PERSONAL DATA PROCESSING POLICY

1. ABOUT US

UNIBELL S.A.C. is a Peruvian company identified with Taxpayer ID No. 20511451354, engaged in the manufacture and marketing of articles for personal care and hygiene, owner of trademarks recognized in the national and international market.

Our address is Jirón General Felipe Varela No. 352, district of Breña, province and department of Lima.

2. PRIVACY POLICY

This document regulates the Privacy Policy of our company, which we recommend you read in full.

This policy applies to information collected in person and through our websites (https://www.estilos.pe/, http://www.kareol.com.pe/, http://www.lanosterin.com.pe/, https://sumaqperu.pe/, https://www.unibell.com.pe/), as well as any of its subdomains and corresponding social media.

UNIBELL is concerned about the protection and privacy of the personal data of its users, therefore UNIBELL uses all the tools at its disposal to guarantee confidentiality and security that any information collected will be used solely and exclusively for the purposes contained herein and in accordance with the current legal framework.

UNIBELL represents that it does not transfer databases to third parties that are not related to the company.

3. APPLICABLE LEGAL FRAMEWORK

a. Political Constitution of Peru. b. Law 29733 – Law on Protection of Personal Data. c. Supreme Decree No. 003-2013-JUS, Regulation of Law on Protection of Personal Data. d. Information Security Directive, approved by Directorial Resolution No. 019-2013-JUS/DGPDP. e. Directive for the Processing of Personal Data through Video Surveillance Systems, approved by Directorial Resolution No. 02-2020-JUS/ DGTAIPD. f. Directives, Directorial Resolutions and other provisions issued by the General Directorate of Protection of Personal Data of the Ministry of Justice and Human Rights.

4. DEFINITIONS

a. Personal Database. Organized set of personal information, whether automated or not, regardless of the support, whether physical, magnetic, digital, optical or other, that is created, whatever the form or modality of its creation, formation, storage, organization and access. b. Personal Data. Any information about an individual that identifies them or makes them identifiable through means that can be reasonably used. c. Sensitive Data. Personal data consisting of biometric data that by itself can identify the holder; data referring to racial and ethnic origin; economic income; political, religious, philosophical or moral opinions or convictions; union membership; and information related to health or sex life. d. Cross-border Flow of Personal Data. International transfer of personal data to a recipient located in a country other than the country of origin of the personal data, regardless of the support in which they are located, the means by which the transfer was made or the processing they receive. e. Sufficient Level of Protection for Personal Data. Level of protection that covers at least the recording and respect of the guiding principles of the Law, as well as technical security and confidentiality measures appropriate, according to the data category in question. f. Holder of Personal Data. Individual to whom the personal data corresponds. g. Holder of Personal Database. UNIBELL. h. T ransfer of Personal Data. Any transmission, supply or disclosure of personal data, whether of national or international nature, to a private legal entity, to a public entity or to an individual other than the holder of personal data. i. Personal Data Processing. Any operation or technical procedure, automated or not, that allows the collection, registration, organization, storage, conservation, processing, modification, extraction, consultation, use, blocking, deletion, communication by transfer or dissemination or any other form of processing that facilitates access, correlation or interconnection of personal data. j. Clients. Individual or legal person to whom UNIBELL sells goods or provides services by virtue of a pre-existing business relationship. k. Suppliers . Individual or legal person supplying goods and/or providing services to UNIBELL by virtue of a pre-existing business relationship. l. Employee. Individual who provides or provided personal services to UNIBELL under an employment contract. m. Visitor. Any individual who is on the premises of UNIBELL offices and who does not have the quality of an employee. n. Applicants. Individuals who, due to work interests, apply to personnel selection processes called by UNIBELL and send information in order to carry out with the respective personnel recruitment processes. o. Holder. Individual whose personal data is subject to processing. p. Responsible for the Treatment. Who, due to his legal status, decides on the processing of personal data. q. User. UNIBELL employee who has access to databases.

5. PERSONAL DATA PROCESSING PURPOSE

a. CLIENTS Database

Processing Purpose

UNIBELL may carry out the Personal Data Processing of Clients for the fulfillment of its corporate purpose. For this reason, the contracts entered into with Clients will be governed by the provisions of this Policy, or will include a clause that regulates the processing of the data accessed thereof.

Likewise, UNIBELL may carry out the Personal Data Processing of its potential, current or future Clients and of those with whom it has ended its business relationship, in order to send them commercial information that in its opinion may be of interest to them; as well as, among others, invite them to events organized by UNIBELL; send newsletters, reports or publications and in general, use the data for the development of activities included in the corporate purpose of UNIBELL.

Also, while carrying out events, training or other activities organized by UNIBELL, it may record audios, videos or take photos of Clients participating in such events. These audios, videos or photos may be used by UNIBELL in newsletters, publications, and in general in any activity carried out by UNIBELL.

Storage duration

UNIBELL will keep your data for the duration of the activity for which it was collected, after which it will be saved until consent is revoked. Subsequent processing for historical, statistical or scientific purposes shall not be considered incompatible.

Register

In this sense, the Personal Data of Clients to which UNIBELL has access as a result of the services provided or by filling in different forms, will be incorporated into the corresponding Personal Database labeled as “CLIENTS”, forming the organized set of Personal Data of Clients, created by UNIBELL and registered in the National Registry of Personal Data Protection with code RNPDP-PJP No. 19961.

b. EMPLOYEES Database

Processing Purpose

UNIBELL will carry out the Personal Data Processing of Employees and their family unit in order to comply with the obligations arising from the respective labor relations. Such obligations include, but are not limited to, payroll payments, award of benefits, performance evaluations, improvement of training programs, among others.

Storage duration

Likewise, UNIBELL will have a file in which the Personal Data of all employees who have terminated their employment with UNIBELL will be saved for up to 5 years. The purpose of this file is: (i) To issue labor certificates or any other document referring to the employment relationship in accordance with current labor regulations, at the request of the former employee or his successors in title; (ii) To give personal references to potential employers of former employee, when authorized by it upon termination of relationship with UNIBELL; and/or iii) The information saved in this file may be studied, analyzed and used by UNIBELL in order to consider the former employee in personnel recruitment processes carried out by UNIBELL.

Register

In this sense, the Personal Data of Employees to which UNIBELL has access as a result of an employment relationship, will be incorporated into the corresponding Personal Database labeled as “EMPLOYEES”, forming the organized set of Personal Data of Employees, created by UNIBELL and registered in the National Registry of Protection of Personal Data, with code RNPDP-PJP No. 18457.

c. APPLICANTS Database

Processing Purpose

UNIBELL may process the Personal Data Processing of Applicants submitted for personnel selection processes published by the company in order to participate in such recruitment processes. UNIBELL may store this information for a maximum of 30 days.

On the other hand, while carrying out events, training or other activities organized by UNIBELL, it may record audios, videos or take photos of Applicants participating in such events. These audios, videos or photos may be used by UNIBELL in newsletters, publications, subject to the express agreement of the Applicant.

Register

In this sense, the Personal Data of Applicants to which UNIBELL has access as a result of applying for a job in the company, will be incorporated into the corresponding Personal Database labeled as “PERSONNEL RECRUITMENT”, forming the organized set of Personal Data of Applicants, created by UNIBELL and registered in the National Registry of Personal Data Protection, with code RNPDP-PJP No. 19151.

d. SUPPLIERS Database

Processing Purpose

UNIBELL will carry out the Personal Data Processing of Suppliers in order to comply with the obligations acquired by virtue of the respective relationship.

Regarding Suppliers, such obligations include, among others, evaluating their performance; establishing, managing or terminating commercial relationships or verifying references; providing business metrics, and others established in the agreements or contracts entered into with the respective Supplier.

Storage duration

The processing of the data collected under the provisions of this section will be carried out and will be in force as long as the purpose for which the respective data was collected is maintained.

Register

In this sense, the Personal Data of Suppliers to which UNIBELL has access as a result of the obligations acquired, will be incorporated into the corresponding Personal Database labeled as “SUPPLIERS”, forming the organized set of Personal Data of Suppliers, created by UNIBELL and registered in the National Registry of Protection of Personal Data with code RNPDP-PJPNo. 19962.

e. CLAIMS AND COMPLAINTS Database

Processing Purpose

UNIBELL will carry out the Personal Data Processing of Holders in order to address any claim they may submit through this means, in accordance with the legislation on consumer rights, and will remain in force during the period indicated by the rules on the matter.

Register

In this sense, the Personal Data that UNIBELL has access to as a result of claims, will be incorporated into the corresponding Personal Database labeled as “CLAIMS AND COMPLAINTS”, forming the organized set of Personal Data of those filing claims and complaints in the Complaints Book, created by UNIBELL and registered in the National Registry of Protection of Personal Data, with code RNPDP-PJP No. 19150.

f. VIDEO SURVEILLANCE Database

Processing Purpose

UNIBELL will carry out the Personal Data Processing of Holders in order to safeguard the security inside and outside their offices. In outdoor spaces, video surveillance will be carried out within reasonable areas and without violating the right to privacy of the neighbors. UNIBELL may record audios, videos or take photos of Holders who have entered their offices through the closed security circuit and other means implemented for the purposes thereof, as well as to verify compliance by employees with their work obligations and duties.

Such data may be obtained during entry, stay and exit of various spaces and environments of UNIBELL offices.

Storage duration

The processing of the data collected under the provisions of this section will be carried out and will be valid for a period of 7 days or, in exceptional cases, while maintaining the purpose for which the respective data was collected or the defined retention time of video surveillance tapes in UNIBELL internal policies or by legal mandate.

Register

In this sense, the Personal Data of the persons that are in the facilities of UNIBELL, will be incorporated into the corresponding Personal Database labeled as “VIDEO SURVEILLANCE”, registered in the National Registry of Protection of Personal Data with code RNPDP-PJPNo. 21200.

g. VISITORS Database

Processing Purpose

UNIBELL will carry out the Personal Data Processing of Visitors in order to safeguard the security within UNIBELL offices, with the sole purpose of knowing the identity of third parties who enter their facilities.

Storage duration

This information will be saved for a period of 30 days.

Register

In this sense, the Personal Data of Visitors to which UNIBELL has access for security purposes during their entrance to the company, will be incorporated into the corresponding Personal Database labeled as “VISITORS”, forming the organized set of Personal Data of Visitors, created by UNIBELL and registered in the National Registry of Protection of Personal Data with code RNPDP-PJP No. 19149.

h. WEBSITE USERS Database

Processing Purpose

UNIBELL may use the data of its website users to process orders, deliver products and services, process payments, maintain and update files and their accounts with the company, make content available such as wish lists, shopping cart and customer comments, product recommendations, manage orders.

Storage duration

The Personal Data will be deleted when it is no longer needed for the purposes for which it was collected. However, it will be saved for as long as UNIBELL may be held liable for this relationship with its users. Subsequent processing for historical, statistical or scientific purposes shall not be considered incompatible.

Register

In this sense, the Personal Data to which UNIBELL has access as a result of filling in different forms on its website, will be incorporated into the corresponding Personal Database labeled as “WEBSITE USERS”, forming the organized set of Personal Data of Website Users, created by UNIBELL and registered in the National Registry of Personal Data Protection with code RNPDP-PJP No. 20176.

6. PROCEDURE FOR EXERCISING THE ARCO RIGHTS (HOLDER’S RIGHTS)

Holders have the rights of information, access, rectification, cancellation, objection and objective processing of Personal Data, which can only be exercised by the holder of Personal Data, notwithstanding the rules governing representation.

Right of Information, The Holder of Personal Data has the right to be informed in a detailed, simple, express, unequivocal manner and prior to its collection, about the purpose for which their Personal Data will be processed; who are or may be the recipients, the database in which Personal Data will be stored, as well as the identity and address of the owner and, if applicable, of the person or persons in charge of processing their Personal Data; the mandatory or optional nature of their answers to the questionnaire proposed to them, especially regarding sensitive data; the transfer of Personal Data; the consequences of providing their Personal Data and their refusal to do so; the duration during which their Personal Data is saved; and the possibility of exercising the rights granted by law and the means provided thereof.

Right of Access, El The Holder of Personal Data has the right to obtain the information subject to processing in databases of public or private administration, the way in which their data is collected, the reasons behind the collection and at the request of whom the collection was carried out, as well as the transfers made or planned to be carried out.

Right to Update, Inclusion, Rectification and Deletion, The Holder of Personal Data has the right to update, inclusion, rectification and deletion of their Personal Data subject to processing when they are partially or totally inaccurate, incomplete; when omissions, errors or falsehood are noticed; when it is no longer necessary or relevant to the purpose for which it was collected or when the period established for its processing has expired.

Right to Prevent the Provision , The Holder of Personal Data has the right to prevent the provision of such data, especially when this affects its fundamental rights. The right to prevent the provision does not apply to the relationship between Holder of the Personal Database and the person in charge of processing Personal Data for the purposes of processing them.

Right of Objection , Provided that, by law, it is not otherwise provided and when it has not given consent, the Holder of Personal Data may refuse its processing when there are well-founded and legitimate reasons relating to a specific personal situation. In case of justified refusal, the Holder or the person in charge of processing Personal Data, as appropriate, must proceed with its deletion, in accordance with the law.

Procedure To exercise the ARCO Rights, you must send the requeste download here to the aforementioned address of UNIBELL or send an email to arco@unibell.com.pe, with the following content:

a. Full name of the person exercising the right and of the legal representative, if applicable; include the respective identity document where appropriate. b. Specific request: The nature of the request must be indicated clearly and in detail. c. Address or electronic address for notifications purposes. d. Date and signature of person exercising the right. e. Documents supporting the request, if applicable.

We will respond to your request within the maximum period established by law for each type of request, unless more information is required to adequately respond.

7. CONFIDENTIALITY AND PROTECTION OF INFORMATION

We are committed to keeping Personal Data and your background information confidential.

For the purposes of Personal Data Processing, we represent to have reasonable policies that involve technical, organizational and legal measures that guarantee its security and prevent its alteration, loss, treatment or unauthorized access.

8. PERSONAL DATA PROCESSING OF MINORS

UNIBELL collects and uses the Personal Data of a minor only if and to the extent that prior consent is given by the holder of parental responsibility over the minor. If any minor enters his Personal Data through our website, the existence of the authorization by the holder of parental responsibility will be presumed, and such holder will be considered responsible for all acts carried out by the minor in his care.

9. INTERNATIONAL TRANSFER OF PERSONAL DATA

UNIBELL uses third-party servers for the “WEBSITE USERS” database storage, so cross-border flow will be carried out with Casa Mayor y Mirallles LDTA., a company providing web hosting services, located in the city of Santiago, Chile.

We undertake not to carry out cross-border flows of Personal Data to countries that do not have adequate levels of protection in accordance with current legislation.

10. USE OF COOKIES

Our website uses cookies, which are small files stored on computers that allow us to remember your navigation characteristics or preferences while using our websites and subdomains. Thanks to this tool we can personalize your future visits to our websites, making your browsing experience safer as well as offer you information of interest.

You can configure your browser to accept or deny the installation of cookies or delete them once you have finished browsing our website. UNIBELL is not responsible if by disabling the cookies the proper functioning of our websites is prevented.

11. CHANGES TO OUR POLICY

UNIBELL reserves the right to modify this Personal Data Processing Policy without prior notice and without the need to communicate the changes, assuming our commitment to publish it on our websites and social media.