Personal Data Processing Policy

This Personal Data Processing Policy is adopted by Chimaná Village S.A.S., identified with Tax ID (NIT) 900.929.539-0 (hereinafter "Chimaná Village"), a Colombian company linked to the business ecosystem led by Wildshore Capital Partners, Inc., a holding company incorporated under the laws of the Republic of Panama.

This policy is adopted in compliance with Colombian personal data protection regulations, in particular:

• Law 1581 of 2012 — General Personal Data Protection Regime.
• Decree 1377 of 2013 — Partial regulation of Law 1581 of 2012.
• Single Regulatory Decree 1074 of 2015 — Commerce, Industry and Tourism Sector.
• External Circular 002 of 2015 of the Superintendence of Industry and Commerce (SIC).

Chimaná Village collects the following personal data through its digital and physical channels:

The personal data collected will be used for the following purposes:

• Manage requests for information about the Chimaná Village project and its components.
• Administer the registration and qualification process for the Founders Club.
• Contact interested parties to schedule private project presentation sessions.
• Send communications related to project progress, ecosystem news and relevant updates, when the data subject has given express authorization.
• Comply with applicable legal, contractual and regulatory obligations.
• Improve the user experience on the website through the analysis of browsing data.
• Manage the commercial relationship with potential ecosystem participants.

In accordance with Article 8 of Law 1581 of 2012, data subjects have the following rights:

• Know the personal data Chimaná Village holds about them and the information related to its processing.
• Update their data when it is partial, inaccurate, incomplete, fragmented or misleading.
• Rectify data that is inaccurate or incomplete.
• Delete their data when they consider it is not being processed in accordance with the law or when consent has been revoked — except where there is a legal or contractual obligation to retain it.
• Revoke the authorization granted for the processing of their data at any time, where no legal or contractual obligation prevents it.
• Access free of charge their personal data that has been processed.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the data protection law.
• Not be subject to decisions based solely on the automated processing of their data.

To exercise any of the rights described in the previous section, the data subject or their legal representative may send a written request addressed to the data controller, including:

• Full name and identification of the data subject.
• Clear and precise description of the data over which the right is to be exercised.
• Documents supporting the request, if applicable.
• Physical or electronic address for notification of the response.

The data controller will respond within a maximum of ten (10) business days from the date the request is received. When it is not possible to address it within that term, the data subject will be informed of the reasons for the delay and the date on which the request will be addressed, which may not exceed five (5) business days following the expiration of the first term.

The processing of personal data requires the prior, express and informed authorization of the data subject. Chimaná Village collects such authorization through:

• Checkboxes in the website forms, in which the data subject confirms having read and accepted this policy.
• Verbal or written statement at the time of direct interaction with the Chimaná Village team.
• Unequivocal conduct of the data subject that reasonably allows the conclusion that authorization was granted.

Authorization may be revoked at any time by communication addressed to the controller, with no retroactive effect on processing already carried out.

The personal data collected by Chimaná Village may be shared with:

• Wildshore Capital Partners, Inc. (Panama) — in its capacity as the ecosystem's holding company, for purposes of corporate governance and strategic management.
• Companies linked to the Chimaná Village ecosystem — Promotora Chimaná Village S.A.S., Inversiones Chimaná S.A.S. and other operating companies and SPVs, when necessary for the management of the project.
• Technology service providers acting as data processors — CRM platforms, web analytics tools, email services — under contracts that guarantee adequate levels of protection.
• Competent authorities when Colombian or international law so requires.

Chimaná Village adopts the technical, human and administrative measures necessary to guarantee the security of personal data and prevent its alteration, loss, unauthorized or fraudulent access, consultation or use, including:

• Restricted access to databases by authorized personnel.
• Use of platforms with security protocols (HTTPS, data encryption).
• Confidentiality commitment of the team that accesses the data.
• Periodic review of the implemented security measures.

Personal data will be retained for the time necessary to fulfill the purposes for which it was collected and while the relationship with the data subject subsists, or until the data subject revokes authorization.

Once the purpose of the processing has been fulfilled, the data will be deleted from Chimaná Village's databases, unless there is a legal, contractual or regulatory obligation to retain it for a specified period.

The website www.chimana-village.com uses cookies and similar technologies to improve the user experience and obtain statistical browsing information. Users may configure their browser to reject cookies, although this may affect the functioning of the site.

The cookies used are analytical in nature (Google Analytics) and do not contain directly identifiable personal data.

This policy enters into force as of June 1, 2026 and may be modified at any time by Chimaná Village, which will be notified to data subjects through the website www.chimana-village.com at least ten (10) business days in advance.

Modifications will have no retroactive effect on processing already carried out based on previous versions of this policy.

If the data subject considers that their rights have been violated, they may file a complaint or inquiry with the Superintendence of Industry and Commerce (SIC), the entity that oversees compliance with Law 1581 of 2012.

For any inquiry, request or complaint related to the processing of your personal data, you can contact us through the following channels: