Privacy policy

TUCESIÓN

1. Privacy and Personal Data Processing Policy

Colombian platform for real-estate assignments and fiduciary-rights assignments

1. Data Controller

For purposes of Colombian personal data protection law, the Data Controller is MUV.ART S.A.S., the company that operates the TuCesion.com brand and platform (hereinafter, “TuCesión”).

2. Scope of this Policy

This Policy applies to the processing of personal data carried out by TuCesión through tucesion.com, its forms, customer service channels, communications, registration processes, and the publication and management of assignment opportunities, as well as to support and intermediation activities relating to real estate projects in Colombia.

TuCesión specializes in opportunities associated with real estate projects, including assignments of fiduciary rights, contractual positions, promissory sale-and-purchase agreements, and other rights connected with new housing, according to the legal nature of each project and the underlying agreement.

3. Legal Framework

• Article 15 of the Political Constitution of Colombia (privacy and habeas data).

• Statutory Law 1581 of 2012 and its implementing provisions incorporated into Decree 1074 of 2015.

• Law 1266 of 2008, solely when applicable to the processing of financial, credit, commercial, or service-related information subject to that special regime.

• Law 527 of 1999, concerning data messages, electronic commerce, and information retention.

• Law 1480 of 2011 and Law 2439 of 2024, where a consumer relationship or a service provided through electronic means exists.

• Title V of the Consolidated Circular of the Superintendence of Industry and Commerce (SIC), as amended from time to time, including rules on demonstrable accountability and international transfers.

• Other Colombian laws applicable to the processing of personal data and to the services offered by TuCesión.

4. Principles Governing Processing

TuCesión processes personal data in accordance with the principles of lawfulness, purpose limitation, freedom, accuracy or quality, transparency, restricted access and circulation, security, and confidentiality, applying criteria of necessity and proportionality.

5. Categories of Personal Data Processed

5.1. Identification and Contact Data

• Full name; type and number of identification document.

• Email address, telephone number, and city or municipality.

• Information concerning a legal entity and its legal representative where a user acts on behalf of a company.

5.2. Account and Authentication Data

• Account identifiers, registration status, access history, and security events.

• Credentials or authentication mechanisms managed directly by TuCesión or by authorized technology providers.

5.3. Assignment Opportunity and Project Data

• Project, city, real estate unit, stage, area, parking spaces, storage units, and other relevant characteristics.

• Information concerning the developer, promoter, trust company, or autonomous trust estate, where necessary to identify and assess the opportunity.

• The type of right or contractual position subject to assignment, contractual terms, restrictions, authorizations, and relevant dates.

• Amounts paid, outstanding balances, assignment price, proof of payment, and other financial information necessary to publish, verify, or manage the transaction.

• Contractual documents or supporting records provided by users, subject to access controls and data minimization.

5.4. Financial and Due Diligence Data

Where necessary to advance a transaction, TuCesión may request information regarding payment capacity, credit pre-approvals, source-of-funds documentation, billing information, or other due diligence documents. Such data will be limited to what is strictly necessary and will not be made public in listings.

5.5. Technical and Browsing Data

• IP address, browser type, operating system, device, technical identifiers, and security logs.

• Interactions with the platform, pages visited, browsing events, and preferences, in accordance with the Cookie Policy and the user's choices.

5.6. Communications and Customer Service Data

• Messages, requests, petitions, complaints, claims, supporting records, and communications with TuCesión.

• Records necessary to evidence acceptance of terms, authorizations, and process traceability.

5.7. Third-Party Data Included in Documents

Users may provide documents containing third-party data, for example, data relating to representatives of developers, trust companies, co-owners, or attorneys-in-fact. A user who provides such documents represents that it has a lawful basis to provide them and must refrain from uploading unnecessary information. TuCesión may redact or limit the disclosure of third-party data to reduce the risk of unauthorized disclosure.

5.8. Sensitive Data

TuCesión does not request sensitive data unless it is strictly necessary. Where the processing of sensitive data is required, its optional nature will be disclosed and explicit authorization will be obtained where required by law. Refusal to provide sensitive data may not prevent access to features that do not objectively depend on that data.

6. Sources of Information

• Information provided directly by the Data Subject during registration or use of the platform.

• Documents and supporting records uploaded by assignors, assignees/purchasers, or their representatives.

• Information obtained, where appropriate, from authorized providers of identity, security, communications, payment, or due diligence services.

• Public sources or public records, solely where consultation and use of the information are legally permissible.

• Technical data generated through use of the platform and the technologies described in the Cookie Policy.

7. Purposes of Processing

1. To create, authenticate, and manage user accounts.

2. To enable the publication, editing, moderation, display, and management of assignment opportunities.

3. To facilitate contact, support, and intermediation between parties interested in an assignment, in accordance with the contracted service.

4. To reasonably verify the identity, ownership, documentary consistency, and status of an opportunity, without such verification constituting a guarantee of the final validity of the assignment.

5. To coordinate requests for information with developers, promoters, trust companies, or other third parties where necessary and where authorization or another legal basis exists.

6. To manage intermediation/brokerage agreements, commissions, invoicing, and payment obligations.

7. To prevent fraud, identity theft, platform misuse, security incidents, and unlawful activity.

8. To comply with legal, tax, accounting, commercial, consumer-protection, and competent-authority requirements.

9. To respond to inquiries, petitions, complaints, claims, and requests from Data Subjects.

10. To retain evidence of authorizations, electronic acceptances, communications, and actions associated with the service.

11. To conduct analytics, measurement, and user-experience improvement on an aggregated basis or with the consents required for non-essential technologies.

12. To send operational communications related to an account or an ongoing transaction.

13. To send commercial or promotional communications only where the Data Subject has granted the relevant authorization or another applicable legal basis exists.

8. Authorization and Evidence of Consent

Except as expressly permitted by law, TuCesión will obtain the Data Subject's prior, express, and informed authorization through a means that permits subsequent consultation. Acceptance of this Policy does not, by itself, replace authorization where applicable law requires a separate or specific manifestation.

TuCesión will retain evidence of authorizations, the version of the accepted texts, and the time of acceptance.

Performance of a contract or TuCesión's business interest will not be treated as an independent exception to the authorization requirement under Law 1581 of 2012, without prejudice to circumstances in which the law permits processing without authorization.

9. Listings and Access to Information

TuCesión seeks to ensure that listings display only the information necessary to assess an opportunity. Identity documents, financial records, signatures, account numbers, private addresses, private contact details, and other unnecessary information must not be publicly disclosed.

Access to detailed contractual documents may depend on registration, user verification, or the stage of the negotiation.

10. Data Processors, Partners, and Recipients

TuCesión may disclose data to providers acting as Data Processors for infrastructure, hosting, storage, authentication, support, communications, analytics, invoicing, security, or due diligence services. Those providers must be subject to confidentiality, security, and processing obligations consistent with TuCesión's instructions.

TuCesión may also provide information to developers, promoters, trust companies, financial institutions, professional advisors, or authorities where necessary for the requested transaction, where the Data Subject has authorized the disclosure, or where a legal duty or power applies.

TuCesión does not sell personal data to enable third parties to conduct their own unauthorized marketing.

11. International Transfers and Transmissions

Where a technology provider processes information from outside Colombia, TuCesión will assess whether the arrangement constitutes an international transfer or transmission and will apply the rules of Law 1581 of 2012, Decree 1074 of 2015, and the SIC's then-current Consolidated Circular. Where required, TuCesión will verify an adequate level of protection, a legal exception, the relevant authorization, or safeguards and mechanisms recognized by the authority.

12. Rights of Data Subjects

• To know, update, and rectify their personal data.

• To request proof of the authorization granted, where applicable.

• To be informed, upon request, about the use made of their data.

• To submit complaints to the SIC for violations of the personal data protection regime, once the direct procedure has been exhausted where required.

• To revoke authorization and/or request erasure where appropriate and where no legal or contractual duty justifies retention.

• To access their personal data free of charge.

13. Procedure for Inquiries and Claims

Requests may be submitted through contacto@tucesion.com and other channels enabled by TuCesión. The requester must provide identification and clearly describe the request.

13.1. Inquiries

Inquiries will be answered within a maximum of ten (10) business days from receipt. If a response cannot be provided within that period, TuCesión will inform the requester of the reasons and the new response date, which may not exceed five (5) additional business days.

13.2. Claims

Claims will be handled in accordance with Article 15 of Law 1581 of 2012. The maximum response period is fifteen (15) business days counted from the day following complete receipt of the claim. If the claim cannot be resolved within that period, TuCesión will inform the requester of the reasons and the new response date, which may not exceed eight (8) additional business days.

Where a claim is incomplete, TuCesión may request the missing information within the statutory time limits. If TuCesión is not competent to handle the claim, it will transfer the claim to the appropriate party where applicable and inform the requester.

14. Information Security and Incidents

TuCesión implements reasonable technical, human, and administrative measures appropriate to the risk to protect the confidentiality, integrity, and availability of data. Such measures may include encryption in transit, role-based access controls, audit logs, backups, vulnerability management, provider controls, and incident response procedures.

Security incidents involving personal data will be assessed, contained, documented, and reported to the authority where applicable. TuCesión will notify affected Data Subjects where legally required or reasonably necessary to enable them to take protective measures.

15. Retention and Deletion

Data will be retained for the reasonable and necessary period to fulfill the authorized purposes and applicable legal obligations. Once a purpose ends, data will be deleted, anonymized, or blocked, unless retention is required by a legal, contractual, or evidentiary obligation.

• Account data: while an active relationship exists and for the period necessary to address subsequent obligations or claims.

• Transaction documents, agreements, invoices, and commercial records: for the applicable statutory period; certain commercial books and records may be subject to a ten (10)-year retention period.

• Marketing data: until authorization is revoked or the purpose ceases, whichever occurs first, without prejudice to retaining minimum evidence of the opt-out request.

• Security records: for the period established in the internal security policy and in accordance with the principle of necessity.

16. Minors

TuCesión's transactional services are directed to individuals over eighteen (18) years of age and legal entities. TuCesión does not intend to collect minors' data for the purpose of entering into assignment transactions. If TuCesión identifies unauthorized processing of minors' data, it will take measures to block or delete that data in accordance with the law.

17. Cookies and Similar Technologies

The use of cookies, local storage, pixels, and similar technologies is additionally governed by TuCesión's Cookie Policy. Technologies that are not strictly necessary will be subject to the applicable consent choices.

18. Amendments

TuCesión may update this Policy in response to legal, technological, or operational changes. Material changes will be communicated through reasonable means and, where they involve new purposes requiring authorization, consent will be requested before the new processing takes place.

19. Supervisory Authority

Colombia's personal data protection authority is the Superintendence of Industry and Commerce (SIC). A Data Subject may file a complaint with the SIC once the direct procedure with TuCesión has been exhausted where required by law.

20. Effective Date and Contact Information

This version becomes effective once approved and published by TuCesión. Proposed effective date: September 14, 2026.

Privacy and PQR (Petitions, Complaints and Claims) channel: contacto@tucesion.com

Website: tucesion.com.

tucesion.com | contacto@tucesion.com | Bogotá D.C., Colombia