Personal Data Processing Policy

This Personal Data Processing Policy is adopted by Chimaná Village S.A.S., identified with tax ID (NIT) 900.929.539-0 (hereinafter "Chimaná Village"), a Colombian company linked to the business ecosystem led by Wildshore Capital Partners, Inc., a holding company incorporated under the laws of the Republic of Panama.

This policy is adopted in compliance with Colombian personal data protection regulations, in particular:

• Law 1581 of 2012 — General Regime for the Protection of Personal Data.
• Decree 1377 of 2013 — Partial regulation of Law 1581 of 2012.
• Sole Regulatory Decree 1074 of 2015 — Commerce, Industry and Tourism sector.
• External Circular 002 of 2015 of the Superintendency of Industry and Commerce (SIC).

Chimaná Village collects the following personal data through its digital and physical channels:

The personal data collected will be used for the following purposes:

• To handle requests for information about the Chimaná Village project and its components.
• To manage the registration and qualification process of The Path to Belonging.
• To contact interested parties to schedule private presentation sessions of the project.
• To send communications related to the progress of the project, ecosystem news and relevant updates, when the data subject has given their express authorisation.
• To comply with applicable legal, contractual and regulatory obligations.
• To improve the user experience on the website through the analysis of browsing data.
• To manage the commercial relationship with potential participants of the ecosystem.

In accordance with article 8 of Law 1581 of 2012, data subjects have the following rights:

• To know the personal data that Chimaná Village holds about them and the information related to its processing.
• To update their data when it is partial, inaccurate, incomplete, fragmented or misleading.
• To rectify data that is inaccurate or incomplete.
• To delete their data when they consider that it is not being processed in accordance with the law or when authorisation has been revoked — except where there is a legal or contractual obligation to retain it.
• To revoke the authorisation granted for the processing of their data at any time, where there is no legal or contractual obligation preventing it.
• To access free of charge their personal data that has been subject to processing.
• To file complaints before the Superintendency of Industry and Commerce (SIC) for breaches of the data protection law.
• Not to be subject to decisions based solely on the automated processing of their data.

To exercise any of the rights described in the previous section, the data subject or their legal representative may send a written request addressed to the data controller, including:

• Full name and identification of the data subject.
• A clear and precise description of the data over which the right is to be exercised.
• Documents supporting the request, where applicable.
• A physical or electronic address for the notification of the response.

The data controller will respond within a maximum period of ten (10) business days from the date the request is received. When it is not possible to respond within that term, the data subject will be informed of the reasons for the delay and the date on which their request will be addressed, which may not exceed five (5) business days following the expiry of the first term.

The processing of personal data requires the prior, express and informed authorisation of the data subject. Chimaná Village collects such authorisation through:

• Checkboxes on the website forms, in which the data subject confirms having read and accepted this policy.
• Verbal or written statements at the time of direct interaction with the Chimaná Village team.
• Unequivocal conduct of the data subject from which it may reasonably be concluded that authorisation was granted.

The authorisation may be revoked at any time by means of a communication addressed to the controller, without retroactive effect on the processing already carried out.

The personal data collected by Chimaná Village may be shared with:

• Wildshore Capital Partners, Inc. (Panama) — in its capacity as the holding company of the ecosystem, for corporate governance and strategic management purposes.
• Companies linked to the Chimaná Village ecosystem — Promotora Chimaná Village S.A.S., Inversiones Chimaná S.A.S. and other operating companies and SPVs, when necessary for the management of the project.
• Technology service providers acting as data processors — CRM platforms, web analytics tools, email services — under contracts that guarantee adequate levels of protection.
• Competent authorities when Colombian or international law so requires.

Chimaná Village adopts the technical, human and administrative measures necessary to guarantee the security of personal data and to prevent its adulteration, loss, unauthorised or fraudulent consultation, use or access, including:

• Restricted access to the databases by authorised personnel.
• Use of platforms with security protocols (HTTPS, data encryption).
• Confidentiality commitment of the team that accesses the data.
• Periodic review of the security measures implemented.

Personal data will be retained for the time necessary to fulfil the purposes for which it was collected and for as long as the relationship with the data subject subsists, or until the data subject revokes their authorisation.

Once the purpose of the processing has been fulfilled, the data will be deleted from Chimaná Village's databases, unless there is a legal, contractual or regulatory obligation to retain it for a specified period.

The website www.chimana-village.com uses cookies and similar technologies to improve the user experience and to obtain statistical browsing information. The user may configure their browser to reject cookies, although this may affect the functioning of the site.

The cookies used are of an analytical nature (Google Analytics) and do not contain directly identifiable personal data.

This policy takes effect from 1 June 2026 and may be amended at any time by Chimaná Village, which will be notified to data subjects through the website www.chimana-village.com at least ten (10) business days in advance.

Amendments will not have retroactive effect on the processing already carried out under previous versions of this policy.

Should the data subject consider that their rights have been infringed, they may file a complaint or query before the Superintendency of Industry and Commerce (SIC), the entity that oversees compliance with Law 1581 of 2012.

For any query, request or complaint related to the processing of your personal data, you may contact us through the following channels: