Article 15 of the Constitution of the Republic of Colombia establishes the right of every person to personal and family privacy and their good name, as well as the right to know, update, and rectify the information collected about them in databases and files of public or private entities. In implementation of the aforementioned constitutional article, Statutory Law 1581 was enacted on October 17, 2012, which establishes the minimum conditions for the treatment of personal data of clients, employees, and any other natural persons. In particular, item k) of Article 18 of this law requires data controllers to “adopt an internal manual of policies and procedures to ensure the proper compliance with this law and, in particular, to address inquiries and complaints,” an obligation that, if not fulfilled, may result in sanctions. To ensure the adoption of the internal manual of policies, Decree 1377 of 2013 regulated some aspects related to the content and requirements of this manual.

IN HOUSE REAL ESTATE S.A.S. is committed to respecting the rights of its clients, employees, and third parties in general, which is why it adopts the following personal data treatment policy that must be applied to all activities involving the treatment of personal data, whether these activities are commercial, civil, consumer, or labor-related, and it will also be governed by principles of good faith, legality, informational self-determination, freedom, and transparency.

In accordance with the provisions of Statutory Law 1581 of 2012 and Decree 1377 of 2013, it is necessary to establish definitions for the understanding and application of the regulation, which will be incorporated into this Manual as follows:

• Authorization: Prior, express, and informed consent from the Data Subject to carry out the processing of personal data.
• Database: An organized set of personal data that is subject to processing.
• Personal Data: Any information linked to or that can be associated with one or more identified or identifiable natural persons. Some examples of personal data include: name, citizen identification number, postal address, email address, phone number, marital status, and health data.
• Sensitive Data: Sensitive data refers to information that affects the privacy of the Data Subject or whose improper use may lead to discrimination against them, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or promoting the interests of any political party, as well as data that guarantees the rights and guarantees of opposition political parties, along with data related to health, sexual life, and biometric data.
• Public Personal Data: This refers to data classified as such according to the mandates of the law or the Political Constitution, as well as any data that is not semi-private or private. Public data includes, among others, information contained in public documents, duly executed judicial rulings that are not subject to confidentiality, and data related to a person’s civil status. Public data also includes personal data available in the commercial registry of the Chambers of Commerce (Article 26 of the Commercial Code). This data can be obtained and provided without any restrictions, regardless of whether it pertains to general, private, or personal information.
• Private Data: This is data that, by its intimate or reserved nature, is only relevant to the Data Subject. Examples include: merchants’ books, private documents, and information obtained from a home inspection.
• Semi-private Data: Semi-private data is that which is not intimate, reserved, or public, and whose knowledge or disclosure may be of interest not only to the Data Subject but also to a certain sector or group of people or to society in general. Examples include data related to compliance or non-compliance with financial obligations or data regarding relationships with social security entities.
• Data Processor: A natural or legal person, public or private, who, on their own or in association with others, processes personal data on behalf of the data controller.
• Data Controller: A natural or legal person, public or private, who, on their own or in association with others, decides on the database and/or the processing of the data.
• Data Subject: A natural or legal person whose personal data is subject to processing.
• Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.
• Inquiry: A request from the Data Subject or individuals authorized by them or by law to access the information held about them in databases or files.
• Claim: A request from the Data Subject or individuals authorized by them or by law to correct, update, or delete their personal data.
• Transfer: The sending of personal data by the Data Controller or the Data Processor from Colombia to another Data Controller located within the country (national transfer) or outside the country (international transfer).
• Transmission: The processing of personal data that involves the communication of such data within (national transmission) or outside of Colombia (international transmission) and aims to carry out processing by the Data Processor on behalf of the Data Controller.

IN HOUSE REAL ESTATE S.A.S. will apply the principles established below, which constitute the rules to be followed in the collection, management, use, processing, storage, and exchange of personal data:

• Principle of Legality: In the use, capture, collection, and processing of personal data, the applicable and current provisions governing the processing of personal data and other related fundamental rights will be applied.
• Principle of Purpose: The use, capture, collection, and processing of personal data accessed and collected by IN HOUSE REAL ESTATE S.A.S. will be subordinate to and serve a legitimate purpose, which must be communicated to the respective Data Subject.
• Principle of Freedom: The use, capture, collection, and processing of personal data may only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal, statutory, or judicial mandate that waives consent.
• Principle of Truthfulness or Quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented data, or data that may lead to error is prohibited.
• Principle of Transparency: In the processing of personal data, the right of the Data Subject to obtain from IN HOUSE REAL ESTATE S.A.S., at any time and without restrictions, information about the existence of data concerning them must be guaranteed.
• Principle of Access and Restricted Circulation: The processing of personal data is subject to the limits derived from the nature of the personal data, the provisions of this law, and the Constitution. In this regard, processing may only be carried out by individuals authorized by the Data Subject and/or by individuals provided for in this law. Personal data, except for public information, may not be available on the Internet or other means of mass dissemination or communication, unless access is technically controllable to provide restricted knowledge only to the Data Subjects or third parties authorized in accordance with this law.
• Principle of Security: The information subject to processing by IN HOUSE REAL ESTATE S.A.S. will be handled with the technical, human, and administrative measures within its reach to ensure the security of the records, seeking to prevent their alteration, loss, unauthorized or fraudulent consultation, use, or access.
• Principle of Confidentiality: All individuals involved in the processing of personal data commit to preserving and maintaining the confidentiality of the information, retaining this obligation even after their relationship with any of the tasks involved in the processing has ended. Personal data may only be supplied or communicated when it pertains to the development of activities authorized by law.
• Principle of Data Collection Limitation: IN HOUSE REAL ESTATE S.A.S. will only collect personal data that is strictly necessary for the fulfillment of the purposes of processing, making it prohibited to register and disclose data that do not have a close relationship with the objective of processing. Consequently, all reasonable measures must be taken to limit the processing of personal data to the minimum necessary. That is, the data must be: (I) adequate, (II) relevant, and (III) aligned with the purposes for which they were collected.
• Principle of Temporality: Personal data will be retained only for the necessary and reasonable time required to fulfill the purpose of processing and the legal requirements or instructions from supervisory and control authorities or other competent authorities. Data will be retained when necessary for compliance with a legal or contractual obligation. In determining the duration of processing, the applicable regulations for each purpose and the administrative, accounting, tax, legal, and historical aspects of the information will be considered. Once the purposes have been fulfilled, the data will be deleted.
• Principle of Non-Discrimination: Any act of discrimination based on the information collected in databases or files is prohibited.
• Principle of Redress: It is the obligation to compensate for the damages caused by possible failures in the processing of personal data.

IN HOUSE REAL ESTATE S.A.S. will apply the following principles, which constitute the rules to be followed in the collection, handling, use, processing, storage, and exchange of personal data:

• Principle of Legality: In the use, capture, collection, and processing of personal data, the current and applicable provisions governing the processing of personal data and other related fundamental rights will be applied.
• Principle of Purpose: The use, capture, collection, and processing of personal data accessed, collected, and gathered by IN HOUSE REAL ESTATE S.A.S. will be subordinate to and will serve a legitimate purpose, which must be communicated to the respective data subject.
• Principle of Freedom: The use, capture, collection, and processing of personal data may only be carried out with the prior, express, and informed consent of the data subject. Personal data cannot be obtained or disclosed without prior authorization or in the absence of a legal, statutory, or judicial mandate that relieves the need for consent.
• Principle of Veracity or Quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and comprehensible. The processing of partial, incomplete, fragmented data, or data that may lead to errors is prohibited.
• Principle of Transparency: In the processing of data, the right of the Data Subject to obtain from IN HOUSE REAL ESTATE S.A.S. information regarding the existence of data concerning them must be guaranteed at any time and without restrictions.
• Principle of Access and Restricted Circulation: The processing of data is subject to the limits arising from the nature of personal data, the provisions of this law, and the Constitution. In this regard, processing may only be carried out by individuals authorized by the Data Subject and/or by those specified in this law. Personal data, except for public information, may not be available on the Internet or other mass dissemination or communication media, unless access is technically controllable to provide restricted knowledge solely to the Data Subjects or authorized third parties in accordance with this law.
• Principle of Security: The information subject to processing by IN HOUSE REAL ESTATE S.A.S. will be managed with the technical, human, and administrative measures available to ensure the security of the records, seeking to prevent their alteration, loss, consultation, unauthorized or fraudulent use, and access.
• Principle of Confidentiality: All individuals involved in the processing of personal data commit to preserving and maintaining the confidentiality of the information. This obligation remains in effect even after the termination of their relationship with any of the tasks involved in the processing. They may only supply or communicate personal data when it corresponds to the execution of activities authorized by law.
• Principle of Data Collection Limitation: IN HOUSE REAL ESTATE S.A.S. will only collect personal data that is strictly necessary to fulfill the purposes of processing. It is prohibited to register or disclose data that does not have a close relationship with the purpose of processing. Therefore, all reasonable efforts must be made to limit the processing of personal data to the minimum necessary. In other words, the data must be: (I) adequate, (II) relevant, and (III) aligned with the purposes for which they were intended.
• Principle of Temporality: Personal data will be retained only for the time necessary and reasonable to fulfill the purpose of processing and the legal requirements or instructions of supervisory authorities or other competent authorities. Data will be retained when necessary to comply with a legal or contractual obligation. To determine the duration of processing, applicable regulations for each purpose will be considered, as well as the administrative, accounting, fiscal, legal, and historical aspects of the information. Once the purpose(s) have been fulfilled, the data will be deleted.
• Principle of Non-Discrimination: It is prohibited to carry out any act of discrimination based on the information collected in databases or files.
• Principle of Compensation: It is mandatory to indemnify for damages caused by possible failures in the processing of personal data.

The individuals obligated to comply with these policies must respect and guarantee the following rights of the Data Subjects:

• To know, update, and rectify personal data concerning IN HOUSE REAL ESTATE S.A.S., it is necessary to first establish the identification of the person to prevent unauthorized third parties from accessing the Data Subject’s information.
• Obtain a copy of the authorization.
• Be informed about the use that IN HOUSE REAL ESTATE S.A.S. has made of the data personal of the Holder.
• Process inquiries and complaints following the guidelines established by law and in this policy.
• Access the request for revocation and/or deletion of personal data authorization when the Superintendency of Industry and Commerce has determined that IN HOUSE REAL ESTATE S.A.S. has engaged in conduct contrary to Law 1581 of 2012 or the Constitution in the processing of such data.
• Access their personal data free of charge. The information requested by the data subject may be provided by any means, including electronic means, as required by the data subject. The information must be easy to read, without technical barriers that impede access, and must correspond in full to that which is held in the database.

The rights of data subjects may be exercised by the following individuals:

• The data subject, who must adequately prove their identity through the various means provided by IN HOUSE REAL ESTATE S.A.S.
• Their legal heirs, who must demonstrate such status.
• The representative and/or attorney of the data subject, upon proof of their representation or power of attorney.
• By stipulation in favor of another or for another.
• The rights of children and adolescents shall be exercised by those who are authorized to represent them.

IN HOUSE REAL ESTATE S.A.S., when acting as the data controller or processor of personal data, shall comply with the following duties:

• Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.
• Request and keep a copy of the respective authorization granted by the Holder.
• Inform the Holder properly about the purpose of the collection and the rights they have by virtue of the granted authorization.
• Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized use, or fraudulent access.
• Ensure that the information provided to the data processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
• Update the information by promptly communicating to the data processor any changes regarding the data previously provided and taking other necessary measures to ensure that the information provided remains current.
• Rectify the information when it is incorrect and communicate the relevant details to the data processor.
• Provide the Data Processor, as applicable, only data for which the Processing has been previously authorized.
• Require the Data Processor at all times to respect the security and privacy conditions of the information of the Data Subject.
• Process the inquiries and complaints submitted.
• Inform the Data Processor when certain information is under dispute by the Data Subject, once the complaint has been submitted and the respective process has not been completed.
• Inform at the request of the Data Subject about the use given to their data.
• Notify the data protection authority when there are violations of security codes and risks in the management of the information of the data subjects.
• Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

IN HOUSE REAL ESTATE S.A.S. reserves the right to maintain and classify certain information as confidential in accordance with current regulations, its bylaws, and regulations, all of which are in line with the fundamental and constitutional rights that protect the company.

The use and processing of data classified as sensitive may be carried out when:

• The data subject has given their explicit consent to such processing, except in cases where the law does not require the granting of such consent.
• The processing is necessary to safeguard the vital interest of the data subject and they are physically or legally incapacitated. In such cases, legal representatives must grant their consent.
• The processing has a historical, statistical, or scientific purpose. In this case, measures must be taken to ensure the anonymity of the data subjects.
• The processing refers to data that is necessary for the recognition, exercise, or defense of a right in legal proceedings.

The collection, storage, use, and circulation of personal data by IN HOUSE REAL ESTATE S.A.S. requires the free, prior, express, and informed consent of the data subject. Without prejudice to the exceptions provided by law, processing requires the prior, express, and informed authorization of the data subject, which must be obtained by any means that can be consulted and verified later. When it comes to the collection of sensitive data, IN HOUSE REAL ESTATE S.A.S. must comply with the following requirements:

• The authorization must be explicit.
• The data subject must be informed that they are not obligated to consent to the processing of such information.
• It must be explicitly and prior informed to the data subject which of the data to be processed are sensitive and the purpose of such processing.

The authorization of the data subject will not be necessary when it concerns:

• Information required by a public or administrative entity in the exercise of its legal functions or by court order.
• Publicly available data.
• Cases of medical or health emergency.
• Processing of information authorized by law for historical, statistical, or scientific purposes.
• Data related to the Civil Registry of Persons.

The authorization may be in a physical document, electronic, data message, website, or any other format that allows for subsequent consultation, or through an appropriate technical or technological mechanism that allows the expression or obtaining of consent via click or double-click, by which it can be unequivocally concluded that, had the data subject not engaged in such conduct, the data would never have been captured and stored in the database. The authorization will be generated by IN HOUSE REAL ESTATE S.A.S. and will be made available to the data subject in advance and prior to the processing of their personal data.

IN HOUSE REAL ESTATE S.A.S. will use the mechanisms it currently has, and will implement and adopt the necessary actions to maintain suitable records or technical or technological mechanisms regarding when and how it obtained authorization from the data subjects for the processing of their personal data. To comply with the above, physical files or electronic repositories may be established, either directly or through third parties contracted for this purpose.

The information provided by the data subject will serve to empower IN HOUSE REAL ESTATE S.A.S. to:

• Consult, verify, and/or corroborate the payment capacity, background, and/or other qualities or variables, with the aim of determining the feasibility of starting or continuing the relationship or engagement.
• Achieve effective communication related to our products and other activities related to the company’s corporate purpose.
• Inform about new products.
• Conduct promotional and/or marketing activities.
• Conduct studies on consumer preferences.
• Fulfill obligations contracted by clients, consumers, suppliers, and other persons directly or indirectly linked to IN HOUSE REAL ESTATE S.A.S.
• Inform about changes in the services of IN HOUSE REAL ESTATE S.A.S.
• Evaluate the quality of the service.
• Conduct internal studies on the consumption habits of the services and products offered.
• Conduct selection and hiring processes for IN HOUSE REAL ESTATE S.A.S.
• Register visitors in our facilities.

Additionally, for reasons of efficiency and security, the servers of IN HOUSE REAL ESTATE S.A.S., where our system and database are hosted, may be located outside of Colombia. For this reason, the data subject authorizes IN HOUSE REAL ESTATE S.A.S., prior, express, informed, and unequivocally, to send their personal data to the servers of IN HOUSE REAL ESTATE S.A.S. in any country we deem appropriate for the purposes of the authorized processing or for storage and/or eventual hosting or cloud computing services that we contract or require.

IN HOUSE REAL ESTATE S.A.S. will implement a Privacy Notice, which is the physical, electronic, or any other known or unknown format document made available to the data subject for the processing of their personal data. Through this document, the data subject is informed about the existence of the information processing policies that will be applicable to them, how to access them, and the characteristics of the processing intended for their personal data.

IN HOUSE REAL ESTATE S.A.S. will always keep in mind that personal data belongs to the individuals to whom it pertains, and that only they can decide about it. In this regard, it will use the data only for the purposes for which it is duly authorized, and in all cases, it will comply with the current regulations on personal data protection.

IN HOUSE REAL ESTATE S.A.S. will guarantee the right of access when, upon verification of the identity of the data subject, legitimacy, or the authority of their representative, it makes the respective personal data available to them in a detailed and comprehensive manner, at no cost or expense.

The data subjects or their successors may inquire about the personal information of the data subject held in any database. IN HOUSE REAL ESTATE S.A.S. will provide them with all the information contained in the individual record or related to the identification of the data subject. The inquiry will be made through the means enabled by IN HOUSE REAL ESTATE S.A.S., of which a record will be kept of the terms and conditions under which it was made.

Data Protection Policies: The inquiry will be addressed within a maximum period of ten (10) business days from the date of receipt. When it is not possible to address the inquiry within this timeframe, the interested party will be informed, stating the reasons for the delay and indicating the date when their inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial period. To enable the data subject to make the inquiry, IN HOUSE REAL ESTATE S.A.S. guarantees:

• Enable electronic communication channels or others deemed appropriate.
• Establish forms, systems, and other simplified methods, which must be disclosed in the privacy notice.
• Utilize the customer service or complaint handling services currently in operation.

The Holder or their successors who believe that the information contained in a database should be corrected, updated, or deleted, or when they notice a presumed breach of any of the duties contained in this law, may file a claim with IN HOUSE REAL ESTATE S.A.S., which will be processed under the following rules:

• The claim will be submitted through a request addressed to IN HOUSE REAL ESTATE S.A.S., including the identification of the Holder, a description of the facts giving rise to the claim, the address or notification site, and attaching any documents to be submitted.
• If the claim is incomplete, the interested party will be required within five (5) days following the receipt of the claim to correct the deficiencies. If two (2) months pass from the date of the request without the applicant providing the required information, it will be understood that they have withdrawn the claim.
• If the person receiving the claim is not competent to resolve it, they will refer it to the appropriate authority within a maximum period of two (2) business days and will inform the interested party of the situation.
• Once the complete claim is received, a note will be included in the database stating “claim in process” along with the reason for it, within a period not exceeding two (2) business days. This note will remain until the claim is resolved.
• The maximum period to address the claim will be fifteen (15) business days counted from the day following the date of its receipt. If it is not possible to address the claim within this period, the interested party will be informed of the reasons for the delay and the date when their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial period.

IN HOUSE REAL ESTATE S.A.S. may establish forms, systems, and other simplified methods, which must be informed in the privacy notice and made available to interested parties on the website https://inhousemedellin.com/

Regarding the suppression of data, since this involves the total or partial elimination of personal information as requested by the Holder in the records, files, databases, or treatments carried out by IN HOUSE REAL ESTATE S.A.S., this right is not absolute, and the responsible party may deny the exercise of the same in certain cases, including when:

• The Holder has a legal or contractual obligation to remain in the database.
• The deletion of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions.
• The data are necessary to protect the legally protected interests of the Holder; to carry out an action based on the public interest, or to comply with a legally acquired obligation by the Holder.

Data subjects may revoke their consent to the processing of their personal data at any time, as long as it is not prohibited by legal or contractual provisions. For this purpose, IN HOUSE REAL ESTATE S.A.S. must establish simple and free mechanisms that allow the data subject to revoke their consent, at least through the same means by which it was granted. It should be noted that there are two (2) modalities in which consent revocation may occur. The first may be regarding all the consented purposes, meaning that IN HOUSE REAL ESTATE S.A.S. must stop processing the data of the data subject entirely; the second may occur regarding specific types of processing, such as for advertising or market research purposes. With the second modality, that is, the partial revocation of consent, other processing purposes that can be carried out in accordance with the granted authorization and that the data subject agrees with will remain in effect.

Depending on the nature of the permanent or occasional relationships that any data subject may have with IN HOUSE REAL ESTATE S.A.S., all of their information may be transferred abroad, with the acceptance of this policy expressly authorizing the transfer of personal information.

Without prejudice to the obligation to observe and maintain the confidentiality of the information, IN HOUSE REAL ESTATE S.A.S. will take the necessary measures to ensure that third parties understand and commit to observing this Policy, with the understanding that the personal information they receive may only be used for matters directly related to the relationship with IN HOUSE REAL ESTATE S.A.S. and only while that relationship exists, and it may not be used or intended for any other purpose. IN HOUSE REAL ESTATE S.A.S. may also share personal information with governmental or public authorities of any kind (including, among others, judicial or administrative authorities, tax authorities, and criminal, civil, administrative, disciplinary, and tax investigative agencies), and third parties participating in civil legal proceedings, along with their accountants, auditors, lawyers, and other advisors and representatives, as necessary or appropriate: (a) to comply with applicable laws, including laws other than those of their country of residence; (b) to comply with legal processes; (c) to respond to requests from public and governmental authorities, including requests from authorities other than those in their country of residence; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect our rights, privacy, security, or property, those of you, or those of third parties; and (g) to obtain applicable indemnities or limit damages that may affect us.

IN HOUSE REAL ESTATE S.A.S. will designate an Information Security Officer to fulfill the function of personal data protection and will process requests from Data Subjects for the exercise of the rights of access, consultation, rectification, updating, deletion, and revocation referred to in the current regulations on personal data protection.

For IN HOUSE REAL ESTATE S.A.S., it is essential to have all technical, legal, human, and procedural measures in place to maintain the security of data, ensuring confidentiality and integrity. Therefore, IN HOUSE REAL ESTATE S.A.S. has implemented security protocols that are mandatory for all personnel who have access to personal data and the company’s information systems. Our information security policy serves as a framework in which we ensure that information is protected appropriately, regardless of how it is handled, processed, transported, or stored. Below are the main points that are part of this policy:

• Protection of the technological infrastructure of the data network. The policy of IN HOUSE REAL ESTATE S.A.S. is to have a specialized data center with adequate levels of security, continuity, and integrity to ensure that data is always available and safeguarded.
• Access control to information. IN HOUSE REAL ESTATE S.A.S. has an Active Directory within its infrastructure that includes roles, access groups, and browsing profiles connected to a Firewall to ensure access for authorized individuals.
• Data recovery in the event of disasters. The policy includes the execution of differential backups of critical information and services, which are performed daily, monthly backups on media external to the data center, and procedures for cloud backups of critical users.
• Protection against malware. All machines at IN HOUSE REAL ESTATE S.A.S. belong to a domain controller that is synchronized with the Firewall, which provides perimeter and network security.
• Restriction on the use of unauthorized USB storage devices. All computers at IN HOUSE REAL ESTATE S.A.S. belong to a domain controller that can define who is allowed or not allowed to connect USB devices.
• Correct use of information tools. The use and responsibilities issued by the IT management area are an integral part of this policy. For more details, you can request information from the area managers.
• Confidentiality agreement with suppliers and third parties. All contracts, agreements, and proposals generated include confidentiality clauses.
• Employees assume a commitment to confidentiality and non-disclosure of information related to the management and institutional, operational, and strategic direction provided to them by IN HOUSE REAL ESTATE S.A.S. or by third parties with whom they have a relationship due to or as a result of their work. They also commit to keeping confidential all information, documentation, or studies that are confidential, reserved, or restricted, which are provided to them by the area to which they belong or by any area or person within the Company— the unauthorized use of which would affect the interests of the Company—regardless of the medium in which it is supported: electronic or audiovisual media, paper, optical disc, CD, microfilmed document, among others.
• Employees commit to using the information provided by IN HOUSE REAL ESTATE S.A.S. or by third parties with whom the company has a relationship exclusively for the assigned work; refraining from reproducing, modifying, making public, or disclosing to third parties any proprietary information related to what the employee knows due to their work, whether from IN HOUSE REAL ESTATE S.A.S., its partners, suppliers, clients, and/or employees, without prior written authorization; adopting the necessary security measures regarding information, documentation, and/or studies and reports that they may come to know directly or indirectly as a result of their work, keeping in mind that the level of care taken should not be less than that which a diligent and reasonable person would take to prevent its loss, theft, removal, or unauthorized use. The obligation of confidentiality and secrecy, which encompasses all information held by the employee from the beginning of the employment contract and in connection with it, is understood to commence from the start of the employment relationship and will continue as long as the information retains its characteristics to be considered strictly confidential and/or for restricted use, regardless of whether the contractual relationship between the parties has ended. Failure to comply with any of the duties, commitments, or obligations included in the “confidentiality agreement – information confidentiality” clause in the employment contract is considered a serious matter and is expressly deemed by the contracting parties, who have expressly agreed to it, as just cause for terminating the employment contract by the Company or its representative. If there is also a financial detriment due to the improper disclosure by the employee, they are obliged to fully compensate for the damages caused by emergent harm and lost profits resulting from the disclosure or use carried out by them in any manner other than that authorized, whether intentional or due to mere negligence.

From the internal control area, periodic monitoring of compliance with this policy will be carried out, without prejudice to the external audits that IN HOUSE REAL ESTATE S.A.S. deems appropriate to execute.

Non-compliance by employees with the provisions of this document will initiate the corresponding disciplinary actions.