For YANAPI SA (hereinafter, “the company” or simply “YANAPI”), the management of all your data is important. That is why we make available to you the following Privacy Policy, through which we inform you, in accordance with the Organic Law on Personal Data Protection (LOPDP) in Ecuador, the treatment we carry out regarding the information you provide us and that we collect, the purposes for its treatment, among other important aspects for your consideration.

In this document we inform you, in particular, of:

1. The type of information we collect, its origin and the purposes for its processing, specifically.
2. The legal basis for data processing.
3. How long we retain the information.
4. With whom we share this information.
5. The means through which you can communicate with us to exercise your rights.

Scope of application

This YANAPI SA Information Privacy Policy (the "Policy") is addressed to business partners, suppliers, clients, employees, interns, collaborators, contractors and, in general, to any person whose Data is being or will be processed by YANAPI SA

Legal basis

The Ecuadorian legal system recognizes and guarantees the right to the protection of personal data. The Constitution of the Republic of Ecuador (hereinafter, CRE), in its article 66, number 19, states:

CRE. “Art. 66.- The following are recognized and guaranteed to individuals: 19. The right to the protection of personal data, which includes access to and decision-making regarding information and data of this nature, as well as its corresponding protection. The collection, archiving, processing, distribution or dissemination of this data or information will require the authorization of the owner or the mandate of the law.”

Likewise, this Policy is based, in a special way, on the Organic Law on the Protection of Personal Data (LOPDP), which, according to its article 2, applies “to the processing of personal data contained in any type of support, whether automated or not, as well as to any form of subsequent use”. This normative body prescribes that the processing of personal data will be legitimate and lawful when one of the following conditions is met (Article 7, numerals 1, 2, 3, 5, 7 and 8):

LOPDP. “Art. 7.- Legitimate processing of personal data. – The processing will be legitimate and lawful if any of the following conditions are met:

1) By consent of the owner for the processing of his/her personal data, for one or more specific purposes;
2) That it is carried out by the data controller in compliance with a legal obligation;
3) That it be carried out by the person responsible for the treatment, by court order, and the principles of this law must be observed;
4) That the processing of personal data is based on the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the controller, derived from a competence attributed by a law, subject to compliance with the international human rights standards applicable to the matter, compliance with the principles of this law and the criteria of legality, proportionality and necessity;
5) For the execution of pre-contractual measures at the request of the data subject or for the fulfillment of contractual obligations pursued by the controller of personal data, the processor of personal data or by a legally authorized third party;
6) To protect vital interests of the interested party or another natural person, such as their life, health or integrity;
7) For the processing of personal data contained in publicly accessible databases; or,
8) To satisfy a legitimate interest of the data controller or a third party, provided that the interest or fundamental rights of the owners under the provisions of this regulation do not prevail.”

The Policy uses the thirteen principles defined in the LOPDP, to carry out any data processing of the owner or interested party.

Data controller

YANAPI SA, with RUC 1790775623001, domiciled at Llanganates No. E2-22 and Tomebamba, Quito-Ecuador EC 170901 (hereinafter, YANAPI), with telephone number 02-2651401, acts as the party responsible for the processing of your data that may be collected and stored in our systems.

This information may come from our website, publicly accessible information systems and links from other websites, as well as from information you provide to us through communication channels such as forms and direct messaging on social networks.

As required by law, we are responsible for your personal information, so we guarantee that we have implemented the necessary technical, organizational and administrative measures to protect it.

Organizationally, all requests will be channeled through the email proteciondedatos@yanapi.com, by telephone with the number of YANAPI SA or at its legal address; so that the Data Protection Officer, in this case Mrs. Carina Cañar, can respond to the requests, and can fulfill her duty to supervise compliance with the current legal regulations and cooperate with the competent Authorities in this matter.

Purposes of processing YANAPI customer and supplier data

YANAPI collects your information in order to always offer you a better product and service. Due to our company's business, the information we process is collected solely for the following purposes:

• Clients: to carry out risk analyses, commercial profiles, offers of our products/services and their improvement. Also, in order to manage any claim related to orders and inform you about any updates to our product catalogue. If you are a representative, guarantor, beneficiary or spouse, whether of the owner or the interested party who issued the consent, we undertake to process your data for the management of the contract in which you are involved.

• Suppliers: Analysis of suppliers in pre-selection processes, validation of references, selection and qualification. In addition, for the implementation of contracts and their compliance, specifically, for the supervision of the provision of the service and/or delivery of the contracted product.

In this regard, the Policy seeks to: guarantee the rights of the Data Subjects or interested parties (whether natural or legal persons); make known the mechanisms and procedures to make these rights effective; inform the company's communication channels to address queries, questions, claims and complaints; and, finally, make known the purposes and Treatments.

We store your data from the moment you enter our websites (through cookies, if you accept their use), when you request more information about the product (when filling out our contact forms or sending the catalogue to your email) or when you log in to our websites, through user registration. Storage is maintained until the purposes for which the information was processed are fulfilled, with strict respect for the times indicated in the applicable regulations and in the maximum period required for the prescription of legal actions. After this time, the data will be deleted, anonymized or blocked, in accordance with the mechanisms, tools and strategies implemented and defined by YANAPI SA

On each of our platforms we handle information in accordance with the provisions of this privacy policy.

Among the purposes of processing your data as a customer or supplier, in particular and without the following list being exhaustive, are:

• To contact you;
• To provide you with good service or give you a good product;
• To manage your orders and review the status of your requests; and,
• To promote our products and services.

By reading this document and clicking accept on the website, you declare that you are familiar with the document and expressly authorize YANAPI to process your data. This consent will be obtained by accepting the privacy statement through digital channels, verbally or other means used by YANAPI.

Purposes of processing YANAPI employee data

YANAPI, acting as Data Controller, for the proper development of its commercial activities, as well as for the strengthening of its relations with third parties, collects, stores, uses, circulates and deletes Data corresponding to natural persons with whom it has or has had an employment relationship, for the following purposes or ends:

– Manage and operate, directly or through third parties, the personnel selection and recruitment processes, including the evaluation and qualification of participants and the verification of work and personal references, as well as the performance of security studies;

– Develop activities specific to Human Resources management within YANAPI, such as payroll, affiliations to entities of the general social security system, welfare and occupational health activities, exercise of the employer's sanctioning power, among others;

– Make the necessary payments arising from the execution of the employment contract and/or its termination, and other socio-economic benefits where applicable, in accordance with applicable law;

– Contract labor benefits with third parties, such as life insurance, medical expenses, among others;

– Notify authorized contacts in case of emergencies during work hours or in connection with the development of work;

– Coordinate employee professional development, employee access to the employer’s IT resources and provide support for their use;

– Plan business activities; and,

– In general, to comply with contractual and legal obligations (for example, Labor, Social Security and Occupational Health regulations).

Data types

For YANAPI clients and suppliers, the data categories include the types indicated in the law and, in particular, the following: (i) identification and contact information; and, (ii) property information. On the other hand, in the case of YANAPI employees, the data categories, in addition to those indicated, will be: (i) identification and contact information; (ii) property information; and, (iii) employment information, which includes, for example, information on occupational health, criminal records, among other information necessary for the purposes described in the Policy.

Likewise, when a user visits the YANAPI Websites, digital behavior data is collected from platforms and media centers assigned to cookies or devices and other tracking technologies, which were previously obtained with the corresponding third-party consents. This type of information includes your IP address and domain name, browser version, operating system, traffic and location data, web logs, the resources you access, and other communication data.

Types of treatment

Collection, recording and organisation, storage, custody, modification, deletion, indexing, extraction, consultation, processing, use, possession, exploitation, distribution, automated assessments and decisions, profiling, assignment, communication or transfer; provided that each of these activities complies with the relevant legal regulations and the purposes of the processing indicated in the Policy.

The incorporation into the archive, profiling and automated processing of the data is intended to link the owner/interested party with YANAPI and its respective maintenance, management, administration, provision, extension, improvement, or sending of updates of the services or products. Likewise, it seeks to make new services or products available to the owner or interested party, sending by traditional and electronic means technical, operational and commercial information about products, promotions and services offered or that YANAPI may offer in the future. The purpose of the registration and automated processing of the Data also includes the sending of survey forms, which the owner or interested party is not obliged to answer.

Storage time

We retain your data for the period necessary to fulfill the purposes outlined in this Policy or our data retention policies, unless a longer retention period is required by law.

Information storage

Depending on the purpose for which the data has been collected, it will be stored in any of the company's banks or databases.

Origin of data and subsequent processing

In addition to the information obtained directly from the owner, for the purposes of file registration, YANAPI may combine the information provided with other types of data collected through various sources, for example, other users, publicly accessible data and links from other websites.

Only if you accept the processing described in this policy, your data may be used to promote products and services; and/or be transferred to suppliers, business partners or any other company that forms part of the YANAPI economic group.

Rights of the interested party

You are in control of your data. As the owner or interested party of your personal information, you can make any request directly to YANAPI, by email at proteciondedatos@yanapi.com, in order to exercise your rights, in accordance with the LOPDP. Therefore, the exercise of the exercisable rights, which are detailed below, will not be subject to a decision based solely on automated assessments.

The rights that can be exercised are:

– Access: You may request YANAPI access to all data and information about its processing without providing justification, provided that this request is reasonable and does not constitute an abuse of rights.

– Portability: You may request that your data be delivered to you, or to another controller, in a compatible, updated, structured, common, interoperable and machine-readable format, preserving its characteristics; provided that the provisions of current regulations are complied with.

– Correction and updating: You may request YANAPI to update or modify any data we hold about you that is incorrect or out of date.

Please note that it is your obligation to ensure that the information you provide us is true and accurate. We review and compare the information you provide us with public information or information available on state authority websites and publicly accessible information.

– Deletion: You may request that we delete your data when there is no longer a reason for its processing, when our contractual relationship has ended or if its conservation is no longer necessary for the purpose for which it was initially collected.

This right, according to the law, has its limitations. We may retain your information if an authority requires us to do so, in the context of investigations or in the public interest, or if there is a legal obligation to keep it for longer than previously established.

– Objection: You may object to the use of your data if you verify that it is being processed for purposes other than those for which it was collected or if it is not necessary to maintain our contractual relationship.

– Suspension of processing: You may request the temporary cessation of the processing of your data when:

• You challenge the accuracy of your data;
• The processing we carry out is unlawful;
• If YANAPI no longer needs to process your data, but you may need it to formulate, exercise or defend claims; and,
• If you object to the processing of your data for the performance of a mission in the public interest or for the satisfaction of a legitimate interest, while we verify whether the legitimate reasons for processing prevail over those of the owner.

– Object to automated decisions: the owner or interested party may request that a YANAPI operator provide a clear and coherent explanation of the automated processing decision, collect their comments on it and challenge YANAPI’s decision if required.
Applications must contain the following elements: (i) Name and surname of the holder of the right, attaching a copy of his/her identity document with photograph and, if applicable, also of his/her legal representative; (ii) Specific request; (iii) Address or physical/electronic address, in order to make the corresponding notifications; and, (iv) Date and signature of the applicant (holder/interested party).

Data transfer

The information provided by users will be available to the owners or interested parties. Personal information may only be accessed by authorized persons, and its circulation will be limited to the exercise of the purposes authorized by the user, without prejudice to compliance with legal and/or judicial orders that require access to the information provided by users, suppliers, employees and contractors of YANAPI.

YANAPI may occasionally share your personal information with certain data processors, acting as suppliers, who have been previously verified not only regarding the handling of the data that comes to their knowledge, but also regarding their compliance with a confidentiality agreement for the information provided and also with a value chain of compliance with applicable regulations, and anti-bribery, anti-corruption and fraud prevention policies or procedures.

You expressly acknowledge and agree that YANAPI may transfer your data received or collected to: (i) any of the members of the companies related, affiliated, controlled, controlling, subsidiaries, representatives or linked to YANAPI SA; (ii) third party providers of data processing and handling services; and, (iii) other third parties that may require such data from YANAPI for a lawful purpose, for example, for the purposes of audits and supervision by State regulators, as well as by administrative or judicial authorities.

Effects of data delivery

The information provided to YANAPI requires the free, prior, informed and express consent of the owner of the information, which will be obtained by physical or electronic means, so that it can be consulted later. The owner undertakes to provide correct and accurate data, otherwise he/she will be responsible for the processing of the information provided. Authorization is not required in cases of requests from public or administrative entities in the exercise of their legal functions, data of public knowledge or cases of medical or health emergency.

– If the user considers that YANAPI should not use or share their personal information, they must express this expressly through the Data Protection Officer, by email at proteciondedatos@yanapi.com.

– Data subjects may at any time revoke the authorization granted for the processing of their data or request the deletion of such data, provided that this is not prevented by a legal or contractual provision.

– YANAPI establishes simple and free mechanisms that allow the owner to revoke his authorization or request the deletion of his data, at least by the same means by which it was granted.

Consent of the owner or interested party

YANAPI will provide the owner or interested party with the necessary tools or means to unequivocally grant their consent regarding the processing of their data and, therefore, their compliance with this Policy.

However, such consent may be collected by YANAPI, through the acceptance of the owner or interested party, whether verbally, physically, digitally or through other means used by YANAPI.

Additionally, the owner or interested party authorizes YANAPI to:

– Consult and process the data and preferences in detail, so that YANAPI can offer its products and services in an optimal manner;

– Contact the owner or interested party to offer value proposals for products and services of YANAPI SA or its related companies;

– Transfer or communicate data to companies related to YANAPI SA or business partners, for the customization of products and services to be offered to the owner or interested party, suppliers, clients and franchises with which collaboration agreements, information security and data protection are maintained;

– Process in an automated manner and incorporate the data subject to processing into the corresponding automated personal data files for which YANAPI will be responsible;

– As a guarantee of informed consent and transparency of legitimate interest, the data protection declaration will direct for further details to the privacy policy notice published on this website.

Changes to the data protection policy

Updates to this document will be notified through the YANAPI website or through the digital channels we have made available to you. It is your responsibility to review them constantly. We will inform you of any details that may affect the processing of your data, without this implying a detriment to your rights as the owner.