PRONACA´s Notice on Data Protection for the Customer

1.The Party Responsible for the Processing of Personal Data

The details of the party responsible for processing the personal data of the customer to whom this notice applies are provided below:

NAME
Procesadora Nacional de Alimentos PRONACA C.A.

RUC
1790319857001

ADDRESS
Los Naranjos N44-15 y Av. De los Granados, Quito, Ecuador

This notice details the processing and other aspects related to customers’ personal data resulting from the interaction with the party responsible for data processing, through any digital, remote, or in-person channel, including platforms, software, applications, websites, virtual assistants, among others.
In accordance with the provisions of the Organic Law on Personal Data Protection, PRONACA acts as the party responsible for the management of the personal data covered by this instrument and makes the information on the protection and use of personal data available to its customers.

2. Categories of Customer Personal Data

The categories of personal data that will be used from customers are as follows:

• Identification data
• Contact information.
• Personal characteristics data.
• Social circumstances data.
• Financial and economic data.
• Academic and professional data.

In some cases, we collect special category data such as criminal history, biometric (facial identification) or disability-related data for specific purposes detailed in this notice.

3. Collection of Customer Personal Data
We collect Customer Personal Data from the following sources:

3.1. Directly:We receive and store personal data that customers provide to us directly, through forms on digital media, within our platforms and applications, or outside of these in physical form.

3.2. Other Sources:In some cases, we may collect customer information from other sources, such as public access or third-party sources with proper authorization. When we refer to public access sources, we mean that personal data may be obtained through third-party sources that are legitimized, such as public consultation systems, government sources (e.g., the IRS, the Superintendence of Companies, academic degree consultation, and criminal record consultation, among others), and authorized third parties, which may include an employer or officers of the organization to which the customer belongs, among others. In all cases, we will proceed as detailed in the Organic Law on Personal Data Protection regarding the collection of data from sources other than the owner. In addition, if there is a legal basis for it, we may obtain customers’ personal data from certain business partners or strategic allies for purposes defined between us and such commercial partners. We hereby affirm our commitment to adhere strictly to the stipulated regulations concerning the protection of personal data in all transfers.

3.3 It is the sole responsibility of customers to ensure that the information provided to us is complete, accurate, and up to date. If providing information from third parties, it is the exclusive responsibility of customers to inform them in advance of the conditions under which their personal data will be processed and to obtain their consent to share this information, especially if it is sensitive data.

3.4 Failure to provide personal data required by us in the exercise of our responsibility as data managers or under applicable regulations may result in the impossibility of fulfilling the obligations existing between the customer and us.

3.5. In general, we do not process data of minors and personal data of children and adolescents will only be processed when their legal representative has consented to such processing or for the fulfillment of a contractual and/or legal obligation. However, in accordance with current regulations, adolescents over the age of fifteen (15) and under the age of eighteen (18) may exercise their rights directly before the person responsible for the personal data processing database or before the Personal Data Protection Authority. To this end, we have implemented special actions, measures, and provisions to safeguard the right to personal data protection of children and adolescents.

4. Purposes of the Use of Personal Data

This section establishes the purposes for which customers’ personal data is collected through various channels and in accordance with the obligations imposed by Ecuadorian law.
In addition to the purposes identified below, personal data of customers may be shared with our suppliers, contractors, agents, or advisors (legal, financial, commercial, or otherwise) engaged by us for specific purposes.
The following purposes are identified:

4.1. To Carry Out Commercial Transactions:

• To analyze the possibility of granting credit to customers and bring it to fulfillment. This includes responding to inquiries, contacting the customer, formalizing and legalizing processes before various public entities, signing contracts, guarantees, securities, and complying with the obligations contracted in the agreements between us and the customer.
• To analyze and manage methods and means of payment for credit that customers have been approved for with us, either independently or jointly, as well as cash payments.
• To meet the requirements of the financial institutions we work with, for the purpose of sustaining credit lines. This process includes verifying the performance of the portfolio, reflecting the company’s financial and operating activity. This ensures that we comply with information requests from banks in an accurate and transparent manner, strengthening our relationship and compliance with these entities.

Basis of Legitimacy:

For these purposes, the legal basis is the execution of pre-contractual measures, the fulfillment of contractual obligations, compliance with legal obligations, and legitimate interest.

4.2. To Manage the Relationship with the Customer:

• For the establishment and formalization of the business relationship, digital or electronic channels and means may be used, such as contract management platforms and electronic signatures, among others.
• We process personal data for the purpose of drawing up contracts and managing enabling documents, as well as accessing them during the review of contracts drawn up by other units. This processing is also essential for the effective execution of such contracts. When handling this data, we ensure that all agreements are established and implemented in accordance with the relevant legal requirements and obligations, thus facilitating efficient and lawful contract management.
• To provide commercial references at the customer’s request, facilitating their commercial transactions and relationships with third parties.
• To register and keep customer information up to date in our systems, including billing, enabling effective and accurate billing management.
• To use customer data within our Mobilvendor platform when they purchase meat products or complementary products at points of sale, improving the efficiency of the sales process and personalizing the service.
• In payment management, we process personal data for the purpose of verifying and enforcing security policies in coordination with banks and payment system providers. This process includes confirming and validating transactions to prevent and detect potential fraud. This approach ensures that all operations are conducted securely, protecting our customers’ financial data and maintaining the integrity of each transaction.
• We process the personal data of our workshop customers for the purpose of keeping their contact details up to date and facilitating effective communication. This processing includes sending maintenance reminders, explaining details of proforma invoices, managing sales, and conducting surveys to check satisfaction with the service received. These actions enable us to offer improved customer service and ensure an optimal user experience.
• To manage commercial transactions, product delivery, and the return process. This includes handling procedures related to warranties, purchase cancellations, or product dissatisfaction. In addition, we record each transaction in a waybill to ensure proper tracking. This process guarantees the correct completion of deliveries and returns, improving customer satisfaction and maintaining a detailed record of operations.
• We use personal data to determine and allocate both internal and external visibility materials at points of sale (POS), including refrigeration equipment, in order to ensure a prominent presence for our brand. This strategy not only improves visibility at POS, but also includes the provision and effective monitoring of the necessary refrigeration equipment. This allows us to optimize the display of our products, ensuring that they are kept in ideal conditions for preservation and presentation, which significantly contributes to improving the consumer shopping experience.
• To build customer loyalty to our brands by delivering exclusive benefits. This approach not only recognizes and rewards customer loyalty and commitment, but also strengthens our relationship with them, encouraging their continued support and preference for our products. By offering these incentives, we seek to create a more enriching and engaging customer experience, fostering a lasting connection with our brand.
• To enable transactional capabilities in the sale of PRONACA products, including effective customer relationship management and commercial reporting. This data management helps ensure that transactions are carried out efficiently and that communication with customers is smooth and productive, contributing to the success of commercial operations and a better customer experience.
• To manage inquiries, purchases, and customer service through digital channels, such as our virtual assistant, by offering efficient and personalized customer service. Using these digital platforms, we can quickly process customer requests, answer their questions, facilitate transactions, and resolve any issues they may have. This approach not only improves the customer experience by providing immediate responses and ongoing support, but also optimizes our customer service processes, enabling effective follow-up and continuous improvement of our interactions with customers.
• To enable customers to benefit from promotional activities offered by Pronaca. This not only enriches the customer experience by providing access to discounts and special offers, but also enhances loyalty to our brand.
• To register and unsubscribe from platforms such as our virtual assistant, as well as to manage your user account, in order to enable and facilitate smooth and personalized interaction with our digital tools. This process allows users to configure and personalize their experiences, manage their preferences, and access specific services efficiently. By providing these means to actively manage their accounts, we ensure that users can control their personal information and how it is used within the platform, thereby improving their satisfaction and the security of their data.

Basis of Legitimacy:

For these purposes, the legal basis is: the implementation of pre-contractual measures, the fulfillment of contractual obligations, compliance with legal obligations, and the consent of the owner.

4.3. For Legal Compliance and Before Authorities

• We process customers’ personal data to comply with legal requirements imposed by public authorities. This process ensures that our company adheres to current regulatory and legal obligations, facilitating cooperation with authorities in the performance of their duties and complying with applicable laws.
• To comply with legal obligations established by the Financial and Economic Analysis Unit (UAFE), the Superintendency of Companies, and the requirements of the Attorney General’s Office regarding the prevention of money laundering. This process includes the identification and reporting of unusual or suspicious transactions, ensuring that our company adheres to current regulations and actively cooperates in the fight against money laundering.
• To register and keep customer information up to date in our systems, including billing, enabling effective and accurate billing management.
• On certain occasions, it is necessary to disclose such data to judicial, regulatory, or other government agencies in response to formal requests, proceedings, or investigations conducted by these agencies.
• We process customers’ personal data to ensure compliance with our contractual obligations, as well as to adhere to applicable laws, regulations, accounting standards, court orders, subpoenas, and other government requirements or regulations. This data processing ensures that our operations remain within the current legal and regulatory framework.
• Customers’ personal data may also be processed to protect and exercise our rights, including participation in litigation or defense in legal proceedings. In certain circumstances, this data may be disclosed publicly if required by applicable laws, regulations, or legal procedures, always ensuring compliance with applicable regulations.
• To ensure effective monitoring of transactions to verify that they align with the business model established by the company. This monitoring allows for the identification of deviations or inconsistencies and ensures the integrity and accuracy of financial and tax information, thus facilitating strategic decision-making and compliance with current accounting and tax regulations. This process involves the review and analysis of accounting transactions carried out by distributors, as well as the opening and closing of monthly periods and fiscal closings.
  Basis of Legitimacy:
  To ensure the quality and lawful nature of the services, the legal bases are compliance with legal and judicial obligations, and legitimate interest.

4.4. For Research and Development Purposes:

• To analyze customers’ personal data, we focus our efforts on deeply understanding their needs and preferences. This analysis allows us not only to better understand the business, but also to innovate and improve the quality of our products and services. In doing so, we ensure that our offerings are aligned with our customers’ expectations and demands, thus enhancing customer satisfaction and strengthening our market position.
• To improve decision-making across all lines of business through sales tracking and predictive modeling, it is crucial to integrate and analyze data from multiple sources. Using advanced analytics and machine learning techniques, we can develop models that forecast future trends, optimize pricing, and tailor marketing strategies for specific customer segments.
• To process the financial base with the aim of running analytical models and performing profitability analysis. This work is essential to provide crucial information and effective tools that enable the Revenue Growth Management (RGM) Department to make informed decisions. By understanding financial dynamics and analyzing economic performance, the RGM team can identify opportunities for improvement, optimize revenue strategies, and ensure that business decisions support sustainable growth and profitability maximization.
• For generating routes to visit customers using data that is used to design and optimize the salespeople’s routes. The purpose of this process is to facilitate efficient planning of customer visits, allowing salespeople to maximize their productivity and improve customer service coverage.
• We generate business reports that are used at both the managerial and operational levels to facilitate informed decision-making and strategic planning. These reports are prepared using data collected from our daily operations, providing detailed analysis of sales performance, market trends, and the effectiveness of the strategies implemented.
  Basis of Legitimacy
  For research and development purposes, a legitimate basis is considered to be legitimate interest.

4.5. To Supervise Certain Activities:

We use personal data to monitor the management of inquiries and transactions, with the aim of ensuring service quality and compliance with regulatory procedures. This monitoring is also essential for combating fraud, thereby protecting both our company and our customers. By actively monitoring these activities, we can quickly identify and mitigate any irregularities or potential risks, ensuring a secure and efficient operation that adheres to the required legal and ethical standards.
Basis of Legitimacy
To ensure the quality and lawfulness of the services, the legal basis is: compliance with legal and judicial obligations, and legitimate interest.

4.6. To Advise about Changes to Products and Services:

To communicate any changes made to our products and services to our customers, we implement a clear and efficient process. This communication includes details about updates or modifications, the reasons behind these changes, and how they may affect or benefit the user. We use various communication channels, such as email, notifications on the platform, or direct messages, to ensure that information is delivered in a timely and accessible manner.
Basis of Legitimacy
To inform the changes produced in products and services, the basis of legitimacy is legitimate interest.

4.7. In the Area of Management with Distributors:

• Manage distribution contracts, including applying discounts for distributors, and manage the notarization of lease and distribution agreements. This activity involves handling data from both distributors and customers.
• Access to our SAP accounting system and payroll, fixed asset, and income tax reports allows for the review and analysis of distributors’ accounting transactions, as well as the management of monthly and fiscal period openings and closings. Authorized users have the ability to perform transactions corresponding to distributors, ensuring that all operations are aligned with the established business model and comply with the company’s financial policies.
  Basis of Legitimacy
  The basis of legitimization will be the fulfillment of contractual obligations as well as our legitimate interests.

4.8. To Measure our Performance:

Personal data is used to measure, analyze, and evaluate the performance of our platforms and services in order to provide customers with consistent, high-quality technology.
Basis of Legitimacy
To perform statistical analysis, to measure the effectiveness of commercial or marketing actions and strategies, for financial or operational evaluations of the organization, and to optimize or personalize your experience, the basis of legitimacy is legitimate interest.

4.9. To Communicate with the Customer:

We use our customers’ personal data to communicate with them about new products, recipes, promotions, and cooking tips, as well as to provide relevant information on the proper handling of protein and other products. This communication aims not only to keep our customers informed, but also to encourage continued consumption by enriching their experience with our products. By offering valuable and relevant content, we seek to foster a closer and more lasting relationship with our customers, thereby supporting their satisfaction and loyalty to our brand.
Basis of Legitimacy
For communication with customers, the bases of legitimacy are legitimate interest and the fulfillment of contractual obligations.

4.10. To Conduct Studies or Surveys:

We use the personal data of our customers for the purpose of conducting studies and surveys, which allows us to develop new products and services and improve existing ones. This information is also essential to evaluate and improve our corporate image and the perception of our brands. By analyzing this data, we can better understand the needs and expectations of our customers, ensuring that our offers and communications are more effective and aligned with the interests of our target audience.
Basis of Legitimacy
To send surveys or studies and analyze the results thereof, the basis of legitimacy will be consent.

4.11. For Security Reasons:

We will use customers’ personal data to improve and maintain our security, that of our employees, and that of third parties who provide services to us. This will include the implementation of measures to detect, prevent, and respond to potential incidents of fraud, abuse, security risks, attacks, cybersecurity incidents, or other events that may affect the security or integrity of our personnel. To further our security programs, automated programs and technologies may be used to detect and address potential incidents.
Basis of Legitimacy
To maintain security, both in physical and digital channels, the basis of legitimacy will be legitimate interest.

4.12. In Connection with Insurance:

• When taking out or renewing insurance policies for vehicles, household, and loans, we process personal data that is essential for assessing risks and defining the terms and conditions of coverage. This information allows us to properly establish the terms and conditions of the policies, ensuring adequate protection for our customers and their property.
• The management of personal data for adding and removing beneficiaries from insurance policies is a key process for maintaining the accuracy of coverage. By adding or removing beneficiaries from the master policy, we ensure that insurance benefits are paid correctly and that policies accurately reflect changes in the status of insured individuals. This careful handling of personal data helps to avoid complications and guarantees clarity in insurance coverage.
  Basis of Legitimacy
  The basis of legitimacy shall be consent, compliance with pre-contractual and contractual measures, as well as our legitimate interest.

4.13. For the Management of the Frigo de mi Barrio Project

• To find partners for the Frigo de mi Barrio Project: This involves identifying and recruiting entrepreneurs interested in operating their own business within the framework of the Frigo de mi Barrio Project. The aim is to facilitate the expansion and strengthening of the distribution network by bringing in partners who can successfully manage and develop these local sales outlets.
• For Data Analysis for Frigos de mi Barrio partners: Our goal is to generate valuable insights for partners of the Frigo de mi Barrio project, focused on optimizing the management and operations of meat centers. We use sales analysis and predictive models to provide information that helps improve decision-making, ensuring an effective, data-driven business strategy.
• To collect and analyze data from our customers at Frigo de mi Barrio meat centers in order to discover insights that support strategic decisions. Through sales tracking and the application of predictive models, we seek to optimize supply and operations, thereby improving customer satisfaction and business profitability.

Basis of Legitimacy:

To maintain security, both in physical and digital channels, the basis for legitimacy shall be legitimate interest.

5. Transmission, Storage and Security of Personal Data:

5.1. Transmission, Communication or Transfer of Data:

We will share customers’ personal data with third parties only if there is a legal basis for doing so or in cases where the customer or prospect has given their consent. A legal basis for such communications or transfers shall be deemed to exist when a legal provision requires the communication or when it is necessary for the performance of the contracted service.
These recipients shall include the following:

• Competent public sector entities and regulating authorities that have the power to request information on personal data, such as the Superintendence of Companies, Securities and Insurance, the Financial and Economic Analysis Unit, the Internal Revenue Service, Judges and Courts, the Attorney General’s Office, the National Police, the Data Protection Superintendence, among others.
• External auditors in compliance with applicable contractual and legal obligations.
• Third parties in the due diligence process or in the formalization and transfer of transactions arising from the partial or total sale of the business.
• Payment service providers, as well as the payment systems themselves and related technological service providers, to whom the data is transmitted to carry out each transaction, may be obliged by Ecuadorian law to provide information on monetary transactions to the authorities or regulatory bodies.
• Managers of contests, events, fairs, exhibitions and marketing campaigns, marketing consultants, among others.
• Other companies that make up our business group.
• Business allies or strategic partners
  Finally, we advise that we use the services of third-party companies in order to provide services to the data subject, for which purpose such third parties may need to access personal data. These service providers may be classified into the following categories: technology and IT service providers, security companies, courier companies, customer service providers, system, infrastructure, and facility management and maintenance companies, logistics services, appraisal services, collection and portfolio recovery services by third parties, payment service providers, banking or financial institutions, legal and tax advisory services, advertising and marketing agencies, and general professional services. The above list is provided as example only, and the joint data managers may use services from companies belonging to other sectors of activity in order to provide quality services. The joint data managers will ensure that personal data is processed correctly by these service providers.
  We will comply, as data managers, with all the requirements set forth in the data protection regulations in allowing access to customers’ personal data by such service providers.

5.2. Internet Security:

5.2.1. The security of transmissions over the Internet or digital channels cannot be completely guaranteed against intruders. However, we employ commercially reasonable security measures to protect user information in accordance with the requirements of data protection legislation.

5.2.2. All personal data provided by customers is stored on our secure servers or those of our data providers, as applicable. Access to and use of such information is subject to our policies and security standards as a data managing entity. When you have chosen (or when we have chosen) a password that allows you to access certain parts of the digital channels, you will keep that password confidential and comply with any other security procedures. You must not share your password with anyone.

5.3. Transfer of Personal Data outside of Ecuador:

Although we process your data mainly within Ecuador, in some situations we will transfer your personal data to some of our service providers based in the United States or countries of the European Union, among others. This means that we will occasionally transfer your personal data to these companies in order to carry out all the activities described in this notice. Any transfer of your personal data outside Ecuador will be carried out in accordance with current regulations and the provisions issued by the Superintendency of Data Protection.
5.3.2. Both for the transfer and for any further processing, the provisions of the applicable data protection regulations shall be complied with.

6. Conservation Period:

We will retain personal data for as long as necessary for the processing purposes for which it was collected, and after this time, for any permitted purpose. For example, we may retain certain details of a transaction and correspondence, until the time period for claims arising from that transaction has expired, or to comply with legal requirements relating to the retention of such data.
Similarly, if you register on any of our platforms, it is important to note that your personal data will be retained for as long as your user account remains active. This includes information necessary to manage your access to and use of the platform, ensuring a personalized and efficient user experience.
We are committed to protecting and handling your data securely, in compliance with all applicable data protection regulations. Once you decide to deactivate or delete your account, your personal data will be deleted from our systems in accordance with our data retention policies and procedures and applicable laws, unless there are legal obligations that require longer retention.

7. Rights of the Account Holders and How to Contact Us:
The holder of the personal data may exercise the following rights:

• Access: We will supply further details on the use of personal data or provide you with a copy of the personal data you have submitted to us in accordance with the guidelines of the Organic Law on Data Protection (LOPDP).
• Updating and rectification: Any data that has changed may be updated and any inaccuracies in the personal data will be rectified.
• Deletion: We will delete any personal data that we no longer have a legal basis to use or that is requested by the owner.
• Consent withdrawal: When processing is based on consent, the customer may withdraw their consent for that specific processing to be carried out.
• Objection: The customer may object to any processing based on legitimate interest when:
  ▪ The fundamental rights and freedoms of third parties are affected, the law allows it, and the information is not public, of public interest, or its processing is required by law.
  ▪ The processing of personal data is for direct marketing purposes. The data subject shall have the right to object at any time to the processing of personal data concerning him or her, including profiling; in which case the personal data shall no longer be processed for such purpose.
  ▪ When consent is not necessary for processing, as a result of the existence of a legitimate interest, as provided for in Article 7 of the LOPDP, and is justified in a specific personal situation of the data subject, unless otherwise provided by law, unless the reasons for carrying out such processing outweigh any harm to the rights of the data subject.
• Suspension: Suspend the processing of data in the following situations:
  ▪ When the data owner disputes the accuracy of the personal data, while the data collecting party verifies its accuracy.
  ▪ When the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead.
  ▪ When the data collecting party no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise, or defense of legal claims; and,
  ▪ When the data subject has objected to the processing pursuant to Article 31 of the LOPDP, while it is being verified whether the legitimate grounds of the data manager override those of the data subject.
• Portability: The portability of data, in a compatible, updated, structured, common, interoperable, and machine-readable format, preserving its characteristics. This shall include transmitting it to other data processing parties, in accordance with the guidelines of the LOPDP, if requested by the data subject.
• Not to be subject to fully or partially automated decisions, including profiling, that produce legal effects or adversely affect the fundamental rights and freedoms of the data subject.
  Not to be subject to fully or partially automated decisions, including profiling, that produce legal effects or adversely affect the fundamental rights and freedoms of the data subject.
  The exercise of these rights is subject to certain exceptions, in some cases established in the Organic Law on Personal Data Protection, to safeguard the public interest (e.g., to prevent or detect an illegal act) and the interests of the data manager(s). If you exercise any of these rights, the legitimacy of the request will be verified, and you will receive a response within fifteen (15) days.
  If you are not satisfied with the response, you have received when exercising your rights, you have the right to file a complaint with the Personal Data Protection Authority through the channels it has established for this purpose.

To exercise the aforementioned rights or raise any questions regarding the processing of your personal data, customers may contact the entity responsible for data management by sending a request to the Data Protection Officer via email at dpersonales@pronaca.com, providing proof of identity.

8. Specific Conditions applicable to Initiatives or Activities Carried out by PRONACA.

This section explains how the specific conditions of each of our initiatives or activities apply to the processing of personal data and is intended especially for customers participating in these initiatives or activities. During the course of particular activities, we may need to collect additional personal data not mentioned in our general data protection notice for customers. In such cases, we will ensure that the specific data protection notices for each activity or initiative clearly detail the nature of this data, the specific purposes for which it will be processed, and the conditions under which it will be processed. This ensures that all data processing is carried out with complete transparency and in strict compliance with applicable regulations.
In data protection notices, tailored to each specific context, we provide detailed information about the types of personal data collected and the specific purposes for which it is processed. Each data processing operation is legally justified, either by the consent of the data subject, compliance with legal obligations, or the need to perform a contract, among other relevant reasons.
These notices also specify the period during which personal data will be stored, which is defined based on the purposes for which the data was collected. We undertake not to retain data for longer than necessary, in compliance with the relevant legal regulations and the principles of minimization and limitation of retention.
In addition, we clearly specify the rights of data subjects with regard to their personal information, applying the same conditions and procedures as described in our general notice to customers. All data processing is in line with our general practices as a data managing entity in relation to personal data protection, ensuring consistency and clarity for all interested parties.
Through these notices, we comply with our legal obligations and underscore our commitment to fair and transparent processing of personal data. We continuously strive to protect the privacy of our users and maintain high standards of accountability and trust in all our operations. We are committed to keeping our customers properly informed of any changes or additions to new types of data and their purposes through regular updates to our data protection notices, ensuring that all interested parties have the most up-to-date information to make informed decisions about the handling of their personal data within our activities and services.
In all cases, this personal data protection notice must be taken into account, specifically the conditions set out in the respective notices for each initiative.

9. Changes to This Personal Data Protection Notice:

We are constantly striving to innovate and improve the services we offer to our customers, which may lead to periodic updates to this Notice. In the event of significant changes, customers will be duly informed in accordance with the provisions established by data protection legislation.
In addition, customers can access and review the Customer Personal Data Protection Notice at any time on our website:https://pronaca.com/
Last update: May 2, 2024