PERSONAL DATA PROCESSING POLICY

SRM GROUP S.A.S. — GRUPOSRM.COM / TIENDASRM.COM / ESPUF.COM

Prepared in accordance with Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and Law 2300 of 2023 — July 2026

1. DATA CONTROLLER

1.1. The controller responsible for processing your personal data is SRM GROUP S.A.S., NIT 830.069.355-8, with registered office at AC 100 No. 49-87, Bogotá D.C., Colombia. Phone: +57 310 310 1789. Websites: gruposrm.com, tiendasrm.com and espuf.com. Exclusive channel for data subjects to exercise their rights: habeasdata@gruposrm.com (hereinafter, "The Company").

1.2. This policy applies to personal data of customers, prospects, visitors to our websites and social networks, suppliers, contractors, employees and candidates, and any natural person who provides information to The Company.

2. DEFINITIONS

For purposes of this policy: Data Subject is the natural person whose data is subject to processing; Personal Data is any information linked to or that can be associated with one or more determined or determinable natural persons; Processing is any operation on personal data (collection, storage, use, disclosure or deletion); Authorization is the prior, express and informed consent of the data subject; Controller is who decides on databases and their processing; Processor is who carries out processing on behalf of the controller; Transmission/Transfer is the sending of data to a third party, within or outside the country.

3. PRINCIPLES

The Company applies the principles of legality, purpose, freedom, truthfulness, transparency, access and restricted circulation, security and confidentiality provided for in article 4 of Law 1581 of 2012. We only process data necessary for the purposes described here, and do not use them for different purposes without new authorization.

4. DATA WE COLLECT

4.1. Identification and contact data: names and surnames, type and identification number, email, phone numbers, city and address; for legal entities, the contact data of their representatives, employees or dependents.

4.2. Billing and tax data: necessary to issue the electronic invoice required by DIAN (business name or name, NIT or ID number, address, tax status).

4.3. Purchase and shipping data: order history, quotes, delivery addresses, specifications and files provided for product customization (logos, images, texts, measurements), and communications related to orders, warranties, returns and claims.

4.4. Payment data: The Company does NOT store credit or debit card numbers. Online payments are processed directly by authorized payment gateways under their own security policies. The Company retains only transaction receipts (reference, amount, date and status).

4.5. Navigation data: cookies and similar identifiers described in section 9, IP address, device type and pages visited on our sites.

4.6. Supplier, contractor, employee and candidate data: those necessary for the corresponding contractual, employment or selection relationship, including those required by labor, accounting and social security regulations.

5. PURPOSES OF DATA PROCESSING

Personal data is used for:

Managing customer registration, orders, product manufacturing—including customization—, delivery or shipment and after-sales service.
Issuing electronic invoices and fulfilling accounting, tax and information obligations to authorities.
Coordinating shipments with transport companies, to whom only data necessary for delivery is provided.
Handling warranty requests, returns, cancellations, inquiries, complaints and claims (PQR).
Sending, with the data subject's authorization, commercial information about products, services, offers and updates from The Company and its own brands, via email, telephone, messaging or social media. The data subject may object or unsubscribe at any time and this does not affect their commercial relationship.
Preparing statistics, internal studies and improvements to our products, services and websites.
Preventing fraud and ensuring the security of transactions and our systems.
Managing relationships with suppliers, contractors, employees and candidates.

5.1. Commercial contact (Law 2300 of 2023): commercial communications will be conducted through channels authorized by the data subject and during business hours published on gruposrm.com. The data subject may choose or exclude contact channels by writing to habeasdata@gruposrm.com.

6. AUTHORIZATION

6.1. Processing requires prior, express and informed authorization from the data subject, obtained through verifiable mechanisms: acceptance checkbox during registration and in the purchase process of our stores, physical or electronic forms, email or any other means that allows subsequent consultation. The Company retains proof of authorization.

6.2. Authorization is not required in the cases of article 10 of Law 1581 of 2012 (information required by authority in exercise of its functions, data of public nature, medical or health emergency, among others).

6.3. The provision of sensitive data is optional. The Company does not request sensitive data for its commercial operations; if exceptionally necessary to process any, express and informed authorization will be requested, indicating that the data subject is not obliged to provide it.

6.4. Minors: our products and websites are not directed at minors. Data of children and adolescents will only be processed when it serves their best interests and authorization from their legal representative is obtained, after exercising the minor's right to be heard.

7. DATA TRANSMISSION AND TRANSFER — PROCESSORS

7.1. The Company does not sell or transfer its databases to third parties. Data is only shared in these cases:

Transport companies and logistics operators: contact and address data, exclusively for order delivery.
Payment gateways: transaction data is handled directly by the payment gateway chosen by the customer, as responsible party or processor according to its own terms.
Technology providers: hosting services, email, store platforms and analytics tools that may involve data storage on servers located outside Colombia. In these cases, international transfer or transmission is carried out to providers that offer adequate levels of data protection, or under authorization from the data subject and exceptions under article 26 of Law 1581 of 2012.
Brands and companies owned by The Company: identified on our websites, solely for the purposes described in this policy.
Public authorities: when required by law or a judicial or administrative order.
Accounting and legal advisors: under confidentiality obligations, for the fulfillment of legal obligations.

7.2. Data processors enter into commitments of confidentiality and compliance with this policy and the law, in accordance with article 18 of Law 1581 of 2012.

8. DATA SUBJECT RIGHTS

The data subject has the right to: (a) know, update and rectify their data with The Company; (b) request proof of the authorization given; (c) be informed of the use that has been made of their data; (d) revoke authorization and/or request deletion of their data when there is no legal or contractual duty to retain them; (e) access their data free of charge, at least once per calendar month and each time there are substantial modifications to this policy; and (f) file complaints with the Superintendence of Industry and Commerce (www.sic.gov.co) for violations of the law, once the consultation or complaint process with The Company has been exhausted.

9. COOKIES AND SIMILAR TECHNOLOGIES

9.1. Our websites use first-party and third-party cookies: (a) technical or functional, necessary for store operation (session, shopping cart, preferences); (b) analytics, which allow us to measure site usage in aggregate; and (c) personalization or advertising, where applicable.

9.2. Users can configure or block cookies from their browser. Blocking technical cookies may prevent the store from functioning (for example, the shopping cart).

10. CONSULTATION AND COMPLAINT PROCEDURES

10.1. Channel: queries and complaints should be submitted to the email habeasdata@gruposrm.com or in writing to AC 100 No. 49-87, Bogotá D.C., indicating: identification of the data subject, description of facts or request, contact address and documents to be submitted. These rights may be exercised by the data subject, their heirs (proving such status), their representative or attorney, or whoever acts by stipulation in favor of another.

10.2. Queries: will be answered within a maximum of ten (10) business days from receipt. If not possible, the interested party will be informed of the reason and the new date, which will not exceed five (5) business days following the expiration of the first term.

10.3. Claims: if the claim is incomplete, the interested party will be requested to provide additional information within five (5) business days; if no response is received within two (2) months, the claim will be deemed withdrawn. A complete claim will be resolved within a maximum of fifteen (15) business days; if this is not possible, the reason and new deadline will be communicated, which shall not exceed eight (8) business days following the expiration of the initial term. While the claim is being resolved, the data in dispute will be marked with the legend "claim pending review".

10.4. Deletion and revocation: these will be resolved under the same terms as stated above. Deletion shall not proceed as long as there is a legal or contractual obligation requiring the retention of data (for example, accounting and billing information for the periods set by law). If the Company fails to comply with the request within the established timeframe, the data subject may file a complaint with the Superintendencia de Industria y Comercio in accordance with Article 22 of Law 1581 of 2012.

11. SECURITY MEASURES

The Company adopts reasonable technical, human, and administrative measures to protect personal data and prevent its alteration, loss, unauthorized access, use, or consultation: access control to systems through usernames and passwords, restricted database access limited to personnel who require it, confidentiality obligations for staff, periodic data backups, and the use of payment platforms and gateways with encrypted connections (HTTPS). No system is infallible; in the event of a security incident affecting personal data, the Company will manage and report it to the Superintendencia de Industria y Comercio in accordance with applicable law.

12. VALIDITY

12.1. Personal data will be retained while there is a commercial, contractual, or legal relationship with the data subject and for the retention periods required by accounting, tax, labor, and commercial regulations. Once those periods have elapsed and the purpose has been fulfilled, the data will be deleted or anonymized.

12.2. This policy becomes effective upon publication on the Company's websites and supersedes any previous version. Any modifications will be published on the same sites and, when substantial, will be communicated to data subjects before implementation. Date of this version: July 2026.

How do I contact tiendasrm.com? If you have any questions about this privacy statement or about the practices of this community... Contact us.