PERSONAL DATA PROCESSING POLICY – VEZRA INMOBILIARIA S.A.S

1. OBJECTIVE

To establish the guidelines, principles, and procedures through which VEZRA INMOBILIARIA S.A.S guarantees the protection of personal data subject to processing, in compliance with Colombian legal regulations and corporate best practices in privacy and information protection.

2. IDENTIFICATION OF THE DATA CONTROLLER

VEZRA INMOBILIARIA S.A.S, identified with Tax ID (NIT) 901.915.000-6, domiciled in the Republic of Colombia, acts as the DATA CONTROLLER of personal data. Email for personal data matters: contacto@vezra-group.com

3. SCOPE

This policy applies to all personal data processed by VEZRA INMOBILIARIA S.A.S in the development of its real estate activities, including information related to clients, potential clients, property owners, tenants, investors, suppliers, contractors, strategic partners, employees, and third parties in general.

4. LEGAL FRAMEWORK

This policy is governed by the following provisions: • Political Constitution of Colombia • Law 1581 of 2012 • Decree 1377 of 2013 • Decree 1074 of 2015 • Law 1266 of 2008 (when applicable) • Guidelines and circulars issued by the Superintendence of Industry and Commerce

5. DEFINITIONS

For the interpretation of this policy, the definitions set forth in Law 1581 of 2012 are adopted, including, among others: personal data, sensitive data, public data, processing, controller, processor, transmission, and transfer of personal data.

6. GUIDING PRINCIPLES

The processing of personal data will be carried out in accordance with the following principles: LEGALITY, PURPOSE, FREEDOM, ACCURACY OR QUALITY, TRANSPARENCY, RESTRICTED ACCESS AND CIRCULATION, SECURITY, CONFIDENTIALITY, AND ACCOUNTABILITY.

7. TYPES OF PERSONAL DATA PROCESSED

VEZRA INMOBILIARIA S.A.S may process the following categories of data: • Identification data. • Contact data. • Financial and asset data. • Commercial, contractual, and administrative data. • Property location data. • Browsing and technological data. • Employee and contractor data. • Supplier and partner data.Sensitive data will be processed only when strictly necessary and with the data subject’s express authorization.

8. PURPOSES OF DATA PROCESSING

Personal data will be processed to: • Execute the corporate purpose and real estate activities. • Manage property purchase, sale, leasing, and administration processes. • Manage contractual and pre-contractual relationships. • Comply with legal, accounting, tax, and regulatory obligations. • Handle requests, inquiries, complaints, and claims. • Manage administrative, financial, and billing processes. • Conduct commercial and market analysis. • Send commercial and promotional information, when authorized. • Ensure the security of people, assets, and information. • Comply with requests from competent authorities.

9. DATA SUBJECT AUTHORIZATION

Personal data processing will be carried out with the prior, express, and informed authorization of the data subject, except for legal exceptions. Authorization may be obtained through physical or electronic means or through unequivocal conduct that allows verification.

10. DATA SUBJECT RIGHTS

Data subjects have the right to: • Know, update, and rectify their data. • Request proof of the authorization granted. • Be informed about the use of their data. • Revoke authorization and/or request data deletion. • File complaints before the Superintendence of Industry and Commerce. • Access their personal data free of charge.

11. PROCEDURE FOR INQUIRIES AND CLAIMS

Inquiries and claims must be submitted via email to contacto@vezra-group.com. Response times will be those established in Law 1581 of 2012 and related regulations.

12. DUTIES OF THE CONTROLLER

VEZRA INMOBILIARIA S.A.S commits to: • Guarantee the full exercise of data subject rights. • Maintain information under adequate security conditions. • Process inquiries and claims in accordance with the law. • Update, rectify, or delete data when applicable. • Require processors to comply with security standards. • Comply with instructions from supervisory authorities.

13. DATA PROCESSORS

The company may appoint data processors for information processing, requiring contractual compliance with personal data protection regulations.

14. DATA TRANSFER AND TRANSMISSION

Personal data may be transferred or transmitted to third parties within or outside the country when necessary to fulfill the described purposes, ensuring adequate levels of information protection.

15. SECURITY MEASURES

VEZRA INMOBILIARIA S.A.S implements reasonable technical, human, and administrative measures to protect personal data against unauthorized access, loss, alteration, or misuse.

16. EFFECTIVE DATE AND MODIFICATIONS

This Personal Data Processing Policy is effective as of its publication and will remain in force as long as the purpose of the processing exists. Any substantial modification will be communicated to the data subjects in a timely manner.