Personal Data Processing Policy

1. Who is responsible for your data

Data controller ("Responsable del tratamiento"):

Data processor ("Encargada del tratamiento"): CONSTRUCTORA CUATRO VIENTOS S.A.S. ("Cuatro Vientos"), Tax ID 901059784-9, domiciled in Medellín, markets the RHY 7 Hotel project and runs its digital channels (website, WhatsApp, calls and customer relationship management system) on behalf of the Developer. Cuatro Vientos processes your data only on the Developer's instructions and under this policy.

When this policy says "we" or "us", it means the Developer and Cuatro Vientos when acting on the Developer's behalf.

2. Scope

This policy applies to the personal data of people interested in the RHY 7 Hotel project, customers, website visitors and anyone who contacts us through any of these channels:

• the forms on rhy.com.co;
• WhatsApp, including our artificial intelligence (AI) virtual assistant;
• phone calls, including those made or answered by our AI voice assistant;
• ad lead forms on Facebook, Instagram, Google and other platforms;
• the sales office, fairs, events and referrals;
• website cookies (see section 17).

This policy is a separate document from the Website Terms of Use (https://rhy.com.co/en/terminos). That is why we ask you to accept each one separately.

3. Definitions

• Data subject: the person the data relates to (you).
• Personal data: any information that identifies you or can identify you, such as your name, phone number, email or voice.
• Sensitive data: data that affects your privacy or could lead to discrimination, such as health data or biometric data (for example, a voiceprint used to identify a person).
• Processing: any use of data: collecting, storing, consulting, using, sharing or deleting it.
• Controller: whoever decides why and how data is processed.
• Processor: whoever processes data on the controller's behalf, for example a technology provider.
• Authorization: your prior, express and informed permission for us to process your data.
• Transmission: sending data to a processor, in Colombia or abroad, to process it on our behalf.
• Transfer: sending data to another controller, who will use it for its own purposes.

4. Principles

We process your data lawfully; only for the purposes we tell you; with your authorization; keeping it accurate and up to date; telling you how we use it; giving access only to those who need it; with security measures; and confidentially. These are the principles of Article 4 of Colombian Law 1581 of 2012.

5. What data we collect

6. Why we use your data

6.1 To handle your interest in the project

1. Answer your request and give you information about the RHY 7 Hotel project: prices, sizes, availability, floor plans, payment options and hotel operation model.
2. Contact you by WhatsApp, email and phone calls —including calls from our AI voice assistant— to give you that information and follow up with you about the RHY 7 Hotel. We only contact you through the channels you authorized and during the hours allowed by law.
3. Assist you on WhatsApp with our AI virtual assistant.
4. Record, transcribe and summarize calls, to keep a record of what we discussed and of your authorization, and to improve service quality.
5. Schedule, confirm, remind, change or cancel your appointments or visits, in person or virtual.
6. Record your data and contact history in our customer relationship management system (CRM) and assign you an advisor.
7. Keep proof of your authorizations and handle your inquiries, complaints and requests to stop receiving messages or calls.
8. Produce internal statistics and measure our campaigns using aggregated data.
9. Protect the security of our systems, prevent fraud and comply with legal obligations and orders from authorities.

6.2 If you decide to reserve or buy a unit

10. Onboard you; prepare and sign the transaction documents; manage payments, invoicing, accounting and taxes; and handle the deed and delivery of the unit.
11. Verify your identity and screen restricted and binding lists to prevent money laundering and terrorist financing. We do this only when the purchase requires it; we do not screen people who only ask for information.
12. Share the necessary data with the project's trust company, notaries, registry offices, the bank you choose for your mortgage and the hotel operator that manages your unit.

6.3 What we do not do with your data

• We do not sell or rent your data.
• We do not use it to offer you projects other than the RHY 7 Hotel, and we do not share it with other companies so they can advertise to you. If we ever wanted to do so, we would first ask for a separate authorization.
• We do not check your financial information or credit bureaus to give you information about the project.
• We do not use your voice to identify you or to imitate it.
• We do not use your data to train our own AI models.

If in the future we want to use your data for a purpose other than those in this section, we will ask you for a new authorization.

7. Artificial intelligence and call recording

• WhatsApp virtual assistant. It is an AI program, not a person. It understands and answers your messages, gives you project information, shows availability, books appointments and prepares a conversation summary for your advisor. It runs on language models from outside providers (see section 11).
• Voice assistant. It is an AI program with an artificial voice, not a person. It may call you or answer your call, give you information, book appointments and leave a summary and the call outcome in the CRM.
• Recording. Calls are recorded and transcribed. At the start, the assistant introduces itself and asks for your authorization to process your data; if you ask, it will confirm that it is an AI assistant.
• You can always ask to speak with a person. Write or say "I want to talk to an advisor".
• No automated decisions that affect you. The assistants classify your interest and organize follow-up (for example, when to contact you again). They do not make decisions with legal effects on you: business decisions are made by people. If you think a classification harmed you, you can ask for a person to review it, through the channels in section 14.2.
• The assistants can make mistakes. The information that counts is what an advisor confirms and what is set out in the documents you sign.

8. How we ask for your authorization and how we keep it

• Website: two separate, unchecked boxes. With the first one you accept the Website Terms of Use. With the second one you authorize the processing of your data under this policy, including contact by WhatsApp, email and phone calls —also calls from an AI voice assistant, which may be recorded and transcribed—.
• WhatsApp: before continuing the conversation, the virtual assistant sends you the links to this policy and to the Terms of Use. By tapping the "I accept" button you authorize the processing of your data under this policy and accept the Terms of Use.
• Phone calls: at the start of the call we ask for your verbal authorization. Your answer is kept in the recording.
• Ad lead forms and events: with the authorization text of each form. If we do not have your authorization, we ask for it at the first contact by WhatsApp or phone.

Silence, not answering or a pre-checked box is not authorization.

Your authorization is not a condition of purchase. Without it we cannot handle your request by WhatsApp, email or phone, but you are welcome to visit our sales office.

What we keep as proof: date and time, channel (website form, WhatsApp or call), the version of the texts you saw or heard, what you accepted and the identifier of the submission, message or call. You can ask us for a copy at any time.

9. Sensitive data

We do not ask for sensitive data, and you are not required to answer questions about it. If you tell us something about your health or other sensitive data in a conversation, we do not use it for any purpose and we ask you not to share it. We do not use your voice to identify you (biometrics). If we ever needed sensitive data, we would tell you what it is, why we need it and that providing it is optional, and we would ask for a separate express authorization.

10. Children and teenagers

The project is aimed at people 18 years of age or older. We do not knowingly collect data from minors. If we learn that we received data from a minor, we delete it, unless the law requires us to keep it.

11. Who we share your data with

11.1 Providers that process data on our behalf (processors)

We may also rely on other technology providers with similar functions (for example, email delivery, telephony or hosting), under the same obligations. These providers may in turn use subcontractors with equivalent obligations. With each processor we use contracts or terms of service that require it to process data only to provide its service to us, to protect it and to keep it confidential.

11.2 Other recipients

• If you decide to buy: the project's trust company, notaries, registry offices, your mortgage bank and the hotel operator of your unit, only with the data needed.
• Advertising platforms (Google, Meta, LinkedIn and X): only if you accept advertising cookies (section 17). These companies may also use that data for their own purposes, under their own policies.
• Authorities: when required by law or by an order.

We do not share your data with anyone else without your authorization.

12. Sending data outside Colombia

Several of our providers store or process data in the United States and in European Union countries. These countries are on the SIC's list of countries with an adequate level of data protection. When we send data to a processor in another country (transmission), we do so under a contract or terms of service that require it to process the data under this policy, securely and confidentially.

By authorizing processing under this policy, you also authorize this international transmission. If we ever had to send your data to another controller in a country without an adequate level of protection (transfer), we will first ask for your express authorization.

13. Your rights

Under Article 8 of Colombian Law 1581 of 2012, you have the right to:

1. Access, update and correct your data.
2. Request proof of the authorization you gave us.
3. Be told how we have used your data, upon request.
4. File complaints with the Superintendence of Industry and Commerce (SIC), after first submitting your inquiry or complaint to us.
5. Revoke your authorization and ask us to delete your data, when there is no legal or contractual duty to keep it.
6. Access your data free of charge, at least once a month and every time this policy changes substantially.

14. How to exercise your rights

14.1 Who handles requests

The Developer's Personal Data Protection Area ("Área de Protección de Datos Personales") handles your inquiries, complaints and requests.

14.2 Channels

• WhatsApp +57 305 292 8569, answered by people. Write what you need, for example: "I want to see my data", "I want to update my email" or "I want you to delete my data".
• Email: comunicacion@4v.com.co.

WhatsApp +57 300 858 3679 is our virtual assistant's line, for project information. It is not a channel for requests about your data.

Handling your requests is free of charge.

14.3 Who can submit a request

You, your heirs, your legal representative or attorney, and anyone you have authorized. To protect your data, we may ask you to confirm your identity; for example, by writing from the same WhatsApp number or email you gave us. If you act on behalf of someone else, you must send the document that proves it.

14.4 Inquiries (to know your data)

We answer within 10 business days of receiving your inquiry. If we cannot meet that deadline, we will tell you why before it expires and answer within 5 additional business days.

14.5 Complaints (to update, correct, delete or revoke, or if you believe we did not comply with the law)

1. Send your complaint with your name and ID, what you are requesting and why, how you want to receive the answer and any documents you want to rely on.
2. If the complaint is incomplete, we will ask you to complete it within 5 days. If 2 months pass without you sending what is missing, we will consider the complaint withdrawn.
3. If the complaint is not for us to handle, we will forward it to whoever should handle it within 2 business days and let you know.
4. Within 2 business days of receiving the complete complaint, we will tag your data as "complaint in process".
5. We answer within 15 business days from the day after we receive the complete complaint. If we cannot meet that deadline, we will tell you why before it expires and answer within 8 additional business days.

14.6 Revoking your authorization and deleting your data

You can revoke your authorization or ask us to delete your data at any time, free of charge, through the same channels. This does not apply while you have a contractual relationship with us that requires keeping it, or when a law requires us to keep it; in that case we will explain why. When we delete your data, we keep only the minimum needed not to contact you again and the proof of your request.

14.7 To stop receiving messages and calls

• To stop receiving messages and calls: write "STOP" (or "BAJA") to our virtual assistant's WhatsApp (+57 300 858 3679), or ask on WhatsApp +57 305 292 8569 or by email at comunicacion@4v.com.co.
• To stop receiving calls only: say so during the call, write "stop calling" (or "no me llamen") to our virtual assistant's WhatsApp (+57 300 858 3679), or ask on WhatsApp +57 305 292 8569 or by email at comunicacion@4v.com.co.

We respect your decision as soon as possible and within 10 business days at the latest. To do so, we keep your number only on a list of people who do not want to be contacted. If you also want us to delete your data, ask through the channels in section 14.2.

14.8 Complaint to the Superintendence of Industry and Commerce

If you disagree with our answer, after submitting your inquiry or complaint to us you may go to the SIC: https://www.sic.gov.co.

15. How long we keep your data

We may delete some data earlier, for example call recordings. Before deleting a recording, we keep the record of your authorization. If you request deletion, we delete your data before these periods end, except what a law or contract requires us to keep.

16. Security

We protect your data with technical, human and administrative measures: access only for staff who need it, with username and password; encrypted connections; providers with recognized security standards; and backups. No system is foolproof. If a security incident affects your data, we will report it to the Superintendence of Industry and Commerce within the legal deadlines and notify you when appropriate.

17. Cookies

Cookies are small files that the website stores in your browser.

• Analytics and advertising cookies are only activated if you accept them in the cookie notice. If you reject them, the website works the same.
• Your choice is stored in your browser. You can change it at any time with the "Cookie preferences" button at the bottom of every page, or by deleting cookies in your browser.
• Each cookie lasts as long as whoever sets it decides: from the length of your visit up to about 2 years. You can delete them at any time from your browser.
• Google, Meta, LinkedIn, X and HubSpot cookies are managed by those companies under their own policies, and they may process data in the United States.

18. Information for people in the United States

• What data and why: see sections 5 and 6. We receive it from you, from the ad lead forms you fill out and from the cookies you accept.
• We do not sell your personal data. We only share browsing data with advertising platforms if you accept those cookies; you can reject them under "Cookie preferences".
• AI calls. If you gave us your number to receive information, we may call you using an AI voice assistant (artificial voice). When you authorize the processing of your data on our website, that consent includes these calls. Giving that consent is not a condition of purchase.
• Recording. Calls may be made by an AI assistant and are recorded and transcribed. If you do not agree, you can hang up or ask us not to call you again.
• How to ask us to stop calling: say so during the call, write "stop calling" (or "no me llamen") to our virtual assistant's WhatsApp (+57 300 858 3679), or write to us on WhatsApp +57 305 292 8569 or at comunicacion@4v.com.co. We stop calling you as soon as possible and within 10 business days at the latest.
• Calling hours: we aim to call you only on business days, between 8:00 a.m. and 8:00 p.m. your local time.
• Emails: our marketing emails include our physical address and a way to unsubscribe.
• Your requests: you can ask us to access, correct or delete your data through the channels in section 14, regardless of the state you live in. We will not treat you differently for exercising your rights.

19. Changes to this policy

If we make substantial changes to this policy (for example, to the controller, the purposes or the providers), we will publish the new version on this website, with its date, and notify you before applying them by WhatsApp, email or another contact method we have. If the purposes change, we will ask for a new authorization. We keep previous versions with their dates.

20. Effective date

• This policy, version PTD-2026-10-30, is effective from October 30, 2026. It replaces the data authorization text previously published on the Terms and Conditions page.
• The databases will remain in force while the Developer develops and markets the RHY 7 Hotel project and fulfills the obligations arising from it, subject to the retention periods in section 15.

21. Applicable law

Colombian Law 1581 of 2012; Decree 1074 of 2015 (chapters 25 and 26 of title 2, part 2, book 2), which incorporates Decree 1377 of 2013; the SIC Single Circular (title V); Law 2300 of 2023; Law 1480 of 2011; Law 527 of 1999; and any rules that amend or replace them. For people in the United States, the federal and state laws that apply.

22. Language

This policy is published in Spanish and English, and both versions say the same. If there is any difference between them, the Spanish version prevails to the extent permitted by the law that applies to you.