Privacy Notice

In compliance with Statutory Law 1581 of 2012 on Personal Data Protection and related regulations, FRUBIK S.A.S., identified with Tax ID (NIT) 901.959.047-7 and owner of the creative universe and platform HOPUNIVERSE.COM, informs that the personal data provided by data subjects will be collected, stored, used, circulated and, when applicable, deleted in accordance with this Personal Data Processing Policy.

Such information may be transmitted or transferred to partner third parties (in Colombia or abroad) exclusively for operational purposes related to the operation of the website, product sales, community communication, and the commercial management of HOPUNIVERSE.

1. Data Controller

FRUBIK S.A.S. (NIT 901.959.047-7) is the data controller responsible for the processing of personal data.

2. Purpose of Processing

Personal data is processed for the following purposes:

• managing relationships with customers, subscribers, and the community;

• sending commercial communications, HOP Universe news, product updates, launches, benefits, and digital content;

• loyalty and rewards programs;

• audience segmentation and internal analysis;

• handling requests, customer service, and post-sales support;

• complying with legal and contractual obligations, including payment processing and logistics for delivery.

3. Sensitive Data and Children’s Data

Providing sensitive data—i.e. data that may affect privacy or could be used for discriminatory purposes—is optional.

HOPUNIVERSE will not request personal data directly from minors without the verifiable consent of their parent or legal guardian. Purchases, account creation, and transactions on the site must be carried out by adults, or under their supervision.

4. Access to the Policy

The Personal Data Processing Policy, as well as any material updates to it, may be requested at: sales@hopuniverse.com

.

5. Data Subject Rights

The data subject (or their duly authorized representative) may exercise their rights to access, correct, update, delete data, revoke authorization, or file a claim for alleged non-compliance by submitting a request to FRUBIK S.A.S. at sales@hopuniverse.com

, indicating the specific right being exercised, or by written communication sent to Calle 147 # 12-55, Bogotá D.C., Colombia.

PERSONAL DATA PROCESSING POLICY

1. Purpose

To establish the guidelines for the processing of personal data collected and managed by FRUBIK S.A.S. within the framework of HOPUNIVERSE.COM and associated activities (online store, digital content, creative community, and loyalty programs).

2. Scope

This Policy applies to the processing of personal data contained in the databases of FRUBIK S.A.S., regardless of format (digital, physical, or mixed).

3. Definitions

The definitions set forth in Law 1581 of 2012 and related regulations apply, including: authorization, data subject, personal data, public data, private data, semi-private data, sensitive data, data controller, data processor, transfer, transmission, inquiry, claim, deletion, revocation, and processing of personal data.

4. General Provisions

4.1 Introduction

FRUBIK S.A.S. (NIT 901.959.047-7) complies with Colombian regulations on the protection of personal data and adopts this Policy to ensure the appropriate, secure, and lawful processing of information.

4.2 Applicable Regulations

Political Constitution of Colombia (Articles 15 and 20)

Law 1581 of 2012

Decree 1377 of 2013 (as compiled in Decree 1074 of 2015)

Decree 1074 of 2015, Chapters 25 and 26

External Circular 005 of 2017 issued by the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio)

4.3 Guiding Principles of Processing

All personal data processing carried out by FRUBIK S.A.S. will be governed by the following principles:

Legality: Processing is subject to applicable laws.

Purpose: Data is processed only for legitimate purposes, which are disclosed to the data subject.

Freedom: Processing requires the prior, express, and informed consent of the data subject.

Accuracy / Quality: Data must be truthful, complete, accurate, up to date, verifiable, and understandable.

Transparency: Data subjects may obtain information about the processing of their data at any time.

Restricted Access and Circulation: Access to personal data is limited to authorized personnel and as permitted by law.

Security: Technical, administrative, and human measures are implemented to prevent loss, misuse, unauthorized access, or fraud.

Confidentiality: All persons involved in data processing must maintain confidentiality, even after their relationship with FRUBIK S.A.S. has ended.

4.4 Privacy and Data Protection Management

FRUBIK S.A.S. will maintain an internal function responsible for personal data protection, which shall:

Maintain the inventory of databases and, when applicable, register them with the Superintendence of Industry and Commerce.

Respond to data subject inquiries, requests, and claims.

Report, when legally required, security incidents affecting personal data.

Promote the implementation of security controls and best practices.

Support international data transfers or transmissions when required for cloud services, payment gateways, email delivery systems, logistics providers, or other operational services of the platform.

5. Processing of Personal Data

5.1 Data Controller

FRUBIK S.A.S.

NIT: 901.959.047-7

Address: Calle 147 # 12-55, Bogotá D.C., Colombia

Email: sales@hopuniverse.com

Contact phone: +57 321 319 4568

5.2 Purposes of Processing

Personal data may be used to:

• create and administer adult user accounts on HOPUNIVERSE.COM;

• process purchases, orders, payments, invoicing, and shipments within Colombia;

• send notifications on new releases, new chapters, promotions, and benefits;

• manage customer service, support, and PQR (petitions, complaints, and claims);

• execute marketing activities, in-house advertising, loyalty initiatives, and internal analytics (including segmentation, content preferences, and participation in creative campaigns);

• comply with legal, regulatory, and contractual obligations.

Important Note on Minors:

The content of the HOP Universe is aimed at children and adolescents; however, commercial transactions, account creation, and the provision of personal data must be carried out by adults (parent/guardian). FRUBIK S.A.S. will not request personal data directly from a minor without the prior, express, and verifiable consent of their parent or legal guardian.

5.3 Authorization from the Data Subject

Before collecting personal data, FRUBIK S.A.S. will request the prior, express, and informed authorization of the data subject (or their legal representative, when applicable). This authorization may be obtained through web forms, opt-in checkboxes, audio records, newsletter sign-up, account creation, or purchase flows.

Data subjects will always be informed of:

• the purpose(s) of processing;

• the optional nature of providing sensitive data or children’s data;

• their rights as data subjects; and

• the channels available to exercise those rights.

5.4 Children’s Data

FRUBIK S.A.S. will only process personal data of minors when:

prior, express, and verifiable authorization has been granted by the parent or legal guardian; and

such processing clearly serves the minor’s best interests and respects their fundamental rights.

All purchases are to be made by responsible adults.

5.5 Information Security

FRUBIK S.A.S. adopts technical, administrative, and human measures designed to:

reduce the risk of unauthorized access, loss, alteration, or misuse of data;

ensure the integrity, availability, and confidentiality of information;

respond to security incidents and, when legally required, notify the Superintendence of Industry and Commerce and any data subjects potentially affected.

5.6 Data Transmission and Transfer

FRUBIK S.A.S. may share personal data with third-party service providers and strategic partners (for example, hosting services, email delivery platforms, payment gateways, logistics/shipping providers), whether located in Colombia or abroad.

Such third parties are required to:

comply with Law 1581 of 2012;

guarantee appropriate security and confidentiality;

use the data solely for the purposes instructed by FRUBIK S.A.S.

Where applicable, formal data transmission agreements will be executed.

5.7 Disclosure to Authorities

If a competent authority (by legal or judicial mandate) requests access to personal data, FRUBIK S.A.S. will verify the legitimacy and scope of the request and will disclose only what is strictly necessary, keeping a record of such disclosure.

5.8 Data Retention Period

Personal data will be processed for the period that is reasonable and necessary to fulfill the purposes authorized by the data subject or required by applicable law. If the data subject revokes their authorization or requests deletion of their data, and there is no legal or contractual obligation to retain it, FRUBIK S.A.S. will proceed with deletion.

6. Data Subject Rights and How to Exercise Them

In accordance with Law 1581 of 2012, the data subject (or their duly authorized representative) is entitled to:

Access, verify, and obtain a copy of their personal data.

Request updates, corrections, or rectifications of inaccurate, partial, or outdated data.

Request deletion of data when continued processing is not justified.

Revoke consent to data processing.

File complaints with the Superintendence of Industry and Commerce for alleged violations of data protection rules.

Channels for Exercising These Rights:

Email: sales@hopuniverse.com

Physical address: Calle 147 # 12-55, Bogotá D.C., Colombia

Inquiries (access to information):

FRUBIK S.A.S. will respond within ten (10) business days of receiving the request.

If it is not possible to respond within that period, the requester will be informed of the reason for the delay and the expected response date, which in any case shall not exceed an additional five (5) business days.

Claims (correction, deletion, revocation):

FRUBIK S.A.S. will respond within fifteen (15) business days of receiving a complete claim.

If the claim is incomplete, the data subject will be asked to correct or clarify it within five (5) business days. If the data subject does not provide the required information within two (2) months of the request, the claim will be deemed withdrawn.

If a full response cannot be provided within fifteen (15) business days, the data subject will be informed of the reason for the delay and given a new response deadline, which shall not exceed an additional eight (8) business days.

7. Effective Date and Updates

This Personal Data Processing Policy is effective as of January 15, 2025, and may be updated. Any material change will be communicated to data subjects through www.hopuniverse.com  or via the available contact channels.