Privacy Notice /Communication Regarding the Processing of Personal Data

Addressed to: owners and/or lessors of the properties (“Sites”) leased to, or under negotiation with Phoenix Tower International.

Date of issuance: August 2026.

1. Data Controller

The Controller determines the purposes and means of the processing, retains final decision-making authority over the contracts, and maintains control over the instructions given to Processors.

2. Who is this notice intended for and what data do we process?

This notice applies to owners or lessors of the Sites, as well as to representatives, attorneys-in-fact, or individual contact persons of legal-entity owners.

Categories of data subject to processing:

• Identification and contact details: name, identity document/tax identification number, telephone number, and email address.
• contractual and asset-related data associated with the Site: ownership or authority to dispose of the property, Site location, current economic terms (rent, adjustments, duration), and history of the lease relationship.
• Data arising from interactions: communications, counteroffers, responses, and management records.

No sensitive data is processed for this purpose. If such data is collected, your explicit consent will be requested in accordance with applicable law.

3. Purposes of the processing

Main purposes necessary for the relationship

• Manage and perform the lease agreement(s) for the Sites.
• Contact you and renegotiate the contractual terms and conditions.
• Document and monitor management activities, communications, and negotiation outcomes.
• Comply with legal, accounting, and regulatory obligations applicable to the Controller.

4. Conditions for lawful processing

The processing is based, depending on the applicable jurisdiction, on:

• The performance and management of the lease relationship to which you are a party;
• The Controller’s legitimate interest in defining terms and conditions and complying with the terms of its contracts; and/or
• Your consent, where local law requires it for a specific purpose or transfer.

5. Recipients and data transfers / disclosures

Your data may be disclosed to:

• Service providers involved in contract management
• Advisors, auditors, and authorities, where there is a legal obligation or legitimate interest;
• Other entities within the Controller’s corporate group.

International transfers: if the service provider, a Phoenix Tower International affiliate, or any recipient is located outside your country, your data may be subject to an international transfer. Such transfer will be carried out only where the destination country provides an adequate level of protection or through appropriate safeguards, such as contractual clauses, data transfer agreements, intra-group agreements, or other mechanisms recognized by applicable law, or, in their absence, with your consent or another authorized legal basis. You may request information about the applicable mechanism by writing to privacy@phoenixintnl.com.

6. Retention period

Your data will be retained for as long as the lease relationship remains in effect and, thereafter, for the applicable legal and accounting limitation period, after which it will be deleted or anonymized.

7. Rights of the data subject

You may exercise, in accordance with applicable law, your rights to be informed whether your personal data are being processed, access your personal data, request rectification of inaccuracies, withdraw your consent where processing is based on consent, request the prevention of processing in the circumstances provided by law, request the transmission of your personal data to another data controller where technically feasible, and exercise your rights in relation to automated decision-making.

How to exercise your rights: send your request to privacy@phoenixintnl.com, indicating your name, the Site or contract to which the request relates, and the right you wish to exercise. We will respond to your request within the legal deadlines applicable in your country. Withdrawal of consent or the exercise of your right to prevent processing does not have retroactive effect and does not affect the validity of processing carried out previously.

8. Security

The Controller and the Processor apply appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or unauthorized disclosure.

9. Supervisory authority

If you believe that your rights have not been properly addressed, you may contact the competent data protection authority in your country.

10. Updates and access to the full policy

This notice may be updated. The current version and the full privacy policy of Phoenix Tower International are available on the Company’s website.

11. Notice.

This document constitutes prior, clear, and sufficient notice regarding the processing of personal data to be carried out. If you have any concerns regarding the processing of your personal data or wish to exercise your applicable data protection rights, you may contact us at:privacy@phoenixintnl.com.