For YANAPI SA (hereinafter, "the company" or simply "YANAPI"), the handling of all your data is important. Therefore, we provide you with the following Privacy Policy, through which we inform you, in accordance with the Organic Law on Personal Data Protection (LOPDP) in Ecuador, how we process the information you provide and collect, the purposes for which it is processed, and other important aspects for your consideration.

In this document we inform you, in particular, of:

1. The type of information we collect, its origin and the purposes for which it is processed, specifically.
2. The legal basis for the processing of the data.
3. How long we retain the information.
4. With whom we share this information.
5. The means through which you can communicate with us to exercise your rights.

Scope of application

This YANAPI SA Information Privacy Policy (the "Policy") is addressed to business partners, suppliers, clients, employees, interns, collaborators, contractors and, in general, to any person whose Data is being or will be processed by YANAPI SA.

Legal basis

The Ecuadorian legal system recognizes and guarantees the right to the protection of personal data. The Constitution of the Republic of Ecuador (hereinafter, CRE), in Article 66, number 19, states:

CRE. “Art. 66.- The following are recognized and guaranteed to individuals: 19. The right to the protection of personal data, which includes access to and decision-making regarding information and data of this nature, as well as its corresponding protection. The collection, archiving, processing, distribution, or dissemination of this data or information will require the authorization of the data subject or a legal mandate.”

Likewise, this Policy is specifically based on the Organic Law on Personal Data Protection (LOPDP), which, according to Article 2, applies "to the processing of personal data contained in any type of medium, whether automated or not, as well as to any form of subsequent use." This regulatory framework stipulates that the processing of personal data will be legitimate and lawful when one of the following conditions is met (Article 7, paragraphs 1, 2, 3, 5, 7, and 8):

LOPDP. “Art. 7.- Legitimate processing of personal data. – Processing will be legitimate and lawful if any of the following conditions are met:

1) By consent of the owner for the processing of his/her personal data, for one or several specific purposes;
2) That it is carried out by the data controller in compliance with a legal obligation;
3) That it be carried out by the data controller, by court order, and the principles of this law must be observed;
4) That the processing of personal data is based on the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the controller, derived from a competence attributed by a law, subject to compliance with international human rights standards applicable to the matter, compliance with the principles of this law and the criteria of legality, proportionality and necessity;
5) For the execution of pre-contractual measures at the request of the data subject or for the fulfillment of contractual obligations pursued by the controller of personal data, the person in charge of processing personal data or by a legally authorized third party;
6) To protect vital interests of the interested party or another natural person, such as their life, health or integrity;
7) For the processing of personal data contained in publicly accessible databases; or,
8) To satisfy a legitimate interest of the data controller or a third party, provided that the interests or fundamental rights of the data subjects do not prevail under the provisions of this regulation.”

The Policy uses the thirteen principles defined in the LOPDP, to carry out any processing of the data of the owner or interested party

Data controller

YANAPI SA, with RUC 1790775623001, domiciled at Llanganates No. E2-22 and Tomebamba, Quito-Ecuador EC 170901 (hereinafter, YANAPI), with telephone number 02-2651401, acts as the data controller for your data that may be collected and stored in our systems.

This information may come from our website, publicly accessible information systems, and links to other websites, as well as from information you provide to us through communication channels such as forms and direct messaging on social media.

As required by law, we are responsible for your personal information, so we guarantee that we have implemented the necessary technical, organizational, and administrative measures to protect it.

Organizationally, all requests will be channeled through the email proteciondedatos@yanapi.com, by phone using the YANAPI SA number, or at its registered address. This will allow the Data Protection Officer, in this case Ms. Carina Cañar, to respond to the requests and fulfill her duty to oversee compliance with current legal regulations and cooperate with the competent authorities in this matter.

Purposes of processing YANAPI customer and supplier data

YANAPI collects your information in order to always offer you a better product and service. Due to our company's business nature, the information we process is collected solely for the following purposes:

• Clients: To conduct risk analyses, commercial profiles, and offer our products/services and improve them. Also, to manage any claims related to orders and inform you of any updates to our product catalog. If you are a representative, guarantor, beneficiary, or spouse, whether of the data subject or the data subject who gave consent, we undertake to process your data to manage the contract in which you are involved.

• Suppliers: Supplier analysis in pre-selection processes, reference validation, selection, and qualification. Also for the implementation of contracts and their compliance, specifically, for the supervision of service provision and/or delivery of the contracted product.

In this regard, the Policy seeks to: guarantee the rights of Data Subjects or interested parties (whether individuals or legal entities); disclose the mechanisms and procedures for enforcing these rights; provide information on the company's communication channels for addressing inquiries, questions, claims, and complaints; and, finally, disclose the purposes and processing procedures.

We store your data from the moment you enter our websites (through cookies, if you accept their use), when you request more information about the product (when you fill out our contact forms or send the catalog to your email), or when you log in to our websites through user registration. Data is stored until the purposes for which the information was processed are fulfilled, strictly adhering to the time periods specified in applicable regulations and for the maximum period required for the statute of limitations for legal actions. After this time, the data will be deleted, anonymized, or blocked, in accordance with the mechanisms, tools, and strategies implemented and defined by YANAPI SA.

On each of our platforms, we handle information in accordance with this privacy policy.

Among the purposes of processing your data as a client or supplier, in particular and without the following list being exhaustive, are:

• To contact you;
• To provide you with good service or give you a good product;
• To manage your orders and check the status of your requests; and,
• To promote our products and services.

By reading this document and clicking accept on the website, you declare that you are aware of the document and expressly authorize YANAPI to process your data. This consent will be collected by accepting the privacy statement through digital channels, verbally, or other means used by YANAPI.

Purposes of processing YANAPI employee data

YANAPI, acting as Data Controller, for the proper development of its commercial activities, as well as to strengthen its relations with third parties, collects, stores, uses, circulates and deletes Data corresponding to natural persons with whom it has or has had an employment relationship, for the following purposes or ends:

– Manage and operate, directly or through third parties, the personnel selection and recruitment processes, including the evaluation and qualification of participants and the verification of work and personal references, as well as the performance of security studies;

– Develop activities related to Human Resources management within YANAPI, such as payroll, affiliations to entities of the general social security system, welfare and occupational health activities, exercising the employer's sanctioning authority, among others;

– Make the necessary payments arising from the execution of the employment contract and/or its termination, and any other socio-economic benefits that may apply, in accordance with applicable law;

– Contract employment benefits with third parties, such as life insurance, medical expenses, among others;

– Notify authorized contacts in case of emergencies during working hours or in the course of work;

– Coordinate employee professional development, employee access to the employer’s IT resources, and provide support for their use;

– Plan business activities; and,

– Generally, to comply with contractual and legal obligations (e.g., Labor, Social Security, and Occupational Health regulations).

Data types

For YANAPI clients and suppliers, the data categories cover the types indicated in the law and, specifically, the following: (i) identification and contact information; and (ii) property information. In the case of YANAPI employees, the data categories, in addition to those indicated, will be: (i) identification and contact information; (ii) property information; and (iii) employment information, which includes, for example, information on occupational health, criminal records, among other information necessary for the purposes described in the Policy.

Likewise, when a user visits the YANAPI Websites, digital behavioral data is collected from platforms and media centers assigned to cookies or devices and other tracking technologies, which were previously obtained with the corresponding third-party consent. This type of information includes your IP address and domain name, browser version, operating system, traffic and location data, web logs, the resources you access, and other communication data.

Types of treatment

Collection, recording, and organization, retention, storage, modification, deletion, indexing, extraction, consultation, processing, use, possession, exploitation, distribution, automated evaluation and decision-making, profiling, assignment, communication, or transfer; provided that each of these activities complies with the relevant legal regulations and the processing purposes outlined in the Policy.

The incorporation into the archive, profiling, and automated processing of data is intended to link the data subject/interested party to YANAPI and its respective maintenance, management, administration, provision, expansion, improvement, or sending of updates to its services or products. It also seeks to make new services or products available to the data subject/interested party, and to send technical, operational, and commercial information about products, promotions, and services offered or to be offered by YANAPI in the future via traditional and electronic means. The purpose of the registration and automated processing of the Data also includes sending survey forms, which the data subject/interested party is not obligated to complete.

Storage time

We retain your data for the period necessary to fulfill the purposes described in this Policy or our data retention policies, unless a longer retention period is required by law.

Storage of information

Depending on the purpose for which the data was collected, it will be stored in one of the company's banks or databases.

Origin of the data and further processing

In addition to the information obtained directly from the data subject, for file recording purposes, YANAPI may combine the information provided with other types of data collected from various sources, such as other users, publicly available data, and links from other websites.

Only if you accept the processing described in this policy may your data be used to promote products and services and/or be transferred to suppliers, business partners, or any other company within the YANAPI economic group.

Rights of the interested party

You are in control of your data. As the owner or data subject of your personal information, you can make any request directly to YANAPI, via email at proteciondedatos@yanapi.com, in order to exercise your rights under the LOPDP. Therefore, the exercise of the exercisable rights detailed below will not be subject to a decision based solely on automated assessments.

The exercisable rights are:

– Access: You may request access to all data and information about its processing from YANAPI without justification, provided that this request is reasonable and does not constitute an abuse of rights.

– Portability: You can request that your data be delivered to you, or another data controller, in a compatible, updated, structured, common, interoperable, and machine-readable format, preserving its characteristics, provided that the provisions of current regulations are met.

– Correction and updating: You can request that YANAPI update or modify any data we hold about you if you verify that it is incorrect or outdated.

Please note that it is your obligation to ensure that the information you provide us is truthful and accurate. We review and compare the information you provide with public information or information posted on publicly accessible websites of state authorities.

– Deletion: You can request that we delete your data when there is no longer a reason for processing it, when our contractual relationship has ended, or if retaining it is no longer necessary for the purpose for which it was initially collected.

This right, according to law, has its limitations. We may retain your information if required by an authority, within the framework of investigations or in the public interest, or if there is a legal obligation to retain it for longer than previously established.

– Objection: You may object to the use of your data if you verify that it is being processed for purposes other than those for which it was collected or if it is not necessary to maintain our contractual relationship.

– Suspension of processing: You can request the temporary cessation of the processing of your data when:

• You challenge the accuracy of your data;
• The processing we carry out is unlawful;
• If YANAPI no longer needs to process your data, but you may need it to formulate, exercise, or defend claims; and,
• If you object to the processing of your data for the performance of a mission in the public interest or for the satisfaction of a legitimate interest, while we verify whether the legitimate reasons for processing prevail over those of the data subject.

– Objecting to automated decisions: The data subject or interested party may request a YANAPI operator to provide a clear and coherent explanation of the automated processing decision, collect their comments on it, and challenge YANAPI's decision if required.
Applications must contain the following information: (i) Full name of the rights holder, including a copy of their photo ID and, where applicable, a copy of their legal representative's ID; (ii) Specific request; (iii) Address or physical/email address, for the purpose of making the corresponding notifications; and (iv) Date and signature of the applicant (holder/interested party).

Data transfer

The information provided by users will be available to the owners or interested parties. Personal information may only be accessed by authorized individuals. Its circulation will be limited to the purposes authorized by the user, without prejudice to compliance with legal and/or judicial orders requiring access to information provided by YANAPI users, suppliers, employees, and contractors.

YANAPI may occasionally share your personal information with certain data processors, acting as suppliers. These processors have been previously verified not only regarding their handling of the data they receive, but also their compliance with a confidentiality agreement for the information provided, as well as a value chain that complies with applicable regulations and anti-bribery, anti-corruption, and fraud prevention policies and procedures.

You expressly acknowledge and agree that YANAPI may transfer your data received or collected to: (i) any of the members of the companies related, affiliated, controlled, controlling, subsidiaries, representatives or linked to YANAPI SA; (ii) third-party providers of data processing and handling services; and (iii) other third parties that may request such data from YANAPI for a lawful purpose, for example, for the purposes of audits and supervision by State regulators, as well as by administrative or judicial authorities.

Effects of data delivery

The information provided to YANAPI requires the free, prior, informed, and express consent of the data subject. This consent will be obtained by physical or electronic means so that it can be consulted at a later date. The data subject agrees to provide accurate and correct data; otherwise, they will be responsible for the processing of the information provided. Authorization is not required in cases of requests from public or administrative entities exercising their legal functions, data of public knowledge, or cases of medical or health emergencies.

– If the user believes that YANAPI should not use or share their personal information, they must expressly state this through the Data Protection Officer at proteciondedatos@yanapi.com.

– Data subjects may at any time revoke the authorization granted for the processing of their data or request its deletion, provided that this is not prevented by a legal or contractual provision.

– YANAPI establishes simple and free mechanisms that allow the data subject to revoke their authorization or request the deletion of their data, at least by the same means by which it was granted.

Consent of the owner or interested party

YANAPI will provide the data subject or interested party with the necessary tools or means to unequivocally grant their consent to the processing of their data and, therefore, their compliance with this Policy.

However, such consent may be obtained by YANAPI through the acceptance of the owner or interested party, whether verbally, physically, digitally, or through other means used by YANAPI.

Additionally, the owner or interested party authorizes YANAPI to:

– Consult and process data and preferences in detail, so that YANAPI can offer its products and services optimally;

– Contact the owner or interested party to offer value propositions for products and services from YANAPI SA or its related companies;

– Transfer or communicate data to companies related to YANAPI SA or business partners, for the customization of products and services to be offered to the owner or interested party, suppliers, clients and franchises with whom collaboration, information security and data protection agreements are maintained;

– Automatically process and incorporate the data being processed into the corresponding automated personal data files for which YANAPI will be responsible;

– As a guarantee of informed consent and transparency of legitimate interest, the data protection declaration will direct you to the privacy policy notice published on this website for further details.

Changes to the data protection policy

Updates to this document will be notified through the YANAPI website or through the digital channels we have made available to you. It is your responsibility to review them regularly. We will inform you of any details that may affect the processing of your data, without prejudice to your rights as the data subject.