Privacy Notice

PRIVACY POLICY CUSHMAN & WAKEFIELD COLOMBIA S A S

Last updated: October 2026

1. GENERAL INFORMATION

The company Cushman & Wakefield Colombia S A S, identified with Tax ID No. 900.050.036-3, domiciled at Calle 98 No. 9A-41, Oficina 203, Bogotá D.C., Colombia, with email address adm.colombia@cushwake.com and telephone number (601) 745 2038 (the "Company"), is an entity committed to protecting the privacy of, and any information that may be associated or related to, identified or identifiable natural persons (the "Personal Data") to which it has access in the course of its activities and functions. The Company receives, collects, uses, manages, analyzes, segments, indexes, transmits, transfers, stores and, in general, processes Personal Data that may be obtained in the course of, and for the purposes of, its activities and functions.

2. SCOPE OF APPLICATION OF THIS POLICY

This Privacy Policy of the Company (the "Policy") is directed at employees and candidates, clients and prospective clients, suppliers and contractors, visitors to the Company's offices, users of its website and, in general, any person whose Personal Data is being or will be Processed by the Company as Controller (the "Data Subjects"). The purpose of the Policy is to describe the mechanisms and procedures for protecting the rights of the Data Subjects; to identify the party (or parties) responsible for addressing inquiries, questions, claims and complaints; and, finally, to describe the purposes and types of Processing (as defined below) to which the Personal Data will be subject as part of the Company's activities.

This Policy will apply to all Processing carried out within the territory of the Republic of Colombia by the Company and, where applicable, with respect to those third parties with whom the Company agrees to carry out, in whole or in part, any activity related to the Processing of Personal Data for which the Company acts as Controller (as defined below).

The Policy will apply to third parties with whom the Company may enter into Transmission agreements (as defined below), so that such third parties are aware of the obligations that will apply to them, the purposes to which they must adhere, and the security and confidentiality standards they must adopt when carrying out Processing on behalf of the Company.

3. DEFINITIONS

a) Authorization: The Data Subject's prior, express and informed consent to carry out the Processing of Personal Data.
b) Authorized Party: Refers to the Company and all persons under the Company's responsibility who, by virtue of the Authorization and this Policy, are entitled to carry out Processing.
c) Database: An organized set of Personal Data subject to Processing, whether electronic or not, regardless of the manner in which it was formed, stored, organized and accessed. The Company will keep separate the Databases in which it acts as Processor from those in which it acts as Controller.
d) Personal Data: Any type of information linked to, or that may be associated with, one or more identified or identifiable natural persons, including, among others:

• Personal identifiers, such as name, postal address, online identifier, Internet Protocol (IP) address, email address, telephone number, and other similar identifiers.
• Device-related information, including IP address, device type, cookie ID, as well as other usage information, internet browsing activity, and network activity.
• CCTV images and other building or facility access-control information, obtained for security purposes.
• Professional or employment-related information, such as job title, department, and payroll or salary records.
• Financial information, including that related to the processing of tenancy applications and tenant qualification assessments.
• Contact details, such as name, telephone number, address, email address, and photograph.
• Sensitive personal information (or a similar term, as defined under applicable law), which may include, among other things, any criminal convictions received, or details regarding political activities or religious affiliations (for example, in the context of determining whether an individual is a politically exposed person).
• Information obtained from third-party sources, including any of the categories described above.

e) Public Data: Personal Data classified as such under the mandates of the law or the Political Constitution, and any data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person's marital status, profession or occupation, and status as a merchant or public servant, as well as any data that may be obtained without any restriction. By its nature, public data may be found, among other sources, in public records, public documents, official gazettes and bulletins, and duly executed court judgments that are not subject to restriction.
f) Sensitive Data: Personal Data that could affect the privacy of the Data Subject or whose misuse could result in discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social or human rights organizations, or organizations that promote the interests of any political party or guarantee the rights of opposition political parties, as well as data relating to health, sexual life, and biometric data.
g) Data Processor: A natural or legal person, whether public or private, who, alone or jointly with others, carries out the Processing of Personal Data on behalf of the Data Controller.
h) Authorized Representative: Persons who may exercise the rights of the Data Subject, such as the Data Subject him/herself, his/her successors, representatives, attorneys-in-fact, and those who, by stipulation in favor of another or for another, are so accredited, provided they can prove such status. 
i) Law: Refers to Law 1581 of 2012, Decree 1074 of 2015, Ruling C-748 of 2011, applicable case law of the Constitutional Court, and regulations issued by the government on this matter. 
j) Manual: The document setting out the internal policies and procedures to ensure compliance with the Law.
k) Data Controller: A natural or legal person, whether public or private, who, alone or jointly with others, decides on the Database and/or the Processing of Personal Data. For purposes of this document, the Data Controller shall be the Company.
l) Data Subject: The natural person to whom the Personal Data refers, whose information may be kept in a Database and who is the holder of the right of habeas data. 
m) Transfer: Processing that involves sending information or Personal Data to a recipient acting as Controller, who may be located inside or outside the territory of the Republic of Colombia. In a Transfer, the recipient will act as Controller and will not be subject to the terms and conditions of this Policy. 
n) Transmission: Processing that involves the communication of Personal Data, within or outside the territory of the Republic of Colombia, so that the Processor may carry out the Processing of such Personal Data on behalf of the Controller. In a Transmission, the recipient will act as Processor and will be subject to this Policy or to the terms established in the corresponding Transmission agreement. 
o) Processing: Any systematic operation or procedure, whether electronic or not, including through tools that allow for the collection, storage, organization, safekeeping, modification, indexing, profiling, cross-referencing, use, circulation, analysis, segmentation, anonymization, compilation, evaluation, blocking, destruction and, in general, the processing of Personal Data, as well as its disclosure to third parties through communications, inquiries, interconnections, assignments, data messages, and other means used for such purposes.

4. RIGHTS OF DATA SUBJECTS

In accordance with the Law, Data Subjects have the following rights:

5. AUTHORIZATIONS AND NOTICES

All Processing must be preceded by obtaining Authorization. To that end, the Company, its employees and Authorized Parties must, prior to collecting Personal Data, obtain the Authorization signed by the Data Subject and retain a copy of this document for future reference. The Company, in its capacity as Data Controller, has implemented the necessary mechanisms to obtain Data Subjects' Authorization, ensuring in all cases that the granting of such Authorization can be verified.

The Authorization may be recorded in a physical or electronic document, a voice recording, or any other format that allows for its subsequent review, or through a suitable technical or technological mechanism by which it can be unequivocally concluded that, had the Data Subject not engaged in a particular conduct, the Personal Data would never have been captured and stored in the Database.

The Data Subject's authorization will not be required in the following cases:

a) Information required by a public or administrative entity in the exercise of its legal functions, or by judicial order;

b) Data of a public nature;

c) Cases of medical or health emergencies;

d) Processing of information authorized by law for historical, statistical or scientific purposes;

e) Data related to the Civil Registry of Persons.

Means of granting authorization:
The Company may obtain Authorization for the Processing of Personal Data through various means, including physical or electronic documents, data messages, the internet, websites, or any other format that in any case allows for consent to be obtained through unequivocal conduct, from which it may be concluded beyond doubt that, had such conduct not been carried out by the Data Subject or the person authorized to act on their behalf, the Personal Data would not have been stored or collected in the Database. Such Authorization will be requested by the Company prior to the Processing of the Personal Data.

Processing of Sensitive Data:
The Company Processes, on a limited basis, the following categories of Sensitive Data: (i) health data of its employees within the framework of the Occupational Health and Safety Management System (for example, fitness-for-work certificates resulting from occupational medical examinations and sick-leave records), and (ii) images captured by the closed-circuit television (CCTV) systems installed at its offices for security and access-control purposes. Sensitive Data is Processed only with the Data Subject's prior, express and informed Authorization, except in the cases exempted by Law. The Company informs Data Subjects that, because this information is Sensitive Data, they are not obliged to authorize its Processing or to answer questions about it, except where such information is required for the Company to comply with its legal obligations. The existence of CCTV systems is notified through signage placed in the monitored areas. The Company does not Process Personal Data of minors.

6. PURPOSES OF THE PROCESSING OF PERSONAL DATA

In the course of its activities, the Company will collect, use, manage, store, analyze, anonymize, index, segment, profile, transmit, transfer, and carry out various operations with Personal Data. Personal Data processed by the Company shall be subject solely to the purposes set out below, or to those accepted by the Data Subjects at the time the Personal Data is collected. Likewise, Processors or third parties who have access to Personal Data by virtue of the Law, a contract, or another binding document, shall carry out Processing for the following purposes:

• To create and manage records relating to your online account (as applicable);
• To provide you with online services, including facilitating your participation in any discussion forum, and for the administration of the website and the system; to improve our website(s) and our products and services;
• For due diligence purposes, in accordance with applicable law, to assess financial, reputational, credit or insurance risks arising from any relationship or potential relationship with you/your organization, and/or to carry out any necessary anti-money laundering checks;
• To provide you or your organization with the information, products or services you have requested, and to manage billing and payment;
• To send you service-related communications, to process communications you send us, and to request your feedback; to facilitate your participation in events or contests for which you have registered/in which you have participated;
• To contact you directly, or through our agents, by mail, telephone, fax, email, SMS or other electronic messaging service, with offers of goods and services or information that may be of interest to you (including information about goods and services from other organizations). In accordance with applicable law, you may opt in or out of receiving commercial communications at any time;
• To carry out analysis of the Personal Information we have collected;
• To verify your identity when you contact us, make a request, or access your online account;
• To prevent fraudulent, prohibited or unlawful activities, and to enforce our Terms of Service; 
• To comply with legal requirements, or to exercise, establish or defend our legal rights, or to protect the vital interests of any person;
• Collect information that will help us distinguish visitors, implement language preferences on our website, and improve their experience;
• Compile statistical reports on website activity through analytics cookies (e.g., number of visitors and the pages they visit); and
  
• Remember information about you when you visit our Website.

In addition, depending on the category of Data Subject, the Company Processes Personal Data for the following purposes:

• Employees and candidates: personnel management, recruitment and hiring, administration of the employment relationship and its conditions, payroll and payments, enrolment and contributions to the Integrated Social Security System, welfare and benefits, training, working-time and attendance control, occupational risk prevention and occupational health and safety management, access control to the premises and CCTV, and administrative management.
• Clients and prospective clients: management of the business relationship and of the contracted services (including property and facilities management and consultancy, valuation and advisory services), billing, payments and collections, due diligence and know-your-client checks, commercial prospecting, market segmentation, opinion surveys, loyalty and retention, commercial communications and own advertising, access control to the premises and administrative management.
• Suppliers and contractors: supplier management, onboarding and due diligence, execution and performance of contracts, billing, payments and collections, verification of independent contractors’ social-security contributions, compliance with tax and accounting obligations, and administrative management.
• Visitors: security and access control to the offices, CCTV and administrative management.

7. INTERNATIONAL TRANSMISSION AND TRANSFER OF PERSONAL DATA

The Company is part of the Cushman & Wakefield group, whose technology platforms and support services are operated centrally. Accordingly, Personal Data may be Transmitted to Processors located outside Colombia, in particular in the United States of America and in European Union countries, which provide the Company with information hosting and management, human-resources and payroll, customer-relationship management, finance and accounting, and business-process outsourcing services. Such Transmissions are carried out under Transmission agreements that meet the requirements of article 2.2.2.25.5.2 of Decree 1074 of 2015.
Likewise, Personal Data of employees and clients may be Transferred to affiliated companies of the Cushman & Wakefield group located outside Colombia, including its shareholder Cushman & Wakefield Consultoría Inmobiliaria Ltda. (Brazil) and the group companies in the United States of America, which act as Controllers for corporate administration, reporting and global management of human resources and client relationships. These Transfers are carried out with the Data Subject's prior, express and informed Authorization and/or to countries that provide an adequate level of personal data protection under the criteria set by the Superintendence of Industry and Commerce, in accordance with article 26 of Law 1581 of 2012.

8. PERSONAL DATA PROTECTION AREA

The Company has a department responsible for receiving and handling Requests, Complaints and Claims related to Personal Data: the Privacy Office, which forms part of the Legal, Ethics & Compliance (LEXIS) function. Within that department, the Privacy area will handle inquiries and claims relating to Personal Data in accordance with the Law, the Manual, and this Policy. Some of this area's specific functions in relation to Personal Data are:

• Attend to and receive all requests from Data Subjects, and process and respond to requests such as:
  (i) requests to update their Personal Data;
  (ii) requests to access knowledge of their Personal Data; 
  (iii) requests for deletion of Personal Data; 
  (iv) requests for revocation of the Authorization, when such revocation is applicable under the Law;
  (v) requests for information regarding the Processing given to their Personal Data;
  (vi) requests for information regarding the purposes of the Processing; and 
  (vii) requests to obtain proof of the Authorization granted, when applicable under the Law.
• Respond to Data Subjects regarding requests that are not applicable under the Law.
• Ensure the protection of Data Subjects' Personal Data.
• Ensure the implementation of good Personal Data management practices within the Company.
• Register the Databases managed by the Company with the National Database Registry (RNBD) and update such registration when necessary.

The contact details of the Privacy area are:
Privacy Office – Legal, Ethics & Compliance (LEXIS)
Privacy Director
Calle 98 No. 9A-41, Oficina 203, Bogotá D.C., Colombia
privacylatam {at} cushwake.com
601) 745 2038

9. PROCEDURES FOR EXERCISING DATA SUBJECTS' RIGHTS

a. Inquiries:
The Company will receive and resolve inquiries from the Data Subject or Authorized Representatives regarding:
• What Personal Data of the Data Subject is held in the Company’s Databases?
• What Processing is such Personal Data subject to?
• What purposes are being pursued?

Such inquiries must be submitted in writing to the following email address: privacylatam@cushwake.com. The Company will retain proof of the inquiry and its response.

The inquiry will be handled within a maximum term of ten (10) business days from the date of receipt.
When it is not possible to handle the inquiry within that term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the inquiry will be handled, which in no case may exceed five (5) business days following the expiration of the first term.

b. Claims:
The Company will receive and resolve claims filed by the Data Subject or Authorized Representatives regarding:
• Personal Data processed by the Company that must be corrected, updated or deleted;
• Alleged non-compliance with any of the Company's obligations under the Law.

Such claims must be submitted in writing to the following email address: privacylatam@cushwake.com. The Company will retain proof of the claim and its response.

The Data Subject or their successors who believe that information in a database should be corrected, updated, or deleted, or who become aware of an alleged breach of this law, may file a claim with the Data Controller or the Data Processor. The claim must include the Data Subject's identification, a description of the facts, an address, and supporting documents; if incomplete, the claimant must correct it within five (5) business days, and if two (2) months pass without a response, the claim will be deemed withdrawn. Once the complete claim is received, the database will include the notation "claim in process" within two (2) business days, remaining until resolved. The claim must be addressed within a maximum of fifteen (15) business days, extendable by up to eight (8) additional business days, with the claimant informed of the reasons for any delay.

10. PUBLICATION AND MODIFICATIONS TO THE POLICY

This Policy may be modified from time to time by the Company and will form part of the contracts entered into by the Company, where applicable. Any substantial modification of this Policy must be communicated to Data Subjects in advance through efficient mechanisms, such as the Company's website and/or email. A substantial modification is understood to include, among others, the following situations:

a) A change in the identification of the department, area or person responsible for handling inquiries and claims. 
b) An evident change in the purposes that could affect the Authorization. In such case, the Company will obtain a new Authorization.
Modifications will be communicated on the Company's website and/or via email sent to Data Subjects, provided the Company has such information available.

11. TERM OF THE POLICY AND OF THE DATABASES

This Policy shall take effect as of 1 November 2026, the date of its publication on the Company's website. Personal Data that is stored, used or transmitted will remain in the Company's Database, based on the criterion of temporality, for as long as necessary to fulfill the purposes set out in this Policy for which it was collected. Accordingly, the term of validity of the Database is closely related to the purposes for which the Personal Data was collected.

12. INFORMATION SECURITY AND SECURITY MEASURES

In compliance with the security principle established under the law, the Company has adopted, and will continue to adopt, the technical, technological, human and administrative measures necessary to provide security to records, preventing their alteration, loss, unauthorized or fraudulent access, use or consultation.