Personal Data Processing Policy

Foodment S.A.S. BIC and Foodment Inc. (Weia)

How we process the information of producers, buyers, partners, funders, visitors and staff

Contact for personal data matters:

contacto@weia.com.co

Carrera 7 # 80-49, oficina 504, Bogotá D.C., Colombia

Bogotá D.C., 26 October 2026

1. In brief

Weia is the brand under which Foodment S.A.S. BIC provides in-kind financing of the inputs a producer needs to plant, backed by an agreement to purchase the harvest, and provides technology services for agricultural supply chains. This policy explains which personal data we process, for what purposes, with whom we share them, how long we keep them and how you can exercise your rights. It applies to Foodment S.A.S. BIC and to Foodment Inc., its parent company.

2. Who we are and how to contact us

2.1 Controllers

This policy applies to the two companies that operate under the Weia brand:

When this policy says "Weia" or "we", it refers to Foodment S.A.S. BIC and, regarding the databases it controls, to Foodment Inc. If either company changes its name, for example by ceasing to be a collective benefit and interest company, this policy continues to apply under the new name (section 18).

2.2 Databases

These are the databases this policy covers:

2.3 Data protection area and service channels

Foodment S.A.S. BIC assigned the personal data protection function to its General Management, and Foodment Inc. to its Chief Executive Officer. Both act in coordination as the Personal Data Protection Area, handle requests about any of the databases through the same channels and follow an internal procedures manual. You can contact it through these channels:

Email: contacto@weia.com.co, with the subject "Datos personales".

In writing: Carrera 7 # 80-49, oficina 504, Bogotá D.C., Colombia, addressed to the Personal Data Protection Area.

WhatsApp: if you joined or communicate with Weia through WhatsApp, you can submit your request through that same channel; we log it and reply through the channel you indicate.

Phone: +57 310 516 8375.

The procedure for exercising your rights is in section 17.

2.4 When Weia processes data on behalf of or jointly with others

Weia provides technology services to other companies, such as traceability platforms, operation records or the digital representation of economic rights. In those cases, Weia processes the personal data those companies provide as a processor: it does so on their behalf, following their instructions and their policies, under a contract that governs it, and does not use the data for its own purposes, except effectively anonymized information when the contract with that company allows it. If you are the data subject of those data, you can exercise your rights before the controlling company, and Weia will support it in answering you.

In some programs, Weia and the buyer of the harvest jointly decide on certain information about producers, such as deliveries, quality and payments under the tripartite agreement signed by the producer, the buyer and Weia. In those cases both are controllers of that information, and the agreement between them defines who handles each type of request. You can submit your request to either of them: whoever receives it handles it or forwards it to the other and informs you.

3. Scope and definitions

3.1 Who it applies to

This policy applies to all processing of personal data carried out by Foodment S.A.S. BIC and Foodment Inc. in Colombia, or outside Colombia when Colombian law applies to them, concerning these people, whom we call data subjects:

Producers, whether natural persons or representatives of legal entities or associations, and those who show interest in the programs without joining.

Co-debtors and guarantors, and other people who sign with the producer.

Representatives, signatories and teams of buyers, input suppliers, manufacturers, transporters, insurers, partners and technology-services clients.

Funders, assignees and investors of the programs, and their representatives.

Shareholders, investors, directors and advisers of Foodment S.A.S. BIC and Foodment Inc.

Visitors to the website and users of Weia’s platforms.

Staff, contractors, interns and candidates.

Participants in meetings, calls and events with Weia.

Staff, contractors and processors who process data on Weia’s behalf must comply with this policy.

3.2 Definitions

The terms in this policy have the meaning the law gives them. For ease of reading:

Term	Meaning
Authorization	Prior, express and informed consent of the data subject for the processing of their personal data. It can be given in writing, orally or through unequivocal conduct, by physical or electronic means that allow it to be consulted later. In no case is silence taken as authorization.
Privacy notice	Verbal or written communication through which we inform, when collecting the data, who the controller is, what the data will be used for, the rights of the data subject and how to consult this policy.
Personal data	Any information linked or that can be associated with one or more identified or identifiable natural persons.
Public data	Data that is not semi-private, private or sensitive, such as data relating to a person’s civil status, profession or trade, and status as a merchant or public servant.
Semi-private data	Data that is not intimate, confidential or public and whose knowledge may interest a certain group of people, such as financial, credit and commercial information.
Private data	Data that, because of its intimate or confidential nature, is relevant only to its data subject.
Sensitive data	Data that affects the data subject’s privacy or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, or membership in trade unions, social or human rights organizations, and data concerning health, sex life and biometric data.
Anonymized data	Information that can no longer be associated with an identified or identifiable person by reasonable means. It is not personal data.
Pseudonymized data	Information in which names and identifiers are replaced by codes, so that it can only be associated with the person using additional information kept separately. It is still personal data.
Controller	Natural or legal person who decides on the database or on the processing of the data.
Processor	Natural or legal person who processes personal data on behalf of the controller.
Data subject	Natural person whose personal data are processed.
Processing	Any operation on personal data, such as collection, storage, use, circulation or deletion.
Transfer	Sending of personal data to a recipient, in Colombia or abroad, who is in turn a controller.
Transmission	Communication of personal data, in Colombia or abroad, so that a processor processes them on behalf of the controller.
In-kind financing	Delivery of the agricultural inputs a producer needs to plant, whose value is paid from the sale of the harvest, usually through the buyer.
Financial, credit, commercial and services information	Information on the creation, performance and extinction of monetary obligations, under Law 1266 of 2008.
Information operator	The entity that receives from sources personal data on monetary obligations, manages them and makes them known to users, such as credit bureaus.
Distributed ledger (DLT)	Database replicated on servers operated by independent third parties in different countries. Confirmed transactions form a dated public history, and Weia cannot delete the copies those third parties keep. The state of accounts and tokens can change through new transactions, but that does not erase the history. The XRP Ledger is a public network of this kind.
Digital fingerprint (hash)	Code calculated from a document or a set of data that serves to check that the information has not changed. Its protection depends on how it is calculated and on the information available to relate it to a person; that is why Weia calculates it with secret values (section 9).
Encrypted information	Information transformed with a key, so that only whoever holds the key can read it.
Token	Digital representation of an economic right, such as one arising from a contract under Weia’s programs.
Automated decision	Result produced by a system without the intervention of a person.
Cookie	Small file a website stores in the browser to remember information between pages or between visits.
Browser storage	Space in the browser where a website stores information, such as local storage or session storage, with effects similar to those of a cookie.

4. Principles we follow

We process personal data in accordance with the principles of Law 1581 of 2012: legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality. In practice, this means that:

a) We collect the data we need for specific purposes that we inform you of, and we do not use them for other purposes without your authorization when the law requires it.

b) We ask for your authorization no later than when we collect your data, and we keep the proof.

c) We keep data accurate and up to date, and we correct those that are not.

d) We do not make personal data available to the public on the internet or in other mass media, except public information, information the law requires to be published or entered in public registries, or when access is technically controlled so that only the data subject or authorized third parties can know it. What we record on distributed ledger technologies is limited to minimal attestations, encrypted or calculated with secret values, which we assess so that they do not reasonably allow you to be identified (section 9).

e) We protect data with technical, human and administrative measures proportionate to the risk.

f) Those who process data at Weia keep them confidential, even after their relationship with us ends.

5. What data we process and where they come from

5.1 Data by type of data subject

We process only the data we need according to our relationship with you:

Data subject	Data we may process
Producers, prospects, co-debtors and guarantors	Identification and contact: name, type and number of ID document, image of the document, sex or gender and age or date of birth, as shown in the document or as you report them, RUT (tax registry), phone and WhatsApp, email and address. Farm and production: location, coordinates and polygon of the plot, area, land tenure, crop, experience, practices, yields, inputs, planting, harvest and deliveries. Household and business: household composition, without identifying its members, marital status, education level, housing tenure, debts, sales, marketing channels, distance to the collection center, support available to tend the crop and, if you choose to answer, membership in associations. Commercial history with the buyer: purchases, quantities, prices, quality and dates. Verification and risk: information from information operators, results of identity verification, background checks and restrictive-list screening, and results of the evaluation model. Contracts and payments: contracts and electronic signatures, bank account for paying out the balance, payments and payment receipts, account statements and collections management. Monitoring: messages, voice notes, photos, videos, field visit reports and, when the program includes them, satellite images and weather information for the plot. Biometric data, only if you choose that verification method (section 7).
Representatives and teams of buyers, suppliers, partners and clients	Name, ID document, position, company, contact details, signatures, restrictive-list screening results, platform access accounts and communications of the relationship.
Funders, assignees, shareholders and investors	Name, ID document, nationality and residence, contact details, beneficial owners, source of funds, restrictive-list screening results, tax information, bank accounts, holdings, investments, payments and communications.
Visitors and platform users	Data they type in forms, language and the site page they write from and, if they authorize it, the campaign that brought them; technical connection and browser data that our providers process to deliver and protect the site; their choice about analytics and its proof; only if they accept it, data on their browsing and their approximate location (section 14), and, for platform users, their account data.
Staff and candidates	Résumé, contact details, documents, employment, social security, occupational health and safety, banking and performance information, use of work tools and beneficiaries’ data when the law requires it.
Participants in meetings, calls and events	Name, position, company and contact details and, when the meeting or call is recorded, transcribed or summarized with their authorization, their image, their voice, what they say and write in it, and the recordings, transcripts, summaries and notes generated (section 6.9).

5.2 Where they come from

We receive data from these sources:

From you, through WhatsApp, forms, calls, emails, meetings, field visits and the documents you sign.

From harvest buyers and other partners, such as their suppliers’ purchase history, deliveries, quality and payments (section 10.3).

From information operators and verification providers, such as credit bureaus and identity, background and restrictive-list verification services.

From public sources, such as public registries, official lists and the commercial registry.

From satellite imagery and weather information from public sources or specialized providers, calculated over the plot’s location.

From our platforms and the website, which generate technical usage records.

From digital advertising platforms, when you contact us from an ad, such as the originating ad and the date of the contact.

From those who act on your behalf, such as your representatives or attorneys.

6. What we use data for

6.1 How purposes are organized

Purposes are grouped as follows:

Necessary: those corresponding to the program you take part in and to your relationship with Weia. Without them we cannot onboard you or perform the contract.

Accessory: optional ones, such as receiving commercial information. You authorize them separately and can object to them at any time, without affecting the main service.

Legal: those the law imposes on us.

With anonymized data: statistics and reports that do not allow anyone to be identified.

Sensitive data have their own rules (section 7). Purposes that say "when the program includes it" apply only if the program you take part in provides for that activity. Tracking of the opening of the emails we send you and of clicks on their links is governed by section 13.1.

6.2 Producers, prospects, co-debtors and guarantors

Necessary purposes:

#	Purpose
1	Onboarding you to the program, verifying your identity, your documents and the information you provide, and preventing identity theft and fraud.
2	Evaluating your application and setting the value of the inputs financed, with Weia’s own evaluation model (section 8).
3	Consulting your financial, credit, commercial and services information with information operators to analyze or calculate your credit risk and, when applicable, reporting it, under the rules of section 12.
4	Checking background and screening national and international restrictive lists and politically exposed person status, to prevent money laundering, terrorist financing, corruption and fraud. We consult only the sources relevant to those purposes, verify matches to avoid errors from namesakes, and do not use unverified news or health information to evaluate you. The result is kept with restricted access and is not shared with third parties that lack a legitimate interest recognized by law.
5	Entering into, signing electronically, performing, amending, documenting and terminating the program contracts, such as the sale of inputs, the sale or supply of the harvest, payment instructions and assignments of economic rights.
6	Creating, registering, managing and enforcing security interests over the harvest and over economic rights, including their registration in the Registro de Garantías Mobiliarias (the public registry of security interests in movable assets), which is publicly accessible (section 10.2).
7	Coordinating with the buyer of your harvest, input suppliers and manufacturers, transporters, collection centers and insurers the delivery of inputs, technical support, planting, harvest, delivery, quality and payment, and sharing with them the information needed for this.
8	Monitoring the financed crop through messages, voice notes, photos, videos, the plot’s location and polygon, field visits and, when the program includes them, satellite images and weather information (section 8.4), and sending you reports, reminders and alerts.
9	Checking consistency between what was declared and what was observed, for example the planted area or deliveries, and detecting irregularities.
10	Receiving payment for the harvest, deducting the financed value, paying out your balance, reconciling and issuing invoices, account statements and certificates.
11	Managing the portfolio and collections, payment agreements and pre-litigation and judicial collection, directly or through third parties, with the information of the contractual relationship and the rules of section 13.
12	Funding the programs: assigning, selling, endorsing or pledging the economic rights under the contracts to funders, investors, trust vehicles (patrimonios autónomos) or other financing vehicles, and providing them, their administrators and their advisers with the information needed to evaluate, acquire, monitor and collect them, pseudonymized as a general rule (section 10.2).
13	Recording on distributed ledger technologies, such as the XRP Ledger, digital fingerprints, codes and minimal encrypted attestations of the contracts and their milestones, and representing the economic rights under the contracts through tokens (section 9).
14	Managing agricultural insurance when the program includes it: quotes, purchase, designation of beneficiaries and claims.
15	Presenting your operation to agricultural financing support programs, such as development financing lines, guarantees or organized markets, when the financing of your operation is structured with them.
16	Recording the traceability of products originating from your harvest and providing it to buyers, without publishing your name, your farm’s name or its location, unless you authorize it (section 6.7).
17	Documenting force majeure events, losses and claims, and exercising or defending rights in judicial, arbitral or administrative proceedings.
18	Improving and recalibrating the evaluation model and the program processes with information from Weia’s operations, such as deliveries and payments, pseudonymized or anonymized, under the conditions of section 8. This purpose does not enable new uses of information collected under earlier authorizations (section 19.3).
19	Checking that the evaluation model’s results do not discriminate, using the sociodemographic information strictly necessary for that check, in pseudonymized form.
20	Maintaining the security of the platforms and the necessary security logs (section 15).
21	Handling your inquiries, claims and requests.

Legal purposes: complying with accounting, tax, corporate, anti-money-laundering and reporting obligations, and responding to requests from authorities.

With anonymized data: producing statistics, studies, reports on the operation, productivity, supply and impact, reports to funders and research, with effectively anonymized information (section 6.8).

Producers’ accessory purposes are in section 6.7.

6.3 Buyers, suppliers, partners and clients

Necessary purposes regarding their representatives, signatories and teams:

#	Purpose
1	Knowing the counterparty: verifying the company’s existence and representation, its representatives and its beneficial owners, and screening restrictive lists.
2	Entering into and performing contracts and alliances: orders, deliveries, quality, invoicing, payments and payment instructions.
3	Creating and managing access accounts to Weia’s platforms and keeping them secure.
4	Delivering program reports on their own suppliers and operations.
5	Providing the contracted technology services.
6	Recording on distributed ledger technologies digital fingerprints, codes and minimal encrypted attestations of the contracts, their milestones and the technology services (section 9).
7	Complying with legal obligations and responding to authorities.

Accessory purposes: sending them information about Weia’s programs, services and events, and inviting them to answer satisfaction surveys.

6.4 Funders, assignees, shareholders and investors

Necessary purposes:

#	Purpose
1	Knowing the funder or investor: identification, beneficial owners, source of funds and restrictive lists.
2	Entering into and performing financing, investment, assignment or guarantee contracts: disbursements, payments, account statements and certificates.
3	Keeping the shareholder registers, calling and holding shareholder and board meetings, and complying with information rights.
4	Sending reports on the operation and the portfolio, pseudonymized or aggregated under section 10.2.
5	Carrying out investment and due diligence processes.
6	Complying with tax, economic sanctions and reporting obligations, in Colombia and, in the case of Foodment Inc., in the United States of America.
7	Recording on distributed ledger technologies digital fingerprints, codes and minimal encrypted attestations of financing, investment and assignment contracts and, when the program includes it, creating and managing economic-rights accounts and recording their positions, assignments and payments (section 9).

Accessory purpose: informing them about new financing or investment opportunities, within the rules applicable to securities offerings.

6.5 Website visitors and platform users

Necessary purposes:

#	Purpose
1	Answering the requests you send us through forms, email or WhatsApp.
2	Keeping the proof of your authorization and of your choice about analytics.
3	Keeping the site and platforms secure and preventing automated or malicious use.
4	Managing platform user accounts.

Accessory purposes, each only with your acceptance or separate authorization: measuring your browsing with analytics tools, including your approximate location, recognizing your next visits through cookies and recording sessions (section 14); keeping with your request the campaign that brought you to the form, to measure which communications generate requests, and sending you newsletters and commercial information. You can refuse each one or withdraw it without affecting our answer or your use of the site.

6.6 Staff, contractors, candidates and meeting participants

Necessary purposes:

#	Purpose
1	Carrying out selection processes, including checking the references the candidate authorizes.
2	Entering into and performing the contract: payroll, social security, benefits, and occupational health and safety.
3	Providing and managing work tools and keeping them secure, with monitoring announced in advance.
4	Evaluating performance, training and issuing certificates.
5	Checking background in proportion to the position.
6	Providing clients, partners and funders with the data of representatives and contact persons they request to know Weia as a counterparty.
7	Managing the relationship with those who take part in meetings, calls and events, taking notes and documenting agreements.
8	Complying with legal obligations.

Accessory purposes: recording, transcribing and summarizing meetings and calls with the authorization of those who take part (section 6.9), using staff images in Weia’s communications and keeping candidates’ résumés for future openings.

6.7 Producers’ accessory purposes

You can authorize each of these purposes separately or not, and object at any time through the channels of section 2.3, without affecting your onboarding or your contract:

Accessory purpose	What it includes
Weia information	Receiving information about new Weia programs, seasons and benefits through the channels you choose.
Partners’ offers	Sharing your contact details and production profile with input suppliers, insurers, financial institutions and other partners, so they can offer you their products directly. Each partner is responsible for its use of your data.
Image and voice	Using your image, your voice and your testimonial in Weia’s communication pieces. We tell you the media, purpose and duration of each use. We do not use your name without your authorization.
Artificial intelligence recreation	Creating with artificial intelligence tools images or voices that represent or imitate you, for Weia’s communication pieces. It is explained to you and authorized separately from the previous one.
Future seasons	Keeping your data after the relationship ends to invite you to new seasons.
Surveys	Inviting you to answer satisfaction and opinion surveys about the programs.
Impact measurement	Using your sex, your age and your household composition to measure the programs’ social impact, for example the participation of women and young people. Results are published only in aggregate form.
Artificial intelligence training	Using your photos, voice notes and conversations to train Weia’s own artificial intelligence models. Without this authorization, for that purpose we only use effectively anonymized information, such as photos of crops or inputs showing no people and no data that identify you.
Public traceability	Showing your name, your farm’s name or its approximate location in the traceability information seen by buyers or consumers.

6.8 Anonymized and aggregated information

We treat as anonymous only information whose collection and transformation are permitted and that does not reasonably allow anyone to be identified, alone or combined with other sources. That information is no longer personal data, and Weia may use and share it for any lawful purpose, such as statistics, productivity and supply studies, impact reports, reports to funders, product development and research. To anonymize, we use techniques such as removing identifiers and metadata, generalizing location or aggregating data, according to the risk that someone could re-identify a person, and we check that risk before delivering the information and whenever its conditions of use change. Figures for very small groups, such as those of a few producers of a single buyer, are treated as personal data. Pseudonymized information is still personal data and circulates only under the rules of this policy.

6.9 Meetings, calls, recordings and note-taking assistants

Weia meets with producers, buyers, partners, funders, candidates, staff and other people, in person, by videoconference or by phone. In those meetings and calls we may use the recording, transcription and summary functions of videoconferencing platforms, and artificial intelligence assistants that record, transcribe, summarize and identify commitments and tasks, which may join the meeting as another participant or run on the device of whoever takes part for Weia. These rules apply to any tool performing those functions, and the Weia company that organizes or takes part in the meeting is responsible for the data:

What we process. Depending on the tool, the participants’ name, email and image, their voice, what they say and write in the meeting, the recording, transcript, summary and notes generated, and conversation metrics, such as its duration or each participant’s speaking time.

What for. To document what is discussed and agreed, and keep evidence of it; prepare minutes, summaries and lists of commitments and tasks, and follow up on them; give continuity to projects and relationships, including with those who did not attend; search information from earlier meetings; prepare documents and answers based on what was discussed, and train Weia’s team.

Authorization. Before recording, transcribing or summarizing a meeting or call with these tools, we tell you that we will do so, who is responsible for the data, for what purpose, who will have access, for how long and how to exercise your rights, and we ask for your authorization in writing, for example in the invitation, in the meeting chat or by email, or orally. We obtain each participant’s authorization before capturing their participation, including that of anyone who joins after the meeting has started. If authorization is oral, we keep proof that can be consulted; when we use the recording as proof, we record in it the confirmation of the authorization already obtained. Authorizing is voluntary. Authorization may be given for one meeting or for the meetings of the same relationship, project or contract; in that case we remind participants at the start of each meeting or the tool shows it to them. That authorization does not cover new purposes or prevent you from refusing in a specific meeting, and you can withdraw it at any time, even during the meeting. Silence is not taken as authorization.

If you do not authorize. We do not record, transcribe or summarize your participation with these tools: we stop the tool or agree with you on another way to take part, and your refusal does not affect your relationship with Weia. We may continue taking notes of the meeting in the usual way.

Meetings organized by others. When Weia takes part in meetings organized by other people, it uses these tools only if the organizer allows it, and applies these same rules.

Who has access. The meeting’s participants and invitees, the Weia team working on the matter and the tool providers. We share recordings, transcripts or summaries with other people only for the purposes of this section or of the relevant relationship, and with the necessary information.

Providers. The providers of these tools act as Weia’s processors and may not use the content to train their own models (section 8.3). Some process data in other countries, under the rules of section 11.

Limits. We do not use these tools to recognize people by the features of their voice or face, or to infer their emotions, health or personality, unless we tell you beforehand and obtain the authorization the law requires. Before processing sensitive data, we identify which they are and why they are needed, and we ask for the corresponding express and separate authorization, without making the service conditional on it. We ask you not to mention unnecessary sensitive data. If they are included and we notice it, we remove them from the recordings, transcripts, notes and summaries under our control and arrange their deletion with the provider; when those fragments cannot be separated, we delete the copy that contains them, unless a legal obligation requires keeping it, in which case we limit its access and use to that purpose.

Retention and rights. We keep these data for the period in section 16. You can ask for access to the recording, transcript or summary of a meeting you took part in, as far as it concerns you and without affecting the rights of the other participants, and for its correction or deletion when applicable (section 17).

7. Sensitive data and data of children and adolescents

7.1 Sensitive data

Weia does not make any activity conditional on your providing sensitive data, and you are not obliged to answer questions about them. When we process them, we tell you which ones and for what purpose, and we ask for your explicit and separate authorization. These are the situations in which they may arise:

Biometric verification. If you choose it, we verify your identity by comparing a photo of your face, with a liveness check, with the photo on your ID document, through a specialized provider acting as Weia’s processor. We offer you an alternative without biometric data that lets you continue onboarding. The provider processes biometrics only for that verification and with reinforced security measures, does not use them to train models or to build biometric databases for other services, and deletes them when the verification ends, except for a specific legal obligation. Weia keeps only the result, does not share biometric data with third parties, checks the deletion period in the contract and keeps evidence of the deletion.

Membership in associations. We may ask whether you belong to a producers’ association, to understand your production context and measure the programs’ impact. Answering is optional and your answer is not used to evaluate your application.

Health. We do not ask producers for health data. For staff, we process the health information required by social security and occupational health and safety.

Recorded meetings. Meeting recordings follow the rules of section 6.9, including those on recognition by voice or face and on sensitive data mentioned in them.

Apart from the identity verification you choose, Weia does not use sensitive data to decide on financing (section 8.1).

7.2 Children and adolescents

Weia does not offer its services to minors. It processes data of children and adolescents only in these cases, when the legal requirements are met and respecting their best interests and fundamental rights:

a) When the producer tells us how many minors are in the household, as a number, without names or individual ages.

b) When a staff member enrolls their children as beneficiaries of social security or other benefits, with the authorization of their legal representative and, when applicable, after hearing the minor according to their maturity.

We ask that monitoring photos and videos not show minors. If we notice that they appear, we delete the image or protect their identity before keeping it. If we notice that whoever is writing to us is a minor, we end the conversation and delete their data, except those the law requires us to keep. We do not use data of children and adolescents for marketing or advertising.

8. Evaluation, automated decisions and artificial intelligence

8.1 How we evaluate an application

Weia uses its own evaluation model to estimate what share of the input basket it can finance in each operation. The model combines these families of information:

a) What you tell us about your production, your farm, your experience and the conditions of your household and business.

b) Your commercial history with the buyer: volumes, prices, quality and delivery compliance.

c) Your information with information operators, when we consult it.

d) Information on the operation: the agreement with the buyer, the crop, monitoring, deliveries and payments.

e) Public information and restrictive-list screening results.

Weia does not use as an evaluation criterion people’s sex, gender identity, sexual orientation, racial or ethnic origin, religious or philosophical beliefs, political orientation, membership in trade unions, social organizations or associations, or health. It uses the sociodemographic information strictly necessary, pseudonymized, only to check that its results do not discriminate.

8.2 Explanation and review

The model proposes a result, and Weia’s team may review it before or after communicating it to you. If the result is unfavorable to you, such as a refusal or a financed value lower than requested, you can ask us, through the channels of section 2.3, for a clear and understandable explanation: the general logic of the model, its main criteria and the factors that most often affect a result like yours. If the nature of the system, the protection of trade secrets or intellectual property, or other legal obligations prevent a detailed explanation, we will give it to you in general terms or grouped by types of factors, so that you can understand the main elements of the result. You can also send us any additional information you consider useful, and Weia may review the result with it. If a person reviews it, they may confirm or change it.

8.3 Artificial intelligence

When the program includes it, Weia uses artificial intelligence tools from specialized providers to understand text messages, transcribe voice notes, read photos of crops, deliveries, inputs and documents, draft reports and classify requests. We tell you what tasks they perform before collecting your data. These tools support the team’s work and the performance of the contracts. If a tool cannot validate a photo or a document, we may ask you for it again or ask a team member to review it. If an automated tool takes part in an unfavorable result about your financing, you have the rights in section 8.2.

Weia’s team also uses, in its daily work, general-purpose artificial intelligence assistants and agents to draft, summarize, translate, search, organize and analyze information, prepare documents and develop software, as well as assistants that take notes in meetings (section 6.9). When the information includes personal data, we use it only for the purposes of this policy and to the extent necessary for each task, and we check what these tools produce before adding it to our records. With sensitive data, information from information operators or background check results, we only use tools that meet the security and use conditions that information requires.

Providers process the data as processors, under conditions that prevent them from using them to train their own models or for purposes other than providing the service to Weia. To train its own artificial intelligence models, Weia uses anonymized information and, only if you authorize it, your photos, voice notes and conversations (section 6.7). The evaluation model is improved with information from Weia’s operations, pseudonymized or anonymized (section 6.2).

Before designing and developing artificial intelligence processing that may create high risk, we assess and document its impact on privacy. We review that assessment before activating the processing and whenever its data, purposes or risks change. For systems already built, we carry out that review, and the necessary corrections, before using them with producers.

8.4 Satellite monitoring and weather information

When the program includes it, Weia analyzes satellite images of the financed plot and cross-references them with weather information for the area to monitor the crop, send you reports and alerts, document force majeure events and check what was declared. For this it uses the plot’s location and polygon. That information may allow you to be identified even if it does not include your name, so we treat it as personal data: we give each imagery, weather or analysis provider only the precision needed for its task, and we do not publish it without your authorization. The analysis is limited to the plot and to the strip of its surroundings needed for the quality of the analysis, and it is not used to evaluate neighboring farms or their owners. Reports may be delivered to funders in pseudonymized form and to the buyer regarding its own supply.

9. Recording on distributed ledger technologies (DLT)

9.1 What we use it for

Weia uses distributed ledger technologies (DLT), in particular the public XRP Ledger network, to leave a verifiable record of its programs’ contracts, their milestones and the economic rights arising from them. This way, a buyer, a funder, an auditor or an authority can check a contract’s history without depending on a report from Weia. This record is part of the programs’ necessary purposes (section 6.2) and of the technology services Weia provides.

9.2 What we record

On the distributed ledger, Weia may write:

a) Internal identifiers of the contracts and their events, dates, times and statuses.

b) Digital fingerprints (hashes) of the documents and information of each contract and its milestones. They are calculated with secret, random values that Weia keeps off the ledger, so that they cannot be reconstructed by trial and error or used to link the contracts of the same natural person.

c) Minimal encrypted attestations about the contract and its milestones, when their necessity and risks have been assessed beforehand. We prefer to record fingerprints of documents kept off the network. Encrypted attestations do not include identity documents, biometric data, health information, bank details, information from information operators or background checks, or full contracts. Weia retains control of the keys and grants access to that information only to those entitled to know it, such as you, the parties to the contract, funders or assignees of its economic rights, auditors or authorities.

d) Tokens that represent the economic rights under the contracts, and their issuances, transfers, locks and closures.

e) When the program includes it, and only if the design allows compliance with the rules of this section and the exercise of your rights: accounts on the ledger associated with program participants, digital attestations that an account meets certain requirements without revealing the data behind them, and movements of economic rights, such as assignments, pledges and payments. Those accounts carry no names or ID numbers, but their movements remain associated with the account, so we treat them as personal data of whoever uses them.

9.3 What we do not record in readable form

Weia does not write on the distributed ledger, in readable form, names, ID numbers, phone numbers, emails, addresses, coordinates or polygons of farms, bank account numbers or bank transaction references, information from information operators or background checks, or other data that allow you to be identified. Before recording information, we also assess accounts, quantities, dates, metadata and their possible cross-references with other sources, and we do not publish stable identifiers of people or information that would reasonably allow them to be recognized through those cross-references. A contract’s economic information, such as its value, crop or quantities, is recorded only encrypted, aggregated or in a way that cannot be associated with you by reasonable means. Token quantities and their movements are visible to anyone.

9.4 What you should know about this record

It is public. Anyone can consult what is recorded. Only whoever holds the key can read encrypted information, and fingerprints are calculated with secret values so that they cannot be checked by trial and error.

It is permanent. Confirmed transactions become part of the public history, and Weia cannot delete the copies kept by third parties. The state of accounts or tokens can change through new transactions, but that change does not erase the history. Because what is recorded remains indefinitely, even if encryption techniques change in the future, we record only minimal attestations.

It is global. The network replicates records on servers operated by independent third parties in different countries, which Weia does not choose or control.

The keys stay outside. The keys, secret values and documents that allow the records to be read or associated with a person are kept outside the distributed ledger, in Weia’s systems, with the measures of section 15.

9.5 Your authorization

The authorization you give for the necessary purposes of Weia’s programs covers the recording described in this section, including the replication of the information on servers located in other countries, which may constitute an international transfer of data under article 26 of Law 1581 of 2012. That express authorization is collected in the same form as the program’s purposes, in a prominent and understandable way, and explains the replication, the independence of those who operate the network and the limits of deletion. It does not replace the restricted circulation, security and deletion measures of this policy, and Weia will not ask you for additional authorization each time it records a contract, a milestone or a movement of economic rights within that scope. Those who operate the network’s servers do not act, for that reason alone, as Weia’s processors. When the recorded information does not allow anyone to be identified, it is not personal data; when Weia keeps the keys or values that allow it to be associated with you, it treats it as personal data with all the safeguards of this policy.

9.6 Deletion and withdrawal regarding the distributed ledger

When deletion of your data applies or the retention period ends (section 16), we delete the data and links under our control, including the keys and secret values that allow the recorded information to be read or associated with you, and we handle the corresponding steps with those who received them. We then check whether a reasonable possibility of identifying you remains. Destroying keys counts as an effective deletion measure only if that check shows that the information remaining on the network can no longer be associated with you; if it does not, we explain to you what remains, why and what measures we apply.

This rule does not mean that records already copied by third parties are deleted. For records made before this version, we assess the links and known copies and apply the corresponding containment and rights-handling measures. If a legal or contractual duty requires keeping certain data, we keep only those data and for the necessary period (section 17.6).

10. Who we share data with

10.1 General rules

We share personal data only when necessary for the purposes of this policy, we deliver only the information the recipient requires, and we require confidentiality and security. We determine each recipient’s role according to its actual use of the data. If it processes them on Weia’s behalf, as a processor, we sign with it a transmission contract covering its sub-processors, security, deletion and the handling of rights. If it uses them for its own purposes, as a controller, we check that the delivery is authorized or permitted by law, and the recipient is responsible for its processing. We also check the countries where data are processed. When a provider’s terms require identifying it or linking its privacy notice, we do so where the data are collected.

10.2 Recipients

These are the possible recipients and what they receive:

Recipient	What it receives and why
Harvest buyers	Information on your onboarding, the agreement, planting, harvest, deliveries, quality and payments, to perform the purchase agreement and the payment mechanism. In some programs the buyer and Weia are joint controllers of this information (section 2.4). Buyers may only use it for the program’s purposes.
Input suppliers and manufacturers, transporters and collection centers	The data needed to deliver the inputs, support their use and receive the harvest.
Insurers and insurance intermediaries	The data needed to quote, purchase and manage agricultural insurance and handle claims.
Information operators	The financial, credit, commercial and services information consulted or reported under section 12.
Funders, assignees, investors and financing vehicles, and their administrators, auditors and advisers	Information on the operation and the portfolio, pseudonymized as a general rule and with tiered access. Identified information only when needed to evaluate or carry out a defined assignment, endorsement, pledge or financing, to collect the economic rights or to comply with the law, to authorized users and under a confidentiality and data processing agreement. A funder or assignee that decides on the use of the data it receives acts as controller of that processing.
Foodment Inc.	Aggregated or pseudonymized information for consolidated reports, corporate governance, investor information, investment processes and group compliance. Identified information only when needed for those purposes and under an agreement between the two companies. When it decides on those data for its own purposes, it acts as an independent controller.
Agricultural financing support programs	The data needed to apply for and carry out your operation when it is financed through development financing lines, guarantees or organized markets.
Lawyers, collection agencies and portfolio assignees	The data needed for collections and judicial collection, under the rules of section 13.
Public registries	The data the law requires to register security interests in movable assets. In the Registro de Garantías Mobiliarias, the registration includes the name, identification and physical and electronic address of whoever grants the security interest, and anyone can consult it.
Financial institutions	The data needed to receive payments and pay out balances.
Service providers	Hosting and cloud, file and image storage, messaging and WhatsApp, email and email tracking, videoconferencing, meeting recording, transcription and summarization, electronic signature, document digitization, identity and background verification, artificial intelligence, satellite imagery and weather, maps and location, data analysis, software development, web analytics and security, digital advertising, electronic invoicing, accounting, auditing and legal advice. Each provider acts as processor or controller according to its actual use of the data (section 10.1). When you use WhatsApp, the company that provides that application also processes data under its own terms. You can ask us for the updated list of providers through the channels of section 2.3.
Authorities	The information they require in the exercise of their legal functions or by court order.
Acquirers in reorganizations	The information needed in the cases of section 18.
XRP Ledger network	Digital fingerprints, codes, minimal encrypted attestations and tokens, under section 9.

10.3 Information buyers give us before you join

Some buyers hire Weia to identify, among their suppliers, those who can take part in an in-kind financing program, and for that analysis they give it their suppliers’ purchase history. At that stage Weia acts as a processor only when the buyer defines the purpose of the analysis and Weia follows its instructions, under a transmission contract. We check that the delivery and the analysis are authorized or permitted by law, and the buyer is responsible for having its suppliers’ authorization. If Weia decides its own purposes, it acts as controller from that moment. Weia uses that information for its own purposes, such as the evaluation of section 8, only from the moment you join and authorize it; the contract with the buyer is not enough to enable those uses.

10.4 Information about our team that we give to counterparties

When a client, partner or funder needs to know Weia as a counterparty, we give it the data of our representatives and contact persons it requests for that purpose, and we ask it to process them in accordance with the law.

11. International transfers and transmissions

Weia processes personal data in Colombia and, through its providers and partners, in other countries, mainly the United States of America, which the Superintendencia de Industria y Comercio recognizes as providing an adequate level of protection. These are the rules:

Transmissions to processors abroad. They are made under transmission contracts that oblige the processor to process the data only on Weia’s behalf, with security and confidentiality. In those cases the law does not require informing you or asking for your consent; even so, we inform you here.

Transfers to countries with an adequate level of protection. They are made for the purposes of this policy and with the recipients of section 10. The adequate level of the destination country does not replace the authorization or the other duties of this policy.

Transfers to other countries. They are made only in the cases permitted by article 26 of Law 1581 of 2012, for example with your express and unequivocal authorization or with the declaration of conformity of the Superintendencia de Industria y Comercio.

Distributed ledger. The replication of the information of section 9 on servers in different countries is made with your authorization, under that section.

12. Financial, credit, commercial and services information

This section applies when Weia consults or reports information with information operators, under Statutory Law 1266 of 2008 and its amendments, including Law 2157 of 2021 and Statutory Law 2573 of 2026, each from its entry into force.

12.1 Consultation

With your prior and express authorization, Weia may consult your financial, credit, commercial and services information with the information operators it has a contract with. We use it only to analyze or calculate your credit risk, when evaluating your application, setting the terms of the in-kind financing and during the relationship. We do not use it for marketing, employment decisions, collections or other purposes. We keep proof of your authorization.

12.2 Reporting

When Weia acts as a source before an information operator, it will report the creation, modification, fulfillment and non-fulfillment of the monetary obligations arising from the program contracts when your authorization or a legal basis exists, and it will keep the proof. We update the reported information monthly and, when applicable, certify to the operator every six months that we hold the authorizations.

Before a negative report we will send you a prior notice to the last physical or electronic address we have on record, and the report will be made only after twenty (20) calendar days from its sending. If the obligation does not exceed 15% of the current legal monthly minimum wage, we will send you at least two notices, on different days, and wait twenty (20) calendar days from the last one. The notice explains how to pay or dispute the obligation. If the report was made without prior notice and the obligation or installment has already been extinguished, we immediately withdraw the negative report. If it is still pending, we withdraw the report and comply with the notice and its periods before any new report that legally applies. Weia will report negative information no later than eighteen (18) months after the default began.

12.3 Permanence of the information

Negative information remains in the databases for twice the duration of the default, up to a maximum of four (4) years counted from the payment of the overdue installments or the extinction of the obligation, and in any case expires eight (8) years after the obligation went into default. Removing the negative data does not by itself extinguish the obligation.

12.4 Inquiries and claims

If you consider that the information reported by Weia is incorrect or outdated, you can submit an inquiry or a claim to Weia or to the operator, which follow the special procedure of Law 1266 of 2008. Consulting your information is free on every occasion and through every means. Inquiries are answered within ten (10) business days at most. Claims are answered within fifteen (15) business days at most, extendable by eight (8) more business days, and if we do not answer a claim within that period, it is deemed resolved in your favor.

If you submit the claim to Weia, we will notify the operator within the following two (2) business days; if the operator forwards it to us, we will answer the operator within ten (10) business days. If the claim is incomplete, we will ask you to complete it, and if one (1) month passes from that request without your completing it, you are deemed to have withdrawn it.

12.5 Identity theft

If you tell us that you were a victim of identity theft regarding an obligation in your name, we immediately suspend collection, including interest and collection costs, and give you a copy of the documents with which the operation was approved if you ask for them, without requiring a copy of a criminal complaint. Within the legal period of ten (10) business days we compare the supporting documents, make the corrections that are our responsibility, including negative information and affected ratings, and arrange those of the operator, with the legend "Víctima de Falsedad Personal" (victim of identity theft), which is not considered a negative report. We do not require a criminal judgment to start this procedure.

When applicable, we inform you of the twenty (20) business day period to file a criminal complaint, and Weia also files the complaint that corresponds to it within the same period. If we find evidence of identity theft, we apply the exemption from the complaint requirement and the other measures provided by law. We maintain the suspension for the time and under the conditions provided by law; an internal decision does not replace a judicial ruling when one is required. We apply these rules from the publication of this policy, under Statutory Law 2573 of 2026.

13. Contact, notices and collections

13.1 Contact channels

We communicate with you through the channels you authorize among WhatsApp, calls, text messages, email, postal mail and visits, and you can change your choice at any time. Contract notices are sent to the contact details you register, which you must keep up to date.

Email tracking. In the emails Weia’s team sends you, we may use tracking tools. They record whether the email was opened, how many times and the date and time of each opening, and clicks on its links, with their date and time. Depending on the tool, they also record the IP address, browser and operating system of the device used to open the email or click. We use this information to know whether our messages arrive and are read, to follow up on pending conversations in time and, for contract notices, collection notices and notifications, to have additional evidence of their receipt. Opening is detected through an image that your email program downloads when it displays the message, so the record may not be accurate: some programs download images even if the email is not opened, and others block them. We do not use these records in the evaluation described in section 8 or to build profiles, and we do not use the IP address to locate you. We tell you so in the signature or footer of each tracked email. The providers of these tools act as Weia’s processors, and some process the data in other countries under the rules of section 11. We keep these records for the period set in section 16. If you would rather we did not track our emails to you, write to contacto@weia.com.co or use the other channels in section 2.3, and we will turn it off for your address, without affecting your relationship with Weia or the sending of your contract notices. You can also avoid the recording of openings by blocking the automatic download of images in your email program.

13.2 Collections

When we manage collections, directly or through third parties, we apply these rules:

a) We contact you only through the channels you authorized.

b) We contact you only Monday to Friday from 7:00 a.m. to 7:00 p.m. and on Saturdays from 8:00 a.m. to 3:00 p.m., and we do not contact you on Sundays or public holidays.

c) We do not contact you more than once on the same day or through several channels in the same week.

d) We do not contact your personal, commercial or other references, or your relatives. We contact co-debtors and guarantors in that capacity. With the buyer of your harvest we only deal with what corresponds to its role in the purchase agreement and the payment mechanism.

e) We do not make collection visits to your home or workplace, except when the obligation falls within a legal exception, such as that for agricultural or rural development obligations, and you have expressly authorized them for that purpose. We check and document both conditions before the visit.

f) We do not ask you the reason for non-payment. We may discuss with you payment alternatives that fit your financial situation.

Field visits to monitor the crop are part of the performance of the contract, are coordinated with you and are not used to circumvent these rules.

13.3 Commercial messages

We send you commercial messages only if you authorized them as an accessory purpose, through the channels you authorized and at the times allowed by law. For each channel, including email and messaging, we check the applicable exclusions, preferences and authorizations, and we consult the Registro de Números Excluidos (the national do-not-contact registry) when regulation requires it. You can stop receiving them at any time, by a simple means and at no cost: by replying "BAJA" to the message, using the unsubscribe link or writing to contacto@weia.com.co. We apply the opt-out without waiting for the response period of a claim. Operational notices do not include advertising without your authorization.

14. Website, cookies and browser storage

On Weia’s website, the controller of the data is Foodment S.A.S. BIC. The "Privacy and cookies" notice and the contact form show, under the "Controller and rights" option, its identification, address, email, phone number and the data subjects’ rights, and link to this policy. This is how we process data on the site:

Forms. When you write to us through the contact form, we receive the profile you identify with, your name and your email and, if you include them, the company, position, phone and message, together with the language and the site page you write from. We use those data to answer your request. Only if you authorize it separately do we keep with it the source, medium and name of the campaign of the link that brought you, when they correspond to Weia campaigns, to measure which communications generate requests. We keep proof of each authorization: date and time, page, language, the full text you accepted, the version of this policy and a code derived from your email with a secret key, which lets us find that proof after deleting your request. We ask you not to include sensitive data in the message; if you send them and they are not necessary, we remove them from the case and delete them from the copies under our control. We avoid collecting unnecessary personal data in addresses, campaign tags and events.

Analytics, only if you accept. If you accept in the "Privacy and cookies" notice, we use an analytics tool that records the pages and sections you visit and the time on each, clicks and scrolling, the form steps and the profile you choose (but not what you type), the site you came from and campaign tags, the type of device and browser, and your approximate location, such as country, department and city, which the tool estimates from your IP address without storing it. It also recognizes your next visits through a cookie and your browser storage, and records sessions with the form fields and the confirmation message hidden. The tool is provided by a provider acting as Weia’s processor, which processes the data in the United States of America. Before you accept, and after you decline or withdraw your acceptance, the tool does not load and captures nothing.

Your choice. You can accept, decline or withdraw your acceptance whenever you want from "Privacy and cookies", at the foot of each page, and the site works the same. When you decline or withdraw, analytics stops immediately, also in other open tabs, and we delete the tool’s identifiers from your browser. Your choice is valid for twelve (12) months; after that we ask you again, and also if the notice changes. To remember it, we store in your browser the answer, the notice version, the date and a random code, your "preference code", which you can see in "Privacy and cookies". To prove it, we store on our servers the answer, the date and time, the text and version of the notice, the language and that same code, which, if you accept, accompanies the analytics data. You can ask us to delete your earlier analytics records when we can locate them, for example with that code, without our requiring excessive information.

Aggregate count. To know how the site is used without identifying anyone, we add up independent quantities by period. By day we count visits to each page and entries to the site by landing page, by the platform the visitor comes from, from a closed list that includes search engines, social networks, messaging and direct access, and by type of screen (phone, tablet or computer). By month we count entries by country, which our infrastructure provider estimates from the connection as part of delivering the site; the count does not read or store the IP address. When each period closes, we group figures below five (5) into a broader period or category, and we suppress those that remain below five. We only consult the totals of closed periods. We do not keep individual records, sequences, times, campaigns, actions within the pages or form contents. We do not use cookies, fingerprinting or identifiers, we do not read the browser type or other data that would allow you to be recognized, and we do not count unique visitors or repeat visits. We do not relate the totals to one another or to requests, authorizations or security logs, and we do not send individual events to external analytics services. This is separate from the technical processing needed to deliver and protect the site, described later in this section.

Site delivery and security. To deliver the pages and protect the site, our hosting and security providers process technical data of each request, such as the IP address, the browser and the page requested, and keep their own records of requests for a limited time, with data such as the time, the page and the estimated country. If a visit must be verified, the security system may store a technical cookie that remembers that the verification was passed. The form uses its own controls against automated submissions, which run on the site itself and do not use third-party verification services, and we limit the number of form submissions per IP address to prevent abuse. Apart from the analytics you accept and the estimated country used by the aggregate count, we do not use those data or those records to measure the use of the site.

Pixels and third-party content. The site does not use advertising pixels or embedded social media content. If we add them, we will say so in this section and will only activate them if you accept them.

Language. The language is determined by the page address; the site does not store a language preference in your browser.

This is what the site may store in your browser:

On Weia’s platforms, such as the traceability platform, we use technical session and security cookies to keep your session active, and some pages load maps from an external provider, which receives technical data from your browser.

15. Information security

Weia protects personal data with technical, human and administrative measures proportionate to the risk, including:

a) Role-based access restricted to the staff and processors who need it, with confidentiality obligations.

b) Encryption of information in transit and encryption at rest of databases on our providers’ infrastructure.

c) Pseudonymization or encryption of data that require it, such as ID numbers and bank accounts.

d) Separation between what is recorded on distributed ledger technologies and the keys and values that allow it to be read or associated with a person (section 9).

e) Logging of the necessary security and operational events, with restricted access, defined periods and the least amount of data possible; we treat as personal data the identifiers that allow a log entry to be associated with a person. Backups.

f) Contracts with processors that require security, confidentiality and incident notification.

g) A procedure to handle security incidents, which includes informing the Superintendencia de Industria y Comercio when the law requires it and notifying affected data subjects when there is a risk to them.

No security measure is infallible. If you detect a risk, let us know at contacto@weia.com.co.

16. Data retention and term of the databases

We keep personal data for the time that is reasonable and necessary to fulfill the purposes of this policy and the periods set by law. Once that time has passed, we delete or anonymize them. The ten (10) year period applies to the corresponding commercial books and records; other data are kept according to their purpose, without automatically extending that period. The periods include copies in email and other systems. Backups of the website database are replaced within thirty (30) days at most. In other systems, the retention periods and deletion measures corresponding to each class of information apply. Backups remain restricted and, if restored, we reapply deletions. These are the general periods:

Information	Retention period
Contracts, invoices, payments, accounting, collections and other commercial records	Ten (10) years from the last entry, document or receipt, under article 28 of Law 962 of 2005.
Proof of authorizations and notice templates	During the processing. Afterwards, only the minimum evidence needed to address liabilities: two (2) years for website contacts and analytics choices, and the period of the contract file for contractual relationships. Texts and notices are kept at least as long as proofs that refer to them exist.
Identity verification	With the contract file, to handle claims, including identity theft claims.
Background and restrictive-list results	The result and the decision, with the operation file. The full report, only as long as needed to decide and during the relationship.
Biometric data	Weia does not keep them. The provider deletes them when the verification ends, except for a specific legal obligation, and Weia keeps evidence of the deletion.
Information from information operators	As long as needed for the evaluation and the relationship. Reports, for the periods of Law 1266 of 2008.
Messages, voice notes, photos and monitoring reports, including satellite ones	With the contract file they serve as evidence for.
Prospects who do not join	Twenty-four (24) months from their last communication with Weia. Automatic messages or messages sent by Weia do not restart that period.
Evaluation data and model versions	With the contract file. Models, as long as they must remain auditable.
Keys and secret values of distributed ledger records	Ten (10) years from the closing of the contract they correspond to, and then destroyed (section 9.6).
Requests received through the website	Twenty-four (24) months from receipt, including email copies. If a relationship begins, we keep only the necessary information in its file.
Web analytics, if you accept it	Browsing data, up to twenty-four (24) months from capture; when that period ends, we delete them, also in the provider’s systems. Session recordings are configured to expire thirty (30) days after capture; deletion by the provider is not immediate upon expiry and may take a short additional time. Weia checks that deletion takes place and addresses delays, without extending the period during which recordings may be used.
Totals of the website’s aggregate count	They contain no personal data. They are kept as long as they are useful to measure the use of the site.
Recordings, transcripts, summaries and notes of meetings and calls	Up to twenty-four (24) months from the meeting. If they document agreements or facts that serve as evidence of a contract or a claim, the necessary part is kept with the corresponding file and for its period.
Email tracking records	Up to twelve (12) months from when the email was sent. A record that serves as evidence of a notice or notification is kept with the corresponding file and for its period.
Commercial messaging lists	Until you withdraw your authorization. We keep a minimal record so as not to contact you again.
Data for future seasons, if you authorize it	Up to three (3) years from the end of the relationship, or until you withdraw your authorization.
Image, voice, testimonials and artificial intelligence recreations, if you authorize them	While used in communication pieces and until you withdraw your authorization. When you withdraw it, we stop new uses, remove the pieces from the media under our control and arrange their removal with other recipients when applicable.
Impact measurement, if you authorize it	For the duration of the relationship or until you withdraw your authorization. Aggregate results are kept without personal data.
Photos, voice notes and conversations for model training, if you authorize it	Until you withdraw your authorization. For models already trained, we assess whether they retain personal data or allow them to be recovered, apply the measures needed to honor your rights and explain those measures and their limits to you.
Candidates not selected	Until the end of the process, or twelve (12) months if you authorize us to keep your résumé.
Staff	The periods set by labor, social security and occupational health and safety rules.
Shareholders and investors	While they hold that status and ten (10) more years, or the longer period required by the law applicable to each company.

If a legal or contractual obligation requires keeping certain data, we keep only those data, for that purpose and for the necessary period, and delete the rest when appropriate (section 17.6).

Term of the databases. The databases of Foodment S.A.S. BIC and Foodment Inc. will remain in force while each company carries out its corporate purpose, and the data they contain will be kept for the periods in this section.

17. Your rights and how to exercise them

17.1 Your rights

As a data subject, you have the right to:

a) Access, update and correct your personal data, including partial, inaccurate, incomplete, fragmented or misleading data, or data whose processing is prohibited or has not been authorized.

b) Request proof of the authorization you gave, except when the law does not require it.

c) Be informed, upon request, about the use we have made of your data.

d) File complaints with the Superintendencia de Industria y Comercio, once the procedure before Weia has been exhausted.

e) Withdraw your authorization and request the deletion of your data, when there is no legal or contractual duty to keep them.

f) Access your data free of charge, at least once every calendar month and every time this policy changes substantially. Consulting your financial, credit, commercial and services information is free on every occasion and through every means.

g) Refrain from answering questions about sensitive data or about data of children and adolescents.

h) Object at any time to accessory purposes, without losing the service.

i) Receive a clear and understandable explanation of the main reasons for any unfavorable result of the evaluation, including one based on the model or other automated tools, and provide the information you consider useful so that Weia can review it (section 8.2).

17.2 Who can exercise them

They can be exercised by the data subject, proving their identity; their successors, proving that status; their representative or attorney, proving the representation; and the person in whose favor the data subject has made a stipulation. The rights of children and adolescents are exercised by their legal representatives.

17.3 How to submit your request

Write to us through any of the channels of section 2.3 with this information:

a) Your name and the type and number of your ID document, or information that allows you to be identified in our databases.

b) What you are requesting and, if it is a claim, the facts and the documents you wish to rely on.

c) The channel through which you want to receive the answer.

The mechanisms for exercising your rights are free of charge and easy to access. We will not ask for more information than necessary to identify you and answer you, nor for a copy of your ID document when less invasive data suffice. If you act on behalf of another person, prove the representation. If you live outside Colombia, you can use the same channels.

17.4 Inquiries

We answer inquiries within ten (10) business days at most from receipt. If that is not possible, we explain the reason before that period expires and answer within five (5) additional business days at most.

17.5 Claims

If you consider that your data must be corrected, updated or deleted, or that we failed to comply with the law or this policy, you can submit a claim:

a) If the claim is incomplete, we tell you within five (5) days of receiving it so that you can complete it. If two (2) months pass from that notice without your completing it, we consider that you have withdrawn it.

b) Once the claim is complete, within two (2) business days at most we mark your data with the legend "reclamo en trámite" (claim in progress) and the reason, while we resolve it.

c) We answer within fifteen (15) business days at most counted from the day after receiving the complete claim. If that is not possible, we explain the reason before that period expires and answer within eight (8) additional business days at most.

d) If we are not competent to resolve a claim, we forward it to whoever is within the following two (2) business days and inform you.

e) Claims about financial, credit, commercial and services information reported to information operators follow the special procedure of section 12.4.

17.6 Withdrawal and deletion

You can withdraw your authorization or request the deletion of your data at any time. If a legal or contractual obligation requires keeping certain data, for example while obligations under a program contract remain outstanding, we keep only those data, for that purpose and for the necessary period, and delete the rest when appropriate. We explain to you what information we keep, which obligation requires it and for how long. This does not prevent withdrawing authorizations for accessory purposes, which we apply without affecting the service. Deletion regarding the distributed ledger is handled as described in section 9.6.

17.7 Complaint to the Superintendencia de Industria y Comercio

You can file a complaint with the Superintendencia de Industria y Comercio after exhausting the inquiry or claim procedure before Weia.

18. Reorganizations, assignments and changes of control

If Foodment S.A.S. BIC or Foodment Inc. merge, split, transform or change their name, if all or part of their business is sold or assigned, or if their control changes, personal data may pass to the resulting company or the acquirer, which may only process them for the purposes of the policy in force at the time of the change. We will inform you of the change of controller before it is implemented, through the contact details we have. If the new controller wants to use the data for new purposes, it must ask for your authorization.

Assignments, sales, endorsements and pledges of the economic rights under the contracts, which are part of the programs’ ordinary operation, are governed by section 6.2 (purpose 12) and section 10.2. These operations do not by themselves mean that Weia ceases to be the controller of the data it keeps. An assignee or funder that decides on the use of the data it receives acts as controller of that processing and fulfills its own information and protection duties. Delivery is limited to what is necessary and to the purposes authorized or permitted by law.

In the prior evaluation of these operations we share anonymized or pseudonymized information as a general rule, with tiered and logged access, and identified information only when indispensable, under confidentiality agreements and with the obligation to return or destroy it if the operation does not go ahead, except what the law requires to be kept. If the acquirer is outside Colombia, the rules of section 11 also apply.

19. References to this policy, changes and versions

19.1 References in contracts and other documents

Weia’s contracts, annexes, authorizations, privacy notices, forms and other documents that refer to the processing of personal data refer to the Personal Data Processing Policy of Foodment S.A.S. BIC and Foodment Inc. in force, that is, the version published at any given time on Weia’s website, currently weia.com.co/politica-de-datos. That reference covers references to the policy of "Weia", "WËIA", "Foodment" or their brand owners contained in documents signed before this version. This reference makes it possible to locate the version in force: it does not by itself amend contracts or broaden earlier authorizations. If a document sets another rule of incorporation or scope, that rule and the authorization actually given are examined. The update does not authorize new purposes or unnecessary retention periods for older data (section 19.3).

19.2 Changes to this policy

Weia may update this policy to reflect changes in the law, its services or its processes. Substantial changes, such as those concerning the identity of the controller or the purposes, will be communicated through the contact channels we have and on the website before they are applied. When a change involves a new purpose, Weia will ask for the authorization the law requires before using the data for that purpose.

19.3 Data collected before this version

Data collected under authorizations prior to this version are used only for the purposes informed when they were collected. For this version’s new purposes, Weia will ask for a new authorization before using them. The other rules of this policy, such as those on rights, security and retention, apply to all data from its entry into force. Before continuing to use historical information we check its legal basis; when there is no demonstrable authorization or other legal basis, we stop using it and resolve its regularization or deletion, without presuming consent from the publication of this version. Earlier versions of this policy are kept in our records and provided to anyone who asks for them through the channels of section 2.3, so that you can know the rules informed at each time.

19.4 Version history

These are the versions of this policy:

20. Entry into force

This version is published on 26 October 2026 and applies from that date to data collected from then on. For data collected earlier, it takes effect on 25 November 2026, after being communicated to data subjects through the contact channels we have. It replaces the policy in force since 1 April 2022. It is available at weia.com.co/politica-de-datos, in English at weia.com.co/en/privacy-policy, and can be requested through the channels of section 2.3. This English version is a translation; in case of any difference, the Spanish version prevails.

Jairo Andrés Burgos Guerra

Legal representative of Foodment S.A.S. BIC and Chief Executive Officer of Foodment Inc.