Grupo Leonia SAS · Isabelita Fashion

Personal Data Processing Policy

Version 1.0 · Effective from October 29, 2026

This translation is provided for information only. In case of any discrepancy, the Spanish version prevails.

1. Data controller

• Legal name: Grupo Leonia S.A.S.
• NIT (Colombian tax ID): 902.083.921-6
• Registered domicile: Bogotá D.C., Bogotá, Colombia
• Address: Calle 61 # 3F-43, apt. 604, Bogotá D.C., Colombia
• Email for personal data matters: isabelita@grupoleonia.com
• Phone: +57 305 263 3211
• Website: grupoleonia.com

Grupo Leonia S.A.S. (hereinafter, “Grupo Leonia”) is the controller of the personal data collected through the channels of Isabelita Fashion, a Grupo Leonia project.

2. Legal framework

This policy is issued in compliance with the Constitución Política (Political Constitution of Colombia), articles 15 and 20; the Ley Estatutaria 1581 de 2012 (Colombian Statutory Law 1581 of 2012); the Decreto 1377 de 2013 (Decree 1377 of 2013), compiled in the Decreto Único Reglamentario 1074 de 2015 (Single Regulatory Decree 1074 of 2015); and any other regulations that amend or supplement them.

3. Definitions

• Personal data: any information linked to, or that may be associated with, an identified or identifiable natural person.
• Data subject: the natural person whose personal data is processed.
• Processing: any operation performed on personal data, such as collection, storage, use, circulation or deletion.
• Authorization: the prior, express and informed consent of the data subject to the processing of their data.
• Data processor: the person who processes data on behalf of the controller.

4. Data we collect

Through the “Notify me” form, we collect only the email address that the data subject voluntarily provides. We do not request sensitive data or data from children or adolescents.

5. Purposes of processing

The data will be processed in order to:

1. Provide information about the launch of Isabelita Fashion, its products, news and availability.
2. Send commercial and promotional communications from Isabelita Fashion.
3. Invite the data subject to surveys or opinion studies to improve the products and the shopping experience.
4. Respond to the data subject’s inquiries, requests and complaints.
5. Comply with legal obligations and requests from competent authorities.

The data will not be sold or transferred to third parties for those third parties’ own commercial purposes.

6. Rights of the data subject

In accordance with article 8 of Ley 1581 de 2012, the data subject has the right to:

1. Know, update and correct their personal data.
2. Request proof of the authorization granted.
3. Be informed, upon request, of the use that has been made of their data.
4. File complaints with the Superintendencia de Industria y Comercio (SIC, Colombia’s data protection authority), once the inquiry or complaint procedure before Grupo Leonia has been exhausted.
5. Revoke the authorization and/or request the deletion of their data when there is no legal or contractual duty for the data to remain in the database.
6. Access their personal data free of charge.

The data subject may stop receiving communications at any time by using the unsubscribe link included in each email or by writing to isabelita@grupoleonia.com.

7. Procedure for inquiries and complaints

Channel: written requests to isabelita@grupoleonia.com, stating name, registered email, a description of the request and contact details for the response.

Inquiries: will be answered within a maximum of ten (10) business days from the date of receipt. If it is not possible to respond within that period, the requester will be informed of the reason and of the date on which a response will be given, which may not exceed five (5) business days following the expiry of the first period.

Complaints (correction, update, deletion or alleged non-compliance): will be handled within a maximum of fifteen (15) business days from the day following the date of receipt. If it is not possible to handle the complaint within that period, the requester will be informed of the reason and of the date on which a response will be given, which may not exceed eight (8) business days following the expiry of the first period. If the complaint is incomplete, the requester will be asked, within five (5) days of its receipt, to correct the deficiencies; if two (2) months pass from that request without the information being submitted, the requester will be deemed to have withdrawn the complaint.

8. Responsible department

Requests, inquiries and complaints are handled by the Management of Grupo Leonia S.A.S., via the email address isabelita@grupoleonia.com or the phone number +57 305 263 3211.

9. Processors and transfers

To operate the website and send emails, Grupo Leonia relies on technology providers that act as data processors. In particular, the website and the subscription database are hosted on the infrastructure of Cloudflare, Inc. (United States), so the information may be stored or processed outside Colombia. In such cases, Grupo Leonia will require that the data be processed only for the purposes described herein and with adequate security measures, in accordance with applicable regulations.

10. Information security

Grupo Leonia adopts reasonable technical, human and administrative measures to protect personal data against tampering, loss, and unauthorized or fraudulent consultation, use or access.

11. Validity

This policy is effective from the date indicated at the beginning. The data will be retained for as long as necessary for the purposes described or until the data subject requests its deletion, without prejudice to legal retention duties. Any substantial change to this policy will be communicated in a timely manner through this website.