PROPTECH SOCIEDAD POR ACCIONES SIMPLIFICADA NIT 901286693 – 1

Our Personal Information Processing Policy describes how PROPTECH SOCIEDAD POR ACCIONES SIMPLIFICADA NIT 901286693 – 1 (hereinafter, “COOLHOUSE”), controlling company of the web platform www.coolhouse.com.co, among others, will handle and manage the personal information of the Holders, in accordance with Law 1581 of 2012 and other rules governing the matter. The guidelines that you will find below will apply to COOLHOUSE databases or files containing personal data, as well as the practices of its agents, employees and contractors, whose purpose will be to safeguard your information and provide appropriate treatment, in the terms required by law.

TO KEEP IN MIND

What is personal data?

It is any data or information that allows linking or associating one or several persons. Examples of personal data include, but are not limited to: name, identification document number, fingerprints (biometric data), a person’s financial information and home address.

Who are personal data subjects?

All natural persons are holders of personal data, i.e., they are the ones who can authorize COOLHOUSE to process them. In that sense, if you are a natural person and user of our services, we inform you that, for all purposes of this policy, you are a Personal Data Subject. However, in the case of a minor, it is the legal representatives or guardians who have the power to grant authorization or not for the treatment that is made to their personal data.

What types of personal data exist?

According to the classification taken by the Colombian law, the classification of personal data in our territory responds to the criterion of the nature of the same. In this sense, the following are the four (4) types of data legally in force:

Public data

They are those that, by express provision in the law, do not require the granting of authorization by the owner of the information to be processed. Such is the case of the data related to the

profession or trade that a person performs, such as a cell phone number or corporate email address; or those found in public documents such as a person’s civil registry.

Semi-private data: Data that are not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to the Data Subject, but also to a group of persons or to society in general. A clear example of this type of data may be the information related to the relations with social security entities or to the financial behavior of individuals, as well as their residence address.

Private data: Data that, due to their intimate nature and because they belong to the private and personal sphere of individuals, are only relevant to the Data Controller or to a specialized group of individuals. This is the case of merchants’ books, private documents, medical records or information extracted from the inspection of a domicile by an authorized entity.

Sensitive data: Data that affect the privacy of the Data Subject or whose improper use may lead to discrimination. Clear examples of this type of personal data are, among others, those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, trade union membership; data related to health, sex life, and biometric data. Regarding this type of personal information, it is important to mention that the Data Controllers are empowered by law not to answer any question in which they are involved and, above all, not to authorize its processing.

What are the rights of data subjects?

Regarding the processing of personal data by COOLHOUSE as the Controller, the Data Controllers have the following rights:

1. Know, update and rectify your personal data.

2. Request proof of the authorization granted to COOLHOUSE, except when expressly exempted as a requirement for the Processing.

3. Be informed, upon request to COOLHOUSE, of the use you have made of your personal data.

4. Free access to personal data that are processed by COOLHOUSE. To revoke the authorization and/or request the deletion of the data when the processing violates the law and, provided that the Superintendence of Industry and Commerce has verified such violation.

6. File before the Superintendence of Industry and Commerce complaints for infringements to the general regime of personal data protection.

What does it mean that COOLHOUSE is the Controller of personal data?

That COOLHOUSE is the Data Controller of the personal data that the Data Controllers, such as you, authorized to use in a certain way, means that it is the one who determines the purposes and ways in which the data will be treated, prior communication to the Data Controllers. In this way, as Data Controller, it must comply with the duties established by Law 1581 of 2012, and other complementary rules, among which are:

1. To inform and guarantee the exercise of the rights of the holders of personal data. 2. Use only personal data that have been obtained through authorization, in accordance with the law, unless they do not require it.

3. To keep the information of the Holders under the required security and privacy conditions.

4. To process the Consultations, Petitions and Claims that are presented.

5. Comply with instructions and requirements issued by the competent administrative authority. How should be the authorization of the Data Subject for the processing of personal data?

1. The authorization must be prior, express and informed, containing the purposes for which the personal data were collected.

2. The authorization must guarantee its subsequent consultation; for this, it may be recorded in a physical, electronic or any other format that allows it, or through a suitable technical or technological mechanism through which it can be unequivocally concluded that, if the conduct of the Holder had not occurred, the data would never have been captured and stored in the database; such as, for example, the one given by our visitors when they enter COOLHOUSE facilities.

What is contained in the authorization for the processing of personal data requested by COOLHOUSE?

By means of the authorization required and requested by COOLHOUSE, the Holder of personal data is informed of the following information:

1. Who collects (COOLHOUSE, as Data Controller).

2. What is collected (data collected).

3. Why do you collect the data (the purposes of the processing).

4. How to exercise rights of access, correction, updating, deletion of personal data provided and/or revocation of authorization.

5. If sensitive personal data is collected and the power not to authorize its treatment.

For how long will the authorization for the processing of personal data granted by the Data Controllers be in force?

You, as the Holder of the personal data, accept and acknowledge that the authorization granted will be valid from the moment you accepted it and for as long as COOLHOUSE carries out its commercial activities; provided that you have not exercised your right to request the deletion of your data from the databases or files of COOLHOUSE or the revocation of the authorization of the treatment, which in any case, will only be appropriate if there is no legal or contractual duty to remain in the database of COOLHOUSE.

TREATMENT AND PURPOSES OF PERSONAL INFORMATION

How does COOLHOUSE capture the personal information of the Registrants?

COOLHOUSE offers its users the possibility of acquiring its services through different sales channels, namely:

1. Social networks under service promotion campaigns

2. Web platform coolhouse.com.co

3. Real estate portals

4. Sales strategies, physical or digital forms where the collection of the information of those interested in leasing or buying a property is carried out.

5. Telephone calls

6. E-mails of COOLHOUSE officers or representatives

These sales and service offering channels represent the ways in which COOLHOUSE receives personal information about its users. In addition, personal information is received directly upon entering COOLHOUSE facilities.

What personal information is processed by COOLHOUSE?

The types of data stored and managed vary depending on the relationship that exists between the Data Subject and COOLHOUSE and the services and benefits offered, as indicated below:

1. If you are a customer and/or supplier of COOLHOUSE, we need to capture personal data, such as:

1.1 Name

1.2 Photography

1.3 Type and number of identification document

1.4 Signature

1.5 Fingerprinting

1.6 Corporate and/or personal management

1.7 Personal or corporate telephone number

1.8 Personal or corporate e-mail address

1.9 Bank account number

1.10 Tax information

1.11 Information related to work history

1.12 Information related to the economic activity carried out by the Company

1.13 Educational level or academic background

2. If you are an officer or contractor at COOLHOUSE, we require you to provide us with personal data, such as:

2.1 Name

2.2 Type and number of identification document

2.3 Signature

2.4 Fingerprinting

2.5 Photography

2.6 Personal telephone and/or cell phone number

2.7 Personal address

2.8 Information regarding affiliation to the General Social Security Health System and payment of contributions

2.9 Bank account number

2.10 Health-related information

2.11 Social stratification

2.12 Information related to work history

2.13 Educational level or academic background

When you give us your consent, either verbally, in writing or through unequivocal acts, you grant us the right to process your personal data, in the terms that you authorize. Thus, we guarantee that your information will not be used for purposes other than those previously agreed.

How does COOLHOUSE use your personal information?

COOLHOUSE requests, consults, stores, safeguards, shares, informs, reports, verifies, processes, modifies, updates, clarifies, withdraws, discloses, transmits and transfers (if applicable) personal information to all those entities, public and/or private, that according to the regulations that regulate them, can and/or must access it, as well as to all those third parties (suppliers and contractors) with whom an agreement of transmission or transfer of personal data has been signed, in the latter case, with prior authorization of the Data Subject. All of the above, in order to meet your expectations at the time of providing our services, as detailed below.

What does COOLHOUSE use your personal information for?

COOLHOUSE may use your personal information for a variety of purposes in connection with the services and benefits offered, including the following:

1. Comply with COOLHOUSE’s internal processes for managing workers, suppliers and contractors.

2. To comply with the purposes proper to the service contracts entered into with customers and/or suppliers, providing services in accordance with the particular needs of the customers.

3. Establish, maintain, modify and terminate the necessary contractual relationships with employees, customers and suppliers; as well as manage and maintain the traceability of all contracts that have been signed and are in force.

4. Comply with tax regulations and all other obligations related to commercial and accounting records.

5. Manage, control and maintain the traceability of the operations carried out in compliance with the corporate purpose of COOLHOUSE.

6. Establish a channel of communication with you in order to inform you of new developments with respect to the services and benefits offered may be created, as well as provide a range of products and services we have for you through commercial campaigns and advertising and marketing to be developed.

7. Promote properties for the purpose of leasing or purchasing them, by sending content related to such properties.

8. Include them in one or more databases, allowing them to be transmitted and/or transferred between COOLHHOUSE, its related subordinates, its parent or controlling company, the subordinates of its parent or controlling company, so that directly or through third parties, they can treat the Personal Data in accordance with the purposes set forth in this policy. Likewise, the

COOLHOUSE databases may include and integrate data transmitted and/or transferred to COOLHOUSE by the Authorized Entities and/or third parties.

9. To achieve an efficient communication with the Data Subject, inviting and/or sharing information through any means of contact, related to our products, services, forums, promotions, alliances, studies, contests, events, contents, advertising and marketing campaigns, benefits, conditions or applicable policies, customer service channels, social networks, as well as those of the Authorized Entities.

10. Transmit personal information to third parties or commercial allies with whom an agreement for the transmission of such information has been signed, in order to complement and improve the offering of products and the provision of quality services, from the commercial, administrative and/or marketing areas.

11. Elaborate marketing studies, market segmentation and statistics for internal purposes.

12. Identify, collect and associate to the data, information about your buying habits or interests and share them with The Authorized Entities and/or third parties, such as: use of data related to the management and brokerage of real estate.

13. Manage, control, archive and safeguard all information, databases and files held by COOLHOUSE.

COOLHOUSE does not sell personal information without your consent, however, COOLHOUSE may release your personal information for use by third party contractors and service providers to help us operate our business or provide you with better service.

COMMUNICATION CHANNELS FOR INQUIRIES, PETITIONS AND COMPLAINTS

How will COOLHOUSE deal with the Inquiries, Requests and Complaints (CPR) made by the Data Subjects?

The means and channels provided by COOLHOUSE for the attention of Consultations, Petitions and Claims are the following:

1. Inquiries

All Personal Data Holders, such as You, may consult the personal information contained in our databases through the following mechanisms:

– By means of a written request through the communication channels indicated below:

Physical address: Calle 85 # 11 – 53 Interior 10 office 301 in Bogota D.C. 2. E-mail: info@coolhouse.com.co

Any of the mechanisms you choose to consult the personal data we collect from you must be accompanied by your request, your contact information and a copy of your identification document.

Our policy considers that all information queries will be answered in writing within 10 (ten) business days from the date of receipt of the same. When it is not possible to respond to the request within that period, the interested party will be informed, stating the reasons for the delay and indicating the date on which the request will be answered, which may not exceed 5 (five) business days following the expiration of the first term, as provided in Article 14 of Law 1581 of 2012.

2. Petitions and Claims (update, rectify or delete data and/or revoke authorizations).

As a Personal Data Subject, you also have the right to request us to correct information that is incorrect, incomplete, outdated or that you wish us to delete or revoke the authorization for processing, through the mechanisms and communication channels indicated in the previous paragraph, letting us know the reason for your claim or the facts that give rise to it, accompanied by a copy of your identification document, your contact information and any other document that you wish to assert.

We will evaluate your request and if it is the case, we will require you within 5 (five) days after receiving the claim to correct the faults and provide us with the missing information within a maximum term of two (2) months, under penalty of considering your claim abandoned.

Once the request is complete, we will process your request and send you a communication, via email or physical mail, referring to the receipt and acceptance of your request. The response will be generated within 15 (fifteen) business days following the receipt of the complaint or claim; in case of delay, we will inform you of the causes that give rise to the same and we will indicate the date on which your request will be resolved without such term may exceed 8 (eight) business days following the expiration of the first term, in accordance with Article 15 of Law 1581 of 2012.

Remember that if you are not satisfied with the solution or response provided by COOLHOUSE, you can go to the Superintendence of Industry and Commerce to enforce your rights.

What happens if COOLHOUSE modifies this Privacy Policy and/or the Privacy Notice?

Any change in the Terms and Conditions of the present Personal Information Treatment Policy and/or in the Privacy Notice, will be notified in writing, either through the web page www.coolhouse.com.co or through an email to the email address provided by the user at the time of granting the treatment authorization.

In the event that COOLHOUSE sends the notification of the aforementioned modifications to an e-mail that was unsubscribed, COOLHOUSE will not be responsible for the Data Subject not being aware of the modifications made to the Personal Information Processing Policy and/or the Privacy Notice.

If you feel that COOLHOUSE is not complying with this Personal Information Processing Policy, or if you have other privacy concerns, please contact our customer service staff at info@coolhouse.com.co.

Last updated: Thursday, November 7, 2019

GLOSSARY

Authorization.

Prior, express and informed consent of the Data Subject, to carry out the processing of personal data.

Database.

Organized set of personal data that is the object of processing.

Consultation.

Mechanism by means of which the owners or their assignees may consult personal information contained in any database, whether public or private sector.

Personal data.

Any information that allows the identification of a natural person.

Open data.

Primary or raw data that are made available to any citizen, so that third parties can reuse them and create services derived from them.

Biometric data.

Physical parameters unique to each person that unequivocally prove his or her identity and are identified when a person or part of a person interacts with a specialized system (fingerprint or voice).

Private data.

Data that due to its intimate or reserved nature is only relevant to the owner.

Public data.

Data contained in public documents that are not subject to confidentiality; and data related to the civil status of individuals.

Semi-private data.

Data that is not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to its owner, but also to a group of persons or to society in general.

Sensitive data.

Data that affect the privacy, the private sphere of the holder or whose improper use may generate discrimination.

Data Processor.

Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Controller.

Habeas data.

The right to access, update, modify or delete personal information stored in databases or files, which implies the possibility of being informed about the data recorded about oneself.

Personal Information.

Synonymous with personal data.

Data messages.

Information generated, sent, received, stored or communicated by optical or similar electronic means. Among others, Electronic Data Interchange (EDI), Internet, e-mail, telegram, telex or telefax.

Petition.

Procedure through which the Data Subject or his/her assignees may request that the information contained in a database must be corrected, updated or deleted, revocation of the authorization duly granted or when he/she notices the alleged breach of any of the duties contained in the law.

Complaint.

Mechanism through which the Holders may exercise their rights directly before the Superintendence of Industry and Commerce, having exhausted the process of Consultation, Petition or Claim (CPR) directly before COOLHOUSE.

Claim.

Procedure through which the Data Subject or his/her assignees may request that the information contained in a database must be corrected, updated or deleted, revocation of the authorization duly granted or when he/she notices the alleged breach of any of the duties contained in the law.

Responsible for the treatment.

Natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the processing of data.

Headline.

Natural person whose personal data is processed by COOLHOUSE.

Treatment.

It consists of any activity that is developed on personal data, such as: collection, storage, use, circulation or suppression of personal data.