We design the moments people remember.

BLACK PENGUIN S.A.S. (hereinafter, “Black Penguin”) recognises the importance of privacy and the protection of personal data. In compliance with Law 1581 of 2012, Decree 1074 of 2015 (which compiles Decree 1377 of 2013) and other applicable regulations in Colombia, it adopts this Policy to inform data subjects about the processing of their personal data and the mechanisms available to exercise their rights.

This Policy is complemented by the privacy notices, the terms and conditions of the store and of the Waddle platform, and by the specific consents presented to the data subject at the moment the information is collected (for example, in web forms, WhatsApp, SMS, email or the Waddle application).

Data controller: BLACK PENGUIN S.A.S. — NIT 902.076.036-3.

• Registered address / contact address: Carrera 40 B # 17 - 188, Medellín, Antioquia, Colombia.
• Contact email for personal data requests: sumate@weareblackpenguin.com.
• Phone: +57 313 487 0405.
• Area responsible for handling enquiries and claims: Black Penguin's Personal Data Protection Area, under the responsibility of Management, through the channels above.

Black Penguin will handle enquiries and claims through the channels above or through any additional channels published on its website and official social profiles (Instagram @blackpenguin_oficial, Facebook /blackpenguinpostres, LinkedIn /company/weareblackpenguin).

This Policy applies to the processing of personal data carried out by Black Penguin in the course of its activities, including but not limited to:

• Customers and prospective customers of the Black Penguin store (gifts, sweets and desserts) who place orders, enquiries or purchases via WhatsApp or other channels.
• Users and customers of Waddle, the WhatsApp automation and artificial intelligence platform developed and operated by Black Penguin.
• Companies that contract or license Waddle to manage their own communications and customer relationships, and the end users of those companies whose data is processed through the platform.
• People who interact with Black Penguin through digital channels (website, forms, chat, WhatsApp or others) and traditional channels.
• Customers, suppliers, partners and third parties with a contractual or pre-contractual relationship.

Depending on the service, Black Penguin may act as:

• Data controller: when it decides on the database and the purposes of the processing (for example, in the operation of the store and the administration of its own customer base).
• Data processor: when it processes personal data on behalf of a client company that contracts or licenses the Waddle platform to manage its own customers.
• Joint controller: when, together with a client or partner, it defines the purposes and means of the processing.

In Waddle licensing or rental agreements, the data transmission agreement signed with each client company will state Black Penguin's role and the specific channels through which data subjects may exercise their rights before that company. Black Penguin will require confidentiality agreements, instructions and security measures from its clients and suppliers where applicable.

When Black Penguin acts as Processor and a data subject addresses an enquiry or claim to it regarding data of a client company, Black Penguin will forward the request to that company, as Controller, within five (5) business days of receipt, will inform the data subject to whom it was forwarded and will support its handling.

Depending on the channel or service, Black Penguin may collect and process the following categories of data:

• Identification and contact: name, type and number of identity document (where applicable), phone, email, city, delivery address.
• Order and purchase data: products requested, order history, payment records, delivery addresses, customer preferences.
• Waddle platform data: contacts, conversations, templates, campaigns and announcements managed by client companies through the platform, as well as usage logs and account configuration.
• Service and support data: requests, complaints and claims, communication traceability and records of case handling.
• Technical and browsing data: IP address, device identifiers, logs, cookies or similar technologies, usage analytics.
• Geolocation (where applicable): approximate location, only where necessary for the purpose disclosed (for example, delivery coverage or security).
• Images, audio or video (where applicable): material supplied by the data subject or required as evidence, according to the rules of each activity.

Sensitive data: Black Penguin will process sensitive data only where strictly necessary and with explicit authorisation. Providing sensitive data is optional. When a Waddle client company, due to its activity (for example, health services), receives sensitive data in its conversations, obtaining the authorisation is the responsibility of that company as Controller, and Black Penguin will apply reinforced security measures as Processor.

Data of children and adolescents: where a service allows the participation of minors, the authorisation of the legal representative will be requested, observing the best interests of the child and their prevailing rights.

Black Penguin will process personal data for the following general purposes, plus any additional purposes disclosed for each service:

• Managing orders, sales, deliveries and after-sales service for the Black Penguin store.
• Operating, maintaining and improving the Waddle platform for its client companies, including sending and managing WhatsApp messages on behalf of those companies.
• Handling requests, enquiries, complaints and claims, and technical and operational support.
• Carrying out measurement, analytics, reporting and statistics for service improvement, security and quality control.
• Sending information related to orders or to the service and, where authorisation exists, commercial and marketing communications through the authorised channels (WhatsApp, SMS, email or others).
• Complying with legal, contractual and accounting obligations and requests from authorities.

Specific geolocation purposes (where applicable): validating delivery coverage, enabling platform functionality, improving security and preventing fraud.

Processing will be carried out on the basis of: (i) the data subject's prior, express and informed authorisation, (ii) compliance with legal obligations, (iii) the performance of a contractual or pre-contractual relationship, and/or (iv) other grounds provided for by law.

Authorisation may be obtained by physical or electronic means (forms, checkboxes, data messages, acceptance within the platform, recordings, etc.). The data subject may revoke their authorisation or request the deletion of their data where legally admissible. To stop receiving commercial communications via WhatsApp, the data subject may also request this by replying in the same conversation in which they receive them.

Black Penguin uses Waddle, its own automation and artificial intelligence platform, to manage records, conversations, communications and support over WhatsApp, both for its own store and on behalf of the companies that license the platform. The data subject understands that, on messaging channels, the exchange of information may involve third-party platforms (e.g. WhatsApp/Meta) subject to their own policies.

To generate automated responses, Waddle uses artificial intelligence models from external providers, which process the content of conversations solely to provide the service. Black Penguin does not authorise the use of this data to train third-party models, nor does it use it to train its own models. Automated responses do not constitute decisions with legal effects on the data subject, and the data subject may ask to be attended to by a person.

In all cases, Black Penguin will use the data exclusively for the purposes disclosed and will apply reasonable security measures.

Black Penguin may transmit data to suppliers that support its operation (hosting, databases, messaging, artificial intelligence, analytics, CRM, development, support, order logistics) under agreements requiring confidentiality, security and use limited to the contracted purposes.

For services delivered through Waddle, Black Penguin may share with the client company the information necessary for the performance of the contract, auditing and service compliance, as disclosed in each case.

To operate Waddle and its other services, Black Penguin uses cloud service providers that process or store information outside Colombia, mainly in the United States and Brazil. These providers deliver infrastructure and server, database, file storage, artificial intelligence and messaging services. Black Penguin transmits data to these providers under contracts requiring confidentiality, security and use limited to the provision of the service, in accordance with applicable regulations. The up-to-date list of providers may be requested through the contact channels set out in this Policy.

The data subject may exercise, among others, the following rights:

• To know, update and rectify their personal data.
• To request proof of the authorisation granted.
• To be informed about the use made of their personal data.
• To submit enquiries and claims, and to request deletion or revocation where admissible.
• To access their personal data free of charge, under the terms of the law.
• To file complaints with the Superintendence of Industry and Commerce (SIC) for infringements, after first submitting the matter to Black Penguin.

The data subject may send requests to sumate@weareblackpenguin.com or to the channels published by Black Penguin. The request must include: the data subject's name and identification (or proof of representation), a clear description of the request, contact details for the response and, where applicable, supporting documents.

Enquiries: handled within a maximum of ten (10) business days from receipt. If this is not possible, the reason and the new response date will be communicated, which will not exceed five (5) additional business days.

Claims (correction/update/deletion/revocation): handled within a maximum of fifteen (15) business days from the day following receipt. If this is not possible, the reason and the new response date will be communicated, which will not exceed eight (8) additional business days.

If a claim is incomplete, Black Penguin will ask the claimant, within five (5) business days of receipt, to remedy the deficiencies. If two (2) months pass from that request without the claimant submitting the required information, the claim will be deemed withdrawn. Once the complete claim has been received, the note “claim in process” and the reason for it will be added to the database within no more than two (2) business days, and will remain until the claim is decided.

Revocation of authorisation or a deletion request will proceed where legally and technically feasible and where no legal or contractual duty requires the information to be retained. For store orders or use of the Waddle platform, deletion or revocation may prevent the purchase, the delivery or the provision of the service from continuing, which will be disclosed under the terms of each activity.

Black Penguin adopts reasonable technical, human and administrative measures to protect personal data and prevent its alteration, loss, unauthorised or fraudulent consultation, use or access, taking into account the nature of the information and the associated risks.

If a breach of security codes or a risk in the management of the information occurs, Black Penguin will immediately adopt measures to contain it, will report it to the Superintendence of Industry and Commerce under the terms of the law when acting as Controller and, when acting as Processor, will inform the responsible client company without delay so that it can meet its reporting duties.

Personal data will be retained for as long as necessary to fulfil the purposes disclosed, meet legal and contractual obligations, resolve disputes, carry out audits and handle claims. Once the purpose has been fulfilled, data will be deleted or anonymised as appropriate, unless a retention obligation applies. Data processed on behalf of Waddle client companies will be retained and deleted as agreed in the data transmission agreement with each company.

The website may use cookies or equivalent technologies to enable its operation, improve the experience, perform analytics and strengthen security. Users can manage cookies from their browser. If Black Penguin implements a cookie banner, configuration and preference options will be disclosed there.

Where an application or service requires geolocation, Black Penguin will request device permissions and explain the purpose. The data subject may allow or deny the permission from their operating system. If denied, certain features may be unavailable, which will be disclosed within the app or the service.

Black Penguin will not use geolocation for purposes other than those disclosed, unless additional authorisation is given or a legal duty applies.

This Policy is effective from the date indicated on the cover and may be updated. Any material change will be communicated through the available means (website, service notices or contact channels). History: version 1.0 of August 3, 2026; version 1.1 (current), which clarifies the use of third-party artificial intelligence, international transfers, the responsible area, the forwarding of requests when Black Penguin acts as Processor, the handling of incomplete claims and the management of security incidents.