Personal Data Processing Policy

SARAH JO SAS — NIT 900.693.208-2
Registered brand: Fraîche & Kâffè
Trade name: Tierras de Montaña

1. INTRODUCTION

In accordance with personal data protection regulations and respecting the rights of the data subject (the “holder”), SARAH JO SAS, a Colombian company operating under the name Tierras de Montaña, adopts this personal data processing policy.

This policy governs the management of data in the context of interactions with clients, suppliers, partners, collaborators, and with communities and organizations aligned with its social, environmental, and commercial mission.

According to Resolution 666 of 2020, SARAH JO SAS informs that some personal data may be collected for health and epidemiological purposes, without prior authorization.

2. PURPOSE

SARAH JO SAS carries out operations in which the collection of personal data is essential, particularly in the context of commercial, contractual, social, and community relationships.

This data enables the implementation of logistical, agricultural, environmental, or educational activities developed through its projects: Tierras de Montaña, Coffee T+ank, and Fraîche & Kâffè.

3. DEFINITIONS

• Authorization: Prior consent of the data subject.

• Personal data: Information related to an identified or identifiable person.

• Sensitive data: Information that may affect the privacy of the data subject.

• Processing: Any operation performed on personal data.

• Data Controller: SARAH JO SAS or the entity deciding on the processing.

• Data Processor: A person or entity that processes data on behalf of the controller.

• Transfer: Communication of data to third parties, including internationally.

4. GUIDING PRINCIPLES

SARAH JO SAS commits to respect the following principles:

Legality, freedom, purpose, accuracy, transparency, restricted access, security, confidentiality, and temporality.

5. DATA PROCESSING

Collected personal data will be used to:

• Update databases.

• Support social, environmental, and commercial activities.

• Manage relationships with clients, suppliers, allies, and communities.

5.1. Exceptions

Authorization is not required when:

• The request comes from a public authority.

• The data is public or used for statistical/scientific purposes.

• There is a medical or health emergency.

5.2. Means

Data processing may be carried out through physical or digital means, depending on the context and collection channel.

5.3. Additional Purposes

• Satisfaction surveys.

• Social marketing or communication campaigns.

• Risk assessment (legal, commercial, or social).

• Inclusion in fair trade or ecological transition networks.

6. FAIR TRADE AND PEACE TERRITORIES

SARAH JO SAS will dedicate a section on its website to highlight alliances with fair trade actors or communities from post-conflict transition territories.

This directory will showcase ethical, traceable, and transparent partnerships built through projects involving coffee growers, rural communities, and allied institutions.