Privacy and Personal Data Processing Policy

1. Data controller

DOMUS CONSULTING S.A.S., identified with Tax ID (NIT) 901.307.586-1 and headquartered in Barranquilla, Atlántico, Colombia, is responsible for the processing of the personal data it collects and manages in the course of its professional activities and through its service channels and website.

2. Purpose and scope

At DOMUS CONSULTING S.A.S. we recognize the importance of protecting the privacy and personal information of our clients, users, employees, suppliers, partners, prospects and anyone else who interacts with the firm.

This Policy sets out the guidelines applicable to the collection, storage, use, circulation, updating, transmission, transfer, retention and, where appropriate, deletion of personal data.

Data will be processed in accordance with the Political Constitution of Colombia, Law 1581 of 2012, Decree 1074 of 2015 and any rules that amend, add to or supplement them.

3. Information we may collect

Depending on the data subject’s relationship with DOMUS CONSULTING S.A.S. and the services requested, we may collect, among others:

• Identification and contact data.
• Name, identification number, phone number, email and address.
• Information provided through forms, email, WhatsApp or other channels enabled by the firm.
• Information related to service requests and contractual or pre-contractual relationships.
• Legal, contractual, financial or real estate information needed to provide our services.
• Documents and information provided for legal reviews, real estate procedures, creation of collateral and other professional services.
• Information needed for know-your-customer processes for clients, counterparties and third parties, as well as for watchlist screening and risk-prevention activities.
• Technical information related to the use of our website, where applicable.

4. Purposes of processing

DOMUS CONSULTING S.A.S. may process personal data for the following purposes:

• Responding to inquiries, information requests and requirements.
• Evaluating, managing and providing the legal services requested or contracted.
• Managing contractual, pre-contractual, commercial and professional relationships.
• Maintaining communication with clients, users, prospects, suppliers, partners and other third parties related to the firm.
• Preparing reviews, opinions, documents and other actions inherent to the contracted legal services.
• Carrying out identity and background checks and watchlist screening when necessary or appropriate.
• Conducting know-your-customer and counterparty activities and measures related to the prevention of money laundering, terrorist financing and other associated risks, where applicable.
• Complying with legal, regulatory, contractual, accounting and tax obligations.
• Responding to requests from judicial, administrative or supervisory authorities when legally required.
• Handling petitions, inquiries, complaints, claims and requests from data subjects.
• Managing and improving our internal processes, services and digital channels.
• Carrying out statistical analysis and website usage analysis.
• Sending, with prior authorization where required, institutional, legal, academic or commercial information related to our services, publications, news, events and content.

5. Data subject authorization

Where required by law, DOMUS CONSULTING S.A.S. will request the data subject’s prior, express and informed authorization to process their personal data.

Authorization may be obtained through physical documents, electronic forms, data messages, acceptance via digital mechanisms or any other means that allows it to be subsequently proven.

Information provided to DOMUS CONSULTING S.A.S. will be used exclusively for the purposes disclosed to the data subject and those permitted by applicable law.

6. Sensitive data

DOMUS CONSULTING S.A.S. may come to know data considered sensitive when necessary to provide a service, comply with a legal obligation or in any other circumstance permitted by law.

When processing requires authorization, the data subject will be informed of the sensitive nature of the data and their explicit authorization will be requested. The data subject is not required to provide sensitive information unless there is a legal obligation or one of the exceptions provided by the regulations applies.

7. Rights of data subjects

Data subjects whose personal data is processed by DOMUS CONSULTING S.A.S. have the right to:

• Know, update and rectify their personal data.
• Request proof of the authorization granted, where legally applicable.
• Know how their personal data has been used.
• Access, free of charge, the personal information being processed.
• Submit inquiries and claims related to the processing of their data.
• Revoke the authorization and request the deletion of data when legally appropriate.
• File complaints with the Superintendence of Industry and Commerce (SIC) for possible violations of data protection rules, once the corresponding procedure with DOMUS CONSULTING S.A.S. has been exhausted.
• Exercise any other rights recognized by Colombian law.

8. Inquiries and claims

Data subjects may exercise their rights, submit inquiries, request updates or corrections and file claims related to their personal data through the following channel:

The request must contain sufficient information to identify the data subject, their contact details, a clear description of the request and, when necessary, supporting documents.

DOMUS CONSULTING S.A.S. will handle inquiries and claims within the terms and according to the procedure established by applicable Colombian law.

9. Security and confidentiality

DOMUS CONSULTING S.A.S. will adopt reasonable technical, human, administrative and organizational measures to protect personal data against loss, alteration, misuse, unauthorized or fraudulent consultation, access, circulation or processing.

Persons with access to personal information must respect its confidentiality, even after the relationship that gave rise to its processing has ended.

10. Transmission and transfer of data

To carry out its activities, DOMUS CONSULTING S.A.S. may share information with, or allow its processing by, technology providers, financial institutions, notary offices, authorities, partners, service providers and other third parties whose involvement is necessary to provide the contracted service or comply with legal obligations.

When such third parties act as data processors, DOMUS CONSULTING S.A.S. will seek to ensure that processing is carried out in accordance with the authorized purposes and applicable data protection and information security obligations.

International transmissions or transfers of information, when they occur, will be carried out in accordance with applicable legal provisions.

11. Cookies and similar technologies

The DOMUS CONSULTING S.A.S. website may use cookies and similar technologies to ensure its operation, remember preferences, understand how users interact with the site, obtain browsing statistics and improve the digital experience.

When non-essential cookies requiring consent are used, users may accept, reject or manage their preferences through the mechanisms enabled on the site.

Users may also manage certain cookies from their browser settings.

12. Third-party sites and services

The website may contain links to or integrations with pages, social networks, platforms or services managed by third parties.

DOMUS CONSULTING S.A.S. does not control the privacy policies or information-processing practices of such third parties. We therefore recommend reviewing their respective policies before providing any personal information.

13. Legal content on the website

Articles, newsletters, publications, analyses, comments and other legal content published on the DOMUS CONSULTING S.A.S. website are for informational and academic purposes.

Reading them does not constitute individual legal advice or a legal opinion applicable to a particular case, nor does it in itself create an attorney-client relationship.

Each legal situation requires a specific analysis of its facts, documents and particular circumstances.

14. Effective date and amendments

This Privacy and Personal Data Processing Policy is effective as of October 2026.

DOMUS CONSULTING S.A.S. may amend it when there are legal, regulatory, technological or operational changes, or changes related to the services offered by the firm.

When amendments are substantial, they will be communicated to data subjects through the appropriate means.

This English version is provided for convenience. In case of any discrepancy, the Spanish version shall prevail.