Personal data
processing policy

In compliance with Statutory Law 1581 of October 17, 2012, Decree 1377 of June 27, 2013, and Constitutional Court ruling C-748 of October 2, 2011, which set out general provisions for the protection of personal data and regulate the collection, storage, use, circulation, and deletion of personal data, Mejía Villegas Constructores S.A. and its business partners, consortia, and/or joint ventures (hereinafter MEVICONSA S.A.), as the parties responsible for processing the personal data of all such persons, present their PERSONAL DATA PROCESSING POLICY.

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA MEJIA VILLEGAS CONSTRUCTORES S.A.

The following principles will apply:

• Principle of legality: processing will be subject to the established rules and the other provisions that develop them.
• Principle of purpose: the data subject will be informed of the legitimate purpose of the processing, in accordance with the Constitution and the law.
• Principle of freedom: processing may only be carried out with the prior, express, and informed consent of the data subject, or by legal or judicial mandate.
• Principle of truthfulness or quality: information must be truthful, complete, accurate, up to date, verifiable, and understandable.
• Principle of transparency: the data subject is guaranteed the right to obtain from the controller or processor, at any time and without restriction, information about the existence of data concerning them.
• Principle of restricted access and circulation: processing is subject to the limits arising from the nature of personal data and from the provisions of the law and the Constitution.
• Principle of security: information subject to processing will be handled with the technical, human, and administrative measures necessary to keep records secure, preventing their alteration, loss, consultation, use, or unauthorized or fraudulent access.
• Principle of confidentiality: all persons involved in the processing are required to keep the information confidential, even after their relationship with any of the tasks involved in the processing has ended, except where this corresponds to activities authorized by law and under its terms.

AUTHORIZATION AND COLLECTION OF DATA

AUTHORIZATION for the collection of data must be given by the data subject, who expresses verbally or in writing their consent to its use and collection. The person in charge of data processing has the duty to inform the data subject of the usage policies, that is, the purpose for which the requested information will be needed. This must be done at the time the data is collected. Authorization of the data subject: without prejudice to the exceptions provided by law, processing requires the prior and informed authorization of the data subject, which may be obtained by any lawful means that can be consulted later. The data subject's authorization is not required in the case of:

• Information required by a public or administrative entity in the exercise of its legal functions or by court order.
• Data of a public nature.
• Cases of medical or health emergency.
• Information authorized by law for historical, statistical, or scientific purposes.
• Data related to the civil registry of persons. Anyone who accesses personal data without prior authorization must in any case comply with the provisions of the law.

The controller must clearly and expressly inform the data subject of the following:

• The processing to which their personal data will be subjected.
• That answering questions is optional when they concern sensitive data or children and adolescents.
• The rights they have as data subject.
• The identification, physical or electronic address, and telephone number of the controller. THE DATA SUBJECT'S AUTHORIZATION WILL BE DEEMED GIVEN WHEN IT IS MADE: in writing, orally, or through unequivocal conduct of the data subject that allows it to be reasonably concluded that they granted authorization. In no case may silence be taken as unequivocal conduct. PROOF OF HOW THE HANDLING OF DATA WAS AUTHORIZED MUST ALWAYS BE KEPT. Personal data is collected, stored, organized, analyzed, transmitted, updated, rectified, deleted, eliminated, and managed according to the purpose or purposes for which it was obtained and as indicated in this policy. MEVICONSA S.A. may COLLECT this information on the website, or directly at its own facilities and the camps of works in progress. The data collected is stored on servers located at our company, where it is safeguarded using information-security tools reasonably accepted in the industry, such as firewalls, antivirus software, and access-control procedures. All of the above is intended to prevent unauthorized access by third parties to the stored personal data. Personal data found in publicly accessible sources, regardless of the means of access, meaning data or databases available to the public, may be processed by anyone provided that, by their nature, they are public data.

Direct data collection: this refers to the information that you, as a User, give us directly as a condition for accessing the services we offer directly or indirectly, such as employees, suppliers, contractors, or customers. The information collected allows us to:

– Comply with the legal obligations of Meviconsa S.A., including tax, commercial, and social-security regulatory obligations. Execute the contracts Meviconsa S.A. enters into with data subjects. Develop and carry out Meviconsa S.A.'s internal processes for the selection and management of contractors and suppliers. Record, develop, analyze, and keep statistical information. Contact data subjects, including by electronic means such as email, fax, mobile messages, or similar, for the proper fulfillment of Meviconsa S.A.'s corporate purpose and of the contracts entered into between it and the data subjects. In employment matters, comply with the resulting obligations, such as carrying out all necessary procedures before national authorities, including registration with the comprehensive social-security system, carrying out procedures before the National Tax and Customs Directorate (DIAN), or any other activity or obligation provided for by law or in current contracts, including taking out life or medical-expense insurance, granting any other benefit, or making the corresponding payments. Notify the appropriate person in case of emergency while data subjects are on the Company's premises. Communicate, consolidate, organize, update, control, accredit, secure, report, maintain, interact with, and manage the actions, information, and activities by virtue of which data subjects are related or linked to the company. Provide MEVICONSA S.A.'s contractors who provide services requested by the data subject with the information necessary for the proper provision of their services. MEVICONSA S.A. will not sell the personal data provided to it. The information collected may be shared with and processed by Mejía Villegas Constructores S.A. for its business partners, consortia, and/or joint ventures.

In addition, the handling of the information collected is carried out through strict information management and retention processes and methodologies, which are described in internal policy manuals on information handling. REVOCATION OF AUTHORIZATION: data subjects may at any time ask the controller or processor to delete their personal data and/or revoke the authorization granted for its processing, by submitting a claim or request.

DUTIES OF THOSE RESPONSIBLE FOR DATA PROCESSING

Guarantee the data subject, at all times, the full and effective exercise of the right of habeas data. Request and keep, under the conditions provided in this law, a copy of the respective authorization granted by the data subject. Duly inform the data subject about the purpose of the collection and the rights they have by virtue of the authorization granted. Keep the information under the security conditions necessary to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access; guarantee that the information provided to the processor is truthful, complete, accurate, up to date, verifiable, and understandable; update the information, promptly communicating to the processor all changes to the data previously provided and adopting the other measures necessary to keep the information provided up to date; rectify the information when it is incorrect and communicate this to the processor; provide the processor, as the case may be, only with data whose processing has been previously authorized in accordance with this law; require the processor at all times to respect the security and privacy conditions of the data subject's information; handle inquiries and claims made under the terms of this law; adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, for handling inquiries and claims; inform the processor when certain information is being disputed by the data subject, once the claim has been filed and the respective procedure has not been completed; inform the data subject, upon request, about the use given to their data; inform the data protection authority when there are violations of security codes and risks in the management of data subjects' information.

PURPOSE OF THE PROCESSING

MEVICONSA S.A. will process personal data in order to: Effectively provide its customers with civil works and other services in accordance with its corporate purpose. Comply with legal obligations, including tax, commercial, and regulatory security and airport-services obligations. Execute the contracts MEVICONSA S.A. enters into with data subjects. Send and manage information related to the contracts or services provided by MEVICONSA S.A. Develop and carry out MEVICONSA S.A.'s internal processes for the selection and management of contractors and suppliers. Record, develop, analyze, and keep statistical information. Provide information on, or updates to, the services provided by MEVICONSA S.A. Respond to questions, requests, comments, and/or suggestions submitted by data subjects. Contact data subjects, including by electronic means such as email, fax, mobile messages, or similar, for the proper fulfillment of MEVICONSA S.A.'s corporate purpose and of the contracts entered into between it and the data subjects. In employment relationships, comply with the resulting obligations, such as carrying out all necessary procedures before national authorities, including registration with the Comprehensive Social Security System, carrying out procedures before the National Tax and Customs Directorate (DIAN), or any other activity or obligation provided for by law or in current contracts, including taking out life or medical-expense insurance, granting any other benefit, or making the corresponding payments. Notify the appropriate person in case of emergency while data subjects are at our facilities or work sites. Communicate, consolidate, organize, update, control, accredit, secure, report, maintain, interact with, and manage the actions, information, and activities by virtue of which data subjects are related or linked to the Company. Verify and validate the information provided by data subjects. Access, consult, compare, and evaluate all information about data subjects stored in the databases of any legitimately constituted credit, financial, criminal-record, or security bureau, whether public or private, national or foreign. Provide MEVICONSA S.A.'s contractors who provide services requested by the data subject with the information necessary for the proper provision of their services. If MEVICONSA S.A. is unable to carry out the processing by its own means, or if current regulations so require, it may transfer the personal data collected to be processed by a third party, after notifying the data subjects. This third party will be the processor and must guarantee suitable conditions of confidentiality and security for the information transferred. If the data subject requests a product or service, provide the necessary information to distributors or third parties in order to deliver the product or provide the service in question or, where applicable, so that a third party can contact the data subject. These third parties will not be authorized to use the personal data in any way other than that indicated by MEVICONSA S.A. Information provided to third parties will be covered by the same rights and guarantees established by law and set out in this policy. MEVICONSA S.A. will not sell the personal data provided to it.

EFFECTIVE DATE OF THE POLICY

This policy takes effect on September 8, 2016. MEVICONSA S.A.'s databases are kept for the time necessary to ensure fulfillment of its corporate purpose, legal mandate, and the provisions of other document-retention rules.

AUTHORIZATION

Data authorization will be requested by email or in person, stating the following: By filling in and registering the data listed in this form, the third party (individual) authorizes MEJIA VILLEGAS CONSTRUCTORES S.A., and the consortia and/or joint ventures in which the company participates, to collect, store, and use such data in order to carry out the procedure established according to its content. The above is in compliance with Law 1581 of 2012 ("Data Protection Law"), partially regulated by Decree 1377 of 2013. In accordance with our data processing policy available on the website: www.itacatower.com. For all legal purposes, by signing I certify that the information entered above in this form is true and I authorize the processing of the data recorded in this form. Signature of the Legal Representative: _________________________ Content of the authorization for personal data processing: These legends will appear on forms GT-FT-165, GT-FT-126, GT-FT124, GT-FT-003, GT-FT-092, GT-FT-062, SO-FT-203, SO-FT-251. In compliance with Article 10 of Decree 1377 of 2013, which regulates Law 1581. Authorization for the processing of personal data: By signing this document, I state that I have been informed by MEJIA VILLEGAS CONSTRUCTORES S.A. and the consortia and/or joint ventures in which the company participates (hereinafter MEVICONSA S.A.) that: 1. MEVICONSA S.A. will act as controllers of the personal data of which I am the subject and, jointly or separately, may collect, use, and process my personal data in accordance with the MEVICONSA S.A. Personal Data Processing Policy available at www.itacatower.com 2. Answering questions about sensitive data¹ or about minors is optional.

3. My rights as data subject are those provided in the Constitution and the law, especially the right to know, update, rectify, and delete my personal information, as well as the right to revoke the consent granted for the processing of personal data. 4. These rights may be exercised through the free channels provided by MEVICONSA S.A. and in accordance with the MEVICONSA S.A. Personal Data Processing Policy. 5. For any questions or additional information related to the processing of personal data, I may write to habeasdatameviconsa@gmail.com 6. MEVICONSA S.A. guarantees the confidentiality, freedom, security, truthfulness, transparency, access, and restricted circulation of my data and reserves the right to modify its Personal Data Processing Policy at any time. Any change will be announced and published in a timely manner on the website. In light of the above, I voluntarily, previously, explicitly, knowingly, and unequivocally authorize MEVICONSA S.A. to process my personal data in accordance with the MEVICONSA S.A. Personal Data Processing Policy and for purposes related to its corporate purpose, especially the legal, contractual, and commercial purposes described in the MEVICONSA S.A. Personal Data Processing Policy. I have provided the information obtained for the processing of my personal data voluntarily and it is true. Signed in ________________________, on the ____ of _______________ 2016. Signature: _________________________________ Name: _______________________________ ID: ___________________________ Email: ___________________________ NOTE: Please fill in this document with your name, ID, date, and signature, and send it to habeasdatameviconsa@gmail.com. ¹ Sensitive data is data that affects the data subject's privacy or whose misuse may lead to discrimination, for example political orientation, religious or philosophical beliefs, human rights, as well as data related to health, sex life, and biometric data.

DATA DELETION

The data subject has the right to ask MEVICONSA S.A. to delete their personal data when they believe it is not being processed in accordance with Law 1581 of 2012 and its regulations, or that it is no longer necessary for the purpose for which it was collected. Deletion means the total or partial elimination of the personal information, as requested by the data subject. MEVICONSA S.A. may refuse deletion when:

• There is a legal or contractual duty for the data to remain in the database.
• It would obstruct judicial or administrative proceedings related to tax obligations, the investigation and/or prosecution of crimes, or the updating of administrative investigations.
• The data is necessary to fulfill an obligation legally acquired by the data subject, or for reasons of public interest. When the deletion request affects the provision of services or the execution of contracts, the data subject will be informed in a timely manner and may freely and voluntarily withdraw the deletion request.

REQUEST FOR AUTHORIZATION FOR NEW USES

MEVICONSA S.A. may request the User's express authorization to use or circulate their data or information for purposes other than those stated in this Data Processing Policy and in the Terms and Conditions, for which it may send the User an email with that request.

EFFECTIVE DATE OF THE MANUAL

This manual will take effect from the date of its approval.