Privacy Policy

1. INTRODUCTION

At Distribution Park , your privacy and the protection of your personal data are our top priorities. This Privacy Policy clearly describes what information we collect, why we collect it, and how we protect it.

2. WHO WE ARE

Distribution Park is an initiative and brand of the Hines group , focused on the development of logistics warehouses throughout Brazil. Hines is the building manager responsible for ensuring the safety, well-being, and proper functioning of each unit.

3. APPLICATION OF THIS POLICY

This Policy applies to all persons who access or use the facilities of Distribution Park , including visitors, service providers, employees of tenant companies, and authorized representatives or third parties. Its guidelines cover all environments and systems under the responsibility of the park’s management.

4. DEFINITIONS

This Policy will adopt the following definitions:

• National Data Protection Authority (ANPD): A special-purpose autonomous agency, endowed with technical and decision-making autonomy, with its own assets and headquarters in the Federal District of Brazil, responsible for ensuring, implementing, and overseeing compliance with the General Data Protection Law throughout Brazilian territory.

• Consent: This is the legal basis for authorizing the processing of personal data based on the free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.

• Controller: A natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data.

• Cookies: Files stored on your device that allow the collection of certain information, including personal data in some situations, for various purposes.

• Sensitive personal data: Personal data concerning racial or ethnic origin, religious beliefs, political opinions, membership of a trade union or religious, philosophical or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person.

• Personal data: Information relating to an identified or identifiable natural person, such as their name, CPF (Brazilian tax identification number), email, address, among others.

• Data Protection Officer: Person appointed by the controller and processor to act as a communication channel between the controller, data subjects, and the National Data Protection Authority (ANPD). Their main responsibility is to provide adequate support to the Company and its business areas to ensure compliance with the LGPD ( Brazilian General Data Protection Law) in all operations .

• General Data Protection Law (“LGPD”): Law that governs the processing of personal data, including in digital media, by natural persons or legal entities under public or private law, with the objective of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person .

• Operator: A natural or legal person, governed by public or private law, who processes personal data on behalf of the controller.

• Data Subject: This is the natural person to whom the personal data refers, whether in the capacity of a consumer or in the capacity of a representative/reseller.

• Processing of personal data: This means any activity carried out with personal data, such as collection, use, access, reproduction, sharing, storage and deletion.

5. PERSONAL DATA WE COLLECT

Depending on your interaction with us, we may collect different types of data, such as:

• Identification Data : Full name , RG number (Brazilian national identity card number), CPF number ( Brazilian taxpayer identification number ), passport number , CNH number (Brazilian driver’s license number), images and videos captured by surveillance cameras, among others.

• Contact Information : Email address , phone number , among others.

• Professional Information : Job title , company name , department, among others .

• Sensitive Data : Facial biometrics, fingerprint biometrics , health data , among others.

6. USE OF PERSONAL DATA

We may use the personal data we collect for one or more of the following purposes:

• Access control

• Property security

• Contract management

• Financial management

• Legal and regulatory compliance

• Report writing

• Operational records

• Service provision

We will not collect additional categories of personal information or use it for materially different, unrelated, or incompatible purposes without notifying you.

7. HOW WE COLLECT YOUR PERSONAL DATA

At No s Distribution Park s , we value transparency and seek to collect only the personal data strictly necessary to guarantee security, efficient operation of the enterprise, and a good experience for everyone who visits. Information may be collected in the following ways:

➢ Provided directly by you

Your data may be collected when you identify yourself at reception or the entrance, fill out registration forms to access the premises, or make a specific request. In these cases, information such as identification data, contact details, professional information, and, eventually, sensitive data are collected.

➢ Provided by authorized third parties

Tenant companies, partners , or service providers may share their data with us through official Distribution Park systems and channels in order to facilitate their access or service within the development.

➢ Collected automatically via devices

When you access our website, some information may be automatically collected through cookies and similar technologies, such as browser data, IP address, and browsing preferences.

8. HOW DO WE SHARE YOUR PERSONAL DATA?

At No s Distribution Park s , your personal data is shared with third parties only when strictly necessary to fulfill the purposes for which it was collected, as described in this Policy.

We are committed to ensuring that, whenever data is shared, the security, confidentiality, and privacy of your information are preserved. When sharing occurs for a commercial purpose, we enter into specific contracts with the third parties involved. These contracts clearly define the purpose of data use, prohibit any misuse, and require that the data be treated with the same level of protection adopted by us.

Your personal data may be shared with the following categories of third parties:

• Service providers contracted to support the operation of the project.

• Companies affiliated with Hines involved in the management or administration of the Distribution Park .

• Authorized third parties, in contexts related to the services we provide.

• In corporate reorganization processes, such as mergers, acquisitions, incorporations, or asset sales , personal data may be transferred as part of the assets involved.

• Public or judicial authorities, when required by law, applicable regulations, court order, or request from government agencies.

9. INTERNATIONAL TRANSFER OF PERSONAL DATA

To facilitate some of our operational and administrative activities, your personal data may be transferred to Hines’ headquarters, located in Houston, Texas (USA), as well as to other company branches abroad.

These transfers occur in a controlled manner, and only when necessary for the execution of legitimate purposes, always in accordance with the General Data Protection Law (LGPD) and other applicable legislation.

You can find out the locations where Hines operates by visiting: https://www.hines.com/about and checking the “ Geographies ” section.

We emphasize that, regardless of the recipient’s location, we have adopted contractual, technical, and administrative measures to ensure that their data is treated with the same level of protection required by Brazilian law.

10. HOW WE STORE YOUR PERSONAL DATA

Your personal data will only be stored for the time necessary to fulfill the purposes for which it was collected, respecting applicable legal, regulatory, and contractual deadlines. The definition of this period takes into account criteria such as the duration of the business relationship, tax obligations, security needs, and compliance with any court orders.

At the end of this period, the data will be duly deleted or anonymized, as provided for in current legislation, ensuring that it can no longer be associated with you. Throughout the storage period, we adopt technical and administrative measures to protect your data against unauthorized access, loss, alteration, or any form of inappropriate processing.

11. YOUR RIGHTS AS A PERSONAL DATA SUBJECT

The LGPD (Brazilian General Data Protection Law) provides you with specific rights regarding your personal data, as described in Article 18 and following articles of the law. This section explains your rights.

• Right to confirmation and access: The right to obtain confirmation that we have processed your personal data , and the right to access that data.

• Right to correction: the right to request the correction of incomplete, inaccurate, or outdated data .

• Right to anonymization: the right to request that personal data be transformed into anonymized data.

• Right to the deletion of unnecessary, excessive, or unlawfully processed data (in violation of the LGPD).

• Right to data portability: the possibility for the data subject to obtain their data from the company in a structured way so that it can be transferred to a third party.

• Right to revoke consent: if the processing was carried out with your consent , you may revoke that consent at any time .

• Right to information about the possibility of not providing consent and about the consequences of refusal.

• Right to erasure of personal data processed with the data subject’s consent: if the processing was carried out with your consent, in addition to being able to revoke that consent at any time, you can also request the deletion of such data.

• Right to object: the right to object to the processing of your data by us , if the processing is not in accordance with the LGPD (Brazilian General Data Protection Law).

• Right to information from public and private entities with which we share your data .

• Right to review decisions made based on automated processing: if the company builds a profile of the data subject based on automated processing (without human intervention) of their personal data, the data subject may request a review of said profile .

12. COOKIES AND SIMILAR TECHNOLOGIES

12.1 COOKIES

The Distribution Park website uses cookies and similar technologies to enhance the browsing experience, personalize content, understand visitor behavior, and ensure the functioning of essential features.

The cookies we use fall into the following categories:

➢ Required Cookies

They ensure the proper functioning of the website, allowing secure access to restricted areas that are essential for navigation.

➢ Functionality Cookies

They allow the website to remember your preferences, such as language or custom settings, offering a more personalized experience.

Performance Cookies

They collect information about how visitors use the site, identifying the most accessed pages and any errors, so that we can optimize the platform’s performance.

➢ Analytical Cookies

They gather anonymized statistical data that helps to understand user behavior, enabling analyses to continuously improve the usability and content of the website.

➢ Advertising and Marketing Cookies

Used to display relevant and personalized ads, as well as to measure the effectiveness of advertising campaigns.

When accessing our website, you can manage your cookie preferences directly through the cookie banner. Additionally, you can enable or disable cookies at any time through your browser settings. Please remember that some website functionalities may be affected if cookies are disabled.

12.2 Social Media Plug-ins

Our website may incorporate social media plugins , such as YouTube . By interacting with these plugins, certain information may be shared with these platforms, even if you are not logged in to them.

We recommend that you review the privacy policies of these platforms to understand how your information may be used.

12.3 THIRD-PARTY LINKED SITES

Our website may contain links to third-party websites, whose privacy practices may differ from ours. We are not responsible for the content, security, or policies of such websites. We recommend that you carefully read the privacy policy of any website accessed through ours .

13. Data Protection Officer

We have designated Grant Thornton Corporate Consultores de Negócios Ltda . as the Data Protection Officer, represented by Alline Ribeiro Benfatti Vaz, with Alessandro Gratão Marques as the Substitute Representative.

Our Data Protection Officer is available to answer questions, receive suggestions or comments related to this Policy and our Privacy and Data Protection Program , as well as to receive requests regarding your rights as provided for in the LGPD (Brazilian General Data Protection Law ) and in Chapter 1.1 of this Policy . You can contact us by email: brazil.dataprotection@hines.com .

14. UPDATE TO THIS POLICY

We reserve the right to change or update this Policy as we see fit and at any time. When we make changes to this Policy , we will post the updated version on our website and change the effective date. If you continue to use our website after the changes are posted, this means that you have accepted our changes .

15. VERSION HISTORY

Published	Updated	Author
12/15/2021	10/17/2025	Data Controller

PRIVACY POLICY