Personal Data Protection Policy

1. Who are we?

Each company is the controller of the data it collects:

OHM MODULAR S.A.S. offers the OHM homes and Plan O Group S.A.S. builds them. When we work together on your project, we share your data only for the purposes of this policy.

Official channel: the email address buenavida@plano.com.co. Only the quotations and communications you receive from that address are valid.

2. Which laws do we follow?

• Article 15 of the Political Constitution of Colombia.
• Law 1581 of 2012.
• Decree 1074 of 2015 (articles 2.2.2.25.1.1 et seq.).
• The instructions of the Superintendence of Industry and Commerce (SIC).

3. Key terms

• Personal data: any information that identifies you or that can be associated with you. This also includes your image and your voice in a recording.
• Sensitive data: data that affects your privacy or whose misuse could lead to discrimination against you, such as health data.
• Data subject (titular): the person the data refers to; that is, you.
• Processing (tratamiento): any use of the data: collecting, storing, consulting, sending or deleting it.
• Controller (responsable): whoever decides on the processing; here, each of our companies.
• Processor (encargado): whoever processes the data on behalf of the controller; for example, an email or storage provider.
• Authorization: your prior, express and informed consent.

4. Principles we apply

We process your data according to the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality (Law 1581 of 2012, article 4). In short:

• We only collect what is necessary.
• We use it for what we told you and with your authorization.
• We do not publish your data on the internet.

5. What data do we process?

Clients and prospective clients

• Contact: name, phone number and email.
• Your lot: location (municipality, rural district, point on the map) and the documents you send us: property title certificate (certificado de tradición y libertad), photos, videos, regulations, drawings and studies. We do not ask for your ID number to give you a quotation.
• Your project: what you need and like for your home and, if you choose to tell us, your budget.
• If you sign a contract: identification (ID number or NIT), billing and payment details, construction communications, formal records (actas), handovers and warranties.

Visitors to our offices

• Your image and your voice, captured by the video surveillance system (section 7).

Visitors to our websites

• Browsing data (IP address, device type and pages visited), collected with analytics cookies.

Suppliers, contractors and partners

• Identification, contact details, tax and banking details and, when the law requires it, social security and occupational health and safety documents.

Employees and job applicants

• The data needed for recruitment and for the employment relationship. When they join us, we give them the details of this processing.

Sensitive data. We do not ask for it as a requirement, and none of our services depends on you giving it to us. If you decide to tell us something sensitive, we use it only to design your home and with your express authorization. For example: accessibility needs due to health or mobility. Answering those questions is optional.

Children and adolescents. We do not collect data from minors. If, to design your home, you tell us how many children will live in it or their approximate ages, we use that information only for the design, respecting their best interests and with the authorization of their legal representative.

Other people's data in your documents. The property title certificate, the drawings or the regulations may include data about other people, such as the owner, the seller or the neighbors. We use it only to review your lot and keep it confidential.

6. What do we use your data for?

1. To answer your questions by email, phone, forms or messages on social media.
2. To review your lot documents, and to prepare and send you quotations and design proposals.
3. To enter into and perform your contract: design, permits and procedures, construction, invoicing, payments, handover, warranties and after-sales service.
4. To send you marketing information (news, launches and offers) by email, WhatsApp or direct message on social media, only if you authorized it in a separate checkbox. You can opt out whenever you want.
5. Web analytics: to learn, in aggregate, how our websites are used, in order to improve them.
6. Security of the people, property and facilities of our offices, through video surveillance with image and sound (section 7).
7. To show images of the projects we build, only with the owner's separate authorization (section 8).
8. To comply with legal, accounting, tax, and occupational health and safety obligations; to respond to the authorities; and to defend our rights.
9. With suppliers and contractors: to hire them, pay them and verify legal requirements.
10. With employees and job applicants: recruitment, the employment relationship and social security obligations.

We do not sell or rent your data.

7. Video surveillance in our offices (image and sound)

• Purpose. At the offices in Ciudadela Complex Llanogrande (Rionegro), there are cameras that record image and sound, only for the security of people, property and facilities. We do not use them for any other purpose.
• Notice. At the entrance and in each monitored area, there are visible signs stating that image and sound are being recorded, who the controller is and where to consult this policy. If you enter after seeing the sign, you accept being recorded for that purpose.
• Where sound is recorded. Only at the entrance and the reception. There are never cameras or microphones in restrooms, meeting rooms, private offices or break areas, and we do not record phone calls.
• No live listening. We do not listen to the recordings live. We only review them if there is a security incident, a claim or a request from an authority.
• How long. Recordings are kept for 30 days and are then deleted automatically, unless a recording is needed to handle an incident, a claim or a request from an authority.
• Who sees them. Only authorized persons, and the authorities when they legally request them.
• Your rights. You can request the recordings in which you appear. To protect other people, we give them to you without showing third parties or letting them be heard.

8. Project images

• Only with your authorization. We use photos or videos of your home (for example, on our websites, in catalogs, on social media or in architecture competitions) only if you authorize it in a separate document.
• It is optional. Signing it or not signing it does not change your contract, your price or your warranty.
• Without your details. We do not show your name or the exact location of your home. If a person appears in an image, we also need their authorization.
• You can withdraw it. If you change your mind, we remove the images from our digital channels within a maximum of 10 business days (Monday to Friday, excluding Colombian public holidays) and we do not use them in new materials. We cannot recall printed materials that have already been delivered.

9. Who do we share your data with?

• Between Plan O Group S.A.S. and OHM MODULAR S.A.S., for the purposes of this policy.
• Technology providers that process data on our behalf (processors): website hosting, email, cloud storage, forms, messaging, social media, video surveillance, analytics, and the productivity and artificial intelligence tools we use for our work. For example, Google (email, storage, forms and analytics), Cloudflare (website hosting) and Meta (WhatsApp, Instagram and Facebook).
  • Some of them are outside Colombia.
  • We require them to maintain confidentiality and security, and to use the data only for what we entrust to them.
• Professionals and entities involved in your project, and only as needed: designers, engineers, the urban permit office (curaduría) or the planning office (for the permit) and the utility companies.
• Authorities, when a law or a court order requires it.

10. Your rights

As the data subject, you can:

1. Access, update and rectify your data.
2. Request proof of the authorization you gave us.
3. Find out, upon request, how we have used your data.
4. File complaints with the Superintendence of Industry and Commerce, after submitting your inquiry or claim to us.
5. Revoke your authorization or ask us to delete your data, unless there is a legal or contractual duty to keep it.
6. Access your data free of charge.

11. How do you exercise your rights?

Where: write to buenavida@plano.com.co with the subject line "Datos personales" (personal data), or send a letter to the address of the relevant company (section 1). Requests are handled by General Management, with the support of Administrative Management.

Who can make the request:

• You, by proving your identity.
• Your heirs, by proving that status.
• Your representative or attorney-in-fact, with the document that proves it.
• Children's rights are exercised by those who represent them.

Inquiries (to find out what data we hold and how we use it):

• We answer within a maximum of 10 business days from the date we receive your inquiry.
• If we cannot meet that deadline, we tell you why and answer within a maximum of 5 additional business days.

Claims (to correct, update or delete data, revoke the authorization or report non-compliance):

• What to include: your identification, what happened, your address and any documents you wish to provide.
• If something is missing: we ask you for it within 5 days after we receive your claim. If 2 months go by after our request without you completing it, we will consider that you have withdrawn your claim.
• If it is not ours to resolve: we forward it to the appropriate party within a maximum of 2 business days and let you know.
• While it is being resolved: within a maximum of 2 business days, we mark your data with the legend "reclamo en trámite" (claim in process).
• Response time: a maximum of 15 business days, counted from the day after the date of receipt. If we cannot meet that deadline, we tell you why and answer within a maximum of 8 additional business days.

These procedures are free of charge.

12. How do we protect your data?

We use reasonable security measures:

• Access only for the people who need it.
• Two-step verification.
• Backups.
• Providers with security standards.

Lot documents are kept in a restricted-access folder. Everyone who works with us must maintain confidentiality. If an incident occurs that puts your data at risk, we report it to the Superintendence of Industry and Commerce and take the necessary measures.

13. How long do we keep your data?

Only for as long as each purpose requires and as the law requires:

14. Cookies and analytics

Our websites use analytics cookies to learn, in aggregate, how many people visit us and which pages they read. You can block or delete them in your browser settings without losing access to the website.

15. Changes to this policy

If we make a significant change, we will publish it on this page and inform you before applying it. If the change affects the purpose for which you authorized the use of your data, we will ask you for a new authorization.

16. Effective date

This policy has been in force since October 5, 2026. Our databases will remain in force for as long as the purposes described remain and our companies carry on their activities, without prejudice to the retention periods in section 13.