PRIVACY POLICY

INCA TOPS S.A.

Arequipa, July 2025

1. PURPOSE AND SCOPE

The purpose of this document, called the Privacy Policy (hereinafter the Policy), is to inform you about how INCA TOPS S.A. (hereinafter INCA TOPS) uses, protects, and, in general, processes the personal data of its customers, potential customers, and any other person whose information is processed by INCA TOPS in the course of its commercial activities, through its Essentials website, at https://www.incatops.com/stockservice/ (hereinafter the Users’ Web). The information regarding INCA TOPS is as follows:

Name: INCA TOPS S.A.
Taxpayer Registration Number: 20100199743
Address: Avenida Miguel Forga 348 Z.I. Parque Industrial, Arequipa, Peru

2. COMMITMENT TO THE PROTECTION OF PERSONAL DATA

At INCA TOPS, we are committed to, and convinced of the importance of, personal data protection rights, which we guarantee for all Web Users who access this platform.

INCA TOPS processes personal data in strict compliance with Law 29733, the Law for the Protection of Personal Data (hereinafter the Law), its Rules, approved by Supreme Decree 016-2024-JUS (hereinafter the Rules), and other complementary standards.

3. PERSONAL DATA

For the purposes of this Policy, personal data shall be understood as any information that identifies or makes identifiable a natural person – in this case, Web Users – through means that can reasonably be used. INCA TOPS may collect various items of personal data through the different web forms that may be found in the sections of this website – complaints book, purchases section, and others – as well as personal data contained in publicly accessible sources.

The personal data gathered may include given names, family names, telephone number, and cell-phone number. The list is not exhaustive, and other types of personal data may be processed as indicated in the respective form.

When the Web User registers the personal data required in the forms on the website, the User guarantees the accuracy, veracity, and current validity of the information provided. If inaccurate, erroneous, or false personal data are provided, INCA TOPS will not be able to contact Web Users to attain the desired objectives.

4. SECURITY OF WEB USERS’ PERSONAL DATA

INCA TOPS is committed to taking the necessary technical, legal, and organizational measures, as established in Law 29733, the Personal Data Protection Law, and its Rules, approved by Supreme Decree 016-2024-JUS, to guarantee the security and proper processing of the personal data of data subjects, as well as to prevent any improper manipulation, accidental loss, destruction, or unauthorized access by third parties.

It is hereby made known that Web Users’ information will not be sold, transferred, or shared without their authorization, much less for purposes other than those for which it was requested. However, currently, no system is completely secure or free from attacks of any kind, and it is not possible to prevent completely the loss, misuse, alteration, unauthorized access, and theft of personal data or confidential information provided.

5. AIMS OF PERSONAL DATA PROCESSING

5.1. FOR SENDING ADVERTISING

The personal data of Web Users interested in receiving advertising will be gathered by INCA TOPS in the personal data bank called ‘Advertising’, owned by INCA TOPS, for the purpose of sending advertising for INCA TOPS and/or the companies that are part of this group.

To this end, INCA TOPS may use call centres, telephone call systems, sending text messages to cell phones or mass and/or personalized e-mails, sending magazines and/or catalogues, and/or any other similar means of communication, whether existing or which may exist in the future.

1. MANDATORY AND OPTIONAL PERSONAL DATA
   In order to realize the aims described in section 5.1, you must provide us with the following personal data: given and family names, e-mail address, company where you work, and country of residence.
   The following data are optional: address, landline and cell-phone numbers.
2. CONSEQUENCES OF PROVIDING DATA OR REFUSAL TO DO SO
   Advertising will be sent through the provided means only with the consent of the Web User.
3. RETENTION PERIOD
   Your personal data will be processed as long as we have the Web User’s consent to realize the aims described in section 5.1.
4. RECIPIENTS OF PERSONAL DATA
   In order to realize the aforementioned aims, INCA TOPS may transfer the personal data of Web Users to the following recipients

Recipient	Country
Directly related organizations or individuals	Peru
Companies members of the Group
Publicity or marketing companies
Digital Ocean	USA

5.2. AIM OF PROCESSING PERSONAL DATA FOR QUOTATION AND BUSINESS RELATIONSHIP PURPOSES

INCA TOPS collects its customers’ personal data in the personal database called ‘Customers’, which is owned by INCA TOPS, for the purposes of:

1. Providing a quote for INCA TOPS products or services.
2. Executing the contractual relationship that arises between the customer and INCA TOPS.
3. Evaluating any request you make and/or may make, and also conducting satisfaction surveys within the framework of the execution of the contractual relationship.
4. Meeting statistical and historical requirements for INCA TOPS.

1. OBLIGATORY AND OPTIONAL PERSONAL DATA
   To achieve the ends described in section 5.2, it is obligatory that you provide us with the following personal data: given and family names, ID number, telephone number, e-mail address, home address, Taxpayer Registration Number, and bank details
   
   
2. CONSEQUENCES OF PROVIDING THE DATA OR REFUSAL TO DO SO
   Failure to provide the obligatory data will prevent the aims indicated in section 5.2 of this Policy from being fulfilled.
   
   
3. RETENTION PERIOD
   Your personal data will be processed as long as necessary to fulfil the aims described above or for a maximum period of five (05) years from the date of purchase of our product or service, with the exception of legal requirements which may exceed this period.
   
   
4. RECIPIENTS OF PERSONAL DATA
   To carry out the aims described above, INCA TOPS may transfer the personal data of Web Users to the following recipients:

Recipient	Country
Directly related organizations or individuals	Peru
Companies members of the Group
Financial institutions
Credit-reporting bureaux
Tax Administration
Digital Ocean	USA

5.3. FOR THE ADDRESSING OF COMPLAINTS AND CLAIMS

INCA TOPS collects the personal data of individuals who present a claim, complaint, or suggestion in the personal database called ‘Complaints and Claims’, ​​which is owned by INCA TOPS, for the purposes of:

1. Responding to complaints or claims presented.
2. Compliance with the provisions of Law 29571, the Consumer Protection and Defence Code.

1. MANDATORY PERSONAL DATA
   ITo fulfil the aims described in section 5.3, you must provide us with the following personal data: given and family names, email address, home address, ID number, cell-phone number, and age.
   
   
2. CONSEQUENCES OF PROVIDING DATA OR REFUSAL TO DO SO
   If the consumer does not provide, at a minimum, their name, ID number, address or e-mail address, the date of the claim or complaint, and the corresponding details, these will be considered as not presented, and INCA TOPS will not be able to fulfil the aim set out in section 5.3 of this Policy.
   
   
3. RETENTION PERIOD
   Your personal data will be processed as long as necessary to fulfil the aims described above and for a maximum period of two (02) years from the date the complaint or claim is filed.
   
   
4. RECIPIENTS OF PERSONAL DATA
   To achieve the aims described above, INCA TOPS may transfer the personal data of Web Users to the following recipient

Recipient	Country
Digital Ocean	USA

6. CONFIDENTIALITY OF PERSONAL DATA

The personal data provided will be treated with complete confidentiality. INCA TOPS undertakes to maintain professional secrecy indefinitely regarding said data and guarantees its duty to safeguard those data by adopting all necessary security measures.

7.EXERCISE OF PERSONAL-DATA PROTECTION RIGHTS

As holders of their personal data, Web Users have the right to access these personal data; to know the details of how they are processed; to rectify them if inaccurate or incomplete; and to request their deletion or cancellation if they consider them unnecessary for the aims previously stated, or object to their being processed for specific purposes.

Web Users who have provided their personal data to INCA TOPS may therefore contact the company in order to exercise their rights to information, access, data portability, rectification (updating and inclusion), cancellation (deletion), and objection.

To exercise these rights, they may contact the following address by any means that allows proof of sending and receiving the request: Avenida Miguel Forga 348 Z.I. Parque Industrial, Arequipa, or write to derechosarco@incatops.com with the reference ‘Personal Data Protection’, and attaching the following information:

1. Given and family names of the holder of the rights.
2. Specific request giving rise to the petition, which must contain a clear and precise description of the personal data for which the Personal Data Protection Rights are requested, as well as the specific details of which rights are being exercised.
3. Supporting documents for the request (if any).
4. E-mail address for receiving notifications.
5. Date and signature of the applicant making the request.
6. Copy of the applicant’s ID.
   
   

8. PERSONAL DATA PROTECTION RIGHTS DEADLINE

The response time to the request to exercise the right to information is eight (8) working days; the right to rectification (update and inclusion), cancellation, and objection (deletion) is ten (10) working days; and the right to access and portability of personal data is twenty (20) working days. All of these deadlines, with the exception of the right to information, may be extended once and for an equal period, provided that circumstances justify it. This extension and its justification must be communicated to the data subject or their legal representative within the period for which the extension is sought.

Personal data will not be erased when they must be retained for historical, statistical, or scientific reasons, in accordance with applicable regulations, due to contractual relationships with the data subject that justify their processing, or by order of the competent authority.

In addition, if personal data subjects believe they have not been respected in the exercise of their rights, they may file a complaint with the National Personal-Data Protection Authority by contacting the Reception Desk of the Ministry of Justice and Human Rights: Calle Scipión Llona No. 350, Miraflores, Lima, Peru.

9. PERSONAL-DATA OFFICER

With the aim of ensuring adequate compliance with personal data protection, the post of Personal-Data Officer (PDO) has been implemented at INCA TOPS. The PDO’s role is to verify, advise, and implement compliance with the legal regime on personal-data protection.

Information regarding the PDO is made available to personal-data subjects should they need to make any communication regarding personal-data protection on the website:

• Name / Position or Title: […]
• E-mail: […]

10. CHANGES TO THE PRIVACY POLICY

INCA TOPS reserves the right to make modifications, adjustments, or updates to this privacy policy at any time to address new legal, regulatory, or jurisprudential provisions or adopted internal policies.