Privacy Notice

1. Who we are and who this Notice applies to

This Privacy and Personal Data Processing Notice applies to the Vértis Torres Group companies established in Brazil and Colombia, identified below:

Brazil

IHS Brasil – Cessão de Infraestruturas S.A., inscrita no CNPJ/MF sob o nº 15.811.119/0001-11, com sede na Avenida Doutor Chucri Zaidan, 296, 22º andar, Condomínio Torre Z, Vila Cordeiro, São Paulo/SP, CEP 04583-110.

Colombia

Centennial Towers Colombia S.A.S, registered under NIT 900.616.308-2, with its registered office at Ce 14 No. 93 B 45 Of 204, Bogotá D.C.

The companies above are jointly referred to in this Notice as the “Vértis Torres Group”.

Each Vértis Torres Group company will act as controller or as the party responsible for the processing of personal data relating to the activities it carries out and to the decisions it makes about that processing.

In certain situations, two or more Vértis Torres Group companies may take part in the same processing activity. In those cases, their responsibilities will be determined according to their actual role and to the applicable law.

The Vértis Torres Group is committed to protecting the privacy and personal data of customers, prospective customers, suppliers, service providers, business partners, property owners, job applicants, employees, former employees, visitors to this website and other people its companies deal with.

The purpose of this Notice is to explain, clearly and transparently, how the Vértis Torres Group companies collect, use, store, share, protect and otherwise process personal data, and to inform data subjects of their rights.

Processing will be carried out in accordance with the law applicable in each country, including:

• in Brazil, Law No. 13,709/2018, the General Personal Data Protection Law, LGPD, the regulations of the Autoridade Nacional de Proteção de Dados, ANPD, and other applicable rules;
• in Colombia, Ley Estatutaria 1581 of 2012, its implementing rules, including Decreto Único Reglamentario 1074 of 2015, and the guidance of the Superintendencia de Industria y Comercio, SIC.

2. How we obtain personal data

The Vértis Torres Group companies may obtain personal data directly from data subjects or from duly authorised third parties, in the context of contractual, commercial, regulatory and institutional relationships, during recruitment and people management processes, and through the use of this website and its contact channels.

Where data is provided by third parties, the responsible company will carry out the processing in accordance with the legitimate purposes of the relationship, the responsibilities applicable to each processing agent and the law in force.

3. What personal data we process

Depending on the nature of the relationship, the company involved and the purpose of the processing, the following categories of personal data may be processed:

Identification data

Name, identity document, CPF, cédula de ciudadanía, cédula de extranjería, passport, date of birth, signature, photograph and other information needed to identify the data subject.

Contact data

Address, telephone number, email address and other information needed for communication.

Professional and corporate data

Job title, employer, area of work, professional history, qualifications, professional registrations and information relating to the commercial, contractual, regulatory or institutional relationship maintained with the Vértis Torres Group companies.

Financial, banking, tax and registration data

Information needed to make payments, issue invoices, process reimbursements, maintain records, manage contracts and comply with legal, tax, contractual or regulatory obligations.

Contractual and property data

Information relating to contracts, ownership, possession, representation, powers of attorney, public registries, licences, authorisations and the management of properties used in the activities of the Vértis Torres Group companies.

Job applicant data

Information contained in CVs, academic and professional history, qualifications, experience, availability and other information provided during recruitment and selection processes.

Data relating to browsing on this website

IP address, electronic identifiers, information about the device, browser and operating system, pages visited, date and time of access, and information collected through similar technologies.

Other data relating to the activities of the Vértis Torres Group

Depending on the nature of the relationship, other information may be processed where necessary for the Vértis Torres Group companies to carry out their activities, provided the processing is compatible with the purposes disclosed, proportionate and carried out in accordance with the applicable law.

4. Sensitive personal data

In specific situations, sensitive personal data may be processed, particularly data relating to health or occupational safety, where necessary to comply with legal or regulatory obligations, to exercise or defend rights, or for other purposes permitted by the applicable law.

Sensitive personal data will be processed only where there is an adequate legal basis, and will be subject to security measures appropriate to the nature of that information.

5. Personal data of children and adolescents

The Vértis Torres Group companies may process personal data of children and adolescents in specific situations, particularly in connection with the administration of dependants' benefits or with obligations relating to people management.

In those situations, processing will be carried out in accordance with the requirements of the applicable law and with safeguards appropriate to protecting the rights and interests of children and adolescents.

This website is not directed at children.

6. How we use personal data

The Vértis Torres Group companies may use the personal data they process for legitimate purposes relating to the conduct of their business activities, compliance with legal and regulatory obligations and the management of their relationships.

Personal data may be processed in order to:

• identify data subjects and communicate with them;
• manage relationships with customers, suppliers, service providers, business partners, property owners, job applicants and other third parties;
• negotiate, enter into, perform and administer contracts and other instruments;
• carry out registrations, approvals, qualifications, due diligence and verification;
• process payments, invoicing, reimbursements and tax obligations;
• administer contractual and property relationships;
• obtain, maintain and administer licences, authorisations, permits and registrations;
• carry out activities relating to the installation, operation, maintenance, regularisation and management of infrastructure;
• conduct recruitment, selection and hiring processes;
• comply with legal, regulatory, tax, employment, social security and contractual obligations;
• respond to requests, requisitions and orders from competent authorities, public bodies and government entities;
• exercise, defend and safeguard rights in judicial, administrative or arbitral proceedings or in other dispute resolution procedures;
• carry out audits, internal controls, compliance activities and investigations;
• respond to requests, communications and demands submitted through the channels made available by the Vértis Torres Group companies;
• protect people, systems, facilities, assets and operations;
• prevent fraud, unauthorised access, security incidents and other improper uses;
• operate, administer, protect and improve this website;
• analyse the performance, security and user experience of this website;
• carry out corporate transactions, reorganisations, audits and due diligence relating to potential transactions;
• carry out other processing compatible with the context and with the purposes disclosed in this Notice, observing the principles, legal bases and other requirements of the applicable law.

Where a Vértis Torres Group company intends to use personal data for a material purpose that is not compatible with those previously disclosed, it will provide the data subject with the additional information required, except where legally exempted.

7. Legal bases and authorisation for processing

The Vértis Torres Group companies will process personal data on the bases set out in the law applicable in each country, according to the purpose, the nature of the data processed and the context of the relationship maintained with each data subject.

Processing carried out in Brazil

In Brazil, processing may be carried out, as applicable, for:

• compliance with a legal or regulatory obligation;
• performance of a contract, or preliminary steps relating to a contract to which the data subject is a party;
• the regular exercise of rights;
• protection of the life or physical safety of the data subject or of third parties;
• credit protection, where effectively applicable;
• the legitimate interests of the controller or of third parties, observing the fundamental rights and freedoms of data subjects;
• obtaining the data subject's consent;
• other bases provided for in the LGPD.

Consent may be withdrawn at any time, subject to the applicable legal provisions.

Processing carried out in Colombia

In Colombia, processing will be carried out with the data subject's prior, express and informed authorisation where required, or on one of the statutory bases under which authorisation is not required.

The data subject will be informed of the purposes of the processing, their rights, and the identity and contact channels of the responsible company.

Authorisation may be obtained by physical, electronic or digital means, or by any mechanism that allows it to be consulted subsequently, in accordance with the applicable law.

Sensitive personal data will be processed only where permitted by law and in compliance with the specific conditions and safeguards that apply.

8. Who we share personal data with

Personal data may be shared where necessary for the Vértis Torres Group companies to carry out their activities, to manage relationships, to comply with obligations or for the other purposes disclosed in this Notice.

The Vértis Torres Group companies do not sell personal data. Sharing will be limited to what is necessary to fulfil the purposes described in this Notice.

Sharing may occur with:

Vértis Torres Group companies

For corporate management, shared services, administrative or technological support, security, audit, internal controls and the conduct of business activities.

Customers, suppliers, service providers, business partners and property owners

Where necessary for the performance of contracts, property management, infrastructure operation or compliance with the responsibilities assumed by the Vértis Torres Group companies.

Technology providers

Including companies responsible for hosting, cloud storage, technical support, information security, analytics, systems operation and the running of this website.

Professional advisers

Such as lawyers, consultants, auditors, insurers, financial institutions, benefits administrators and other professionals or providers needed to carry out the activities.

Public bodies and authorities

Including competent authorities, government entities, licensing bodies, public utility concessionaires, notary offices and other entities before which the Vértis Torres Group companies need to act.

Parties involved in corporate transactions

In the context of reorganisations, mergers, acquisitions, financings, investments, disposals, audits or due diligence, with appropriate confidentiality and data protection measures in place.

Other third parties

Where the third party's involvement is necessary to fulfil the purposes described in this Notice, observing the principles of necessity, transparency and security.

Sharing will be limited to the data necessary for each purpose. Technical, administrative, organisational and contractual measures aimed at protecting personal data will be adopted as applicable.

9. International transmission and transfer of personal data

Because the Vértis Torres Group operates internationally, personal data may be shared between companies located in Brazil and Colombia, and may be accessed, stored or processed in other countries by suppliers, service providers or partners.

Data subject to Brazilian law

Where processing is subject to the LGPD, the responsible company will observe the requirements of Brazilian law and of the ANPD regulations, adopting one of the applicable legitimate international transfer mechanisms.

Data subject to Colombian law

Where processing is subject to Colombian law, the responsible company will observe the rules applicable to the international transmission or transfer of data, including requirements relating to the data subject's authorisation, transmission agreements and restrictions on transfers to countries that do not provide an adequate level of protection, save for the cases permitted by law.

Further information about the applicable transfers, transmissions and safeguards may be requested through the channels indicated in this Notice, subject to commercial and industrial secrecy and to the rights of third parties.

10. Cookies and similar technologies

This website does not use cookies.

The only information stored is technical information relating to the user's language preference and a random visit identifier that remains active only for the duration of the browsing session.

Audience measurement is carried out without cookies and produces aggregate information about the use of the website; it does not allow users to be identified or recognised on future visits.

No advertising cookies, tracking pixels, third-party cookies or other technologies intended to monitor browsing across websites are used.

Should the technologies used on this website change in the future, this Notice will be updated to reflect those changes.

11. How we protect personal data

The Vértis Torres Group companies adopt technical, administrative and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or any form of improper or unlawful processing.

Access to personal data is limited to employees, service providers and third parties who need that information to perform their duties or to carry out the contracted activities, subject to the applicable confidentiality and security obligations.

Protection measures are defined according to the nature of the data processed, the context, the purposes and the risks involved, with the aim of preserving the confidentiality, integrity and availability of the information.

Although no measure can entirely eliminate every risk associated with processing personal data, the Vértis Torres Group companies review their controls and procedures as their activities, technologies and risks evolve.

12. Security incidents

The Vértis Torres Group companies maintain procedures for identifying, assessing, responding to and mitigating security incidents involving personal data.

Where the requirements of the applicable law are met, the appropriate notifications will be made to data subjects and to the competent authorities, including the ANPD in Brazil and the Superintendencia de Industria y Comercio in Colombia, as the case may be.

Suspicions relating to the misuse of personal data or to the occurrence of incidents may be reported through the channels indicated in this Notice.

13. How long we keep personal data

Personal data will be kept for as long as necessary to fulfil the purposes for which it was collected or subsequently processed.

Retention periods may vary according to:

• the nature of the data;
• the purpose of the processing;
• the context of the relationship;
• the duration of the contracts;
• the applicable legal, regulatory or limitation periods;
• the need to retain data for audits, internal controls, investigations or the defence of rights;
• compliance with requests from authorities;
• other cases permitted by law.

Once processing ends, or when the data is no longer necessary, it may be deleted or anonymised, as permitted by the applicable law.

Data may also be retained where there is a legal basis for keeping it, remaining subject to access controls and used only for the purposes that justify its retention.

14. Rights of data subjects

Data subjects may exercise the rights provided for in the law applicable to the processing.

Rights under Brazilian law

Where processing is subject to the LGPD, the data subject may request:

• confirmation that processing exists;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability, subject to the applicable regulations and to commercial and industrial secrecy;
• information about data sharing;
• information about the possibility of withholding consent and the consequences of doing so;
• deletion of data processed on the basis of consent, subject to the statutory cases for retention;
• withdrawal of consent;
• objection to processing carried out in breach of the law;
• review of decisions taken solely on the basis of automated processing, where applicable.

The data subject may also petition the ANPD and, where applicable, consumer protection bodies.

Rights under Colombian law

Where processing is subject to Colombian law, the data subject may:

• know, update and rectify their personal data;
• request proof of the authorisation granted, except where legally not required;
• be informed of the use made of their data;
• file complaints with the Superintendencia de Industria y Comercio;
• withdraw the authorisation or request deletion of the data, where applicable;
• access free of charge the personal data that has been processed;
• exercise the other rights provided for in the applicable law.

15. How to exercise your rights

Requests should be submitted to the company responsible for the processing or through the channels indicated in this Notice.

To protect personal data against improper access or fraudulent requests, additional information reasonably necessary to confirm the requester's identity and the legitimacy of the request may be sought.

Representatives may submit requests on behalf of the data subject upon adequate proof of their authority.

Requests will be reviewed and answered within the time limits and on the terms set out in the applicable law.

Certain requests may be limited or declined where there is a retention obligation, a need to exercise or defend rights, protection of third-party rights, security, commercial or industrial secrecy, or another legally applicable justification.

16. Contact channel

Requests relating to the processing of personal data may be sent to the Data Protection Officer (DPO) through the following channels:

Data Protection Officer: Marcela Raposo

Brazil — encarregado.privacidade@vertistorres.com.br

Colombia — oficial.datospersonales@vertistorres.com.co

17. Updates to this Notice

This Notice may be updated from time to time to reflect changes in processing activities, processes, systems or legal and regulatory requirements.

The most recent version will always be available on this website, together with the corresponding update date.

Where changes are material to the rights or expectations of data subjects, additional means of communication may be used, taking into account the context of the relationship and the contact details available.