Privacy Notice

1. PURPOSE

This Privacy Notice (hereinafter, the “Notice”) sets forth the terms and conditions under which CONSTRUCTORA CARPOL S.A.S. (hereinafter “THE CONSTRUCTION COMPANY” or “THE DATA CONTROLLER”), in its capacity as Data Controller pursuant to Law 1581 of 2012 and Decree 1377 of 2013, will process your personal data.

THE CONSTRUCTION COMPANY governs the processing of personal data of its SHAREHOLDERS, MANAGERS, BOARD MEMBERS, EMPLOYEES/COLLABORATORS, JOB APPLICANTS, INTERNS, SUPPLIERS AND/OR CONTRACTORS, DONORS, CUSTOMERS, THIRD-PARTY CONTRIBUTORS, AND OTHER THIRD PARTIES. THE CONSTRUCTION COMPANY will at all times respect the fundamental rights of data subjects regarding the processing of their personal data.

2. IDENTIFICATION OF THE DATA CONTROLLER

3. DATA PROCESSING AND PURPOSES

THE CONSTRUCTION COMPANY will process personal information as follows:

3.1. Purpose: Business and Social Management

• Carry out activities related to the business relationship—whether pre-contractual or contractual—including the collection and transmission of information relevant to the management of the relationship, such as financial and banking data necessary for receiving documents and transferring funds.
• Compliance with legal and/or pre-contractual and contractual obligations related to the conduct of activities falling within the scope of LA CONSTRUCTORA’s corporate purpose.
• Assess the borrower's past performance and ability to pay in order to maintain a contractual relationship and manage financial and credit risk.
• Monitor the level of indebtedness and/or non-compliance with obligations, and manage collections either directly or through third parties.
• Check international lists and public or private databases to identify individuals and/or companies involved in illegal activities or activities that violate LA CONSTRUCTORA’s internal policies
• To store and process information obtained from credit bureaus or public or private information agencies regarding credit history, benefits from special or financial programs, as well as contact information such as landline and cell phone numbers, home address, and email address, and sociodemographic information
• To measure customer satisfaction with products and services, and to carry out sales campaigns and marketing activities.
• Contact us for market research, or to receive information about product launches, events, news, and promotions.
• Conduct analyses of tastes and preferences to develop products and services tailored to customer needs.
• Sharing information with third parties to offer additional financial or commercial products and services through open data sharing.
• Share information with business and strategic partners to present attractive, value-added offers.
• Send communications via email, SMS, and MMS or any other type of data message, taking into account the contact channels chosen and provided by the data subject.
• To share the personal information you provide with the various entities that provide public utilities for the property—such as electricity, gas, and water—and with all other entities necessary to process the change of account holder.
• Submit information about community outreach activities carried out as part of the housing project, which may be promoted on websites, social media, in magazines, and/or in promotional materials produced by LA CONSTRUCTORA.
• Implementation of control and security measures for the various facilities, property, or assets of THE CONTROLLER.
• Use of personal images and/or videos in which the data subject appears, captured by monitoring and/or video surveillance systems installed by THE CONTROLLER throughout its infrastructure, as evidence in judicial, extrajudicial, or administrative proceedings in which THE CONTROLLER is a party or is otherwise involved; as well as in internal investigations and proceedings conducted by THE CONTROLLER.
• Share the subscribers' information with LA CONSTRUCTORA's partner companies in order to provide information regarding the services they offer.
• The transfer and disclosure of data subjects’ personal data, both domestically and internationally, to individuals or legal entities that are strategic partners of LA CONSTRUCTORA or with whom LA CONSTRUCTORA has entered into or may enter into collaboration or partnership agreements.
• Transfer and disclosure of data subjects’ personal data to companies controlled by the parent company of THE DATA CONTROLLER, both domestically and internationally, or to third parties.

3.2. Purpose: Potential Customer

• Contact the account holder to provide information about the products and services offered and to learn about their needs and preferences.
• Check international lists and public or private databases to identify individuals and/or companies involved in illegal activities or activities that violate LA CONSTRUCTORA’s internal policies
• Manage a referral program by collecting data on individuals connected to customers who are interested in products and services, and ensure that the data is deleted if the referred individual does not express interest.
• Send communications via email, SMS, and MMS or any other type of data message, taking into account the contact channels chosen and provided by the data subject.
• Sending newsletters and information related to the products and services offered by LA CONSTRUCTORA.
• Carrying out marketing and advertising activities related to LA CONSTRUCTORA's corporate purpose, as well as other organized programs and events.
• As a basis for analysis in establishing and/or maintaining contractual relationships.
• As a tool for analyzing and assessing the risks arising from existing contractual relationships.
• Understand the preferences and needs of potential buyers in order to offer the best option in terms of location, quality, and price, one that fully meets their requirements
• Sending invitations to project launches and collecting images and videos for product advertising
• Document the real estate sales process, including the Letter of Intent to Purchase, Real Estate Purchase Agreement, Deed, and other documents
• To process warranties and after-sales services arising from the sale of real estate that has been built or marketed, or in cases where THE DATA CONTROLLER acts as a processor of personal data for this purpose.
• To use photographs and videos (those we take or that you share with us) and publish them on our screens, social media (Facebook, YouTube, Instagram, and/or our website), and various advertising media that THE CONTROLLER chooses and deems appropriate, exclusively for informational, promotional, and advertising purposes related to the companies.
• Inquiries and reports to credit bureaus by the construction company and/or any financial institution.

3.3. Purpose: Employees and Contributors

• Manage the employee’s employment relationship, including the execution, implementation, and termination of the employment contract, as well as handling registrations, updates, reports, transfers, and other procedures with the entities that make up the Comprehensive Social Security System and the Social Protection System, such as Health Promotion Entities (EPS), Pension Fund Administrators (AFP), Occupational Risk Administrators (ARL), severance fund administrators, family compensation funds, and other applicable parafiscal or social security entities. Likewise, manage, document, report, and process workplace accidents, occupational illnesses, disabilities, leaves of absence, and other situations related to occupational safety and health, in compliance with current labor, social security, and occupational risk regulations.
• Conducting knowledge, psychological, and/or technical tests on the subjects of the personal data.
• Compliance with obligations arising from existing employment contracts, either directly or through third parties.
• Implementation of employee training and development programs and other events organized by THE CONSTRUCTION COMPANY or in which THE CONSTRUCTION COMPANY has an interest in participating.
• Conducting performance evaluations for the company's employees.
• Transfer of personal data of data subjects to funds and similar entities that employ or provide services to employees of LA CONSTRUCTORA.
• Capturing and using images and videos to carry out activities related to occupational health, including their use in LA CONSTRUCTORA’s advertising materials.
• Implementation of control and safety measures at LA CONSTRUCTORA's various facilities.

3.4. Purpose: Suppliers

• Manage the processes of selection, onboarding, evaluation, contracting, execution, monitoring, renewal, and termination of commercial or contractual relationships with suppliers and contractors, including the preparation of requests for quotes, requests for goods or services, and verification of compliance with agreed-upon obligations.
• Handle the administrative, financial, accounting, tax, documentation, and operational matters arising from the commercial or contractual relationship, including invoicing, payments, reconciliations, accounting records, filing, updating, safekeeping, and preservation of documents and information.
• Evaluate the quality, suitability, performance, and compliance of the products and services provided by suppliers and contractors, as well as conduct satisfaction surveys and internal statistical analyses to ensure the continuous improvement of processes.
• Analyze, assess, and manage the risks associated with establishing, executing, and maintaining business or contractual relationships, including consulting and verifying information in public or private databases—whether domestic or foreign—restrictive lists, and criminal, disciplinary, tax, and security records, as well as other legally available sources for the prevention of fraud, money laundering, terrorist financing, corruption, and other illicit activities.
• To comply with legal, regulatory, contractual, tax, accounting, auditing, and internal control obligations, as well as to respond to requests from judicial, administrative, regulatory, inspection, oversight, and control authorities; internal or external auditors; and other competent entities.
• To contact suppliers and contractors via email, regular mail, phone calls, text messages (SMS/MMS), instant messaging apps, or other authorized channels for the development, execution, monitoring, and fulfillment of the business or contractual relationship.
• Issue certificates, statements, and other documents related to the existing business or contractual relationship between the parties.
• Conduct data update campaigns, notify stakeholders of changes to personal data processing policies, and keep supplier and contractor information up to date.
• Retain the information for historical, statistical, evidentiary, legal, accounting, contractual, and auditing purposes for the periods established by law.
• To transfer and disclose personal data to third parties, strategic partners, parent companies, subsidiaries, affiliates, service providers, or entities located in Colombia or abroad, when necessary for the conduct of the business or contractual relationship or to comply with legal and corporate obligations, in accordance with applicable legal provisions regarding the protection of personal data.
• Manage guarantees, compliance policies, construction quality and stability policies, civil liability insurance, and other required coverage within the framework of the contractual relationship with suppliers and contractors, including the data processing necessary for the issuance, monitoring, filing claims, and settling such policies with insurers and the relevant authorities.

3.5. Processing of Personal Data of Minors (Children and Adolescents)

In the normal course of its operations, THE CONSTRUCTION COMPANY does not typically process the personal data of children. However, if it is necessary to do so (for example, for activities related to employees’ children or in specific programs), the company will ensure that the best interests of children and their fundamental rights are respected.

THE CONSTRUCTION COMPANY will not engage in marketing activities, commercial profiling, advertising segmentation, or automated decision-making with respect to children and adolescents.

3.5.1. Special Requirements for the Processing of Children's Data

The processing of children’s data requires the prior, express, and informed consent of the child’s legal representative (parents or whoever exercises parental authority or legal representation), after the child has exercised their right to be heard, and their opinion shall be taken into account in light of their maturity, autonomy, and ability to understand the matter.

The legal representative will be informed of the nature of the data to be collected, the purposes of the processing, and the rights of the child as the data subject.

Only those data regarding children and adolescents that are in the public domain or that are strictly necessary for the fulfillment of the authorized purpose will be processed.

3.6. Data Processing in Video Surveillance Systems

AS PART OF ITS SECURITY POLICIES, MONITORING OF ITS ACTIVITIES, AND CONTROLS ON ENTRY TO AND EXIT FROM ITS OFFICES, THE CONSTRUCTION COMPANY MAY MAKE AUDIO AND VIDEO RECORDINGS IN ITS OFFICES AND COMMON AREAS OF ITS FACILITIES. Such recordings, made using a video surveillance system, will be retained in the company’s archives for a maximum of thirty (30) days, after which they will be securely deleted or destroyed.

4. RIGHTS OF THE OWNER

THE CONSTRUCTION COMPANY guarantees the exercise of the following rights, in accordance with Article 8 of Law 1581 of 2012:

• To access, update, and correct your personal data by contacting the Data Controllers or Data Processors. This right may be exercised, among other things, with respect to data that is partial, inaccurate, incomplete, fragmented, misleading, or data whose processing is expressly prohibited or has not been authorized;
• Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the processing, in accordance with the provisions of Article 10 of Law 1581 of 2012 and any other regulations that amend, add to, or supplement it;
• To be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been made of your personal data;
• File complaints with the Superintendency of Industry and Commerce regarding violations of the provisions of Law 1581 of 2012 and any other regulations that amend, supplement, or add to it;
• To revoke consent and/or request the deletion of data when the processing does not comply with constitutional and legal principles, rights, and safeguards. Revocation and/or deletion shall apply when the Superintendency of Industry and Commerce has determined that, in the processing of data, the Data Controller or Data Processor has engaged in conduct contrary to the Data Protection Law and the Constitution;
• Access, free of charge, your personal data that has been processed

4.1. How to Exercise Your Rights

5. OBLIGATIONS OF THE CONSTRUCTION COMPANY AS THE DATA CONTROLLER

THE CONSTRUCTION COMPANY, in its capacity as the Data Controller, undertakes to:

• Ensure that the data subject can fully and effectively exercise the right to access personal data at all times.
• Retain and provide a copy of the authorization granted by the account holder, in accordance with Law 1581 of 2012.
• Properly inform the data subject of the purpose of the data collection and the rights to which they are entitled.
• Store the information under secure conditions that prevent its tampering, loss, unauthorized access, or unauthorized consultation.
• Update the information and promptly notify the Data Controller of any changes.
• Process inquiries and complaints in accordance with the terms set forth in the law.
• Adopt and maintain an Internal Manual of Policies and Procedures for the Protection of Personal Data.
• Notify the data protection authority when security breaches occur.
• Comply with the instructions and requirements of the Superintendency of Industry and Commerce.

6. DATA TRANSFER AND TRANSMISSION

THE CONSTRUCTION COMPANY may transfer and disclose personal data to third countries solely and exclusively when any of the following conditions are met, in accordance with Article 26 of Law 1581 of 2012 and Article 24 of Decree 1377 of 2013. THE CONSTRUCTION COMPANY may not sell, transfer, or share personal data. Any sharing with third parties will be based on prior authorization from the data subject or express legal authorization.

7. DATA RETENTION PERIOD AND STORAGE

Personal data will be retained for the following periods, unless there is a legal or contractual obligation to retain it for a longer period:

Once these time limits have expired, THE CONSTRUCTION COMPANY will proceed to securely delete or anonymize the personal data.

8. SECURITY AND DATA INCIDENTS

LA CONSTRUCTORA implements technical, administrative, and physical measures to protect personal data from loss, unauthorized use, illegal access, or improper disclosure, in accordance with External Circular SIC 003 of 2018.

9. DATA PROCESSING POLICY AND CHANGES TO THE NOTICE

The full version of LA CONSTRUCTORA's Personal Data Processing Policy is available at: www.constructoracarpol.com

Any substantial changes to the terms of this Notice, as well as to the Data Processing Policy, will be communicated by posting them on the website at least fifteen (15) calendar days before they take effect, or by direct communication to the data subject when their contact information is available.