PERSONAL DATA PROCESSING POLICY

In force from: 15 August 2026

In compliance with Ley 1581 de 2012, Decreto 1074 de 2015 and other concordant regulations.

1. Data controller

MAGENTA FARMS S.A.S.
NIT 901.479.899-9
Carrera 24 A No. 9 A 03, Barrio Bosques de La Argentina, La Ceja, Antioquia, Colombia
Email for personal data matters: sales@magentafarms.com
Telephone: +57 318 810 5585
Business hours: Monday to Friday, 8:00 a.m. to 5:00 p.m.

2. Personal data we collect

From those who contact us through the form: name, email address, telephone or WhatsApp, company, country and the content of the message.

From those who buy in the shop: name, email address, telephone, delivery address, city and department, preferred delivery date, delivery notes and, when the order is a gift, the name and telephone of the recipient.

Browsing data: approximate country, in order to show the site in the corresponding language, and basic technical data of the connection.

We do not collect or store credit or debit card data. That information is processed directly by the payment gateway.

Third-party data. When the buyer gives us the data of the recipient of a gift, they declare that they have that person’s authorisation to do so.

3. Purposes of the processing

1. To process, dispatch and deliver the orders.
2. To communicate with the buyer about the status of their order.
3. To attend requests, quotes, petitions, complaints and claims.
4. To comply with legal, accounting and tax obligations, including electronic invoicing.
5. To prevent fraud and guarantee the security of transactions.
6. Subject to specific and separate authorisation, to send commercial and promotional information about products and seasons.

The data will not be used for different purposes without obtaining a new authorisation.

4. Rights of the data subject

In accordance with article 8 of Ley 1581 de 2012, the data subject has the right to:

• Know, update and rectify their personal data.
• Request proof of the authorisation granted.
• Be informed about the use that has been made of their data.
• Submit complaints to the Superintendencia de Industria y Comercio for infringements of the law.
• Revoke the authorisation and request the deletion of their data, where there is no legal or contractual duty preventing it.
• Access their personal data free of charge.

5. How to exercise these rights

By writing to sales@magentafarms.com, indicating full name, identity document, the right they wish to exercise and the facts that motivate the request.

Response times:

• Queries: maximum ten (10) business days. If it is not possible to respond within that period, the interested party will be informed and the matter will be attended within the following five (5) business days.
• Claims: maximum fifteen (15) business days. If it is not possible to respond within that period, the interested party will be informed and the matter will be attended within the following eight (8) business days.

An incomplete claim will be returned within the following five (5) days so that it may be corrected. If the interested party does not respond within two months, it will be understood as withdrawn.

6. Authorisation

The authorisation is obtained in a prior, express and informed manner, through the acceptance checkbox that the user ticks before submitting the contact form or confirming a purchase.

7. International transfer and transmission of data

To operate the site and the shop we use technology providers that may store or process information on servers located outside Colombia:

By accepting this policy, the data subject expressly authorises the transfer and transmission of their data to these providers, for the purposes described. Magenta Farms requires its providers to meet security and confidentiality standards equivalent to those provided for in Colombian law.

8. Security measures

We adopt reasonable technical and administrative measures to protect the data:

• Encrypted connection (HTTPS) across the whole site.
• Access to the database restricted, only from the server and never from the user’s browser.
• The tracking page requires the order code and the buyer’s email, and does not expose address, telephones or internal notes.
• Payment data does not pass through our servers.

9. Validity

This policy is in force from 15 August 2026. The data will be kept for as long as a commercial relationship exists and, thereafter, for the time required by the applicable legal, accounting and tax obligations.

Any substantial modification will be communicated through the website.