1. Information for the user

Who is responsible for the processing of your personal data?

VINÍCOLA DE SARRAL I SECCIÓ DE CRÈDIT COVISAL, SCCL is the DATA CONTROLLER for the USER's personal data and hereby informs that such data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD).

Why do we process your personal data and on what basis?

Depending on the form through which we have obtained your personal data, we will process them confidentially to fulfil the following purposes:

Contact form:

— To respond to enquiries or any type of request made by the user through any of the contact methods available on the controller's website (legitimate interest of the Controller, art. 6.1.f GDPR)

— To carry out statistical analyses and market studies (legitimate interest of the Controller, art. 6.1.f GDPR)

How long will we keep your personal data?

Data will be retained for no longer than is necessary to fulfil the purpose of the processing, or for as long as there are legal obligations requiring their custody. Once they are no longer needed, they will be deleted using appropriate security measures to ensure the data are anonymised or completely destroyed.

To whom do we disclose your personal data?

No disclosure of personal data to third parties is foreseen, except where necessary for the development and execution of the purposes of the processing, to our communications-related service providers, with whom COVISAL has entered into the confidentiality and data processing agreements required by current privacy regulations.

What are your rights?

The USER has the following rights:

— Right to withdraw consent at any time.

— Right of access, rectification, portability and erasure of personal data, and the right to restriction of or objection to their processing.

— Right to lodge a complaint with the supervisory authority (www.aepd.es) if you consider that the processing does not comply with current legislation.

Contact details to exercise your rights:

VINÍCOLA DE SARRAL I SECCIÓ DE CRÈDIT COVISAL, SCCL

Registered office: Avinguda de la Conca, 33 — 43424 Sarral (Tarragona), Spain

E-mail: rgpd@covisal.cat

2. Mandatory or optional nature of the information provided by the user

By ticking the corresponding boxes and entering data in the fields of the contact form or download forms, USERS expressly, freely and unequivocally accept that their data are necessary for the provider to attend to their request, and that the inclusion of data in the remaining fields is therefore voluntary.

The USER guarantees that the personal data provided to COVISAL are truthful and is responsible for communicating any changes thereto.

COVISAL informs that all data requested through the website are mandatory, as they are necessary for the provision of an optimal service to the USER. Should not all data be provided, there is no guarantee that the information and services supplied will fully meet the USER's needs.

3. Security measures

In accordance with current personal data protection regulations, COVISAL complies with all provisions of the GDPR and the LOPDGDD for the processing of personal data under its responsibility, and expressly with the principles set out in Article 5 of the GDPR, whereby data are processed lawfully, fairly and transparently in relation to the data subject, and are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

COVISAL guarantees that it has implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPDGDD, in order to protect the rights and freedoms of USERS, and has provided them with adequate information so that they may exercise those rights.

For further information on privacy safeguards, you may contact COVISAL at:

VINÍCOLA DE SARRAL I SECCIÓ DE CRÈDIT COVISAL, SCCL

Avinguda de la Conca, 33 — 43424 Sarral (Tarragona), Spain

E-mail: rgpd@covisal.cat

Version: March 2026