PRIVACY POLICY AND DATA PROTECTION POLICY (hereinafter the “Policy”)

The Company informs you that in accordance with the Law for the Protection of the Person against the Use of Personal Data Nº 8968 (hereinafter, the “LPD”) and its Regulations, of the existence of a Personal Data Base created by the Responsible, and called “The Company’s Data Base” (hereinafter, the “Database”).

PURPOSE OF DATA COLLECTION

The data that the Registered User provides to The Company is collected for informative purposes, contact, research and commercial prospecting and at the same time, serves to establish a loyalty program, so that customers can accumulate points for each visit they make to the premises of The Company. Points can be redeemed through the application and being physically at the branch. It must be in person.

This information will be treated with the reserve, confidentiality and security stipulated by current legislation on the matter.

DEFINITIONS

App: The Company’s App.

User: You are with the simple download and use of the App.

Registered User: You once have completed any of the registration forms of the App.

Data Base: Set of personal data of Registered Users, duly organized and used for the purposes that The Company informs you in this “Privacy and Data Protection Policy”.

ACCEPTANCE OF THIS POLICY

The User approves this Policy by checking the box in the App that says: “I have read and accept the privacy and data protection policy”, which is found in the data compilation forms, which is an indispensable requirement to be able to finish the process and become a Registered User. Therefore, the User is recommended to read this Policy thoroughly before checking the aforementioned box.

OF THE IDENTITY OF THE REGISTERED USER, VERACITY AND ACCURACY OF THE PROVIDED INFORMATION

The Registered User declares that he/she is who he/she claims to be and that he/she is aware of the legal consequences of impersonating another person, as well as that the information he/she enters the Company’s App is accurate, and that he/she assumes the duty to comply with the necessary updates of information to keep it clear and accurate at all times. In case of failure to comply with this obligation to update, the Registered User exempts The Company from any legal consequence for these elements of authenticity and accuracy, corresponding to the principle of quality of information established in the national legislation.

On the other hand, if The Company were to establish that The User has entered information contrary to what is indicated in the previous paragraph, it will immediately proceed to conclude any rights that you have obtained regarding the App and terminate the relationship with you at the time. All the foregoing is without prejudice to the possibility of bringing such legal action as may be necessary to protect the rights of The Company or any third parties who have suffered damage as a result of your infringement.

COLLECTION OF OTHER INFORMATION IN THE APP

Apart from the information that you provide us in the registration as a Registered User, The Company may expand with other information by means of surveys, interviews or questionnaires sent to the Registered User, you are also advised that The Company uses automated systems of traffic analysis of the Registered User that collect information about your experience in the use of our App. The latter is done in order to provide a secure service to the Registered User; notwithstanding the foregoing, the Registered User is guaranteed that the information that is selected as set forth in this paragraph is absolutely private and for the use of The Company, and will never be given access or transferred to third parties.

The Company does not request information of a financial nature or identified as “sensitive” by the data protection regulation of the Registered Users of the App, therefore, if you receive a communication requesting this type of information, you are kindly requested to immediately contact The Company at the address info@vainillacr.com and do not reply to the sender of such messages.

DATA QUALITY AND REVOCATION OF CONSENT

The data obtained are appropriate and not excessive in relation to the scope, purposes and services provided by The Company and its relationship with the Registered User, having data that are marked with an asterisk – “*”- as mandatory and others that are not. However, in the event that you have given your consent to proceed to process your data, such consent may be revoked at any time by sending a communication to the contact email address of The Company.

CONSEQUENCES OF REFUSAL TO PROVIDE DATA

The implication of not providing the data or of refusing consent at any time for its processing will prevent The Company from providing the different services offered to you as a Registered User of the App, including not enabling your Registered User account to access the App.

RIGHTS OF THE COMPANY ON BALANCES, LEVELS AND COUPONS OF REGISTERED USERS

The Company has the right to modify, regulate or delete balances, levels and active coupons that Registered Users have in their account. In addition, The Company may modify regulations, point accumulation percentages, bonuses, coupons, balances and other variables included in the Loyalty Program without prior notice. In the event that the program is terminated or eliminated by The Company, The Company shall have no obligation to refund any amounts or balances to Registered Users.

OF THE RECIPIENTS OF THE INFORMATION

In principle, the Data of the Registered Users will not be yielded, communicated or transferred to other third parties, in case of a special situation in which it should be granted some personal data to a third party, first it will be notified to the Registered User, and it will be able to be facilitated previous consent of this one – Registered User-.

OF THE AGE OF MAJORITY OF THE REGISTERED USER

The use of the App is intended for persons over 18 years of age, however, minors may also use the App, it being understood that they do so under the supervision and responsibility of their parents or guardians. For which the parents or guardians of the minor, must provide written authorization to the Company, for the minor to provide their personal data. Likewise, it is forbidden for minors, even if they have the consent of their parents, to include any type of information that: (i) is considered as sensitive data by the LPD, or (ii) personal data of their parents or guardians and that are not merely contact data to verify the authorization mentioned in the previous paragraph. In this case, the minor’s account will be immediately disabled without liability.

OF THE RIGHTS THAT ATTEND HIM/HER

The Registered User may exercise the rights of access, rectification, revocation or deletion of his/her personal data by sending a written communication to The Company at the contact e-mail address info@vainillacr.com.

REGARDING COMMUNICATIONS WITH REGISTERED USERS

The administration of personal data and the sending of communications by electronic means are in accordance with the regulations established in the LPD and its Regulations.

When managing your Registered User account, you authorize The Company to send you communications on behalf of The Company or third parties. You are informed that all electronic communications sent by The Company will formally state the name of the sender, as well as the way in which you can oppose to continue receiving communications. Also requesting it to the mail info@vainillacr.com.

Notwithstanding the foregoing, Registered Users who, so request may simply and free of charge dispense with this service by sending a communication to the contact e-mail address info@vainillacr.com “unsubscribing”.

SECURITY LEVELS

The personal data of our Registered Users are collected and stored in the database owned by the Company, which guarantees the appropriate technical and structural measures to ensure the integrity and security of the personal information provided in accordance with the current state of the art.

The Company maintains the security levels of protection of your data in accordance with the LPD and its Regulations, with respect to everything related to the security measures of the databases containing personal data and has established all the technical means to which it has access to prevent the loss, misuse, alteration, unauthorized access and theft of the data you provide to The Company, without prejudice to inform you that security measures on the Internet can never be considered totally secure, not involving legal consequences of The Company in case of loss or loss of data.

APPLICABLE LAW

This Privacy and Data Protection Policy is governed by Costa Rican law. The parties submit to the administrative system, courts and tribunals of Costa Rica.

All actions of The Company or Registered Users shall be deemed to be made in Costa Rican territory for any legal effect.

This Privacy and Data Protection Policy shall be governed by and construed in accordance with Costa Rican law in all matters not expressly set forth herein.