From Life..... For Life

PRIVACY AND DATA PROTECTION POLICY

RESPONSIBLE

Identity of the Treatment Manager: RIOSA-REFINING INDUSTRIAL OLEICOLA, SA ESA23008238

Legal Representative: CEO of RIOSA - Industrial Olive Oil Refining, SA. The identifying data of
positions are registered in the Commercial Registry of Jaén.

Mailing address: BARRIADA DEL PUENTE, S/N - 23450 - IBROS (JAEN)

Phone: +34 953692000

Email: riosa@riosa.com

PURPOSE

Browsing data such as source IP addresses, browser software used, pages accessed or access statistics, stored in the web server log files, will be processed for the following purposes:

- Monitoring of the operation of the web portal and analysis of service errors.

- Statistics of access and use of resources to improve the quality of the service. 

The personal data of the interested party will be processed for the following purposes, as applicable:

 - Manage and develop the registration in the web portal to get in touch with the User and solve all the doubts that arise about our products.  

 - Management, administration, and delivery of products requested by the customer. We use customer or interested party information to process the sale, delivery, invoicing, and information regarding the requested products, as well as to carry out the necessary communications for the purpose of the processing. These communications will be carried out through electronic means (SMS, email, text messaging, or telephone).

 - Manage and send commercial information about products and services offered by RIOSA-REFINING INDUSTRIAL OLEICOLA, SA, through electronic means (email, SMS, text messaging, web, telephone, etc.) and postal means.

- Recording of incoming and outgoing telephone calls for the purposes described in section «"RECORDING OF TELEPHONE CALLS"» of this policy.

 - Respond to the exercise of rights, queries and claims.

TEMPORALITY 

 - The personal data provided for the sale of our products will be kept for the legally required time, at least while some type of contractual or business relationship is maintained between the User and RIOSA-REFINING INDUSTRIAL OLEICOLA, SA and their deletion is not requested by the User. When they are no longer necessary, they will be kept for the limitation period of the actions arising from the processing, from the last confirmation of interest or last transaction or communication (6 years for commercial purposes according to article 30 of the Commercial Code, for documentation, receipts, invoices, contracts, delivery notes etc. Other retention periods according to provisions in the current applicable regulations). These periods will extend beyond the established statute of limitations, keeping said data duly blocked, without giving it any use except that set out below, if said data were necessary for the management of non-payments, exercise or defense of claims or for the necessary actions derived from any type of judicial, legal or contractual responsibility of its processing, which must be addressed and for which its recovery is necessary.

 - The data collected to send commercial communications will be kept until the interested party revokes their consent.

 - The data collected through the contact form of the web portal will be kept for 30 days to answer questions about our products.

 - The data of access accounts to our portal will be kept until the interested party revokes their consent.

- Telephone call recordings will be kept for a maximum of 365 days, with the prolonged blocking assumptions described in the corresponding section.

During the storage time the data will be kept blocked and under strict security measures.

After these periods, the personal data will be deleted with the appropriate security measures to guarantee their total destruction.

Specific legal time limits apply, depending on the type of data and its purpose: 6 years for commercial purposes (Article 30 of the Commercial Code: documentation, supporting documents, invoices, contracts,
delivery notes); 4 years for tax purposes (articles 66 et seq. of Law 58/2003, of December 17, General Tax Law); 1 year for traffic data relating to emails and data provided through the website (Article 12 of Law 34/2002, LSSICE); 1 year for data relating to calls sent or received from fixed and mobile telephony (Article 5 of Law 25/2007, on the preservation of data relating to electronic communications and public communications networks); other time limits according to current applicable regulations.

LEGITIMATION  

The legal basis for processing your personal data depends on the specific purpose of the processing, as detailed below:

a) Contract execution (Art. 6.1.b GDPR):

This is the legal basis for processing data related to the sale of products: order management, product delivery, necessary communications regarding the order (electronic, telephone, or courier), and incident and after-sales service management. For this purpose, the customer is required to provide the essential data, as otherwise the contract cannot be executed.

b) Compliance with a legal obligation (Art. 6.1.c GDPR):

It is the legal basis for the issuance of invoices and the preservation of accounting documentation, in compliance with Law 58/2003 General Tax Law and Articles 25 and 30 of the Commercial Code (retention for six years); for the handling of the exercise of rights, inquiries and claims of the interested party under Articles 15 to 22 of the GDPR; and for any other current legal obligation that applies to RIOSA.

c) Legitimate interest of the Controller (Art. 6.1.f RGPD):

This is the legal basis for sending commercial communications about products or services similar to those previously contracted with RIOSA, in accordance with Article 21.2 of Law 34/2002 (LSSI) and Recital 47 of the GDPR. The data subject may object to this processing at any time.

d) Consent of the data subject (Art. 6.1.a GDPR):

This is the legal basis for: sending commercial communications to non-customers; inclusion in voluntary newsletters; the use of analytics and advertising measurement cookies on the Website; and resolving queries and inquiries submitted voluntarily through the website forms. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent only affects the purposes for which it was given; it does not affect processing based on the performance of a contract or a legal obligation.

To withdraw consent or object to processing based on legitimate interest, the interested party may contact RIOSA by email at riosa@riosa.com clearly indicating the affected purpose.

RECIPIENTS

The personal data of the interested party may be communicated to the following recipients:

-Companies of the Responsible group for administrative and management purposes.

-Public administrations and public bodies (Treasury, Administration of Justice, etc.) or state security bodies and forces, when required by any rule or law or necessary for the legal protection of the legitimate interests of the Responsible for the purposes of compliance with the law.

-Banks and financial companies that operate providing financial services to RIOSA-REFINING INDUSTRIAL OLEICOLA, SA, with the sole purpose of providing said services and excluding the use of your data for any unrelated commercial activity.

-Correos, transport agencies, logistics companies and courier companies that operate providing services to RIOSA-REFINING INDUSTRIAL OLEICOLA, SA, with the sole purpose of providing said services and excluding the use of your data for any unrelated commercial activity.

-Product and quality analysis laboratories contracted to provide services to RIOSA-REFINING INDUSTRIAL OLEICOLA, SA., with the sole purpose of providing said services and excluding the use of your data for any unrelated commercial activity.

- Lawyers, solicitors, consultants and consultancies that provide services to RIOSA-REFINING INDUSTRIAL OLEICOLA, SA., with the sole purpose of providing said services and excluding the use of your data for any unrelated commercial activity.

International Data Transfers, in the event that there are communications through text messaging. Specific:

• WHATSAPP: protected by the EU-US Data Privacy Framework (DPF), a framework approved by the European Commission on July 10, 2023
  (Adequacy Decision 2023/1795) which allows the transfer of personal data to US companies
  Certified. List of participating companies available at: https://www.dataprivacyframework.gov/list. To communicate via WhatsApp, we will provide the interested party's or customer's phone number to WhatsApp Inc. to verify that they are a user of this service. The customer or user should review WhatsApp's settings and privacy policy for more detailed information on how WhatsApp uses the personal data of users of its services.

RECORDING OF TELEPHONE CALLS

Incoming and outgoing calls made to corporate lines of RIOSA-REFINING INDUSTRIAL OLEICOLA, SA They can be automatically recorded. The other party is notified before the start of each call by a system-played notification. Anyone who does not wish to be recorded can hang up after hearing this notification.

Purposes of the treatment

- Guarantee the quality of the service provided to the client or user.

- Traceability of orders, instructions, claims and business transactions or
administrative.

- To constitute documentary evidence of communications for the purpose of resolving incidents,
legal defense or contractual compliance.

- Training and improvement of customer service staff.

Legal basis

- Contract execution and pre-contractual measures (Art. 6.1.b GDPR) for the calls
related to existing or ongoing contractual relationships.

- Legitimate interest of the Controller (Art. 6.1.f RGPD) in having objective evidence of the
Commercial and operational communications. The data subject may object to this processing at any time by indicating it.
expressly.

- Compliance with legal obligations (Art. 6.1.c GDPR) when recording is required
by applicable sectoral regulation.

Conservation

The recordings are kept for a maximum period of 180 days from his
performance, unless a longer period is necessary for reasons of debt collection, claims, legal defense
or compliance with a legal obligation, in which case they will remain blocked and accessible only for those purposes.
Once the deadlines have passed, they are automatically deleted.

Security measures

The recordings are stored on corporate systems with access restricted to authorized personnel.,
through individual authentication. Access is recorded in auditable logs. The recordings are not shared with
third parties, except in the cases described in section RECIPIENTS of this Policy or by
legal or judicial requirement.

Rights of the interested party

The owner of the line or of the recorded communications may exercise at any time the
rights of access, rectification, erasure, objection and limitation of processing regarding the recordings that concern you,
heading to riosa@riosa.com with sufficient identification.
Suppression may be refused in the cases provided for by law when it is necessary for the exercise or defense of
claims.

RIGHTS

Anyone has the right to obtain confirmation as to whether in RIOSA-REFINING INDUSTRIAL OLEICOLA, SA we are processing personal data that concerns them, or not.

Right of access, rectification and deletion: Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. .

Right of limitation: In certain circumstances, the interested parties may request the limitation of the processing of their data, in which case we will only keep them for the exercise or defense of claims.

Right of Opposition: In certain circumstances and for reasons related to their particular situation, the interested parties may oppose the processing of their data. Therefore, RIOSA-REFINING INDUSTRIAL OLEICOLA, SA will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims.

When the processing of personal data is for direct marketing purposes, the interested party shall have the right to oppose the processing of their data, including the preparation of profiles related to said marketing.

Right to data portability: The interested party may request the portability of their data to another controller, in which case it will be done as long as the processing is based on lawful consent, the processing is automated and they will be transmitted from controller to controller when technically possible.

Right to withdraw consent, without affecting the legality of the treatment based on the consent prior to its withdrawal.

Right to file a claim before the SPANISH DATA PROTECTION AGENCY, when you have not obtained satisfaction in the exercise of your rights. To contact said Control Authority you can do so through its website www.aepd.es.

To exercise said rights, The interested party has at their disposal a series of models or forms located in www.aepd.es/reglamento/derechos and you must direct them to RIOSA-REFINING INDUSTRIAL OLEICOLA, SA riosa@riosa.com

Optionally, the interested party may also contact the SPANISH DATA PROTECTION AGENCY (www.aepd.es) to request information about these rights.

To process your request to exercise your rights, we may ask you to prove your identity by proportionate and sufficient means (for example, communication from the
email address linked to your account or order transaction data).

OTHER INFORMATION

RIOSA-REFINING INDUSTRIAL OLEICOLA, SA  The company will maintain professional secrecy regarding all information related to the data, storing it with due confidentiality and using it only for the specific purposes for which it was provided. It will also adopt appropriate technical and organizational measures against unauthorized access to or unlawful processing of personal data, as well as against its accidental loss or destruction. The information is confidential, privileged, and handled only by authorized users with access to the personal data. Any disclosure, distribution, or reproduction of the processed information is strictly prohibited.

Last updated: June 2026