PERSONAL DATA PROCESSING POLICY

ESTABLECER INMOBILIARIA S.A.S.

ESTABLECER INMOBILIARIA S.A.S. (hereinafter referred to as "ESTABLECER"), in compliance with the provisions of Law 1581 of 2012, "whereby general provisions for the protection of personal data are established," the full text of which may be consulted on the Company's corporate website, in its capacity as Data Controller, hereby makes available its Personal Data Processing Policy, the means by which such Policy may be accessed, and the characteristics of the processing intended to be carried out on the data contained in the following databases:

• Property Owner Client Database;

• Tenant Client Database;

• Property Valuation Client Database;

• Sales Client Database;

• Homeowners' Association Management Client Database;

• Employee Database; and

• Third-Party Database.

DATA PROCESSED BY ESTABLECER

ESTABLECER is responsible for the processing of personal data for the purpose of carrying out the activities included within its corporate purpose, including, but not limited to:

• managing and selling real estate;

• acquiring, transferring, leasing, and managing all types of real property or rights derived therefrom, within or outside the territory of the Republic of Colombia;

• administering agency and lease agreements on behalf of third parties, whether natural persons or legal entities;

• leasing or granting concessions over all types of real estate located within or outside the national territory;

• exploiting, enjoying usufruct over, and encumbering all classes of real property;

• entering into commission, brokerage, consignment, and all other forms of intermediary agreements relating to real estate;

• providing real estate advisory services to individuals and legal entities in connection with the promotion, leasing, and sale of real property, real estate development projects, residential complexes, and residential or commercial buildings;

• acquiring and granting, within Colombia or abroad, franchises, commercial agencies, representation agreements, or any other commercial concessions with domestic or foreign companies engaged in activities similar, complementary, or ancillary to the Company's corporate purpose;

• providing appraisal and valuation services for movable and immovable property, both domestically and internationally;

• providing asset tagging and fixed asset identification services;

• conducting market sampling, price verification, and market trend analyses relating to movable and immovable property;

• participating in, investing in, or entering into partnerships, joint ventures, or collaborative business agreements related to the real estate industry;

• managing corporations and commercial establishments under provisional administration as provided by Law 785 of 2002, as amended;

• conducting or commissioning studies, consulting services, appraisals, valuations, and other professional services related to its corporate purpose;

• carrying out investment banking activities, project valuation, investment analysis, and corporate valuation;

• developing infrastructure projects, including roads, highways, bridges, and all other forms of infrastructure;

• participating in public procurement processes, concessions, and government contracts under any legally authorized modality; and

• providing consulting and advisory services in connection with corporate reorganization, restructuring, recovery, and liquidation proceedings, except for fiduciary companies governed by Decree 962 of March 20, 2009.

Furthermore, whenever ESTABLECER, in the course of conducting its business activities, seeks to establish contact with individuals who are not yet its clients but who may become clients, and for such purpose uses their contact information, it shall do so in accordance with the General Personal Data Protection Regime established under Law 1581 of 2012.

Likewise, whenever ESTABLECER requests, obtains, or processes personal information relating to Data Subjects with whom it previously maintained a financial or credit relationship that has already terminated, or whenever it collects, administers, and circulates information concerning its suppliers and contractors, such processing shall likewise be governed by the provisions of Law 1581 of 2012.

ESTABLECER respects every individual and, consequently, their personal data. Accordingly, it shall endeavor to adequately inform Data Subjects of the rights granted to them under applicable law and shall provide the necessary communication channels and mechanisms to enable the effective exercise of such rights.

SCOPE

This Policy shall apply to all employees, officers, and representatives of ESTABLECER. To this end, the Company shall conduct the educational and training programs necessary to ensure that departments with greater interaction in the administration of personal data are fully aware of the applicable legislation and of the internal procedures adopted by the Company to ensure compliance therewith.

Likewise, ESTABLECER shall require all of its business partners, suppliers, contractors, and service providers who have access to the personal data supplied by Data Subjects to comply with the provisions of Law 1581 of 2012, its implementing regulations, and this Personal Data Processing Policy.

1. Personal Data Processing Policy

Through this Policy, ESTABLECER, in fulfillment of its legal and regulatory obligations, seeks to ensure the effective protection of the constitutional right to personal and family privacy of all individuals by establishing appropriate mechanisms and controls to guarantee the lawful and proper processing of the information under its administration.

This Policy establishes the terms, conditions, and purposes under which ESTABLECER, acting as Data Controller with respect to the personal data collected through its various service channels, processes the information of all individuals who, at any time and by reason of the Company's business activities, have provided personal data (hereinafter referred to as the "Data Subject").

These terms and conditions shall apply to any registration of personal data carried out either physically or electronically for purposes of establishing a commercial relationship as a client and/or supplier. The Data Subject provides such information freely, expressly, voluntarily, knowingly, unequivocally, and without any form of coercion, and acknowledges having read and expressly accepted these terms and conditions.

ESTABLECER directly performs the processing of Personal Data; however, it reserves the right to delegate such processing to third parties. Whenever processing is entrusted to a Data Processor, ESTABLECER shall require such processor to implement appropriate procedures, safeguards, and security measures to ensure the protection, confidentiality, and integrity of the Personal Data under its custody.

2. Purpose of Personal Data Processing

The authorization granted for the processing of your Personal Data enables ESTABLECER to collect, transfer, store, use, circulate, erase, share, update, and transmit such data for the purpose of fulfilling, among others, the following objectives:

The databases containing information relating to clients, suppliers, and users are intended to enable the proper provision of the services or products acquired by the Data Subject from ESTABLECER in accordance with its corporate purpose. Such processing also includes, whether directly or through third parties, the performance of research, market studies, technical studies, financial analyses, economic assessments, and any other activities related to the Company's corporate purpose.

Likewise, Personal Data shall be processed for the purposes of:

• Verifying compliance with applicable legal and regulatory requirements;

• Identifying potential conflicts of interest;

• Assessing the financial, legal, and commercial viability of business relationships with clients and suppliers;

• Facilitating tax compliance services, including the preparation and filing of tax returns and electronic tax reports before the National Tax and Customs Directorate (DIAN);

• Providing immigration-related services both within Colombia and abroad;

• Submitting reports to supervisory authorities, regulatory agencies, and credit reporting agencies;

• Collecting, storing, administering, and processing the Personal Data supplied by Data Subjects through the Company's various commercial and communication channels.

In connection with the commercial relationship established with the Data Subject, ESTABLECER may use Personal Data to inform the Data Subject of:

• innovations, improvements, or updates to its products and services;

• opportunities to expand or strengthen the existing business relationship with the Company;

• improvements or modifications to its customer service channels; and

• complementary products and/or services offered either by ESTABLECER or by entities under its supervision or with which it maintains commercial alliances.

ESTABLECER may also send information concerning promotional campaigns, offers developed jointly with business partners that may be of interest to the Data Subject, account statements, account summaries, invoices, receipts, or any other information arising from the contractual relationship, using the mailing address or email address registered in the registration or data update form, or any other address subsequently provided through written or verbal communication.

The Client Database is intended to enable ESTABLECER to establish contact with the Data Subject, introduce itself as a business entity, provide information regarding the products and services it offers, and deliver documentation relating to transactions carried out, including but not limited to invoices, statements of account, collection coupons, payment notices, and similar documents.

The Supplier Database is intended to maintain accurate, complete, and up-to-date information regarding existing suppliers as well as individuals or entities interested in becoming suppliers of ESTABLECER.

The scope of the authorization granted by the Data Subject expressly includes ESTABLECER's right to send messages, notifications, statements of account, outstanding balances, payment reminders, overdue installments, and any other information related to the services acquired or provided, through electronic mail, text messages (SMS), mobile telephone communications, instant messaging applications, online chat platforms, and physical correspondence, using the contact information supplied by the Data Subject.

3. Rights of the Data Subject

The Data Subject is hereby informed of the rights granted under the applicable Personal Data Protection legislation, which ESTABLECER guarantees through the implementation of the procedures set forth below:

• To know, update, and rectify his or her Personal Data held by the Company. This right may be exercised, among other circumstances, with respect to partial, inaccurate, incomplete, misleading, or fragmented data, or data whose processing is expressly prohibited or has not been duly authorized. Such requests shall be submitted in writing through the communication channels established in the Company's Privacy Notice.

• To request evidence of the authorization granted to the Company for the processing of Personal Data, except where such authorization is not required pursuant to Article 10 of Law 1581 of 2012. For this purpose, ESTABLECER shall retain the authorizations granted by Data Subjects whenever such authorizations have been provided in writing, recorded through telephone communications, or obtained through the Company's website or electronic mail.

• To be informed, upon request, of the use that has been made of his or her Personal Data.

• To file complaints before the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio – SIC) for any alleged violations of the provisions of Law 1581 of 2012 or any regulations that amend, supplement, or replace it.

• To revoke the authorization granted and/or request the deletion of Personal Data whenever the processing thereof fails to comply with the constitutional and statutory principles, rights, and guarantees governing Personal Data Protection. Such revocation and/or deletion shall proceed whenever the Superintendence of Industry and Commerce determines that the Company or the Data Processor has engaged in conduct contrary to applicable law or the Constitution.

• To access, free of charge, the Personal Data that has been processed by ESTABLECER.

The rights granted to Data Subjects under applicable law may be exercised by:

• The Data Subject, upon providing sufficient proof of identity through any of the identification methods made available by ESTABLECER.

• The heirs or legal successors of the Data Subject, upon demonstrating their legal capacity.

• The duly appointed representative or attorney-in-fact of the Data Subject, upon presentation of the corresponding power of attorney or evidence of legal representation.

• Public authorities or administrative entities, acting within the scope of their legal powers or pursuant to a judicial order.

• Any person acting pursuant to a stipulation in favor of another or on behalf of another, as permitted under applicable law.

4. Requests for Access to Personal Data Contained in the Databases

Data Subjects or their legal successors may consult the Personal Data relating to the Data Subject contained in any database administered by ESTABLECER. In such event, ESTABLECER, or the Data Processor acting on its behalf, shall provide all information contained in the individual record or otherwise associated with the identification of the Data Subject.

To request access to Personal Data, obtain a copy of the authorization granted, or receive information regarding the processing of Personal Data, the Data Subject shall submit a written request addressed to ESTABLECER including, at a minimum:

• the full name of the Data Subject;

• a copy of the identification document;

• a description of the request;

• residential address;

• telephone number; and

• email address.

Regardless of the communication channel used to submit the request, ESTABLECER shall respond within a maximum period of ten (10) Business Days following receipt thereof.

Where it is not possible to respond within such period, ESTABLECER shall notify the applicant before the expiration of the initial ten (10) Business Days, indicating the reasons for the delay and specifying the date on which the request will be answered. Under no circumstances may such extension exceed five (5) additional Business Days following the expiration of the original response period.

5. Claims – Procedure for the Exercise of Data Subjects' Rights

Any Data Subject or his or her legal successors who consider that the information contained in a database administered by ESTABLECER should be corrected, updated, or deleted, or who believe that ESTABLECER or any of its Data Processors has failed to comply with its obligations under the applicable Personal Data Protection legislation, may submit a claim to ESTABLECER or to the relevant Data Processor. Such claim shall be processed in accordance with the following rules:

• Submission of Claims:
  To request the correction, updating, rectification, or deletion of Personal Data, or to submit a claim regarding an alleged breach of ESTABLECER's obligations relating to Personal Data Protection, the Data Subject shall submit a written request addressed to ESTABLECER containing at least the following information:

  • Full name of the Data Subject;

  • Copy of the Data Subject's identification document;

  • A detailed description of the facts giving rise to the request or claim;

  • Residential address;

  • Telephone number;

  • Email address; and

  • Any documents that the claimant wishes to rely upon in support of the request or claim.

• Incomplete Claims:
  If the claim is incomplete, ESTABLECER shall request the claimant, within five (5) Business Days following receipt of the claim, to provide the missing information or correct the deficiencies.

  Should the claimant fail to provide the required information within two (2) months from the date of such request, the claim shall be deemed withdrawn.

• Lack of Jurisdiction:
  If the person receiving the claim is not competent to resolve it, the claim shall be forwarded to the appropriate department or authority within two (2) Business Days, and the claimant shall be informed accordingly.

• Claim Pending Annotation:
  Once a complete claim has been received, ESTABLECER shall include in the corresponding database, within two (2) Business Days, a notation stating "Claim Pending" together with a brief description of the reason for the claim.

  Such notation shall remain in the database until the claim has been finally resolved.

• Response Time:
  Requests for updating, correction, rectification, or deletion of Personal Data shall be resolved within fifteen (15) Business Days, counted from the Business Day following receipt of the complete claim.

  If it is not possible to resolve the claim within such period, ESTABLECER shall notify the claimant before the expiration of the original deadline, indicating the reasons for the delay and specifying the date on which the claim will be resolved. Such extension shall not exceed eight (8) additional Business Days after the expiration of the initial response period.

• Prior Administrative Requirement:
  Before filing any complaint with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio – SIC), the Data Subject, his or her legal successors, or authorized representative must first exhaust the consultation or claims procedure established in this Policy.

• Responsible Department:
  The Customer Service Department shall be responsible for ensuring compliance with these procedures.

  This department shall maintain direct communication with the Company's Commercial, Administrative and Financial, Accounts Receivable, Human Resources, and Quality departments in order to ensure that all obligations established under Law 1581 of 2012 are fully implemented and consistently observed throughout the organization.

​