Personal Data Treatment and Privacy Policy

PERSONAL DATA PROCESSING AND PRIVACY POLICY

1. INTRODUCTION

Loft Me, a company identified with NIT 1039464048, hereinafter Loft Me, is committed to the protection of privacy and all information that may be associated or related to natural persons (the "Personal Data"), to which it has access in the development of its activities and functions. Loft Me receives, collects, uses, manages, analyzes, segments, transmits, transfers, stores, and, in general, processes Personal Data that may be obtained in the course and for the development of its activities and functions.

Your Personal Data is very important to us and will be processed based on the principles established by Law 1581 of 2012 and other concordant regulations, and will be used only for the purposes indicated in this Policy.

2. DATA CONTROLLER

Loft Me, as the Data Controller, hereby informs you of its identification details through this Policy:

NIT: 1039464048
Main Address: Calle 72 sur # 34-61

3. PURPOSE

This Loft Me Personal Data Processing and Privacy Policy (the "Policy") aims to clearly and precisely describe the guidelines, principles, and procedures to protect the rights of Data Subjects and ensure compliance with the General Personal Data Protection Regime of Colombia; describe the purposes and types of Processing (as defined below) to which Personal Data will be subjected; and, finally, identify the area that will handle inquiries, questions, claims, and complaints.

4. SCOPE OF APPLICATION

The Policy is addressed to employees, former employees, visitors, clients and prospects, suppliers, contractors, active and inactive creditors, commercial partners of Loft Me, and any other third party who is in any way related to or involved in a procedure with Loft Me in the development of its corporate purpose, whether in person, by phone, or in writing and, in general, to any person whose Personal Data is being or will be processed by Loft Me (the "Data Subjects").

This Policy will apply to all Processing carried out within the territory of the Republic of Colombia by Loft Me and, where appropriate, with those third parties with whom Loft Me agrees to carry out all or part of any activity related to the Processing of Personal Data for which Loft Me acts as Controller (as defined below).

The Policy will apply to third parties with whom Loft Me may eventually enter into Transmission contracts, so that such third parties are aware of the obligations that will apply to them, the purposes to which they must submit, and the security and confidentiality standards they must adopt when carrying out the Processing on behalf of Loft Me.

5. APPLICABLE REGULATIONS

This Policy has been drafted in accordance with the General Personal Data Protection Regime applicable in Colombia, especially articles 15 and 20 of the Political Constitution of Colombia; Law 1581 of 2012, regulatory Decrees 1377 of 2013 and 1074 of 2015, and other norms that modify, add, complement, or develop it.

6. DEFINITIONS

Expressions in parentheses, underlined, and capitalized in this Policy will have the meaning attributed to them before the parentheses. Undefined terms will have the meaning attributed to them by law or applicable jurisprudence in Colombia. Notwithstanding the foregoing, the most relevant terms of this Policy are defined below:

Authorization: Prior, express, and informed consent of the Data Subject to carry out the Processing of personal data.
Authorized Person: This refers to Loft Me and all persons under Loft Me's responsibility who, by virtue of the Authorization and this Policy, are legitimate to carry out the Processing.
Privacy Notice: Verbal or written communication generated by the Controller (Loft Me being the controller) addressed to the Data Subject for the Processing of their personal data, by which they are informed about the existence of the information Processing policies that will apply to them, how to access them, and the purposes of the Processing intended for the personal data.
Database: An organized set of personal data, whether electronic or not, subject to Processing, regardless of the method of its formation, storage, organization, and access. Loft Me will keep separate the Databases in which it acts as Processor from those in which it acts as Controller.
Biometric Data: These are physical, biological, or behavioral traits of an individual that identify them as unique from the rest of the population, such as fingerprints, DNA analysis, video images.
Personal Data: Any information linked or that can be associated with one or more specific or identifiable natural persons, such as identification data (name, ID, age, gender), contact data (phone, email, address), information about profession or occupation, among other data.
Private Data: Private data is data that, due to its intimate or reserved nature, is only relevant to the data subject.
Public Data: Public data includes, among others, data relating to the civil status of individuals, their profession or occupation, and their status as a merchant or public servant. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial sentences that are not subject to reservation.
Semi-private Data: Semi-private data is data that is not intimate, reserved, or public, and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector of people or to society in general, such as financial and credit data.
Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use may generate discrimination, such as those revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or those promoting the interests of any political party or guaranteeing the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
Data Processor: Natural or legal person, public or private, who, alone or in association with others, performs the Processing of personal data on behalf of the Data Controller.
Legitimate Person: These are the individuals who can exercise the rights of the Data Subject, such as the Data Subject themselves, their heirs, representatives, proxies, and those who, by stipulation in favor of another or for another, are accredited, provided they can prove their status.
Processing Policy: Refers to this document, as the personal data processing policy applied by Loft Me in accordance with the guidelines of current legislation on the matter.
Third Parties: Any natural or legal person with whom the Company has had, has, or may have commercial, labor, contractual, legal, or any other kind of ties, such as employees, former employees, visitors, clients and prospects, suppliers, contractors, active and inactive creditors, and commercial partners.
Data Controller: Natural or legal person, public or private, who, alone or in association with others, decides on the database and/or the Processing of Data. For the purposes of this document, Loft Me will be the Data Controller.
Processing: Any systematic, electronic or non-electronic operation or procedure, including through tools such as cookies, that allows the collection, retention, ordering, storage, modification, indexing, profiling, linking, use, circulation, analysis, segmentation, compilation, evaluation, blocking, destruction and, in general, the processing of Personal Data, as well as its delivery to third parties through communications, inquiries, interconnections, assignments, data messages and other means that serve the purpose.
Transfer: Processing that involves sending information or Personal Data to a recipient, who is a Controller and may be outside or within the territory of the Republic of Colombia. In a Transfer, the recipient will act as a Controller and will not be subject to the terms and conditions of this Policy.
Transmission: Processing that involves the communication of Personal Data within or outside the territory of the Republic of Colombia for the Processor to carry out the Processing of such Personal Data on behalf of the Controller. In a Transmission, the recipient will act as a Processor and will be subject to the Policy or the terms established in the corresponding Transmission contract.
Data Subject: The natural person to whom the Personal Data refers, whose information may be held in a Database and who is the subject of the habeas data right.

7. AUTHORIZATION

All processing of personal data that is not public must be preceded by obtaining Authorization. To this end, Loft Me, its employees, and authorized persons, prior to the collection of Personal Data, will obtain the Authorization signed by the Data Subject and will retain a copy of this document for future reference. Loft Me, in its capacity as Controller, has implemented the necessary mechanisms to obtain the Data Subjects' Authorization, ensuring in all cases that it is possible to verify the granting of said Authorization.

The Authorization may be recorded in a physical document, electronically, voice recording, or any other format that guarantees its subsequent consultation, or through an appropriate technical or technological mechanism by which it can be unequivocally concluded that, had the Data Subject not taken an action, the Personal Data would never have been captured and stored in the Database.

The Data Subject's authorization will not be necessary in the following cases:

Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
Public data.
Cases of medical or health emergency.
Processing of information authorized by law for historical, statistical, or scientific purposes.
Data related to the Civil Registry of Persons.

8. MEANS OF AUTHORIZATION AND COLLECTION

Loft Me may obtain Authorization for the Processing of Personal Data through different means:

Electronic: Loft Me may use technological means, such as data messages, internet, website, official chat on its website and on the official social media accounts of the brands it markets, mobile applications, Google forms or similar, and WhatsApp.
Written: Loft Me may request the Data Subject's physical, in-person signature for Authorization for the Processing of their Personal Data through its Sales Points and at events and/or forums it organizes.
Verbal: Loft Me may request the Data Subject to grant their Authorization verbally and audibly through its contact center.
Unequivocal Conduct: Loft Me may obtain Authorization through unequivocal conduct, through which it can be concluded without a doubt that, had the same not occurred on the part of the Data Subject or the person legitimate to do so, the Authorization would not be given.

9. DATA SUBJECT TO PROCESSING

To carry out the purposes described in this Policy, Loft Me will process the following personal data:

10.1. Employees/Candidates/Interns/Former Employees

Contact data
Identification data
Demographic data (age, gender, place of residence, interests, occupation, income, and similar)
Financial data
Biometric data
Medical data
Data necessary for compliance with legal obligations
Sensitive data
Socioeconomic content data

10.2. Suppliers/Contractors

Contact data
Identification data
Data related to profession or occupation

10.3. Clients/Prospects

Contact data
Identification data
Demographic data (age, gender, place of residence, and interests)
Financial data
Data related to profession or occupation
Sensitive data

10.4. Visitors

Contact data
Identification data

10.5. Business Partners

Contact data
Identification data
Financial data
Data related to profession or occupation

Loft Me may also collect Personal Data that it deems relevant for the purposes for which they are authorized by the Data Subject (which are described below).

10. PURPOSES

Loft Me, in the course of its commercial activities, will process Personal Data. The Personal Data processed by Loft Me shall be subject only to the purposes indicated below and/or those accepted by the Data Subjects at the time of collection of the Personal Data. Likewise, the Processors or third parties who have access to the Personal Data by virtue of law, contract, or other binding document, will carry out the Processing for the achievement of the following purposes:

11.1. Employees/Candidates/Interns/Former Employees

Delivery to the Data Subject of information of interest to them, including: pay stubs, statements, liquidations, among others.
Conducting surveys of any kind.
Invitation to corporate events of Loft Me, its partners and investors.
Invitation to selection processes carried out by Loft Me.
Entry evaluation and the candidate's hiring process, including: private investigations of individuals, in order to complete the candidate security process and medical information regarding the entry examination.
Management of existing labor relations, as well as the development of the different activities established by Loft Me.
In the case of former employees, Loft Me will store, even after the termination of the employment contract, the necessary information to comply with the obligations that may arise from the existing labor relationship in accordance with Colombian law.
Provide labor certificates requested by the former employee or by third parties with whom the former employee is undergoing a selection process.
Maintain the security of Loft Me's buildings and facilities.
Carry out internal disciplinary processes and investigations.
Monitor the use of work tools provided by Loft Me.
Process your personal data for the fulfillment of legal and contractual obligations.
Management of cultural activities.
Conducting sociological and opinion surveys.
Granting and management of permits, licenses, and authorizations.
Reservations and issuance of transportation and/or lodging tickets.
Legal proceedings.
Carry out activities typical of the human resources department, which include: personal training activities; payroll management; personnel management; compliance with social benefits; prevention of occupational risks; job promotion and management; personnel promotion and selection.
Fulfill the obligations contracted by Loft Me regarding the payment of salaries, social benefits and other remunerations established in the employment contract or as required by law.
To comply with applicable anti-money laundering regulations.
Offer corporate wellness programs and plan business activities for the Data Subject and their beneficiaries (parents, children, spouse, permanent partner).
Provide information to third parties with whom Loft Me has a contractual relationship and to whom it is necessary to provide it for the fulfillment of the contracted purpose.
Epidemiological research and similar activities.
Knowledge about the mental health of employees.

11.2. Suppliers/Contractors

Fulfillment of Loft Me's legal or contractual obligations with third parties.
Confirm and update information and identity, and that of their legal representative, as applicable.
Provision of services to Loft Me.
Compliance with Loft Me's internal policies.
Verification of compliance with obligations.
Offering and promoting new and existing products.
Manage and consolidate supplier and contractor records.
Conduct data update campaigns.
Conduct security studies.
Prevention of fraud, money laundering, and terrorism financing.
Carry out and organize promotional activities.
Administration of its information and communication systems.
Reporting information to competent authorities.
Consolidation and updating of databases.

11.3. Visitors

Confirm and update identity and contact information.
Maintain the security of Loft Me's premises and facilities.

11.4. Clients/Prospects

Establish and manage a contractual relationship.
Verify their identity and update their personal data.
Process and manage their petitions, complaints, claims, and requests in a timely manner through the different service channels related to Loft Me's products and/or services and/or those of its business partners.
Contact them for commercial, marketing, and contractual relationship management purposes, through any means, including data messages, social media, and WhatsApp.
Contact them via telephone for surveys, studies, and/or confirmation of personal data necessary for the execution of a contractual relationship, for sending invoices, news related to loyalty campaigns, and service improvements.
Invitations to commercial, marketing, and after-sales events, and offering new products and services.
Share them with third parties (agencies) to carry out commercial prospecting campaigns.
Provide contact information to the sales force and/or distribution network, telemarketing, market research, and any third party with whom Loft Me has a contractual link for the development of such activities (market research and telemarketing, etc.) for their execution.
Conduct satisfaction and quality surveys regarding the goods and services offered by Loft Me and/or its business partners.
Develop statistical analyses.
Manage applications and social networks.
Monitor the provision of services and products marketed by Loft Me and/or its business partners.
Verify and manage compliance with legal and contractual obligations, including fraud and money laundering control and prevention.
Validate credit information in risk bureaus and/or make reports to these bureaus when necessary.
Perform portfolio collection.
Notify about the status of credit applications with financial entities with which Loft Me has a current agreement, for the acquisition of Loft Me goods and services.
For after-sales activities, including the provision of after-sales or warranty services on Loft Me's products and/or services and/or those of its business partners.
The consolidation and updating of databases.
Conduct data update campaigns.
Transmit personal data outside the country to third parties with whom Loft Me has signed a data processing agreement and to whom it is necessary to provide it for the fulfillment of the contractual purpose.
Conduct security campaigns.
Notify changes in Loft Me's policies.

11.5. Business Partners

Establish and manage a contractual relationship.
Confirm and update information and identity, and that of their legal representative, as applicable.
Verify and manage compliance with legal and contractual obligations, including fraud and money laundering control and prevention.
Validate credit information in risk bureaus and/or make reports to these bureaus when necessary.
Monitor compliance with contractual obligations.
Monitor the management of authorized distribution and sales centers that are not part of Loft Me's own network.
Monitor quotes, sales, and delivery of Loft Me's products and/or services by business partners.
Monitor and verify the provision of after-sales services carried out by business partners on Loft Me's products and/or services.
Send updated information useful for the development of the contractual relationship, including institutional, administrative, advertising, and marketing information, on the technical characteristics of Loft Me's products and/or services and of interest to the sector.
Train and qualify business partners in important matters for the proper development of the contractual relationship.
Notify about the status of credit applications with financial entities with which Loft Me has a current agreement, for the acquisition of Loft Me goods and services.
The consolidation and updating of databases.

Likewise, the information may be provided to authorities or public entities when there are legal, contractual, or consensual provisions that require it.

11. SHARING INFORMATION WITH THIRD PARTIES

Loft Me may share information with third parties in the following cases:

To authorities that require it under applicable legislation.
To authorities that request it as part of a judicial or administrative process where disclosure of information is necessary.
To tools contracted by Loft Me for communication and marketing with its consumers and to carry out outsourcing services.
To Loft Me's commercial, service, and/or financial partners.
Other cases provided by law.

12. RIGHTS OF DATA SUBJECTS

Data Subjects may exercise a series of rights in relation to the Processing of their Personal Data. These rights may also be exercised by the following persons:

By the Data Subject's successors, who must prove such status.
By the Data Subject's representative and/or attorney, after proving representation or power of attorney.
By stipulation for another and for another.

The rights of children and adolescents shall be exercised by the persons authorized to represent them.

In accordance with the law, Data Subjects have the following rights:

Right	Description
Update	Update the Personal Data held in Loft Me's Databases to maintain its integrity and veracity.
Knowledge and Access	Know and access their Personal Data stored by Loft Me or the Processors. This access will be allowed free of charge upon request at least once a month.
Proof	Request proof of the Authorization granted to Loft Me, unless the law indicates that such Authorization is not necessary or that it has been validated in accordance with the provisions of Article 10 of Decree 1377 (Article 2.2.2.25.2.7 of Decree 1074 of 2015).
Complaint	File complaints before the Superintendency of Industry and Commerce for violations of the law when the requirement of admissibility has been exhausted and first address Loft Me.
Rectification	Rectify information and Personal Data under Loft Me's control.
Revocation	Request the revocation of the Authorization, provided there is no legal duty or contractual obligation on the part of the Data Subject with Loft Me, according to which the Data Subject does not have the right to request the deletion of their Personal Data.
Request	Submit requests to Loft Me or the Processor regarding the use given to their Personal Data.
Deletion	Request the deletion of their Personal Data from Loft Me's Databases, provided there is no legal duty or contractual obligation on the part of the Data Subject with Loft Me, according to which the Data Subject does not have the right to request the deletion of their Personal Data.

13. LOFT ME'S DUTIES

Loft Me, in the Processing of Personal Data, shall comply with the following duties, without prejudice to those provided in the provisions governing the matter:

Request and keep proof of the authorization granted by the Data Subject for the processing of personal data.
Duly inform the Data Subject about the purpose of the collection and the rights they have by virtue of the authorization granted.
Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
Guarantee that the information is truthful, complete, updated, verifiable, and understandable.
Update the information in a timely manner, thus addressing all developments regarding the Data Subject's data.
Rectify the information when it is incorrect and communicate what is relevant.
Respect the security and privacy conditions of the Data Subject's information.
Process inquiries and claims formulated in the terms indicated by law.
Identify when certain information is being disputed by the Data Subject.
Inform the Data Subject, upon request, about the use given to their data.
Comply with the requirements and instructions issued by the Superintendency of Industry and Commerce on the particular subject.
Only use data whose processing is previously authorized in accordance with the provisions of Law 1581 of 2012.
Ensure the proper use of the personal data of children and adolescents.
Refrain from circulating information that is being challenged by the Data Subject and whose blocking has been ordered by the Superintendency of Industry and Commerce.
Allow access to information only to those persons who may have access to it.
Use the Data Subject's personal data only for those purposes for which it is duly authorized, always respecting current regulations on personal data protection.
Inform the Superintendency of Industry and Commerce of any violations of security measures and/or the existence of risks in the administration of Data Subjects' information.

14. CONFIDENTIALITY AND SECURITY MEASURES

The confidentiality and protection of Personal Data is a priority for Loft Me, which is why the company has established and will maintain administrative, technical, and physical security measures to prevent damage, loss, alteration, destruction, as well as improper use, access, or disclosure.

Additionally, and in compliance with the principle of security established in the law, Loft Me has adopted and will adopt the technical, technological, human, and administrative measures that are appropriate to ensure the security of records, safeguarding their confidentiality, integrity, and availability.

15. POLICIES AND PROCEDURE FOR CLAIMS

15.1. Area Responsible for Handling Inquiries, Claims, and Requests: Loft Me's Customer Service area is responsible for receiving inquiries, claims, and requests from the Data Subject of Personal Data related to their rights to know, update, rectify, and delete Personal Data and revoke authorization. Likewise, it will ensure the timely and appropriate response issued by each of Loft Me's areas to the requests, inquiries, and claims of the Data Subjects.

Inquiries: Loft Me will receive and resolve inquiries from the Data Subject or Legitimate Parties regarding:

What Personal Data of the Data Subject is held in Loft Me's Databases?
What Processing is the Personal Data subject to?
What are the purposes intended to be satisfied?

Such inquiries must be sent in writing to the following email address: loftmedesign@gmail.com. Loft Me will keep proof of the inquiry and its response. The inquiry will be answered within a maximum period of ten (10) business days from the date of receipt. When it is not possible to answer the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the initial term.

Claims: Loft Me will receive and resolve claims filed by the Data Subject or the Legitimate Parties regarding:

Personal Data processed by Loft Me that must be corrected, updated, or deleted.
The alleged non-compliance with any of Loft Me's obligations according to the law.

Such claims must be sent in writing to the following email address: loftmedesign@gmail.com. If the claim is incomplete, the interested party will be required within five (5) business days following receipt of the claim to correct the deficiencies. After two (2) months from the date of the requirement, if the applicant does not submit the required information, it will be understood that they have withdrawn the claim. Loft Me will keep proof of the claim and its response. The maximum term to address the claim will be fifteen (15) business days from the day following its receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial term.

Receiving Requests: Loft Me will receive data subject information requests for the exercise of the rights of access, consultation, rectification, updating, suppression, and revocation referred to in Law 1581 of 2012, through the email loftmedesign@gmail.com. For the filing and processing of your requests, complaints, and claims, we ask you to provide the following information:

Full name.
Contact information (physical and/or electronic address and contact telephone numbers).
Means to receive a response to your request.
Reason(s)/fact(s) giving rise to the claim with a brief description of the right you wish to exercise (to know, update, rectify, request proof of the authorization granted, revoke it, suppress, access the information).
Signature (if applicable) and identification number.

16. INFORMATION WE COLLECT AUTOMATICALLY

Our Websites: When you visit our websites, information will be automatically sent by the browser used on your device to our web host's server and temporarily stored. Loft Me has no influence over this. The following information is also collected without any action on the part of Loft Me and is stored until its automated deletion:

The IP address of the requesting web-enabled device.
The date and time of access.
The name and URL of the retrieved file.
The website/application from which access was made (referrer URL).
The browser used by you and, if applicable, the operating system of your web-enabled device.

The IP address of your device and the other data listed above are used for the following purposes:

Ensuring a smooth connection.
Ensuring that our website/application is user-friendly.
Analyzing system security and stability.
Conducting digital advertising.

The data is automatically stored and deleted once the aforementioned purposes have been achieved.

Cookies and Web Analytics Tools: In order to make our website more attractive to visit and allow the use of certain functions, we use so-called "cookies." These are small text files that are stored on your device. Some of the cookies used by us are deleted after the end of the browser session, i.e., after your browser is closed ("session cookies"). Other cookies remain on your device and allow us to recognize your browser the next time you visit the site ("persistent cookies"). Cookies do not allow us to access other files on your computer or identify your email address.

Cookies may be used for the following purposes:

Recording user activities on the website.
Measuring the effectiveness of advertisements.
Distinguishing unique users to calculate visitor, session, and campaign data.
Measuring clicks, heat maps, and site visibility statistics.
Generating marketing strategies and campaigns.
Conducting digital advertising and information analysis.

Loft Me may share information obtained through cookies with external individuals or third parties (partners, clients, suppliers, or companies linked to Loft Me), in order to improve user services. Likewise, the information received through cookies will be used by Loft Me and the aforementioned third parties for the purposes described in this document and any of its updates.

Location Data: We integrate geolocation options provided by third parties. The processed data may include, in particular, IP addresses and users' location data, but this data cannot be collected without your consent (generally provided in your mobile device settings).

17. PRIVACY NOTICE

It is read in all forms or documents through which information from the Data Subjects handled by Loft Me is collected. When collected verbally, the Privacy Notice is communicated to the Data Subject in the same way, and the Authorization is recorded through technical means provided for this purpose.

18. PUBLICATION AND MODIFICATIONS OF THE POLICY

This Policy may be modified and will form an integral part of the contracts entered into by Loft Me, where relevant. Any substantial modification to this Policy must be communicated to the Data Subjects in advance through the Loft Me website: www.loftme.co

19. VALIDITY OF THE POLICY AND DATABASES

This Policy will take effect on November 22, 2024. The Personal Data that is stored, used, or transmitted will remain in the Loft Me Database, based on the temporality criterion, for as long as necessary to comply with the purposes mentioned in this Policy, for which they were collected, as long as their deletion is not requested by the interested party and provided that there is no legal duty to keep them. In this way, the validity of the Database is closely related to the purposes for which the Personal Data were collected.

Do you have questions about our accessories or need help with your order? Fill out the form and we'll get back to you soon. We're here to help you find the perfect accessory!