database and/or the processing of the data. For the purposes of this Policy, Joe Hawkins is the Controller regarding the databases for which it determines the purposes and means of processing.

Data Subject: Natural person whose personal data is subject to processing.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, update, transmission, transfer, or deletion.

Transfer: Sending of personal data to a recipient acting as a Data Controller, within or outside Colombia.

Transmission: Communication of personal data to a Processor for them to process it on behalf of the Controller, within or outside Colombia.

4. PRINCIPLES APPLICABLE TO PROCESSING

Joe Hawkins will process personal data in accordance with the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security, and confidentiality provided for in Colombian personal data protection regulations.

5. PERSONAL DATA SUBJECT TO PROCESSING

Depending on the relationship the Data Subject maintains with Joe Hawkins, the following types of information may be processed, among others:

• Identification and contact data: first name, last name, type and number of identification when necessary, address, city, email, and phone number.

• Data related to purchases and customer service: products purchased, orders, returns, exchanges, warranties, communications, requests, complaints, and transactional history.

• Billing, delivery, and logistics data necessary to process and ship orders.

• Technical and navigation data: IP address, device or browser identifiers, cookies, pages visited, interactions with the site, traffic source, and similar data obtained through technological tools, where applicable.

• Data related to labor, contractual, and selection relationships, to the extent necessary to manage said relationships and comply with legal obligations.

• Data voluntarily provided by the Data Subject through forms, email, social networks, WhatsApp, or other channels enabled by Joe Hawkins.

When a payment is processed by an external gateway or provider, financial and authentication data may be collected and processed directly by said third party. Joe Hawkins will seek to receive only the information necessary to confirm, manage, and reconcile the transaction, in accordance with the configuration and conditions of the corresponding payment provider.

6. PURPOSES OF PROCESSING

6.1 Customers, buyers, users, subscribers, and website visitors

• Manage registration, navigation, shopping cart, ordering, sales, and other e-commerce functionalities.

• Verify, process, confirm, and reconcile payments and transactions made through gateways or payment providers.

• Manage picking, dispatch, delivery, tracking, exchanges, returns, warranties, and other logistics activities associated with purchases.

• Issue invoices and equivalent documents and comply with accounting, tax, contractual, and legal obligations.

• Address requests, inquiries, petitions, complaints, claims, and customer service communications.

• Prevent, detect, and manage fraud, misuse, security incidents, and risks related to transactions and the website.

• Manage accounts, preferences, and transactional communications related to a purchase or interaction requested by the Data Subject.

• Perform statistical analysis, usage and performance analysis of the website and business, including campaign measurement and advertising attribution, where applicable.

• Send news, product launches, promotions, pre-sales, discounts, events, content, and other commercial communications from Joe Hawkins when there is authorization or an applicable legal basis, and allow the Data Subject to opt out of said communications.

• Customize, within the limits permitted by law, the user experience and digital advertising through technological and measurement tools.

6.2 Employees and former employees

• Manage the hiring, execution, and termination of the employment relationship.

• Administer payroll, benefits, social security, occupational health and safety obligations, and other legal or contractual duties.

• Maintain labor files and address requirements from administrative, judicial, or control authorities where applicable.

• Manage internal communications, security, access to resources, and other activities necessary for the employment relationship.

6.3 Candidates for selection processes

• Manage selection and hiring processes.

• Verify training, experience, references, and suitability, within applicable legal limits.

• Contact the candidate during the process and retain information for the time reasonably necessary for the stated purpose.

6.4 Suppliers, contractors, and partners

• Manage the commercial or contractual relationship, including quotes, contracting, payments, invoicing, and service evaluation.

• Verify information necessary for compliance with legal, tax, accounting, and contractual obligations.

• Manage access, communications, support, activity coordination, and attention to requirements related to the commercial relationship.

7. WEBSITE, SHOPIFY, COOKIES, AND SIMILAR TECHNOLOGIES

Joe Hawkins' e-commerce operates on Shopify. The website may use cookies, pixels, tags, SDKs, or other similar technologies necessary for its operation, security, measurement, analytics, customization, and advertising.

Tools currently used include Meta Pixel, Google Analytics, and Google Ads. These tools may process online identifiers, device information, IP address, browsing events, site interactions, and other technical data, in accordance with their configuration and the policies of the respective providers.

Joe Hawkins may classify these technologies into categories such as essential, functional, analytical or performance, and advertising or marketing. Strictly necessary cookies may operate to enable basic site functionalities. For non-essential technologies, Joe Hawkins will provide the applicable information and preference management mechanisms.

The Data Subject may manage their preferences through the tools enabled on the site and, additionally, through their browser or device settings, taking into account that disabling certain technologies may affect some functionalities.

8. SENSITIVE DATA AND DATA OF CHILDREN AND ADOLESCENTS

8.1 Sensitive data

Joe Hawkins will not request sensitive data unless they are adequate, relevant, and necessary for a legitimate purpose and their processing is authorized by law. Where applicable, the Data Subject will be informed that they are not required to authorize the processing of sensitive data, such data and their purposes will be expressly identified, and express consent will be obtained.

8.2 Data of children and adolescents

Joe Hawkins will endeavor not to deliberately collect personal data of children and adolescents, except when processing is permitted by applicable regulations, responds to and respects their best interests and fundamental rights, and the authorization of their legal representative is obtained where applicable, taking into account the minor's opinion according to their maturity and capacity to understand the matter.

9. AUTHORIZATION AND CASES WHERE IT IS NOT REQUIRED

When the law requires authorization, Joe Hawkins will obtain it no later than the time of data collection, informing the Data Subject in advance or concurrently of the purposes of the processing and the rights of the Data Subject. The authorization may be written, oral, through electronic means, or through unequivocal conduct that reasonably allows for the conclusion that it was granted. Silence does not constitute authorization.

Authorization will not be necessary in cases provided for by Law 1581 of 2012, including:

• Information required by a public or administrative entity in the exercise of its legal functions or by court order.

• Data of a public nature.

• Cases of medical or health emergencies.

• Processing of information authorized by law for historical, statistical, or scientific purposes, under applicable legal terms.

• Data related to the Civil Registry of Persons.

10. PROCESSORS, THIRD PARTIES, AND DATA TRANSFERS OR TRANSMISSIONS

To carry out the described purposes, Joe Hawkins may share or communicate personal data with third parties that provide services necessary for the operation, always within the limits permitted by law and according to the functions performed by each third party.

Such third parties may include:

• Providers of e-commerce and technology infrastructure, including Shopify and its providers or sub-processors, where applicable.

• Gateways and payment providers, including currently PayU, PayPal, Addi, and Bold, according to the payment method chosen by the Data Subject.

• Transportation companies, logistics operators, and delivery service providers contracted by Joe Hawkins.

• Providers of hosting, analytics, advertising, measurement, and digital communications, including Meta and Google, according to the implemented tools.

• Accounting, administrative, technological, legal providers, and other contractors who require access to data to perform their services.

• Administrative, judicial, tax, or control authorities, when there is a legal duty or valid request.

Some of these third parties may process information outside of Colombia. When an international transfer or transmission of personal data occurs, Joe Hawkins will apply the rules provided in Law 1581 of 2012, Decree 1074 of 2015, and current instructions from the Superintendency of Industry and Commerce, including contractual measures, authorizations, exceptions, or compliance mechanisms that are applicable according to the recipient's role and the destination country.

The inclusion of a provider in this Policy does not imply that they always receive all personal data or that they necessarily act under a single legal capacity; their role will depend on the contracted service and the processing actually performed.

11. RIGHTS OF DATA SUBJECTS

In accordance with Law 1581 of 2012, Data Subjects may exercise, among others, the following rights:

• Know, update, and rectify their personal data.

• Request proof of the authorization granted, except when it is not legally required.

• Be informed, upon request, regarding the use that has been made of their personal data.

• Access their personal data that has been subject to processing, free of charge, under legal terms.

• Revoke the authorization and/or request the deletion of data when appropriate. Deletion or revocation may not be appropriate when there is a legal or contractual duty to retain the information or when processing is necessary for another legally valid reason.

• File complaints with the Superintendency of Industry and Commerce for violations of regulations, once the consultation or claim process before Joe Hawkins has been exhausted, when said requirement is applicable.

12. RESPONSIBLE AREA AND CHANNELS FOR EXERCISING RIGHTS

The administration of JOE HAWKINS SAS will be responsible for coordinating the handling of petitions, inquiries, and complaints related to personal data protection.

Data Subjects may exercise their rights through the following channels:

• Email: info@joehawkinsbogota.com

• Physical address: Carrera 6 # 34-62, Bogotá D.C., Colombia.

• Contact phone: +57 310 579 5271.

13. PROCEDURE FOR INQUIRIES AND COMPLAINTS

13.1 Inquiries

The Data Subject or their successors may inquire about the personal information contained in Joe Hawkins’ databases by submitting a request via the channels indicated in this Policy. Joe Hawkins may request the information reasonably necessary to verify the identity of the requester and their legitimacy.

The inquiry will be addressed within a maximum term of ten (10) business days from the date of receipt. When it is not possible to address it within said term, Joe Hawkins will inform the requester of the reasons for the delay and the date on which it will be addressed, which may not exceed five (5) business days following the expiration of the first term.

13.2 Complaints, correction, updating, deletion, and revocation

The Data Subject, their successors, or any person duly authorized may file a complaint when they believe that the information should be corrected, updated, or deleted, when requesting the revocation of the authorization in applicable cases, or when they identify a presumed breach of data protection regulations.

The complaint must contain, at a minimum:

• Identification of the Data Subject and, where applicable, proof of the requester's representation or legitimacy.

• Contact details for receiving a response.

• A clear description of the facts giving rise to the complaint and the right intended to be exercised.

• Any documents that the requester deems relevant.

If the complaint is incomplete, Joe Hawkins will require the interested party within five (5) days following its receipt to remedy the deficiencies. If two (2) months elapse from the request without the required information being provided, it will be understood that the Data Subject has withdrawn the complaint.

Once the complete complaint is received, a legend stating "complaint in progress" and the corresponding reason will be included in the database, where applicable, within a term not exceeding two (2) business days. The maximum term for addressing the complaint will be fifteen (15) business days from the day following its receipt. If it is not possible to address it within that term, the reasons for the delay and the new response date will be communicated, which may not exceed eight (8) business days following the expiration of the first term.

14. SECURITY AND CONFIDENTIALITY

Joe Hawkins will adopt administrative, human, and technical measures that are reasonable and proportional to the type of information processed to protect personal data against loss, unauthorized or fraudulent access, inquiry, use, tampering, modification, disclosure, or processing. Access to the information will be limited to the persons and third parties who require it for authorized or legally permitted purposes.

No information system or Internet transmission is absolutely foolproof. In the event of security incidents affecting personal data, Joe Hawkins will act in accordance with the applicable legal and regulatory obligations.

15. RETENTION AND DELETION OF INFORMATION

Personal data will be retained for the reasonable and necessary time to fulfill the purposes that justified its Processing and, subsequently, for the terms required or permitted by applicable regulations, including contractual, accounting, tax, labor, consumer protection, evidentiary, or claim handling obligations.

When the information is no longer necessary for the authorized purposes and there is no legal or contractual duty to retain it, Joe Hawkins will proceed with its deletion, anonymization, or blocking, as appropriate and technically reasonable.

16. VALIDITY AND MODIFICATIONS

This version of the Policy is updated as of September 2026 and will become effective upon its publication on the Joe Hawkins website. The databases will remain in effect for the time necessary to fulfill the purposes of the Processing and the associated legal obligations.

Joe Hawkins may modify this Policy to reflect legal, regulatory, technological, operational, or commercial changes. Any material change affecting the content of the authorization or the purposes of the Processing will be communicated to Data Subjects in a timely manner and, where appropriate, prior to its implementation and through an efficient mechanism.

The current version of this Policy will be available at www.joehawkinsbogota.com.