Cookie and similar technologies notice

DOCUMENT CONTROL

Identification

Version history

Use notice

Central declaration of this Notice. The VHG Group Site uses strictly necessary technical cookies only. It installs no analytics, advertising, targeting or third-party tracking cookies. Accordingly, no cookie banner or consent management panel is deployed, because there is no processing subject to authorisation to obtain. The addition of any non-technical cookie is subject to the activation regime in section 9, which must be completed before installation.

CONTENTS

1. Purpose and relationship to the other instruments
2. Scope of application
3. Technical definitions
4. Declaration of use
5. Legal basis by jurisdiction
6. Inventory of the Site's cookies
7. Data collected and its legal nature
8. Browser-level management and consequences of blocking
9. Activation regime for non-technical cookies
10. Third parties, international transfers and processors
11. Data subject rights
12. Effectiveness, updates and contact channels

1. Purpose and relationship to the other instruments

Tracking technologies are the point at which regulatory compliance is most directly assessed by authorities, since their deployment is observable from the outside by inspecting the site itself. The regime governing them must therefore be precise and match exactly what the site does: a notice announcing more than actually happens is as defective as one announcing less.

This Cookie Notice (the "Notice") explains how Valencia Holding Group LLC ("VHG" or the "Parent Company") and the entities adhering to the VHG Group Digital Legal Framework (the "Adhering Entities" and, together, the "VHG Group") use cookies and similar technologies on their websites, portals and online services (the "Digital Platforms").

It must be read together with the Terms and Conditions of Use (MLD-01), the Privacy Notice (MLD-02) and the Personal Data Processing and Protection Policy (MLD-04). On matters of personal data, MLD-04 prevails; on matters specific to cookies, this instrument prevails.

2. Scope of application

This Notice applies to all Digital Platforms operated by VHG and by the Adhering Entities — including Valencia Capital Group (VCG) and Valencia Investment Group (VIG), as well as any other affiliate, subsidiary or business unit that may in future join the Group, be incorporated by it or come under its control; an illustrative, non-exhaustive list — to all users accessing them, and to all cookies and similar technologies deployed through those platforms, whether first-party or third-party.

As at the publication date, the only Digital Platform in operation is the corporate site https://vhg.capital, operated by Valencia Holding Group LLC. The operating entity is identified in Annex A.

Each Adhering Entity is the Data Controller in respect of the cookies deployed on the platforms it operates and is answerable for compliance with this Notice on them.

3. Technical definitions

Cookie. A small text file that a website stores on the user's device — computer, tablet or mobile telephone — allowing information about the user's browsing to be retrieved.

First-party cookie. One placed from a domain managed by the VHG Group.

Third-party cookie. One placed from a domain managed by a third party, over which the VHG Group exercises no direct technical control.

Session cookie. One automatically deleted when the browser is closed.

Persistent cookie. One that remains stored on the device for a defined period or until manually deleted.

Strictly necessary technical cookie. One indispensable for transmitting a communication or for providing a service expressly requested by the user, which does not permit identifying the user or building a profile of them, and whose duration is limited to what is strictly required.

Similar technologies. Pixels, web beacons, tags, scripts, device fingerprinting, local storage (localStorage, sessionStorage) and browser-indexed databases, among others. All of these are subject to the same regime as cookies under this Notice, regardless of their technical designation.

4. Declaration of use

This section is the core of the Notice and the declaration that users and authorities can test directly against the Site's actual behaviour.

The VHG Group Site uses strictly necessary technical cookies exclusively. In particular, and expressly, the Site does not install:

● Analytics or audience-measurement cookies, whether first-party or third-party. ● Advertising, targeting, remarketing or frequency-capping cookies. ● Social network or advertising platform pixels or tags. ● Device fingerprinting techniques. ● Third-party cookies for the purpose of tracking user behaviour.

Practical consequence. Since there is no cookie-derived processing subject to authorisation, the Site deploys no cookie banner and no consent management panel. The VHG Group takes the view that a banner requesting consent where there is nothing to consent to misleads the user and undermines the consent mechanism itself.

Duty of correspondence. The Group Data Protection Office shall verify every six months, by technical inspection of the Site, that its actual behaviour matches this declaration. Each verification is documented.

5. Legal basis by jurisdiction

The regime of lawful bases is not uniform across the jurisdictions in which the VHG Group operates. This section differentiates it expressly, because applying an international standard without differentiation is precisely what produces a defect of lawfulness.

5.1 Colombia

In Colombia, the processing of personal data collected through cookies requires the data subject's prior, express and informed authorisation, in accordance with Article 9 of Law 1581 of 2012.

Colombian law does not recognise "legitimate interest" as an autonomous lawful basis. The only exceptions to the authorisation requirement are those exhaustively listed in Article 10 of Law 1581 of 2012.

Technical exception applicable to the Site. No authorisation is required for strictly technical cookies indispensable for transmitting a communication or for providing a service expressly requested by the user, provided they do not permit identifying the user or building a profile of them and their use is limited to the strictly necessary duration. This exception is construed restrictively and does not cover analytics, advertising or audience-measurement cookies. The cookies listed in section 6 fall entirely within this exception.

5.2 United States

Valencia Holding Group LLC is incorporated in the State of Delaware. The applicable federal and state frameworks apply, including Section 5 of the Federal Trade Commission Act on unfair or deceptive practices and, where their applicability thresholds are met — which the Group does not currently reach — state consumer privacy laws.

5.3 European Economic Area and United Kingdom

Where Regulation (EU) 2016/679 or the UK GDPR applies under their territorial scope rules, their own lawful bases shall govern, together with national rules on electronic communications. The exclusive use of strictly necessary technical cookies likewise satisfies the standard of those jurisdictions.

5.4 Application rule

The VHG Group shall apply to each user the regime corresponding to their jurisdiction of access. Where that jurisdiction cannot be determined with reasonable certainty, the most protective applicable standard shall apply by default.

6. Inventory of the Site's cookies

The required transparency is not satisfied by a generic description: the user must be able to know what is placed on their device, for what purpose and for how long. The following is the complete inventory of technologies deployed at https://vhg.capital.

None of these cookies permits identifying the user, building a profile of them, or tracking their browsing outside the Site. None is persistent beyond the session or the technical period stated. None is shared with third parties for those parties' own purposes.

Inventory maintenance. This inventory is reviewed at least every six months and whenever the platform, the hosting provider or the Site's functionality changes. Installing any technology not listed in this table, without first updating the inventory and completing the regime in section 9, constitutes a breach of the Framework.

7. Data collected and its legal nature

Through the technical cookies in section 6, the following is processed on a transient basis: a randomly generated session identifier, the IP address for routing and security purposes, and browser technical data necessary to serve content in the appropriate format.

Legal characterisation. IP addresses and device identifiers constitute personal data where they permit identifying the user or making the user identifiable, directly or indirectly. The VHG Group does not use them for that purpose and does not associate them with other data to achieve identification; their processing is limited to what is indispensable for transmission and security. Subsequent statistical aggregation would not alter the personal nature of the data at the moment of collection, which is why the Group refrains from characterising this information as "anonymous". Its processing is governed in full by instrument MLD-04.

This clarification expressly corrects the characterisation as "anonymised information" used in earlier versions in respect of data incorporating IP addresses or device identifiers.

8. Browser-level management and consequences of blocking

Users may manage cookies through their browser settings, where they can generally view stored cookies, delete them, block all or specific categories, and receive alerts before installation. Specific instructions are available in each browser's help or settings section.

Consequences of blocking. Since the Site uses strictly necessary technical cookies only, blocking them entirely may prevent correct browsing, submission of the contact form or delivery of content. There are no cookies the user could selectively refuse without affecting functionality, precisely because no dispensable cookies are installed.

The Site remains accessible in its informational content even under browser restrictions, although certain interactive functions may not operate.

9. Activation regime for non-technical cookies

This section is the safeguard that prevents the declaration in section 4 from eroding over time. It is common for an analytics tool or an advertising pixel to be added on a marketing or vendor decision, without prior legal review; that is precisely the scenario this clause prevents.

The addition of any non-technical cookie or technology to the Site is subject to the following regime, which must be completed beforehand:

First — Internal authorisation. No non-technical cookie may be installed without the prior written approval of the Group Data Protection Office, which shall assess its purpose, proportionality and lawful basis.

Second — Documentary update. The inventory in section 6 and this Notice must be updated before installation, identifying the cookie, its provider, purpose, duration, country of processing and lawful basis.

Third — Consent mechanism. A consent management panel must be implemented meeting at least: prior blocking of the cookie until authorisation is obtained; express affirmative action, with no pre-ticked boxes and no acceptance by scrolling or continued browsing; genuine symmetry between accept and reject, with equal visual prominence and at the same interaction level; granularity by category; a prohibition on conditioning access to informational content upon acceptance; a preference panel permanently accessible from the footer; an evidentiary record of consent including session identifier, date, time, version of the Notice displayed and categories accepted and rejected; and renewal of consent after twelve (12) months.

Fourth — Engagement of the processor. The transmission agreement provided for in Article 2.2.2.25.5.2 of Decree 1074 of 2015 must be executed with the provider, verifying the country of processing and its adequacy status.

Fifth — Communication. The addition is prominently communicated on the Site and triggers a fresh request for consent from users.

Failure to complete any of these steps requires immediate removal of the technology and deletion of the data collected through it.

10. Third parties, international transfers and processors

The Site incorporates no third-party tracking cookies. The only third party with technical access to connection data is the hosting and content delivery network provider, acting as a data processor under a transmission agreement containing the obligations in Article 2.2.2.25.5.2 of Decree 1074 of 2015: confidentiality, security, use limited to the controller's instructions, and return or deletion at the end of the relationship.

International transfers. Technical connection data may be processed in the United States of America, a jurisdiction declared to provide an adequate level of protection by External Circular 005 of 2017 of the Superintendency of Industry and Commerce. The VHG Group carries out no transfers to jurisdictions not declared adequate. Any change of provider or country of processing is subject to the regime in section 13 of instrument MLD-04.

11. Data subject rights

In respect of any personal data arising from the technical cookies, data subjects may exercise the rights to know, update and rectify their data, request evidence of authorisation where required, be informed of the use made of their data, withdraw authorisation, request deletion and lodge complaints with the supervisory authority, under Article 8 of Law 1581 of 2012.

Requests are submitted to info@vhg.capital. The applicable periods are those in Article 14 of Law 1581 of 2012 for enquiries — ten (10) business days, extendable by five (5) — and Article 15 for complaints — fifteen (15) business days, extendable by eight (8) — in accordance with the procedure in section 10 of instrument MLD-04.

12. Effectiveness, updates and contact channels

12.1 Effectiveness and updates

This Notice takes effect upon publication at https://vhg.capital, on the date stated in the Document Control block, and is subject to ordinary review on 1 January each year, as well as to extraordinary review upon regulatory changes, a change of hosting provider, modifications to the Site's functionality or the addition of new technologies.

Substantial amendments shall be prominently communicated. The addition of non-technical cookies is governed by section 9 and shall trigger a fresh request for consent.

12.2 Contact channels

END OF INSTRUMENT MLD-03

Valencia Holding Group — VHG Group Digital Legal Framework MLD-03 — Cookie and Similar Technologies Notice | Version 3.0 | Governing language: Spanish