ONA INVEST PRIVACY POLICY

This Privacy Policy describes how Ona Invest SpA collects, uses, retains, discloses and protects the personal data of persons who access its websites, create an account, use its services, view projects or carry out transactions through the Ona Invest platform.

It also specifies the rights available to data subjects and the means of exercising them.

This Policy is an integral part of the Ona Invest Terms of Use.

It applies in particular to the following websites:

• onainvest.deals;
• hotels.onainvest.deals;
• any application, interface, API or other digital service officially operated by Ona Invest.

The controller of the personal data is:

Ona Invest SpA

Company incorporated under the laws of the Republic of Chile

Email address: contact@onainvest.deals

Ona Invest determines the purposes and means of the personal data processing carried out in connection with the operation of its platform and the provision of its services.

For any question relating to this Policy or to the processing of personal data, the User may contact Ona Invest at the following address:

contact@onainvest.deals

Where applicable, Ona Invest may appoint an internal officer or delegate responsible for personal data protection. Their contact details will be published in this Policy.

Ona Invest processes personal data in accordance with applicable Chilean law, in particular:

• the Political Constitution of the Republic of Chile;
• Law No. 19,628 on the protection of privacy;
• Law No. 21,719 amending Law No. 19,628 and strengthening the protection of personal data;
• Law No. 21,521 on the development of technological financial services, where applicable;
• regulations on the prevention of money laundering, the financing of terrorism and know-your-customer obligations;
• regulations applicable to electronic communications, consumer protection and cybersecurity.

Where the services are offered to persons located in another jurisdiction, additional data protection rules may also apply.

For the purposes of this Policy:

"Personal data" means any information concerning an identified or identifiable natural person.

"Sensitive data" means any personal data relating in particular to a person's physical or moral characteristics, racial or ethnic origin, political opinions, religious or philosophical beliefs, physical or mental health, sex life, biometric data, or any other category benefiting from enhanced protection under applicable law.

"Data subject" means the natural person to whom the personal data relates.

"Data controller" means the entity that determines the purposes and means of processing of personal data.

"Data processor" means any person or entity that processes personal data on behalf of the data controller.

"Processing" means any operation performed on personal data, including its collection, recording, organization, storage, consultation, alteration, use, disclosure, transmission, combination, restriction, deletion or destruction.

"Platform" means the websites, applications, interfaces and technological systems used by Ona Invest to provide its services.

"User" means any person accessing the Platform or using Ona Invest's services.

Ona Invest processes personal data in accordance with the following principles:

Data is processed lawfully, fairly and transparently.

Data is collected for determined, explicit and legitimate purposes.

It is not subsequently used in a manner incompatible with those purposes.

Ona Invest collects only data that is adequate, relevant and reasonably necessary in view of the purposes pursued.

Ona Invest takes reasonable measures to ensure that personal data is accurate, complete and up to date.

Data is retained only for as long as necessary to fulfill the purposes for which it was collected, subject to applicable legal or regulatory obligations.

Ona Invest implements technical, organizational and contractual measures intended to protect personal data against unauthorized access, loss, alteration, destruction or unlawful disclosure.

Ona Invest adopts the measures reasonably necessary to be able to demonstrate compliance with its personal data protection obligations.

Depending on the nature of the relationship with the User and the features used, Ona Invest may collect the following categories of data.

This data may include in particular:

• surname and first names;
• date and place of birth;
• nationality;
• sex, where this information is legally required;
• identity card, passport, RUT or other identification number;
• copy of an identity document;
• photograph or facial image;
• electronic or handwritten signature;
• status as legal representative of a company.

This data may include:

• postal address;
• country of residence;
• email address;
• telephone number;
• communication channels associated with the Account.

Where the User acts on behalf of a legal entity, Ona Invest may collect:

• corporate name;
• RUT or registration number;
• registered office;
• economic activity;
• incorporation documents;
• identity of directors, legal representatives, beneficial owners and relevant shareholders;
• powers and mandates;
• financial or business information relating to the company.

Ona Invest may collect:

• bank details;
• payment-related information;
• transaction history;
• amounts invested;
• Shares acquired, held or transferred;
• distributions received;
• information relating to the source of funds;
• level of income or wealth where this information is necessary;
• tax information;
• investor status or economic profile.

Ona Invest does not necessarily retain all bank card data where payments are processed by an independent payment provider.

In order to comply with its legal and regulatory obligations, Ona Invest may collect:

• results of KYC and KYB procedures;
• information relating to beneficial owners;
• information on politically exposed persons;
• results of international sanctions checks;
• evidence of the source of funds or assets;
• information relating to fraud alerts;
• information from public sources or specialized providers;
• data necessary for the prevention of money laundering and the financing of terrorism.

This data may include:

• projects viewed;
• investment intentions or requests;
• contracts accepted;
• acquisition or transfer instructions;
• Shares held;
• investment preferences;
• communications relating to Projects;
• requests sent to support;
• complaints;
• history of interactions with Ona Invest.

When using the Platform, Ona Invest may automatically collect:

• IP address;
• session identifiers;
• device type;
• browser type and version;
• operating system;
• language used;
• date and time of connection;
• pages viewed;
• technical logs;
• data relating to errors or malfunctions;
• information relating to Account security;
• approximate location data inferred from the IP address.

Ona Invest may retain:

• emails;
• messages sent to support;
• exchanges carried out on the Platform;
• responses to questionnaires;
• information provided in connection with a complaint;
• call recordings, where such recording is legally permitted and the person is informed of it beforehand.

Ona Invest may process the documents, comments, messages, files, forms and other content transmitted by the User through the Platform.

Ona Invest does not intend to collect sensitive data, except where:

• its processing is necessary to comply with a legal or regulatory obligation;
• the data subject has given explicit consent;
• the processing is necessary for the establishment, exercise or defense of a right;
• another legal basis expressly provided for by applicable law authorizes its processing.

Any biometric data used in identity verification procedures is subject to enhanced protection measures.

Ona Invest may obtain personal data:

• directly from the User;
• when an Account is created or updated;
• when a transaction is carried out;
• from documents provided by the User;
• from a legal representative or a company on whose behalf the User acts;
• from identity verification providers;
• from payment providers or financial institutions;
• from public databases;
• from official registers;
• from providers combating fraud, money laundering or international sanctions;
• from partners involved in the structuring or administration of a Project;
• automatically when the Platform is used.

Where data relating to a third party is provided by a User, the User must ensure that they are authorized to disclose it to Ona Invest and that the third party has received the necessary information relating to the processing of their data.

Ona Invest may process personal data for the following purposes.

Data is used to:

• create the Account;
• verify the User's identity;
• authenticate logins;
• manage Account settings;
• keep information up to date;
• provide the features of the Platform.

Data is used to:

• carry out KYC and KYB procedures;
• identify beneficial owners;
• verify the source of funds;
• detect politically exposed persons;
• carry out sanctions checks;
• prevent money laundering and the financing of terrorism;
• detect fraud and unlawful activities;
• comply with requests from competent authorities.

Data may be used to:

• present Projects;
• process requests for the acquisition of Shares;
• register holders of Shares;
• administer the Official Register of Holders;
• process transfers of Shares;
• calculate and make distributions;
• manage economic rights;
• provide information relating to investments;
• perform contracts entered into with the User.

Data may be used to:

• receive or return funds;
• verify payments;
• process distributions;
• manage commissions and fees;
• prevent fraudulent transactions;
• maintain accounting and financial records.

Data may be used to:

• send operational notifications;
• communicate information relating to the Account;
• transmit information relating to Projects and Shares held;
• answer questions;
• process complaints;
• inform the User of contractual or regulatory changes.

Data may be used to:

• protect Accounts;
• detect unusual logins or transactions;
• prevent unauthorized access;
• protect the Platform against cyberattacks;
• conduct internal investigations;
• document security incidents.

Data may be used to:

• comply with tax, accounting and regulatory obligations;
• respond to administrative, judicial or supervisory authorities;
• retain evidence of transactions;
• defend Ona Invest's legitimate rights and interests;
• comply with obligations relating to the fight against fraud and financial crime.

Ona Invest may analyze the use of the Platform in order to:

• improve the user experience;
• measure technical performance;
• correct errors;
• develop new features;
• produce statistics;
• improve the security and reliability of the Services.

Where reasonably possible, these analyses are carried out using aggregated or anonymized data.

Subject to applicable regulations and the User's preferences, Ona Invest may use the User's contact details to send them:

• information about new Projects;
• news relating to Ona Invest;
• invitations;
• commercial or promotional content.

The User may unsubscribe from commercial communications at any time.

Unsubscribing from commercial communications does not prevent the sending of communications necessary for the operation of the Account, the performance of a contract, or compliance with a legal obligation.

Depending on the purpose concerned, Ona Invest processes personal data on the basis of:

Consent may in particular be used for:

• sending certain commercial communications;
• the use of non-essential cookies;
• the processing of certain sensitive data;
• any other purpose for which consent is legally required.

Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out prior to its withdrawal.

Processing may be necessary in order to:

• create and administer an Account;
• process an investment request;
• perform a Share Agreement;
• administer the Shares;
• process payments or distributions;
• respond to a request made by the User.

Processing may be necessary in order to comply with:

• KYC and KYB obligations;
• rules relating to the prevention of money laundering;
• tax and accounting obligations;
• retention obligations;
• requests from competent authorities;
• regulatory obligations applicable to financial services.

Where permitted by applicable law, Ona Invest may process data in order to pursue a legitimate interest, in particular to:

• ensure the security of the Platform;
• prevent fraud;
• defend its rights;
• improve its Services;
• produce internal statistics;
• manage its activities and risks.

In such cases, Ona Invest assesses whether its interests are compatible with the rights and freedoms of the data subjects.

Data may be retained or used where necessary for the prevention of a dispute, the gathering of evidence, or the defense of a right.

Ona Invest may use automated tools in order to:

• detect unusual activity;
• assess fraud risks;
• carry out certain identity verifications;
• identify transactions requiring additional review;
• personalize certain features of the Platform.

Ona Invest does not make decisions producing significant legal effects for a person based solely on automated processing, except where:

• such a decision is necessary for the conclusion or performance of a contract;
• it is authorized by law;
• the data subject has expressly consented to it;
• appropriate safeguards have been put in place.

Where a significant decision is based exclusively on automated processing, the data subject may request information on the general logic used and, where the law permits, request human intervention or challenge the decision.

Ona Invest does not sell Users' personal data.

Data may be disclosed, to the extent necessary, to the following categories of recipients:

• companies affiliated with Ona Invest;
• SPVs and entities involved in the structuring of Projects;
• identity verification providers;
• KYC and KYB providers;
• providers combating fraud and money laundering;
• banking institutions and payment providers;
• IT hosting and cloud service providers;
• software, cybersecurity and technical support providers;
• email and communication service providers;
• accounting, tax and legal firms and auditors;
• Project managers or administrators, where necessary;
• insurers;
• administrative, tax, judicial or regulatory authorities;
• acquirers, investors or advisors in connection with a restructuring, merger, acquisition or sale of business.

Each recipient receives only the data reasonably necessary to perform its functions.

Providers processing data on behalf of Ona Invest are subject to contractual obligations of confidentiality, security and purpose limitation.

Ona Invest may engage data processors to carry out certain processing operations.

Ona Invest selects data processors offering sufficient guarantees in terms of security and data protection.

The contracts entered into with these providers include in particular, where applicable:

• processing of data only on Ona Invest's documented instructions;
• a confidentiality obligation;
• the implementation of appropriate security measures;
• assistance in handling requests from data subjects;
• notification of security incidents;
• the return or deletion of data at the end of the service;
• restrictions on the use of further sub-processors;
• the ability to carry out reasonable checks or audits.

The providers, partners or technological infrastructure used by Ona Invest may be located outside Chile.

Personal data may therefore be transferred to, or accessible from, other countries.

Before carrying out an international transfer, Ona Invest verifies that it is authorized under applicable law and that an appropriate level of protection is ensured.

Depending on the circumstances, Ona Invest may in particular rely on:

• a decision recognizing an adequate level of protection;
• contractual data protection clauses;
• binding corporate rules;
• the explicit consent of the data subject;
• an applicable legal exception;
• any other safeguard recognized under Chilean law.

Ona Invest ensures that foreign recipients are subject to appropriate confidentiality and security obligations.

Ona Invest retains personal data for the period necessary for the purposes described in this Policy.

Retention periods depend in particular on:

• the duration of the contractual relationship;
• the nature of the data;
• the holding of Shares;
• regulatory obligations;
• applicable statutory limitation periods;
• accounting and tax requirements;
• obligations relating to the prevention of money laundering;
• the need to defend Ona Invest's rights.

In general:

• Account data is retained for the duration of the Account's existence;
• contractual and transactional data may be retained for the applicable legal or regulatory period after the end of the relationship;
• KYC and KYB data may be retained for as long as required by compliance rules;
• data relating to commercial communications is retained until consent is withdrawn or the User objects;
• technical logs are retained for a period proportionate to security needs;
• data relating to disputes is retained until the possible remedies have expired.

Where a User still holds Shares, certain data must be retained even after their Account is closed in order to allow for the administration of their economic rights and compliance with legal obligations.

Upon expiry of the applicable period, data is deleted, anonymized, or securely archived where a legal retention requirement remains.

Ona Invest implements technical and organizational measures proportionate to the nature of the data, the purposes of processing and the risks identified.

These measures may in particular include:

• access control;
• secure authentication;
• encryption of data where appropriate;
• logging of access and operations;
• separation of environments;
• backups;
• restoration procedures;
• vulnerability management;
• system monitoring;
• staff training and awareness;
• confidentiality commitments;
• incident management procedures;
• provider assessments;
• periodic security reviews.

The User remains responsible for the confidentiality of their credentials and must promptly inform Ona Invest of any suspicion of unauthorized access to their Account.

No IT system can, however, guarantee absolute security.

Ona Invest has procedures in place to identify, analyze, contain and address security incidents affecting personal data.

Where an incident is likely to affect the rights of data subjects, Ona Invest takes the measures required by applicable law.

This may in particular include:

• analyzing the nature and extent of the incident;
• implementing corrective measures;
• documenting the incident;
• notifying the competent authority;
• informing data subjects where legally required;
• cooperating with the relevant authorities or providers.

Users may report an incident or vulnerability to:

contacto@onainvest.deals

Subject to the conditions, limits and exceptions provided for by applicable law, any data subject may exercise the following rights.

The person may request:

• confirmation that their data is being processed;
• access to data concerning them;
• information on its origin;
• the purposes of processing;
• the categories of recipients;
• the applicable retention period.

The person may request the correction of inaccurate, incomplete, erroneous or outdated data.

The person may request the deletion of their data where:

• it is no longer necessary;
• consent is withdrawn and no other legal basis justifies the processing;
• the data has been processed unlawfully;
• its deletion is required by law.

This right does not apply where retention is necessary for the performance of a contract, compliance with a legal obligation, the maintenance of the Official Register of Holders, or the defense of a right.

The person may object to certain processing based on a legitimate interest, unless Ona Invest demonstrates compelling legitimate grounds.

They may object at any time to the use of their data for direct marketing purposes.

Where applicable law provides for it, the person may request the temporary restriction of the processing of their data, in particular during the review of a rectification or objection request.

Where the legal conditions are met, the person may request to receive the data they have provided in a structured, commonly used and machine-readable format, or request that it be transmitted to another data controller.

Where processing is based on consent, it may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Where applicable law permits, the person may:

• request information on an automated decision;
• challenge the decision;
• submit their observations;
• request human intervention.

Any person may request that Ona Invest cease processing that does not comply with the requirements of applicable law.

Requests relating to personal data must be sent to:

contacto@onainvest.deals

The request must specify:

• the identity of the requester;
• the right they wish to exercise;
• the data or processing concerned;
• any information useful for reviewing the request.

Ona Invest may request reasonable proof of the requester's identity in order to prevent disclosure of data to an unauthorized person.

Where a request is submitted by an agent, Ona Invest may request a document demonstrating their authority.

Ona Invest responds to requests within the time limits provided for by applicable law.

The exercise of rights is, in principle, free of charge.

Reasonable fees may nevertheless be charged, or a request may be refused, where it is manifestly unfounded, excessive or repetitive, within the limits permitted by law.

Where Ona Invest cannot act on a request, it informs the requester of the reasons for its refusal, subject to applicable legal restrictions.

The data subject may lodge a complaint with the competent Chilean personal data protection authority where they consider that their data has been processed in violation of applicable law.

Until the specialized authority provided for under Chilean law is effectively operational, the applicable remedies are those provided for by law and the competent courts.

Ona Invest encourages data subjects to contact it beforehand in order to attempt to resolve any difficulty relating to the processing of their data.

Ona Invest's investment Services are not intended for persons under eighteen years of age.

Ona Invest does not knowingly collect personal data from minors in order to allow them to acquire Shares or use features reserved for investors.

Where Ona Invest becomes aware that a minor's data has been collected without a valid basis, it takes reasonable measures to delete it or restrict its processing.

Ona Invest may use cookies, tags, pixels, technical logs and similar technologies.

These technologies may be used to:

• enable the Platform to function;
• maintain the User's session;
• strengthen security;
• remember certain preferences;
• measure audience;
• analyze performance;
• improve the Services;
• personalize certain communications, where permitted.

Strictly necessary cookies may be used without consent where they are essential to the operation or security of the Services.

Analytics, advertising or non-essential cookies are used in accordance with applicable consent requirements.

The User may manage their preferences through the banner or cookie management tool available on the Platform.

Further information is available in Ona Invest's Cookie Policy.

Ona Invest may send commercial communications where:

• the User has consented to it;
• the law permits their sending on another basis;
• such communications relate to similar services and the User has a simple means of objecting to them.

Each commercial communication contains a mechanism to unsubscribe.

The User may also exercise their right to object by writing to:

contacto@onainvest.deals

Operational, contractual or regulatory communications are not considered commercial communications and may continue to be sent where necessary.

Ona Invest may be present on social networks or provide links to sites operated by third parties.

The operators of these services may process personal data in accordance with their own privacy policies.

Ona Invest is not responsible for processing carried out independently by these third parties.

The User is invited to review their policies before providing them with personal data.

In the event of a merger, acquisition, restructuring, financing, asset sale, or transfer of all or part of Ona Invest's business, personal data may be disclosed to the parties and advisors involved in the transaction.

Ona Invest takes reasonable measures to ensure the confidentiality of data during the transaction.

Where the data controller changes, data subjects are informed in accordance with applicable regulations.

Ona Invest may amend this Policy to take into account:

• a legislative or regulatory development;
• a change to its Services;
• new processing practices;
• developments in its security measures;
• instructions from a competent authority.

The updated version is published on the Website with its date of last modification.

Where amendments substantially affect the rights of data subjects or the purposes of processing, Ona Invest informs them by means of an appropriate notification.

Where the law requires new consent, it will be requested before the relevant processing begins.

This Policy may be made available in several languages.

The Spanish version constitutes the reference legal version.

In the event of a conflict or divergence of interpretation between the versions, the Spanish version shall prevail, within the limits permitted by applicable law.

For any question, complaint or request relating to this Policy or to the processing of personal data, the User may contact:

Ona Invest SpA

Email: contact@onainvest.deals

Data Protection Officer: Nicolas Rouanet

This Policy takes effect on July 11, 2026.