Personal Data Processing Policy

01

Identification of the Data Controller

This Personal Data Processing Policy is adopted by Inversiones Chimaná S.A.S., identified with Tax ID (NIT) 901.106.351-5, a Colombian company related to Wildshore Capital Partners, Inc., holding company of the Chimaná Village ecosystem (hereinafter "Chimaná Village"). Inversiones Chimaná S.A.S. acts as the controller of the personal data collected through the website, forms, digital channels and commercial processes of Chimaná Village.

The data may be transmitted or shared, where necessary and legally appropriate, with Wildshore Capital Partners, Inc. and with the other companies related to the ecosystem for corporate, administrative, commercial or structuring purposes, in accordance with this policy and the applicable regulations.

Controller details

Legal name

Inversiones Chimaná S.A.S.

Tax ID (NIT)

901.106.351-5

Ecosystem

Chimaná Village · Holding: Wildshore Capital Partners, Inc.

Address

Vereda Santa Elena Bajo, Barichara, Santander, Colombia. 684048

Email

info@chimana-village.com

Phone / WhatsApp

+57 (300) 351 5616

Website

www.chimana-village.com

02

Purpose and scope

This policy establishes the terms, conditions and safeguards under which Chimaná Village collects, stores, uses, circulates and, in general, processes the personal data of the individuals who interact with the project through its digital and physical channels.

It applies to all personal data recorded in the databases of Chimaná Village, in accordance with Law 1581 of 2012, Decree 1377 of 2013 and other applicable Colombian regulations on the protection of personal data.

03

Definitions

Term	Definition
Personal data	Any information linked to, or that may be associated with, one or more determined or determinable natural persons.
Sensitive data	Data affecting the data subject's privacy or whose misuse may lead to discrimination: racial origin, sexual orientation, health, biometric data, among others.
Data subject	The natural person whose personal data is subject to processing.
Controller	The natural or legal person who decides on the database and/or the processing.
Processor	The natural or legal person who processes data on behalf of the controller.
Processing	Any operation on personal data: collection, storage, use, circulation, deletion, among others.
Authorization	The data subject's prior, express and informed consent to carry out the processing.
Database	An organized set of personal data subject to processing.

04

Personal data that is collected

Chimaná Village collects the following personal data through its digital and physical channels:

Category	Data collected	Channel
Identification	Full name, identity document number	Web forms, in-person meetings
Contact	Email, phone, WhatsApp, country of residence	Web forms, WhatsApp
Interest profile	Component of interest within the ecosystem, reason for contact	The Path to Belonging form
Web interaction	Browsing cookies, IP address, pages visited (through analytics tools such as Google Analytics)	Website
Communications	Content of messages sent through forms or WhatsApp	Forms, WhatsApp

Note on sensitive data: Chimaná Village does not intentionally collect sensitive data through its forms and general channels. If the data subject voluntarily includes information of this nature in their communications, it will be treated with the same discretion and confidentiality as the rest of their data, without being subject to additional processing. The only exception is the identity verification process applicable to the equity or investment participation paths, which may involve the processing of biometric data (facial image). Such processing is governed by the specific section "Identity verification and biometric data" of this policy and requires prior, express and independent authorization.

Identity verification and biometric data

For those who pursue the reserved information of the project, access may require an identity verification process that includes capturing and matching a facial image (selfie) together with the identity document, as well as a liveness check. This processing involves biometric data, which the law considers sensitive data, and is governed by the following conditions:

Provider	The verification is carried out by Didit (didit.me), a specialized identity-verification provider that acts as a data processor in accordance with its own verification policies and privacy notices.
Data processed	Image of the identity document, facial image (selfie) and data derived from the liveness check and the 1:1 facial match.
Purpose	Solely to verify the data subject's identity and prevent impersonation and fraud. It is not used for profiling, advertising or any commercial purpose.
Receipt and storage by Chimaná	Chimaná Village does not receive or store the identity document image or the data subject's facial image. It only receives the confirmation of the result of the verification (approved or not approved). The images and biometric data are processed directly by the provider (Didit); Chimaná Village has no access to them and does not keep them in its systems.
Retention by the provider	The verification operates under a no-retention configuration: once the result (approved or not approved) is delivered, the document image, the facial image and the biometric data are deleted and not stored persistently. The provider does not retain that information beyond the time needed to run the verification and return its result. During that processing, the data is handled encrypted (AES-256 at rest and TLS 1.3 in transit), with the biometrics protected under a separate key.
International transfer	By default, the provider processes the information in the European Union, under the General Data Protection Regulation (GDPR). The applicable safeguards are governed by the provider's public data-processing terms (Privacy Policy and Data Processing Agreement), which incorporate the European Commission's Standard Contractual Clauses for international transfers, as well as technical security measures. The verification is further supported by the data subject's prior and express authorization, in accordance with Colombian regulations on international data transfers.
When it applies	Identity verification does not apply generally to all interested parties. It is only triggered when a person expresses interest in the ecosystem's equity or investment participation paths, which require signing a confidentiality agreement (NDA) and accessing reserved information. For general inquiries, visits or interest in the other experiences of the ecosystem, biometric verification is not required.
Optional nature	The processing of biometric data is optional: the data subject is not obliged to authorize it. However, when a person chooses the equity or investment participation path, verification is a condition for accessing the corresponding reserved information.
Authorization	This processing requires prior, express and independent authorization, separate from the general consent of this policy, by means of a specific and separate checkbox (not pre-checked) at the time of verification.

The data subject may exercise their rights of access, rectification, updating and deletion regarding this data before Chimaná Village and — where applicable — directly before the provider. Revoking the authorization for biometric processing may prevent the completion of the verification process.

05

Purposes of the processing

The personal data collected will be used for the following purposes:

To manage requests for information about the Chimaná Village project and its components.
To administer the registration and qualification process of The Path to Belonging.
To contact interested parties to schedule private presentation sessions about the project.
To send communications related to the progress of the project, ecosystem news and relevant updates, when the data subject has given their express authorization.
To comply with applicable legal, contractual and regulatory obligations.
To improve the user experience on the website through the analysis of browsing data.
To manage the commercial relationship with potential participants in the ecosystem.

Chimaná Village will not use personal data to make public offerings of securities, mass fundraising, or any activity that could constitute a violation of Law 964 of 2005 or the regulations of the Financial Superintendence of Colombia.

06

Rights of data subjects

In accordance with Article 8 of Law 1581 of 2012, data subjects have the following rights:

To know the personal data that Chimaná Village holds about them and the information related to its processing.
To update their data when it is partial, inaccurate, incomplete, fragmented or misleading.
To rectify data that is inaccurate or incomplete.
To delete their data when they consider that it is not being processed in accordance with the law or when authorization has been revoked — except when there is a legal or contractual obligation to keep it.
To revoke the authorization granted for the processing of their data at any time, when no legal or contractual obligation prevents it.
To access free of charge their personal data that has been subject to processing.
To file complaints with the Superintendence of Industry and Commerce (SIC) for violations of the data protection law.
To not be subject to decisions based solely on the automated processing of their data.

07

Procedure to exercise these rights

To exercise any of the rights described in the previous section, the data subject or their legal representative may send a written request addressed to the data controller, including:

Full name and identification of the data subject.
A clear and precise description of the data over which the right is to be exercised.
Documents supporting the request, if applicable.
A physical or electronic address for the notification of the response.

Contact channels:
Email: info@chimana-village.com
WhatsApp: +57 (300) 351 5616
Physical address: Vereda Santa Elena Bajo, Barichara, Santander, Colombia. 684048

The data controller will respond within a maximum of ten (10) business days from the date the request is received. When it is not possible to address it within that term, the data subject will be informed of the reasons for the delay and the date on which the request will be handled, which may not exceed five (5) business days following the expiration of the first term.

08

Authorization for processing

The processing of personal data requires the prior, express and informed authorization of the data subject. Chimaná Village obtains such authorization through:

Checkboxes on the website forms, in which the data subject confirms having read and accepted this policy.
Verbal or written statement at the time of direct interaction with the Chimaná Village team.
Unequivocal conduct of the data subject that reasonably allows the conclusion that they granted their authorization.

The authorization may be revoked at any time by means of a communication addressed to the controller, without retroactive effect on processing already carried out.

09

Transfer and transmission of data

The personal data collected by Chimaná Village may be shared with:

Wildshore Capital Partners, Inc., holding company of the ecosystem, and the other companies related to Chimaná Village — where necessary and legally appropriate for corporate, administrative, commercial or structuring purposes of the project.
Technology service providers acting as data processors — CRM platforms, web analytics tools, email services — under contracts that guarantee adequate levels of protection.
Identity-verification provider — Didit (didit.me), as a data processor for identity verification and facial biometrics, under the terms of the "Identity verification and biometric data" section.
Competent authorities when Colombian or international law so requires.

When the processing involves the international transfer or transmission of personal data — for example, to technology or identity-verification providers located outside Colombia — it will be carried out under the mechanisms provided for in Colombian regulations. By accepting this policy, the data subject grants their authorization for such transfers.

10

Information security

Chimaná Village adopts the technical, human and administrative measures necessary to guarantee the security of personal data and prevent its alteration, loss, unauthorized or fraudulent consultation, use or access, including:

Restricted access to the databases by authorized personnel.
Use of platforms with security protocols (HTTPS, data encryption).
Confidentiality commitment from the team that accesses the data.
Periodic review of the security measures implemented.

11

Data retention period

Personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and while the relationship with the data subject subsists, or until they revoke their authorization.

Once the purpose of the processing has been fulfilled, the data will be deleted from the databases of Chimaná Village, unless there is a legal, contractual or regulatory obligation to retain it for a specific period.

12

Cookies and tracking technologies

The website www.chimana-village.com uses cookies and similar technologies to improve the user experience and obtain statistical browsing information. Users can configure their browser to reject cookies, although this may affect the functioning of the site.

The cookies used are analytical in nature (Google Analytics) and do not contain directly identifiable personal data.

13

Effective date and amendments

This policy takes effect as of June 1, 2026 and may be amended at any time by Chimaná Village, which will be notified to data subjects through the website www.chimana-village.com at least ten (10) business days in advance.

Amendments will not have retroactive effect on processing already carried out under previous versions of this policy.

14

Superintendence of Industry and Commerce

Should the data subject consider that their rights have been violated, they may file a complaint or inquiry with the Superintendence of Industry and Commerce (SIC), the entity that oversees compliance with Law 1581 of 2012.

Superintendence of Industry and Commerce
Website: www.sic.gov.co
Toll-free line: 01 8000 910165
Address: Carrera 13 No. 27-00, Bogotá D.C., Colombia.

—

Contact for personal data matters

For any inquiry, request or complaint related to the processing of your personal data, you may contact us through the following channels:

Personal data controller

Company