PRIVACY AND PERSONAL DATA SECURITY POLICY ROCCIBEL LLC

This policy shall be governed by the Texas Data Privacy and Security Act (hereinafter, the "TDPSA")

Effective Date: October 1, 2026

1. IDENTIFICATION:

This policy is issued by ROCCIBEL LLC (hereinafter "ROCCIBEL"), an American company domiciled at 24285 Katy Freeway, Suite 300, Katy, TX 77494, United States, and identified with [EIN PENDING], inquiry email address: support@zenttu.com. ROCCIBEL is a company whose main corporate purpose is the marketing and distribution of beauty products and services, including-but not limited to-makeup items, skincare, cosmetics, facial and body treatments, as well as any other product related to aesthetic wellness, through its e-commerce platform available at the website https://zenttu.com/ (English version) and https://zenttu.com/es (Spanish version). Through this portal, ROCCIBEL provides its users with a secure, accessible, and dynamic shopping environment in which they can explore, select, and purchase the products offered by the company efficiently and reliably.

As a result of the use of the platform and the completion of transactions through the e-commerce service, personal data that are necessary for the performance of the commercial relationship and compliance with contractual and legal obligations are collected, processed, and stored. Therefore, by browsing the website, registering as a user, or using any of the services offered, data subjects grant their express and unreserved consent for their information to be processed in accordance with the provisions of this Privacy Notice. This Policy complements-and must be read together with-the Website Terms and Conditions of Use, the Text Message and SMS Notification Consent Policy, and ROCCIBEL's Subscription and Recurring Charges Policy, without replacing them. In particular, the processing of personal data arising from the enrollment in Subscription Plans with recurring charges is additionally governed by the Subscription and Recurring Charges Policy, prepared in accordance with the Restore Online Shoppers' Confidence Act (ROSCA, 15 U.S.C. § 8403) and the Texas Business & Commerce Code Chapter 601 (SB 838).

ROCCIBEL LLC informs that the personal data collected may be shared with and processed by other companies that are part of its corporate group or that may become part of it in the future, as well as by strategic partners, authorized providers, or business units that develop products or services complementary to, related to, or integrated with those offered by ROCCIBEL LLC. These entities will be subject to the same principles, guarantees, and purposes established in this Privacy Notice and will be contractually bound to comply with applicable data protection regulations, including the TDPSA.

Any substantial change in the identity of the data controllers, in the purposes for which the data will be used, or in the ecosystem of associated services, will be notified to the data subject through [support@zenttu.com / website update / in-app notification], guaranteeing the subject's right to revoke consent, object to the processing, or exercise any of the rights provided by law.

This Policy complements-and must be read together with-the Website Terms and Conditions of Use, the Text Message and SMS Notification Consent Policy, and ROCCIBEL's Subscription and Recurring Charges Policy, without replacing them. In particular, any dispute related to the processing of personal data described in this Privacy Notice shall be governed by the applicable law, arbitration, and jurisdiction clause set forth in the Website Terms and Conditions of Use.

2. PURPOSE

The purpose of this document is for ROCCIBEL not only to provide the best service to its customers through its website, but also to become a benchmark in the protection of personal data. Based on this, and in order to comply with all legal requirements under the TDPSA, ROCCIBEL issues this Personal Data Privacy and Security Policy (hereinafter, the "Privacy Policy").

3. GENERAL DESCRIPTION

This Privacy Policy establishes the principles, procedures, and practices through which ROCCIBEL, operator of the website zenttu.com (hereinafter, the "Site" or "we"), collects, uses, stores, discloses, analyzes, modifies, or deletes personal information ("personal data") of users who reside in the State of Texas and who access the Site or make purchases through it. This Policy also informs you of your privacy rights under the TDPSA and other applicable regulatory frameworks in the corresponding jurisdiction.

This Policy may be modified or updated at any time to reflect regulatory changes, improvements to our internal processes, or the evolution of our services. The most recent version will always be available on this page, and the user may identify the date of the last update by consulting the heading "Privacy Policy Effective Date" at the beginning of this document.

4. DEFINITIONS

For all purposes of this policy, the following definitions shall apply:

1. Data Analysis: means the process of examining a data set to discover hidden patterns, unknown correlations, trends, preferences, and other information useful for research purposes.

2. Authenticate: To verify, through reasonable evidence, that the Consumer entitled to exercise their rights is the same Consumer exercising those Consumer rights with respect to the personal data at issue.

3. Privacy Notice: Written communication generated by the Controller, addressed to the Data Subject regarding the Processing of their personal data, by means of which the Data Subject is informed of the existence of the personal data processing policies and of the information that will apply to them, the manner of accessing such information, and the purposes of the intended Processing of the personal data.

4. Database: An organized collection of personal data, gathered for the company's various purposes, that is subject to Processing.

5. Controller: A natural or legal person, public or private, that, alone or jointly with others, determines the purposes and means of the processing of personal data on the basis of the database.

6. Consent: A clear affirmative act, given freely, in advance, expressly, and in an informed manner by the Data Subject, to carry out the Processing of personal data.

We may process your sensitive personal data, including biometric information, only with your express and prior consent.

7. Consumer: A natural person who resides in the State of Texas and who acts solely in a personal or household context. A person acting in a commercial or employment context is not considered a Consumer.

8. Cookies: Small files that a website places on your computer, mobile device, or any other device, which, among many other uses, contain details of your browsing history on that website.

9. Account: A unique account created for the Consumer to access our Website or parts of our Site.

10. Personal Data: Any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable natural person. This may include, among others, name, address, telephone number, email address, financial information, location, or any other data that allows the individual to be identified, directly or indirectly. Information that is publicly available under the laws of the State of Texas is not considered Personal Data.

11. Public Data - Publicly Available Information: Personal data that has been lawfully made available to the public, whether through government records or through voluntary disclosure by the data subject in widely disseminated media, public platforms, or by third parties to whom the data subject provided it without restriction. Data that the data subject has shared in a limited manner or restricted to a specific audience will not be considered public data.

12. Sensitive Personal Data: A special category of personal data that, by its nature, requires a higher level of protection. Under the "TDPSA," the following are considered sensitive data:

    1. Data revealing racial or ethnic origin, religious beliefs, physical or mental health diagnoses, sexual orientation, or immigration or citizenship status.

    2. Genetic or biometric data used to uniquely identify a person.

    3. Precise geographic location data (such as GPS coordinates).

    4. Data collected directly from a child under 13 years of age, when the controller has knowledge of the child's age.

    5. The processing of such data may only be carried out with the prior, informed, specific, and conspicuous consent of the data subject.

13. Biometric Data: Data generated by automatic measurement methods of an individual's biological characteristics. The term includes fingerprint, voiceprint, retina or iris of the eye, or other unique biological pattern or characteristic used to identify a specific individual. It does not include a physical or digital photograph, or data generated from a physical or digital photograph, or a video or audio recording, or data generated from a video or audio recording.

14. Precise Geolocation Data: Information derived from technology, including global positioning system-level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. The term does not include the content of communications or any data generated by or connected to an advanced utility metering infrastructure system or equipment used by a utility company.

15. Privacy Rights: The right of the data subject to require administrators and controllers of personal data to provide access, inclusion, exclusion, correction, addition, updating, rectification, or objection to the data, as well as limitation of its disclosure or transfer.

16. Deidentified Data: The use of reasonable and available technical means, at the time of processing, by which data loses the ability to be associated, directly or indirectly, with an individual. Accordingly, anonymized data is data relating to a data subject who cannot be identified.

17. Device: Any device that can access the Service, such as a computer, a cell phone, or a digital tablet.

18. Disclosure, Sharing, and Sale: Any disclosure, communication, copying, or transfer of personal data from one party to another, regardless of the means used, including but not limited to: network transmissions, physical or digital media, or remote access through technological platforms, whether domestic or cross-border. Disclosure is deemed to occur when ROCCIBEL, as controller of the processing, shares personal data with a third party other than the consumer, with a processor acting on its behalf, or with an affiliate under its same corporate control, on the terms permitted by the law of the State of Texas. When sharing data with third parties outside the contractual relationship or outside ROCCIBEL's control, the data subject's consent will be obtained beforehand, unless a legal exception applies, such as the performance of a contract requested by the user or compliance with a legal obligation. The term does not include:

    1. The disclosure of personal data to a Processor that processes personal data on behalf of the Controller of the benefit;

    2. The disclosure of personal data to a third party for the purpose of providing a product or service requested by the Consumer;

    3. The disclosure or transfer of personal data to an affiliate of the Controller;

    4. The disclosure of information that the Consumer: (i) intentionally made available to the general public through a mass media channel; and (ii) did not restrict to a specific audience; or

    5. The disclosure or transfer of personal data to a third party as an asset that is part of a merger or acquisition.

19. Identified or Identifiable Individual: A Consumer who can easily be identified, directly or indirectly.

20. Child: A person under 13 years of age.

21. Processor: A natural or legal person that processes personal data on behalf of the Controller, following the Controller's instructions and without making decisions on its own regarding the purposes or means of the processing. The Processor is required to comply with the security, confidentiality, and other measures established by the TDPSA, and may only process the data on the terms authorized by the Controller.

22. Service Provider: Any natural or legal person that processes data on behalf of the Company. This refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service, or to help the Company analyze how the Service is used.

23. Targeted Advertising: Means displaying to a target Consumer an advertisement that is selected based on personal data obtained from that Consumer's activities over time and across unaffiliated websites or online applications, in order to predict the Consumer's preferences or interests. The term does not include:

    1. An advertisement that: (i) is based on activities within the controller's own website or online applications; (ii) is based on the context of a Consumer's current search query, visit to a website, or online application; or (iii) is directed to a Consumer in response to the Consumer's request for information or feedback; or

    2. The processing of personal data solely to measure or report on advertising performance, reach, or frequency.

24. Complaint: Dissatisfaction with the processing of personal data.

25. ROCCIBEL: A legal entity, owner and responsible for the operational and functional administration of data processing for the purposes required by the company, considered in this document as Controller of the personal data and as seller, for all purposes of these terms and conditions.

26. Service: refers to the Website.

27. Website: refers to Roccibel LLC, accessible at https://zenttu.com/ (English version) and https://zenttu.com/es (Spanish version) .

28. Request: A formal requirement submitted by a consumer to the Controller of Personal Data Processing in order to exercise their rights under the TDPSA. This request must be clear, specific, and contain the information necessary for it to be processed efficiently.

29. Third Party: A person other than the Consumer, the Controller, the Processor, or an affiliate of the Controller or Processor.

30. Territory: Refers to the State of Texas, United States of America, as well as any other jurisdiction within the territory of the United States in which ROCCIBEL offers its products through its e-commerce platform. This privacy notice applies primarily to consumers residing in Texas, in accordance with the TDPSA, and will extend to residents of other states only to the extent that they have applicable personal data privacy laws. Where required by the applicable state regulation, ROCCIBEL will adapt its personal data processing practices to the specific requirements of that jurisdiction, including the provision of additional notices, opt-out mechanisms, and rights of access, rectification, or deletion, and any other legally established obligation.

31. Data Subject: A natural person whose personal data are processed by ROCCIBEL. Within the framework of the TDPSA, the term "data subject" refers specifically to the consumer residing in Texas who acts in a personal or household context, and whose personal data are processed in the course of a relationship with ROCCIBEL. Notwithstanding the foregoing, ROCCIBEL may also process personal data of other natural persons with whom it maintains commercial, contractual, or employment relationships (such as suppliers, contractors, workers, or partners), with respect to whom the security, confidentiality, and processing limitation measures established by other applicable contractual, regulatory, or ethical rules will apply. This policy does not apply to the processing of data corresponding to legal entities (legal entities, companies, or organizations). However, the data of natural persons associated with such entities that allow their individual identification may be considered personal data when processed outside a strictly commercial context, and will be subject to the provisions set forth herein to the extent applicable.

32. Transmission: A form of processing that involves the communication or delivery of personal data by the Controller to a Processor, so that the latter may carry out specific processing on behalf of the Controller, in accordance with its instructions and under its supervision, without the third party acquiring ownership of the information. This transmission may take place within or outside the State of Texas, provided that the Processor acts on behalf of the Controller and complies with the requirements established in the TDPSA, including the execution of contractual agreements that limit the use of the data and guarantee its protection.

33. Transfer: A transfer of data takes place when the Controller of the processing of personal data, located in Texas, sends the information or personal data to a recipient that is itself a Controller of the processing (which will use it for its own purposes) and that is located within or outside the country.

34. Processing: Processing means any operation or set of operations carried out, by manual or automated means, on personal data or a set of data. This includes, among others, the collection, use, access, storage, analysis, modification, communication, Disclosure, Sharing, Sale, deletion, or any other action on personal data, in accordance with the provisions of the TDPSA.

35. Sale, Disclosure, and Sharing of Personal Data: Any disclosure, communication, copying, or transfer of personal data from one party to another, regardless of the means used, including but not limited to: network transmissions, physical or digital media, or remote access through technological platforms, whether domestic or cross-border. The term does not include:

    1. The disclosure of personal data to a Processor that processes personal data on behalf of the Controller of the benefit;

    2. The disclosure of personal data to a third party for the purpose of providing a product or service requested by the Consumer;

    3. The disclosure or transfer of personal data to an affiliate of the Controller;

    4. The disclosure of information that the Consumer: (i) intentionally made available to the general public through a mass media channel; and (ii) did not restrict to a specific audience; or

    5. The disclosure or transfer of personal data to a third party as an asset that is part of a merger or acquisition.

36. Billing Cycle: The period of time that elapses between one recurring charge and the next, according to the frequency of the Subscription Plan purchased. At the end of each Cycle, and unless previously cancelled, the system automatically executes the charge corresponding to the following cycle.

37. Customer Portal: A self-service platform through which the Subscriber independently manages their subscription, including changing frequency, quantity, shipping address, pausing, skipping cycles, updating the payment method, and cancellation.

38. Dunning (Payment Failure Management): An automated process by which the Subscriber is notified of a failure in processing a recurring charge and is provided a secure link to update their payment method, retrying the charge before proceeding with automatic cancellation of the subscription.

39. Magic Link: A unique, temporary, and expirable link sent by email to the Subscriber to access the Customer Portal without a password (passwordless authentication).

40. Subscription Plan: A recurring purchase arrangement offered by ROCCIBEL through the Website, by which the Subscriber authorizes the automatic and recurring charge of a set amount in each Billing Cycle, in exchange for the periodic delivery of the selected products.

41. Subscription Program: A recurring purchase service operated by ROCCIBEL, through which the Subscriber periodically receives the contracted products in exchange for an automatic charge in each Billing Cycle, in accordance with the Subscription and Recurring Charges Policy.

42. Subscriber: A natural person who has enrolled in a ROCCIBEL Subscription Plan, having given affirmative consent to the execution of recurring charges and accepted the terms of the Subscription and Recurring Charges Policy.

43. Payment Token: An alphanumeric reference string issued by the Payment Processor that replaces the Subscriber's actual card data. It allows recurring charges to be executed without ROCCIBEL accessing the Subscriber's actual financial data. Card data is managed by the Payment Processor in a PCI-DSS environment.

5. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA:

The principles listed below are the guidelines that must be observed by ROCCIBEL in the processes of collecting, storing, using, and processing personal data. These principles guide responsible and transparent conduct with respect to the processing of the personal information of consumers residing in the State of Texas.

1. Restricted Access and Circulation: The data provided by Data Subjects may only be accessed by internal personnel or third parties (Processors) duly authorized by the Controller. Access will be limited exclusively to the legitimate purposes of the processing. The Data Subject may, at any time, access, receive a copy of the documents, rectify, cancel, and object to the processing of their personal data.

2. Confidentiality: All persons previously authorized by ROCCIBEL who participate in the processing of personal data, whether as an internal collaborator or as a contracted third party (Processor), shall be required to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involving the processing of personal data. To this end, ROCCIBEL will ensure the signing of confidentiality and non-disclosure agreements, which will create an obligation to safeguard the information for an indefinite period, restricting access solely to those who have legitimate authorization and operational need.

3. Accuracy: Information subject to Processing must be truthful, complete, accurate, up to date, verifiable, and understandable; additionally, the Company will only collect data that is adequate, relevant, and limited to what is necessary to carry out the intended purpose. ROCCIBEL will allow consumers to exercise their right to request the correction of any inaccurate or incomplete personal information. ROCCIBEL will take all reasonable measures to review, update, or delete such data when appropriate.

4. Specific Purposes: The processing of personal data must be compatible with the purposes previously disclosed to the Data Subject, as set forth in Section 14 of the privacy notice, and ROCCIBEL is prohibited from using the data for purposes other than those authorized by the data subject. Every purpose will be clearly communicated from the outset and must be compatible with the context in which the data is collected and with the relationship existing with the data subject. ROCCIBEL will refrain from using personal data for purposes other than those authorized, unless it obtains new consent from the data subject. All personal data processed must correspond to determined, necessary, and proportional purposes relative to the service offered.

5. Fairness: Personal data may not be collected through fraudulent, deceptive, or unfair means. All personal data collected by ROCCIBEL, directly or through authorized mechanisms, will be linked to the purposes disclosed in a clear, specific, and understandable manner, in accordance with the TDPSA. Practices that could mislead or confuse the consumer regarding the use of their personal data will be avoided, and it will be ensured that the consent given is truly informed.

6. Legality: Since the processing of personal data is a regulated activity, the principles and the processing of personal data described herein shall be subject to the state data protection rules in force, in particular the TDPSA. All principles, rights, and procedures applied to the processing of information shall be subject to that law, as well as to any other applicable regulation in the State of Texas. ROCCIBEL undertakes to rigorously comply with the regulatory provisions governing privacy, security, and transparency in the use of personal data within the corresponding jurisdiction.

7. Lawfulness or Legitimacy: The processing of data may only be carried out with the prior, specific, express, and informed consent of the Data Subject, especially in cases involving sensitive data, the sale of personal data, or purposes other than those originally disclosed. No personal data may be obtained or disclosed without prior authorization, or in the absence of a legal mandate exempting consent. For the processing of data to be lawful, it must always be carried out under the express consent of the Data Subject.

8. Retention Limitation: Personal data collected by the company must be retained for a period of time that is necessary and proportional to fulfill the legitimate purposes disclosed to the data subject. Once that purpose has been fulfilled, the data will be deleted, anonymized, or securely archived, unless there is a legal or contractual obligation that justifies its further retention.

9. Accountability: ROCCIBEL will be the Controller of the processing of personal data, as well as responsible for full compliance with the provisions of its internal data privacy and security protection policy under the "TDPSA." For this reason, if requested by the data subject or any competent authority, it will be required to demonstrate that the processing of data under its charge is carried out in accordance with the provisions established within the company and in accordance with the legislation of each country where the data is processed.

10. Security: All information subject to processing by ROCCIBEL is handled with all reasonable technical, technological, human, and administrative measures necessary to provide security for the records and data given by the data subjects, in order to prevent tampering, loss, accidental damage, destruction, consultation, use, or unauthorized or fraudulent access, and will be proportional to the type of data processed and the level of risk that its processing represents for consumers.

11. Transparency: All information or communication relating to the processing of personal data must be easily accessible, clear, truthful, and easy to understand, using simple and clear language that allows the Data Subject to understand, at any time and without restrictions, all necessary information regarding the existence of data concerning them, always respecting ROCCIBEL's trade secrets and know-how.

6. CATEGORIES

6.1. CATEGORIES OF PERSONAL DATA COLLECTED FROM CONSUMERS. When a third party visits the Site, we collect certain information about their device, their interaction with the Site, and the information necessary to process their purchases. We may also collect additional information if they contact us for customer support.

6.2. CATEGORIES OF SOURCES FROM WHICH CONSUMERS' PERSONAL DATA IS COLLECTED. The categories of personal and usage data indicated above are obtained from the following sources:

6.3. CATEGORIES OF PERSONAL DATA SHARED WITH THIRD PARTIES. We may share personal data according to the categories of personal data listed in this Policy under "Categories of personal data collected from consumers" with the parties identified in this document under "Categories of third parties with whom personal data is shared," which includes data service providers, external providers, business partners, allies, etc.

6.4 CATEGORIES OF THIRD PARTIES WITH WHOM PERSONAL DATA IS SHARED. We may share your information for the purposes identified in Section 14, "Purposes of Processing," of this Policy with the following categories of third parties:

6.5. CATEGORIES OF SENSITIVE PERSONAL DATA: The Site may collect, use, or store sensitive personal data, including biometric data, only when strictly necessary for a specific and disclosed purpose, and with the Consumer's prior express, informed, and affirmative consent, in accordance with the provisions of Section 27 of this Policy.

6.6. CATEGORIES OF PERSONAL DATA OF MINORS: The Site is not intended for persons under 18 years of age. We do not knowingly collect personal information from children under 13 years of age; should this occur, such information will be deleted immediately. If contacted by a parent or guardian who believes their child has provided us with personal information, that person should do so through the contact channels set forth in the Privacy Notice under Section 22, "Methods and Contact Channels Available for Handling Consumer Requests," and request deletion.

7. CONSUMER CONSENT AND AUTHORIZATION

Consumer consent and authorization is a legal requirement that ROCCIBEL, as Controller of the processing of personal data, must comply with; accordingly, consent must meet the following requirements:

1. PRIOR: The Consumer's authorization must be obtained prior to any type of processing of personal data.

2. EXPRESS: The authorization must be given freely, unambiguously, clearly, and specifically.

3. INFORMED: The Consumer must clearly understand the purposes for which their personal data will be processed.

4. SPECIFIC: Consent for the processing of sensitive personal data must specify the purpose of the processing, so that the consumer is aware of how their personal data will be used.

All persons wishing to make purchases on the ROCCIBEL website must authorize the processing of their personal data in order to use the platform and acquire the products offered. Upon entering the purchase process on the website, the user will be presented with an authorization for the processing of personal data, which must be read and accepted in order to continue with the purchase process.

8. PURPOSES OF THE PROCESSING OF CONSUMERS' PERSONAL DATA

The personal data collected by ROCCIBEL will be stored in authorized databases and by duly contracted third parties for specific purposes.

It should be noted that under no circumstances is the processing of information authorized for purposes other than those set forth in this document. In the event of substantial modifications to the purposes, the privacy notice will be updated in an accessible and clear manner, and compliance with applicable legal requirements will be guaranteed, informing consumers of the changes made thereto.

8.1 PURPOSE OF PROCESSING CONSUMERS' PERSONAL DATA:

9. RECORDINGS, FILMING, AND COMMUNICATIONS

In the event that ROCCIBEL organizes virtual activities, meetings, surveys, or promotional campaigns in which the consumer participates, the consumer's authorization may be requested for audio recording, video recording, or image capture, for the purpose of documenting the event, publicizing the company's activities, and strengthening its business and communication strategy. Such recordings will not be made without the data subject's prior, clear, and informed consent when their image or voice may be used for promotional or external distribution purposes. Any publication will respect the dignity, privacy, and good name of the data subject, and may be withdrawn upon the consumer's request, in accordance with the procedure described in the privacy notice.

10. COOKIES

ROCCIBEL uses cookies on its website for the following purposes: a) to facilitate use, b) to facilitate navigation, c) to improve the experience, d) to comply with legal and contractual obligations, e) to profile and establish the Data Subject's habits, f) to improve the quality of the page, in accordance with the browsing habits and styles of users, and g) to comply with legal and contractual obligations. The technical description of the cookies used can be found in the Cookie Policy published on our website zenttu.com.

11. OTHER DATABASES

ROCCIBEL may manage other databases in addition to those expressly described in this policy, provided that such databases comply with the principles and obligations set forth in the TDPSA. These databases will be subject to the same standards of security, purpose, transparency, minimization, and data subject rights described in Section 10 of the privacy notice. Where required by other jurisdictions outside the State of Texas, ROCCIBEL may proceed to register such databases with the competent authorities, in accordance with applicable local provisions.

12. SHARING, DISCLOSING, OR SELLING DATA TO THIRD PARTIES

ROCCIBEL may share, disclose, or sell personal data to third parties when necessary for the development of its activities and corporate purpose, within or outside the State of Texas or the United States, only when necessary to fulfill the purposes disclosed in this Policy and the privacy notice, and in accordance with what is permitted by the TDPSA. Disclosure of data may be made to:

1. Technology or logistics service providers.

2. Companies affiliated with or corporately related to ROCCIBEL.

3. Entities contracted to support surveys, events, customer service, audits, or platform support.

4. Judicial, administrative, or oversight authorities, when required by law.

In all cases, ROCCIBEL will contractually require that these third parties: a) use the data only for authorized purposes; b) apply appropriate security and confidentiality measures; c) refrain from selling or re-disclosing the data without authorization.

Note: ROCCIBEL will not sell personal data unless the consumer's express affirmative consent has been obtained, following prior notice through this Privacy Notice, with the consumer having the ability to exercise their right to opt out at any time.

OPTING OUT OF THE SALE OF DATA: The User has the right to opt out of the sale of their personal data. If they wish to exercise this right, they may do so through the opt-out mechanisms available on our Site, or by contacting us directly through the channels established in the privacy notice under "Methods and Contact Channels Available for Handling Consumer Requests."

13. PROCESSING OF DATA FOR BEHAVIORAL TARGETED ADVERTISING

As described above in Section 8, "Purposes of Processing of Personal Data," we use your personal information to provide you with targeted advertisements or marketing communications that we believe may be of interest to you. For example:

• We use Google Analytics to help us understand how our customers use the Site. You can read more about how Google uses your personal information here: https://policies.google.com/privacy?hl=en . You may also opt out of Google Analytics here: https://support.google.com/analytics/answer/1034840?hl=en

• We share information about your use of the Site, your purchases, and your interaction with our advertisements on other websites with our advertising partners. We collect and share some of this information directly with our advertising partners and, in some cases, through the use of cookies or other similar technologies (to which you may give your consent, depending on your location).

• We use Facebook™ Ads to help us understand how our customers use the Site. You can read more about how Facebook uses your personal information here: https://www.facebook.com/business/help/742478679120153?id=1205376682832142 . You may also opt out of Facebook™ Ads here: https://www.genbeta.com/a-fondo/como-evitar-que-una-web-te-rastree-utilizando-chrome-firefox-y-safari#:~:text=Evitar%20que%20Facebook%20te%20rastree&text=Una%20vez%20dentro%20de%20la,de%20la%20misma%20red%20social

For more information about how targeted advertising works, you may visit the educational page of the Network Advertising Initiative ("NAI") at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

We share information about the use of the Site, your purchases, and your interaction with our advertisements on other websites with our advertising partners. We collect and share some of this information directly with our advertising partners and, in some cases, through the use of cookies or other similar technologies (to which you may give your consent, depending on your location).

For more information about how targeted advertising works, you may visit the educational page of the Network Advertising Initiative ("NAI") at https://thenai.org/self-regulatory-framework/faq/?tab=2

PARAGRAPH: OPTING OUT OF TARGETED ADVERTISING. The User may opt out of receiving targeted advertising through:

https://www.genbeta.com/a-fondo/como-evitar-que-una-web-te-rastree-utilizando-chrome-firefox-y-safari#:~:text=Evitar%20que%20Facebook%20te%20rastree&text=Una%20vez%20dentro%20de%20la,de%20la%20misma%20red%20social

• FACEBOOK - https://www.facebook.com/settings/?tab=ads

• GOOGLE: https://www.google.com/settings/ads/anonymous

• BING: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

In addition, you may opt out of some of these services by visiting the Digital Advertising Alliance's opt-out portal at: http://optout.aboutads.info/ .

14. RETENTION PERIOD OF PERSONAL DATA

In ROCCIBEL's processing of personal data, the retention of information will be determined by the purpose for which it was initially collected and processed, in observance of the principle of data minimization and other provisions of the TDPSA. Nevertheless, and provided the data subject has given express consent, ROCCIBEL may securely retain personal data in its systems once the initial purpose has been fulfilled, for the purpose of using it for compatible secondary purposes, such as:

• Sending commercial, promotional, or informational communications related to ROCCIBEL's products, services, events, or benefits.

• Market analysis activities, audience segmentation, or personalization of digital experiences.

• Management of loyalty campaigns or subsequent contact for commercial purposes.

Data will be retained only for as long as reasonably necessary to fulfill such purposes and will be protected through appropriate technical and organizational measures to prevent unauthorized access, alteration, loss, or use. At any time, the data subject may exercise their right to object to this processing or revoke their consent by contacting ROCCIBEL through the channels provided in this Privacy Notice.

Where required by other applicable laws outside the State of Texas, ROCCIBEL will observe the retention periods established under the corresponding local regulations.

Retention of Evidence of Consent: In order to ensure the traceability and validity of the consents given by data subjects, ROCCIBEL will retain sufficient and verifiable evidence of such consents, when required under the TDPSA or other applicable regulations. Such evidence may be kept in digital records, electronic files, server logs, online forms, or other equivalent mechanisms, and will be securely maintained for as long as necessary for legal, audit, or regulatory compliance purposes. Within the framework of the Subscription Program, the Subscriber's personal data-including the Consent Record, the Payment Token, the order history, and transactional communications-will be retained for the duration of the subscription relationship and for the additional period necessary to comply with legal obligations, defend claims, or regulatory audits, in accordance with ROSCA (15 U.S.C. § 8403) and the TDPSA. If the Subscriber requests deletion of their data, ROCCIBEL will execute the deletion function on the platform within a maximum of ten (10) days; this operation is irreversible and, in the case of an active subscription, involves the prior cancellation thereof.

15. RIGHTS OF CONSUMERS AS DATA SUBJECTS.

In compliance with the TDPSA and applicable supplementary rules, consumers residing in the State of Texas who act in a personal or household context shall be entitled to exercise, free of charge and without discrimination, the following rights with respect to the processing of their personal data:

1. Right of access. The data subject may obtain, at any time, information about how their personal data is being processed by the controller. In compliance with the TDPSA, ROCCIBEL guarantees the right of access to consumers residing in the State of Texas. The consumer may request confirmation as to whether ROCCIBEL is processing their personal data and, if so, may access the personal data, such as:

   1. The categories of personal data;

   2. The categories of sources from which the personal data is collected;

   3. The business or commercial purpose for collecting or selling personal data or sensitive personal data;

   4. The categories of third parties to whom we disclose personal data; and

   5. The specific personal data we have collected about the consumer.

To exercise this right, the consumer must verify their identity or that of their authorized Agent through the mechanisms established by ROCCIBEL for this purpose. If the request is submitted by a legal representative, the representative must demonstrate their standing through a valid document. Access will be provided free of charge up to twice per calendar year, through electronic or physical means that allow for reasonable and understandable access. The information will be provided within the legal timeframe established by the TDPSA.

2. Right to correction: The data subject may rectify, update, and correct the data provided for processing. Consumers residing in the State of Texas may request the correction of any inaccurate personal data they have provided to ROCCIBEL. The request will be reviewed taking into account the nature of the personal data and the purposes of the processing, and the necessary measures will be taken to update or correct such information when appropriate.

3. Right to portability: To receive a copy of your personal data in a portable, structured, and commonly used format. We will provide you with the copy for use in a portable format and, to the extent technically feasible, in an easily usable format that allows you to transfer the data to another Controller without hindrance.

4. Right to Object to the Processing of Data: You have the right to opt out of the processing of personal data for purposes of:

   1. Targeted advertising.

   2. The sale of personal data; or

   3. Profiling in furtherance of decisions that produce legal or similarly significant effects on the consumer.

5. Right to withdraw consent (opt-out): The data subject may request the withdrawal of their personal data so that it is no longer subject to processing; that is, the data subject must indicate the reasons or circumstances leading to the request that the processing of their data cease, as well as the harm or prejudice that would result from continued processing, or must indicate the specific purposes with respect to which they wish to exercise this right. ROCCIBEL has established free, accessible, and simple mechanisms for the consumer to exercise this opt-out right, which may be applied specifically depending on the type of processing. Withdrawal of consent is not absolute. ROCCIBEL may deny or limit the request in the following cases:

   1. The Data Subject has a legal or contractual duty to remain in the database.

   2. Withdrawal of authorization for the processing would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the enforcement of administrative sanctions.

   3. The data are necessary to protect the legally protected interests of the Data Subject; to carry out an action in the public interest, or to comply with an obligation legally assumed by the data subject.

   4. When the request has already been fulfilled.

   5. When the purpose of the processing is not based on consent, but on another valid legal basis under the TDPSA.

6. Right to deletion (cancellation or erasure): Consumers may, at any time, request the deletion, erasure, or cancellation of their own personal data when its processing fails to respect the constitutional principles, rights, and/or guarantees, or when they simply wish to do so of their own volition. The consumer may exercise this right when:

   1. The personal data is not being processed in accordance with the principles, duties, and obligations set forth in the regulations in force on the Protection of Personal Data.

   2. The data have ceased to be necessary or relevant for the purpose for which they were collected.

   3. The data have exceeded the period necessary to fulfill the purposes for which they were collected.

   4. The processing does not conform to the disclosed purposes.

   5. Or when, of their own accord, the consumer no longer wishes their data to be processed, in cases permitted by law.

This deletion may involve the secure, total, or partial erasure of personal information in records, files, or databases under ROCCIBEL's control. Notwithstanding the foregoing, ROCCIBEL may deny or limit this request when:

• Retention of the data is necessary to comply with a legal or contractual obligation.

• Its deletion would prevent completion of a transaction requested by the consumer.

• Deletion of the data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the enforcement of administrative sanctions.

• The data are necessary to protect the legally protected interests of the Data Subject; to carry out an action in the public interest, or to comply with an obligation legally assumed by the data subject.

• When the request has already been fulfilled.

• The use of the data falls within what is reasonably expected by the consumer and is not incompatible with the original purposes.

• ROCCIBEL is not competent to address the request.

7. Right to file complaints and grievances: The consumer may submit their requests to ROCCIBEL, which undertakes to resolve them within a maximum period of 45 days. If the consumer is not satisfied with the decision made by ROCCIBEL, they may file a complaint with the Office of the Attorney General of the State of Texas, the competent authority for data protection matters in this jurisdiction.

8. Right to be informed: The data subject has the right to be informed at all times by ROCCIBEL about the processing that will be given to their personal data, as well as any modifications and updates made to the privacy notice, the data protection policy, and any other purpose or security measures applicable to their personal data.

16. CONTACT CHANNELS AND MECHANISMS AVAILABLE FOR HANDLING REQUESTS, INQUIRIES, COMPLAINTS, AND/OR COMMUNICATIONS.

In order to guarantee the exercise of rights related to the protection of personal data, including the right of access, rectification, deletion, objection, and withdrawal of consent, ROCCIBEL makes official electronic contact channels available to data subjects.

ROCCIBEL currently receives and manages such requests only through the following official electronic means:

ROCCIBEL website: https://zenttu.com/ (English version) and https://zenttu.com/es (Spanish version).

• Electronic Contact: You may send a formal request to our designated privacy and data protection email address, support@zenttu.com, specifying the right you wish to exercise and providing the information necessary for verification.

• Postal Address: You may also send us a written request to our physical address, 24285 Katy Freeway, Suite 300, Katy, TX 77494, United States, clearly stating your request and providing the documentation required for verification.

All requests will be processed in accordance with the timeframes and conditions established under applicable data protection regulations in the United States, including the Texas Data Privacy and Security Act (TDPSA) for consumers located in Texas, and the California Consumer Privacy Act (CCPA/CPRA) for consumers located in California. In the event of receiving requests from consumers of other U.S. states with applicable privacy legislation, ROCCIBEL will apply the corresponding requirements in a proportional and reasonable manner, in accordance with such state laws, applying the TDPSA preferentially unless there is a supplementary law offering broader coverage and protection for the consumer.

17. PROCEDURE FOR THE EXERCISE OF RIGHTS AND HANDLING OF REQUESTS - TDPSA

ROCCIBEL LLC, in its capacity as controller of the processing of personal data, makes available to consumers residing in the State of Texas, as well as to their duly accredited authorized agents, a clear, free, and accessible procedure for handling inquiries, complaints, requests, and the exercise of their rights in accordance with the TDPSA. Consumers may exercise the following rights: a) access to the personal data we process about the consumer; b) rectification of any inaccurate or incomplete information; c) deletion (erasure) of their data, where legally applicable; d) portability of their data to another provider or platform; e) objection to the sale of their personal data.

Requirements for submitting a request: In order for us to process your request, it must meet the following requirements:

1. Include sufficient information to allow us to reasonably verify that the person is the data subject (or their authorized agent). This includes a current copy of official identification.

2. If acting through an authorized agent, a document of representation and copies of the official identification of both the consumer and the agent must be attached.

3. Describe the request in sufficient detail so that it can be understood, evaluated, and appropriately responded to.

4. Be sent through the channels enabled and indicated in this Policy.

Response timeframes: We will confirm receipt of your request within no more than ten (10) business days, and will provide a substantive response within forty-five (45) calendar days following the date of receipt. If the request is complex or involves a high volume of information, this period may be extended once for up to an additional forty-five (45) days, informing you in advance of the reason for such extension.

Costs: ROCCIBEL will not charge any fee for handling verifiable requests, unless they are manifestly unfounded, excessive, or repetitive, in which case it may charge a reasonable fee or decline to act, explaining the reasons in documented form.

Exceptions to the duty to handle requests: ROCCIBEL will not be required to fulfill opt-out requests submitted by an authorized agent if:

1. The agent does not communicate the request clearly and unambiguously.

2. It cannot be verified, with reasonable effort, that the consumer is a Texas resident.

3. ROCCIBEL does not have the operational or technical capacity to fulfill the request.

4. It is a duplicate request already handled pursuant to equivalent legislation in another jurisdiction.

Denial and right of appeal: If ROCCIBEL denies the exercise of any of your rights, the User may file an appeal expressly indicating the word "Appeal" in the subject line of the message and attaching the original communication and any related documents. ROCCIBEL will respond to such appeal within a maximum of sixty (60) calendar days from receipt, including the substantive reasons supporting its decision. If dissatisfied, the User may escalate their case to the Office of the Attorney General of the State of Texas through its official website.

Security Incidents: In the event of a security incident involving the loss, alteration, unauthorized access, or improper disclosure of personal data, ROCCIBEL will notify the affected data subjects and the Office of the Attorney General of Texas, in accordance with Section 521.053 of the Texas Business and Commerce Code. The notification will include: a description of the incident, the type of data affected, the measures adopted to contain and mitigate the harm, and recommendations to protect the interests of the data subject.

Supervisory Authority: The Office of the Attorney General of the State of Texas (OAG) is the competent authority for oversight, control, and enforcement of the TDPSA. This entity has the authority to receive complaints, investigate, and take corrective action in response to non-compliance with this regulation. If you wish to file a complaint, you may do so by visiting the OAG's official website: https://www.texasattorneygeneral.gov/

18. ROCCIBEL'S DUTIES IN THE PROCESSING OF PERSONAL DATA:

ROCCIBEL, in its capacity as controller under the TDPSA, will comply strictly with, and is likewise aware of the importance of observing, the supplementary rules on personal data; it therefore undertakes to comply with the following obligations with respect to consumers residing in the State of Texas:

1. To provide the consumer, at all times, with a clear, accessible, and understandable privacy notice regarding the full and effective exercise of the consumer's data protection rights and the mechanisms for exercising them;

2. To limit the collection and processing of personal data to that which is adequate, relevant, and reasonably necessary for the legitimate purposes disclosed.

3. To ensure the retention of records or mechanisms that make it possible to verify that the consumer gave their consent in an affirmative, specific, and informed manner, in cases where such consent is required by law, such as the processing of sensitive personal data or its sale to third parties.

4. To ensure, at the time of collecting the personal data of consumers residing in the State of Texas, disclosure of the purposes for which their personal data is collected, as well as the rights they may exercise and the mechanisms available for exercising such rights.

5. To retain the information under the security conditions necessary to prevent its tampering, loss, unauthorized consultation, destruction, use, or fraudulent access;

6. As controller, ROCCIBEL will ensure that the personal information provided to its providers or third-party processors is, to the extent possible, truthful, complete, accurate, up to date, and understandable, in accordance with the purpose of the processing. This obligation will be incorporated into the contracts entered into with such third parties, in compliance with the requirements established by the regulation.

7. ROCCIBEL will ensure that personal data is shared with third-party processors only when such Disclosure, Sharing, and/or Sale complies with the requirements of the TDPSA. In cases where the law requires the consumer's consent (such as for the processing of sensitive data or the sale of personal information), ROCCIBEL will ensure that such consent has been obtained beforehand and that subsequent processing by the third party is carried out in accordance with the contractual instructions given.

8. ROCCIBEL will take reasonable measures to keep consumers' personal information up to date and, when necessary, will promptly communicate such updates to the third-party processors acting on its behalf, in accordance with the contracts entered into.

9. As controller, ROCCIBEL will guarantee prompt, clear, and free handling of requests submitted by consumers to exercise their rights of access, correction, deletion, portability, and objection to the processing of their personal data.

10. In the event of a security breach compromising the personal data of consumers residing in the State of Texas, ROCCIBEL will comply with the notification obligations established under applicable state law, including Texas Business & Commerce Code Section 521.053, which governs the reporting of security incidents to affected consumers and, where applicable, to the Attorney General of the State of Texas.

11. When a consumer residing in Texas has filed a claim relating to the accuracy, deletion, or use of their personal data, and while the review process is ongoing, ROCCIBEL may temporarily suspend the processing of such data or internally flag its status, as applicable. In cases where the processing is carried out by a third party (processor), ROCCIBEL may instruct that party to refrain from processing, modifying, or disclosing the disputed data until the request is resolved, in accordance with the contract and in compliance with the TDPSA.

As Controller, ROCCIBEL may not:

1. Process personal data for a purpose that is not reasonably necessary to, or compatible with, the disclosed purpose for which the personal data is processed, as disclosed to the Consumer, unless, as Controller, it obtains the Consumer's consent;

2. Process personal data in violation of state and federal laws that prohibit unlawful discrimination against Consumers;

3. Discriminate against a Consumer for exercising any of the Consumer's rights, including by denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the Consumer; or

4. Process a Consumer's sensitive data without obtaining the Consumer's consent or, in the case of processing personal data, sensitive data of a known child, without processing such data in accordance with the Children's Online Privacy Protection Act.

5. Clause (3) shall not be construed to require the Controller to provide a product or service that requires personal data of a Consumer that the Controller does not collect or maintain, or to prohibit a Controller from offering a different price, rate, level, quality, or selection of goods or services to a Consumer, including offering goods or services free of charge, if the Consumer has exercised their right to opt out under Section 541.051 of the TDPSA, or if the offer is related to the Consumer's voluntary participation in a bona fide loyalty, rewards, premium features, or discount program.

Privacy Impact Assessments: ROCCIBEL may carry out Privacy Impact Assessments (PIAs) when implementing new technologies, processes, or business models that may pose a significant risk to the rights of data subjects. These assessments will be carried out in order to identify, prevent, and mitigate potential negative impacts related to the processing of personal information, in compliance with the principles of proactive accountability established under applicable legislation in the State of Texas.

19. OBLIGATIONS AND DUTIES OF THE CONTROLLER FOR THE PROTECTION OF PERSONAL DATA:

ROCCIBEL, as controller under the TDPSA, will be responsible for promoting, implementing, and monitoring compliance with the organization's personal data processing policies and procedures. To this end, it must:

1. Identify and classify the databases in which personal information is collected (what data and where it is stored), including the type of information collected and its physical or digital location.

2. Establish controls, policies, and procedures that guarantee the security (confidentiality, integrity, availability) of information across ROCCIBEL's various databases.

3. Promote data protection awareness programs directed at ROCCIBEL's various officers and third parties.

4. Define the necessary controls to guarantee compliance with the TDPSA, and the policies, procedures, and technological controls associated with Data Management.

5. Define the necessary controls to guarantee compliance with the TDPSA and other contractual requirements assumed by ROCCIBEL regarding privacy and security.

6. Integrate personal data management into the company's overall risk management processes.

7. Oversee the proper handling of rights requests, appeals, and, where applicable, the management of security incidents involving personal data, in accordance with applicable legislation.

8. Protect the confidentiality, integrity, and accessibility of personal data, and establish, implement, and maintain administrative and technical standards and physical data security practices appropriate to the volume and nature of the personal data at issue.

20. PRIVACY NOTICE

The privacy notice is the physical or electronic document made available to the Consumer, informing them of information about the protection of privacy in an accessible and clear manner. The privacy notice shall contain the following information:

1. The categories of personal data, including sensitive data, processed by the controller.

2. The purpose of the processing of the personal data;

3. The manner in which Consumers may exercise their rights, and the process by which the Consumer may appeal a Controller's decision.

4. The categories of personal data that the Controller shares with third parties;

5. The categories of third parties with whom the Controller shares personal data; and

6. A description of the methods by which Consumers may submit requests to exercise their rights as consumers.

In the event that ROCCIBEL, as Controller of the processing of personal data, collects sensitive data and will sell such data, it must include the following notice: "NOTICE: We may sell your sensitive personal data." The notice must be published in the same place and in the same manner as the privacy notice.

21. OBLIGATIONS OF THE PROCESSOR

1. The Processor must comply with the instructions given by ROCCIBEL (as Controller) and must assist it in complying with its duties or established requirements, such as:

1. Assisting ROCCIBEL in responding to Consumer requests to exercise their rights, through the use of appropriate technical and organizational measures, as reasonable and practicable, taking into account the nature of the processing and the information available to the Processor;

2. Assisting ROCCIBEL with compliance regarding the security of the processing of personal data and the notification of a security breach of the Processor's systems, taking into account the nature of the processing and the information available to the Processor; and

3. Providing the information necessary to enable ROCCIBEL to conduct and document data protection assessments.

2. The contract between ROCCIBEL and a Processor will govern the procedures for the Processor's data processing with respect to the Processing carried out on behalf of ROCCIBEL. Such contracts must include:

1. Clear instructions for data processing;

2. The nature and purpose of the processing;

3. The type of data subject to the processing;

4. The duration of the processing;

5. The rights and obligations of both parties; and

6. The Processor's requirements regarding:

1. Ensuring that each person who processes personal data is subject to a duty of confidentiality with respect to the data;

2. Deleting or returning all personal data to ROCCIBEL as requested after the provision of the service has been completed, unless retention of the personal data is required by law;

3. Making available to ROCCIBEL, upon reasonable request, all information in the Processor's possession necessary to demonstrate the Processor's compliance with the requirements described;

4. Allowing and cooperating with reasonable assessments carried out by ROCCIBEL or by the person designated by ROCCIBEL as evaluator; and

5. Engaging any subcontractor pursuant to a written contract requiring the subcontractor to meet the Processor's obligations with respect to personal data.

3. As an alternative, a Processor may rely on a qualified and independent evaluator to conduct an assessment of the Processor's policies and technical and organizational measures in support of the requirements set forth in this section, using an appropriate method and an accepted control standard or framework and assessment procedure. The Processor must submit an assessment report to ROCCIBEL upon request.

4. This section may not be construed as a waiver of the responsibilities imposed on ROCCIBEL or the Processor by virtue of their role in the processing relationship, as described in this section.

5. A Processor that continues to follow ROCCIBEL's instructions as Controller with respect to specific processing of personal data will remain in the role of Processor.

22. DATA PROTECTION ASSESSMENTS

1. ROCCIBEL must conduct and document a data protection assessment for each of the following processing activities involving personal data:

1. The processing of personal data for purposes of targeted advertising;

2. The sale of personal data;

3. The processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of:

1. Unfair, deceptive, or unlawful treatment of Consumers;

2. Financial, physical, or reputational harm to Consumers;

3. Physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of Consumers, if the intrusion would be offensive to a reasonable person; or

4. Other substantial harm to Consumers;

4. The processing of sensitive data; and

5. Any processing activity involving personal data that presents a heightened risk of harm to Consumers.

2. The data protection assessment:

1. Must identify and weigh the direct or indirect benefits that may result from the processing to ROCCIBEL, the Consumer, other interested parties, and the public in general, against the potential risks to the Consumer's rights associated with such processing, as mitigated by safeguards the controller may employ to reduce such risks; and

2. The following factors must be taken into account:

1. The use of de-identified data;

2. The reasonable expectations of Consumers;

3. The context of the processing; and

4. The relationship between ROCCIBEL and the Consumer whose personal data will be processed.

3. ROCCIBEL must conduct an assessment when requested by the Investigative Authority.

4. A data protection assessment is confidential and is exempt from public inspection and copying under Chapter 552 of the Government Code. Disclosure of a data protection assessment in compliance with a request from the Attorney General does not constitute a waiver of attorney-client privilege or work-product protection with respect to the assessment and any information contained therein.

5. A single data protection assessment may address a comparable set of processing operations involving similar activities.

6. A data protection assessment conducted by ROCCIBEL for compliance with other laws or regulations may satisfy the requirements hereunder if the assessment has a reasonably comparable scope and effect.

23. ANONYMOUS OR PSEUDONYMOUS DATA

When ROCCIBEL holds anonymized data, it must:

1. Take reasonable measures to ensure that the data cannot be associated with an individual;

2. Publicly commit to maintaining and using deidentified data without attempting to re-identify it; and

3. Contractually obligate any recipient of the anonymized data to comply with the provisions of this chapter.

This section shall not be construed to require ROCCIBEL or the Processor to:

1. Re-identify deidentified or pseudonymous data;

2. Maintain data in identifiable form, or obtain, retain, or access any data or technology, in order to enable ROCCIBEL or the Processor to associate a Consumer's request with personal data; or

3. Comply with an authenticated Consumer rights request, if ROCCIBEL:

1. Does not have a reasonable capacity to associate the request with the personal data, or it would be unreasonably burdensome for ROCCIBEL to associate the request with the personal data;

2. Does not use the personal data to recognize or respond to the specific Consumer who is the subject of the personal data, and does not associate the personal data with other personal data about that same specific Consumer; and

3. Does not sell the personal data to any third party or voluntarily disclose it to any third party other than a Processor.

4. Consumer rights and ROCCIBEL's duties do not apply to pseudonymous data in cases where ROCCIBEL can demonstrate that any information necessary to identify the Consumer is maintained separately and is subject to technical measures and organizational controls that prevent ROCCIBEL from accessing such information.

5. If ROCCIBEL discloses pseudonymous data or deidentified data, it must exercise reasonable oversight to monitor compliance with any contractual commitments to which such data is subject, and must take appropriate steps to address any breach of those contractual commitments.

24. GENERAL CONDITIONS FOR THE TRANSMISSION AND TRANSFER OF DATA

ROCCIBEL may share personal data with third parties necessary for the development of its activities and corporate purpose, always protecting the Consumer's rights and information. Any Transmission or Transfer of personal data carried out will observe the conditions provided for such purpose under applicable regulations and by the supervisory authority, in particular the following:

1. Consumer Consent: The consumer must have given clear, specific, and informed authorization for their data to be transmitted or transferred.

2. Performance of a Contract: When the transmission is necessary for the performance of a contract to which the Consumer is a party.

3. Legal Obligation: If the law requires sharing the data with a government entity, judicial authority, or regulator.

4. Legitimate Interests: If the transfer is necessary for ROCCIBEL's legitimate interests, provided the Consumer's rights and freedoms do not prevail over them.

5. Protection of Legal Rights: In situations where sharing the data is necessary to exercise or defend legal rights.

6. Security in Transmission or Transfer: Use of appropriate measures, such as encryption and authentication protocols, to guarantee the integrity and confidentiality of the data.

7. Data Processing Contract or Agreement: Establishment of a data processing contract or agreement in accordance with the security and privacy standards required by law.

In the case of transmissions or transfers of data within the territory of the United States, ROCCIBEL will ensure compliance with the requirements of the data protection legislation in force and the protection measures adopted by the Processor or new Controller, as applicable.

24.1. INTERNATIONAL DATA TRANSFER

24.2. THIRD PARTIES AND COUNTRIES WHERE TRANSMISSION AND/OR TRANSFER TAKES PLACE

25. INFORMATION SECURITY

ROCCIBEL will adopt the technical, human, and administrative measures necessary to guarantee the security of the personal data subject to processing, preventing unauthorized consultation or access, alteration, destruction, or fraudulent use. It must continuously update and monitor the information security controls required for the protection of the personal data processed by ROCCIBEL. These controls are implemented within the framework of guidelines defined by ROCCIBEL.

The security measures apply to all systems, processes, and persons involved in the generation, collection, storage, use, transmission, and deletion of personal information. ROCCIBEL conducts continuous monitoring, updating, and improvement of its security controls, in accordance with internal guidelines and industry best practices.

Likewise, ROCCIBEL maintains specific internal Information Security policies, documented and communicated to all employees, contractors, providers, and other third parties who access personal data processed by the company. Such policies include, among others:

1. Corporate email,

2. Password management,

3. Maintenance and development of applications, corporate network, workstations, use of the internet,

4. Contractor policy, antivirus, software licensing and use, and database security.

5. Database security.

6. The aforementioned IT policies are implemented through controls that ensure compliance, managed throughout the organization and primarily by ROCCIBEL's IT department.

Failure to comply with any of the policies referenced herein will result in disciplinary sanctions in accordance with the magnitude and nature of the situation that occurred.

26. PERSONAL DATA OF A THIRD PARTY

ROCCIBEL states that, under certain circumstances, it may act as a processor of personal data, or as a processor or operator. In such cases, ROCCIBEL will not act as controller of the processing, but will instead process personal data solely on behalf of, and under the documented instructions of, the data controller with whom it has entered into a valid contract for that purpose. In its role as processor, ROCCIBEL:

1. Will guarantee the confidentiality, integrity, and security of the data;

2. Will refrain from selling, sharing, or processing the personal data for purposes other than those authorized by the controller;

3. Will assist the controller in handling requests submitted by data subjects;

4. Will delete or return the data once the contractual relationship ends, in accordance with the applicable contract;

5. Will apply the appropriate technical, organizational, and legal measures to ensure compliance with the contract and applicable data protection laws.

In the event that the controller does not have a personal data processing policy, or it is insufficient to guarantee the protection of the data, ROCCIBEL may, on a supplementary basis, apply the principles, measures, and standards established in its Privacy Notice, without prejudice to compliance with applicable local legislation.

In the event that the personal data processed by ROCCIBEL corresponds to consumers located outside the State of Texas and subject to specific regulations such as the California Consumer Privacy Act (CCPA/CPRA), ROCCIBEL will apply the provisions of such legislation to the extent applicable. This includes, among others, respect for the rights of access, deletion, correction, opt-out of the sale of personal data, and non-discrimination for the exercise of such rights.

27. Automated Decision-Making: Our processor Shopify uses limited automated decision-making to prevent fraud that does not have a legal or otherwise significant effect on the consumer.

1. Services that include elements of automated decision-making include:

2. Temporary denylisting of IP addresses associated with repeated failed transactions. This denylist persists for a few hours.

3. Temporary denylisting of credit cards associated with denylisted IP addresses. This denylist persists for a few days.

28. PROCESSING OF SENSITIVE PERSONAL DATA

ROCCIBEL will not collect, store, sell, or process consumers' sensitive data, unless such processing is strictly necessary and has been authorized through free, express, prior, informed, clear, and affirmative consent, as required by the TDPSA. The following are considered sensitive personal data:

1. Racial or ethnic origin.

2. Religious beliefs.

3. Mental or physical health diagnoses.

4. Sexual orientation.

5. Immigration or citizenship status.

6. Genetic or biometric information used for identification.

7. Information collected from minors with the controller's knowledge.

Under no circumstances will such data be processed without the consumer's consent, except where such processing is expressly permitted by applicable federal or state law, such as in compliance with a legal obligation, a court order, or a request from a competent authority. ROCCIBEL will not condition access to its services, products, or digital platform on the provision of sensitive personal data, unless such data is strictly necessary for a specific purpose previously disclosed to the consumer. Sensitive personal data will be processed under the highest security standard, under the principle of access restricted solely to duly authorized personnel. ROCCIBEL will not use such data for purposes other than those expressly authorized by the consumer.

In compliance with the Texas Data Privacy and Security Act (TDPSA), ROCCIBEL LLC states that it will not sell its consumers' personal data unless it has obtained prior, express, affirmative, and informed authorization from the data subject, in accordance with Section 541.103 of said law. This authorization must be given through a clear and unambiguous mechanism, and in any case, the consumer may revoke their consent at any time, without affecting the lawfulness of the processing carried out prior to such revocation.

29. MODIFICATION OF THIS POLICY

ROCCIBEL reserves the right to modify, update, or replace the content of this Privacy Policy at any time, in accordance with regulatory changes, internal decisions, or operational needs.

Any substantial modification affecting the processing of personal data or consumers' rights will be communicated clearly and promptly through official channels, including ROCCIBEL's website and, where applicable, through in-app notifications.

These updates will be made in accordance with the provisions of the Texas Data Privacy and Security Act and other applicable state data protection regulations.