Privacy Policy

1. INTRODUCTION Malco Digital Group SRL reserves the right to modify this Policy in order to adapt it to legislative changes, case law criteria, industry practices, or the interests of Malco Digital Group SRL. Any modification will be announced in advance so that you are fully informed of its content. In order to provide you with certain services, it is necessary to process your personal data. For these purposes, your data will be incorporated into the corresponding processing activities of Malco Digital Group SRL and will be processed for the specific purpose of each processing, in accordance primarily with the regulation established by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).

2. GENERAL INFORMATION Below, Malco Digital Group SRL provides general information regarding the safeguarding of privacy and the protection of personal data applied to the processing activities carried out on the Portal and Electronic Headquarters, as well as by other means: 2.1. Who is the Data Controller for your personal data? Malco Digital Group SRL is the Data Controller, with its registered office for these purposes at Pol. Ind. Estadio, Nave 8, 12400 Castellón (Spain). Contact email: cliente@malcodigitalgroup.com 2.2. For what purposes do we process your personal data? The purpose of collecting and processing personal data through the various forms owned by Malco Digital Group SRL made available to Users is, as applicable, to manage and respond to requests for information, questions, complaints, compliments, or suggestions regarding publications or any services, activities, events, or acts provided, offered, sponsored and/or promoted by Malco Digital Group SRL, as well as to gauge user opinions. In addition, it is used to manage job applications by collecting CVs to contact the interested party and conduct a selection process. Furthermore, commercial communications may be sent via email unless explicit consent is withdrawn at cliente@malcodigitalgroup.com. Some vehicles you rent from MALCO have been manufactured or equipped with onboard devices to remain connected to the Internet (connected vehicle), which allows us to send commands to the vehicle and receive certain information from it, including geolocation data from a global positioning system (GPS). If you rent a connected vehicle, your personal information will be processed in accordance with this Privacy Policy and the General Conditions. 2.3. What is the legal basis for processing your personal data? In other words, what justifies or enables us to process your personal data? The legal basis that legitimizes our processing of your personal data is as follows: (i) the consent you provide by signing or accepting the relevant forms for one or several specific purposes; (ii) and, where applicable, the execution of a contract to which you are a party, either as a contractor or awardee. 2.4. How long do we retain your personal data? We will retain your personal data for the period necessary to maintain a service history and manage our services efficiently, unless the data subject requests its deletion. Even if deletion is requested, the data will be blocked for the required time and processed only for the following purposes: complying with any legal/contractual obligations to which we are subject and/or for the legally prescribed periods for the limitation of any liabilities on our part and/or for the exercise or defense of claims arising from the relationship with the data subject. 2.5. Who is responsible for keeping the data up-to-date? To ensure that the data in our files, whether electronic and/or paper, always reflect reality, they must be kept up-to-date. For this purpose, the User must make changes directly when such functionality is available or by contacting, through a verifiable method, the corresponding department of Malco Digital Group SRL. 2.6. Who can be recipients or beneficiaries of your personal data? Personal data will not be transferred or disclosed to third parties except in cases necessary for the development, control, and fulfillment of the expressed purpose(s) as provided by law. 2.7. Security of personal data Malco Digital Group SRL will adopt appropriate technical and organizational measures in its information system, in compliance with the principle of proactive responsibility, to guarantee the security and confidentiality of stored data, thereby avoiding their alteration, loss, processing, or unauthorized access; taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of the processing, as well as the risks of variable probability and severity associated with each processing. 2.8. What are your data protection rights and how can you exercise them? You may exercise the rights of access, rectification, deletion, limitation, portability, or, where applicable, objection. To do so, you must submit a written request to Malco Digital Group SRL at Pol. Ind. Estadio, Nave 8, 12400 Castellón (Spain) or via email at cliente@malcodigitalgroup.com. The request must specify which right you wish to exercise and, in the case of postal submission, be accompanied by a copy of your ID or equivalent identification document. If acting through a legal representative or authorized agent, you must also provide documentation proving the representation. Furthermore, if you consider your personal data protection rights to have been violated, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es). Additional information on exercising your data protection rights is provided below: a) What are my rights? b) Who can exercise these rights with Malco Digital Group SRL? c) How and where can I exercise these rights? d) Additional information.

3. DATA PROTECTION RIGHTS a) What are my rights? Data protection regulations allow you to exercise the following rights with respect to the Data Controller, Malco Digital Group SRL: the right of access, rectification, objection, portability, deletion ("right to be forgotten"), limitation of processing, and the right not to be subject to individual automated decision-making, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and the free movement of such data (hereinafter, "GDPR") and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD): Access Right: You have the right to know whether we are processing personal data concerning you, the source of your data if you did not provide it, the purposes of the processing, the categories of data involved, the recipients or categories of recipients to whom the data have been or will be disclosed, and, if possible, the retention period of the personal data (or, if not possible, the criteria used to determine that period). You also have the right to lodge a complaint with a supervisory authority. You have the right to be informed if automated decisions – including profiling – are made using your personal data. Rectification Right: You have the right to have your personal data rectified by completing them if they are incomplete or updating/correcting them if they no longer reflect current reality or are inaccurate. Exercising this right will ensure that your personal data are accurate and complete. Deletion Right: You have the right to have your personal data deleted when: the data are no longer necessary for the purposes for which they were collected or processed; you withdraw the consent on which the processing is based and no other legal basis applies; you have successfully exercised your right to object to the processing; or the personal data have been processed unlawfully. Right to Limitation of Processing: You have the right to request the limitation of the processing of your personal data (i.e., that we retain them without using them for the intended purposes). Objection Right: You have the right to request that we stop using your personal data, for example, if you believe that the data we hold about you are incorrect or no longer necessary. Right to Data Portability: When the processing of your data is based on consent or is necessary for the execution of a contract or pre-contract and is carried out by automated means, you have the right to data portability – that is, to receive your data in a structured, commonly used, and machine-readable format, and to have them transmitted to a new data controller if applicable. For this reason, Malco Digital Group SRL will facilitate the portability of your data to the new controller. b) Who can exercise these rights with MALCO DIGITAL GROUP SRL? You, as the data subject, acting in your own name and right, or through another person who is duly accredited as a legal representative (e.g., when guardians act on behalf of a person under 14 years old, or when acting as the legal representative of a person with disabilities) or as an authorized agent (a person to whom you have voluntarily granted representation powers for these purposes). c) How and where can I exercise these rights? By Postal Mail: You may submit your request by sending a written letter to: Pol. Ind. Estadio, Nave 8, 12400 Castellón (Spain). Online: You may submit your request by sending an email to: cliente@malcodigitalgroup.com. In both cases, you must: • Provide sufficient data and information to process your request. You may use the form templates provided by the Spanish Data Protection Agency (https://www.aepd.es/es/derechos-y-deberes/conoce-tus-derechos). • Sign the document manually or, if you have a recognized digital certificate, sign it electronically. • Attach a copy of your ID, passport, NIE, or other equivalent identification document. If acting on behalf of a third party, include a copy of their ID and proof of representation. • Send the form and identification documents using any of the methods mentioned above. d) Additional Information Malco Digital Group SRL will assess whether your request complies with the law and will communicate its decision accordingly: if granted, appropriate measures will be taken based on the right exercised; if denied, the legally provided avenues for appeal will be indicated. In cases where requests are manifestly unfounded or excessive (e.g., repetitive requests), Malco Digital Group SRL may: (i) charge a fee proportional to the administrative costs incurred; or (ii) refuse to act. For further information or clarification regarding your personal data protection rights, please contact: cliente@malcodigitalgroup.com.

4. ADDITIONAL DATA PROTECTION INFORMATION 4.1. Video Surveillance in Buildings and Facilities In order to ensure the security of property, facilities, and premises, as well as the people who work in or access them, Malco Digital Group SRL informs you that surveillance cameras have been installed. This is a precautionary and preventive measure against possible risks, dangers, or violations affecting persons, property, and facilities. The images captured by the surveillance systems are processed by Malco Digital Group SRL as the Data Controller. The lawfulness of the processing is based on Article 6(1)(f) of the GDPR: the processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, especially when the data subject is a child. The images (personal data) will be retained for a maximum period of one month, unless they need to be blocked for disclosure to the competent public authorities in the event that illicit or irregular acts have been captured. In such cases, the images may be transferred to law enforcement agencies, as well as to courts or tribunals. 4.2. Candidates – CV Your data is processed by Malco Digital Group SRL as the Data Controller. The purpose of processing your curriculum vitae data is to conduct personnel selection processes within our organization. The lawfulness of the processing is based on Article 6(1)(a) of the GDPR: the data subject has given consent for the processing of their personal data for one or several specific purposes. The curriculum vitae will be retained for a maximum period of one year, provided that the applicant has not withdrawn the consent given. Your data will not be transferred or disclosed to third parties. 4.3. Clients Your data is processed by Malco Digital Group SRL as the Data Controller. Your personal data will be used to maintain any type of relationship with our clients as a result of the contractual relationship we maintain, particularly with respect to the management of economic, administrative, and fiscal matters, quality, and the personalized attention necessary to fulfill the contractual relationship. The lawfulness of the processing is based on Article 6(1)(b) of the GDPR (processing is necessary for the execution of a contract in which the data subject is a party) and Article 6(1)(c) (processing is necessary for compliance with a legal obligation applicable to the Data Controller). Your personal data will be retained for as long as the relationship exists and, once terminated, will be kept according to the legally prescribed retention periods for economic and fiscal records, which may range from a minimum of 4 years to a maximum of 10 years depending on the type of document. 4.4. Suppliers The personal data of the signatory of the contract, as well as of those who participate or come into contact in connection with the provision of the service, will be processed by Malco Digital Group SRL as the Data Controller. The legal basis for processing the data is the contractual relationship, for the formalization and execution thereof. The purpose of processing is to maintain the contractual relationship, including its economic and technical aspects, as well as the development and control of the contracted service(s) and, where applicable, the communication of information regarding any incidents related thereto. The data will not be transferred to third parties except when required or mandatory to transfer them to public or private entities in order to manage the contractual relationship, as provided by law. The data will be retained for as long as necessary to fulfill the purpose for which they were collected and to determine any potential liabilities arising from such purpose and processing, and may be required by competent public authorities (e.g., Tax Agency, courts or tribunals). 4.5. Social Networks Malco Digital Group SRL maintains various social media profiles to publicize its activities and interact with users. Users of these social networks who voluntarily decide to follow or befriend Malco Digital Group SRL consent to the processing of their personal data related to their profiles for interacting on the social network. Malco Digital Group SRL does not collect data from social networks for purposes other than those mentioned above. The use of social networks involves an international data transfer for the provision of the service. This transfer is carried out based on the social network's adoption of standard contractual clauses, in accordance with Commission Decision 2010/87 of the European Commission. You may stop following or befriending Malco Digital Group SRL at any time. Users must respect the rights of third parties, particularly privacy and data protection rights, as well as intellectual and industrial property laws regarding any information published on the Malco Digital Group SRL page. The publication of any information that in any way violates morality, public order, fundamental rights, or public liberties – with particular regard to the honor, privacy, or image of third parties – and, in general, human rights, is prohibited. The user is solely responsible for any information they publish. We recommend reviewing your social network privacy settings and note the following links to the respective privacy policies: Twitter: https://twitter.com/es/privacy, Facebook: https://es-es.facebook.com/privacy/explanation. 4.6. Email Personal data processed as a result of receiving and/or exchanging emails will be used for responding to your request for information or inquiry, maintaining commercial or professional contacts and relationships arising therefrom, or, where applicable, for sustaining a contractual relationship. 4.7. Electronic Bulletin or Newsletter Additionally, if you expressly authorize it by checking the corresponding box or by your express request, we will keep you informed about our activities. Consent to process your personal data and its subsequent use for sending newsletters may be revoked at any time. A link to do so will be provided at the footer of each newsletter. You may also unsubscribe at any time or contact us using the contact options specified at the end of this document. In the event you subscribe to our newsletter, please note that we use the Mailchimp application for its management, which implies an international data transfer to Mailchimp (The Rocket Science Group LLC) for the provision of the service. This transfer is carried out based on Mailchimp's adoption of standard contractual clauses, in accordance with Commission Decision 2021/915 of the European Commission. Additionally, please note that Mailchimp uses tracking devices to monitor the activity of recipients in order to track email openings and link clicks, and to collect information such as IP address, browser, email client type, and similar details, for the purpose of generating campaign tracking reports and improving the effectiveness of Mailchimp's services. For more information, please consult Mailchimp's Privacy Policy: https://mailchimp.com/legal/privacy/ 2022 – MALCO DIGITAL GROUP SRL