Personal Data Processing Policy

1. Identification of the Data Controller

Company name: D'ACOSTA Hoteles y Resorts
Tax ID (NIT): [NIT]
Address: Calle 94 # 15 - 32 Of 103, Bogotá D.C., Colombia
Email for personal data matters: callcenter@grupodacosta.com.br
Telephone: (57) 1 6234992
Department responsible for handling inquiries and complaints: callcenter@grupodacosta.com.br
Website: www.grupodacosta.com.br

This Policy is adopted in compliance with Article 15 of the Political Constitution, Statutory Law 1581 of 2012, Chapter 25 of Single Regulatory Decree 1074 of 2015 (which compiles Decree 1377 of 2013), Decree 886 of 2014 on the National Database Registry, and the instructions of the Superintendence of Industry and Commerce (SIC), in particular Title V of its Single Circular.

2. Definitions

The definitions of Article 3 of Law 1581 of 2012 and Decree 1074 of 2015 are adopted:

Authorization: prior, express, and informed consent of the Data Subject for the Processing of their personal data.

Privacy notice: verbal or written communication addressed to the Data Subject, informing them of the existence of this Policy, how to access it, and the purposes of the Processing.

Database: organized set of personal data that is subject to Processing.

Personal data: any information linked to or that can be associated with one or more specific or identifiable natural persons.

Public data: data that is not semi-private, private, or sensitive, such as data relating to a person's marital status, profession or trade, and status as a merchant or public servant.

Private data: data that, because of its intimate or confidential nature, is relevant only to the Data Subject.

Sensitive data: data that affects the Data Subject's privacy or whose improper use may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions or social or human rights organizations, data concerning health or sex life, and biometric data.

Data Processor: natural or legal person, public or private, who carries out the Processing of personal data on behalf of the Data Controller.

Data Controller: natural or legal person, public or private, who decides on the database and/or the Processing of the data.

Data Subject: natural person whose personal data is subject to Processing.

Transfer: sending of personal data by the Data Controller to another Controller located inside or outside the country.

Transmission: communication of personal data to a Processor, inside or outside Colombia, so that the Processor carries out the Processing on behalf of the Controller.

Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion.

3. Purpose and scope

This Policy governs the collection, storage, use, circulation, and deletion of personal data that D'ACOSTA Hoteles y Resorts processes relating to its guests, visitors, customers, users, suppliers, partners, candidates, and employees, in order to guarantee the fundamental right of habeas data. It applies to all databases and files containing personal data that are subject to Processing in Colombian territory, or when Colombian law is applicable by virtue of international rules and treaties.

This Policy also fulfills the duty set out in subsection k) of Article 17 of Law 1581 of 2012 to adopt an internal manual of policies and procedures, especially for handling inquiries and complaints.

4. Principles of Processing

Processing is governed by the following principles of Article 4 of Law 1581 of 2012:

Legality: Processing is subject to the provisions of the law and the regulations that develop it.

Purpose: Processing serves a legitimate purpose, which is communicated to the Data Subject.

Freedom: Processing may only be carried out with the prior, express, and informed consent of the Data Subject, unless there is a legal or judicial mandate.

Truthfulness or quality: information must be truthful, complete, accurate, up to date, verifiable, and understandable.

Transparency: the Data Subject's right to obtain information about their data at any time and without restrictions is guaranteed.

Restricted access and circulation: data will only be shared with the Data Subject, persons authorized by them or by law, and third parties who legitimately require it.

Security: information is handled with the technical, human, and administrative measures necessary to prevent its tampering, loss, or unauthorized or fraudulent consultation, use, or access.

Confidentiality: all persons involved in Processing are obliged to guarantee the confidentiality of the information, even after their relationship with Processing activities has ended.

5. Personal data processed

Depending on the service or relationship concerned, D'ACOSTA Hoteles y Resorts may process the following categories of data:

Identification and contact: first and last names, type and number of identity document, nationality, country of residence, date of birth, gender, telephone numbers, and physical and electronic addresses.

Stay information: origin and destination, purpose of travel, accommodation preferences, special requests, companions and, where applicable, relationship to minors or persons with disabilities.

Professional information: profession or trade, company, and position.

Financial and payment information: credit or debit card data (issuing institution, expiration date, and the data necessary to process payment), cardholder data, and billing address. Full card numbers are processed through payment gateways and are not stored unless strictly necessary and with the corresponding security measures.

Images and video surveillance: images captured by video surveillance systems installed on the premises, for the security of persons, property, and facilities.

Browsing data: IP address, device identifiers, and cookies, as indicated in section 15.

Sensitive data: only when strictly necessary (for example, health conditions or allergies voluntarily reported for the provision of the service, or biometric data if [the company uses them]), in accordance with section 7.

Data of minors: in accordance with section 8.

6. Purposes of Processing

6.1. Purposes necessary for the contractual and legal relationship

• Manage reservations, modifications, cancellations, check-in and check-out, accommodation, and other contracted services.

• Comply with guest registration and the reporting of information to tourism, immigration, and police authorities and other entities that require it, including obligations arising from tourism regulations.

• Process payments, invoicing, refunds, compensation, and indemnities, and keep accounting, fiscal, and tax records.

• Verify and process payments by credit card, debit card, and other instruments, and identify and prevent fraud, money laundering, terrorism financing, and other illicit activities.

• Handle inquiries, requests, complaints, and claims.

• Guarantee the security of persons, property, and facilities.

• Carry out internal or external audits, administrative reports, and statistical analyses.

• Respond to requests from administrative, oversight, police, or judicial authorities, and exercise the defense of the company's rights.

• Manage the relationship with suppliers and contractors, including their selection, evaluation, hiring, and payment.

6.2. Optional purposes

For the following purposes, a separate and specific authorization will be requested, which the Data Subject may grant or refuse without affecting the provision of the contracted service:

• Send advertising, promotions, offers, and commercial communications from D'ACOSTA Hoteles y Resorts and the companies of its corporate group, by email, messaging, calls, social media, or other means.

• Share information with identified business partners with whom a business relationship exists, so that they may offer complementary products and services.

• Conduct market research, satisfaction surveys, and preference profiling.

• Administer loyalty programs and recognize benefits.

Commercial communications will be carried out respecting the channels, hours, and frequencies provided in Law 2300 of 2023 and other applicable rules, and the Data Subject may unsubscribe at any time.

7. Sensitive data

The Processing of sensitive data is prohibited except in the cases provided in Article 6 of Law 1581 of 2012, including when the Data Subject has given explicit authorization, when necessary to safeguard their vital interest and they are physically or legally incapacitated, or when required for the recognition, exercise, or defense of a right in a judicial proceeding.

When D'ACOSTA Hoteles y Resorts collects sensitive data, it will:

• Inform the Data Subject that, because the data is sensitive, they are not obliged to authorize its Processing.

• Inform them explicitly and in advance which data is sensitive and the specific purpose of the Processing.

• Not condition any activity or service on the Data Subject providing sensitive data, unless it is indispensable for the provision of the service.

• Apply reinforced security measures and limit access to those persons strictly necessary.

8. Children and adolescents´s data

The Processing of data of persons under 18 is prohibited unless the data is of a public nature or the Processing responds to and respects the best interests of children and adolescents and ensures respect for their fundamental rights, in accordance with Article 7 of Law 1581 of 2012 and constitutional case law.

Therefore:

• Authorization to process data of minors will be granted by their legal representative, after the minor has exercised their right to be heard, weighing their opinion according to their maturity, autonomy, and capacity to understand the matter.

• Data of minors will be processed only for purposes necessary for the service (for example, hotel registration, security, and contracted recreational activities).

• Data of minors will not be used for advertising or commercial profiling.

• Whoever makes a reservation on behalf of minor companions declares that they have the authority of representation to provide their data.

9. Authorization

The Processing of personal data requires the free, prior, express, and informed consent of the Data Subject, except for the exceptions in Article 10 of Law 1581 of 2012 (information required by a public or administrative entity in the exercise of its legal functions or by court order, data of a public nature, cases of medical or health emergency, Processing authorized by law for historical, statistical, or scientific purposes, and data related to the Civil Registry).

Mechanisms. Authorization may be granted in writing, orally, through unequivocal conduct of the Data Subject from which it can reasonably be concluded that they granted authorization, or through electronic means such as acceptance checkboxes on the website, applications, reservation forms, or emails. Silence will never be considered unequivocal conduct.

Minimum content. When requesting authorization, D'ACOSTA Hoteles y Resorts will inform the Data Subject of: (i) the Processing to which their data will be subjected and its purpose; (ii) the optional nature of the response when it concerns sensitive data or data of minors; (iii) the rights they hold; and (iv) the identification, physical or electronic address, and telephone number of the Data Controller.

Proof. The company will keep proof of the authorization granted, by any suitable means, for the duration of the Processing and any additional time required by law.

Separate authorizations. Acceptance of this Policy does not replace the specific authorization required for the optional purposes in section 6.2 or for sensitive data. This Policy is complemented by the privacy notice in Annex B, which is presented to the Data Subject at each point of data collection (reservation forms, websites, reception, and other channels) together with the authorization checkboxes in Annex A.

10. Rights of Data Subjects

In accordance with Article 8 of Law 1581 of 2012, the Data Subject has the right to:

• Know, update, and rectify their personal data with D'ACOSTA Hoteles y Resorts or the Data Processors. This right may be exercised, among other cases, regarding partial, inaccurate, incomplete, or fragmented data, data that leads to error, or data whose Processing is expressly prohibited or has not been authorized.

• Request proof of the authorization granted, except when it is not required under the law.

• Be informed, upon request, of the use that has been made of their personal data.

• File complaints with the Superintendence of Industry and Commerce for infractions of Law 1581 of 2012 and other rules that modify, add to, or complement it, once they have exhausted the inquiry or claim procedure with the Data Controller or Processor.

• Revoke the authorization and/or request deletion of the data when the Processing does not respect constitutional and legal principles, rights, and guarantees.

• Access their personal data that has been subject to Processing free of charge, at least once per calendar month and whenever there are substantial modifications to this Policy that prompt new inquiries.

11. Duties of D'ACOSTA Hoteles y Resorts as Data Controller

Under the terms of Article 17 of Law 1581 of 2012, the company undertakes to:

• Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.

• Request and keep a copy of the respective authorization granted by the Data Subject.

• Duly inform the Data Subject of the purpose of the collection and the rights that they hold by virtue of the authorization granted.

• Keep the information under the security conditions necessary to prevent its tampering, loss, or unauthorized or fraudulent consultation, use, or access.

• Ensure that the information provided to the Data Processor is truthful, complete, accurate, up to date, verifiable, and understandable, and update it in a timely manner.

• Rectify the information when it is incorrect and notify the Data Processor.

• Provide the Data Processor only with data whose Processing is previously authorized, and require it to respect the security and privacy conditions of the Data Subject.

• Handle inquiries and claims under the terms set out in this Policy and the law.

• Insert in the database the legend "information under judicial dispute" once notified by the competent authority of judicial proceedings related to the quality of the data.

• Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the SIC.

• Allow access to the information only to persons who may have access to it.

• Inform the SIC when there are violations of security codes and there are risks in the administration of Data Subjects' information.

• Comply with the instructions and requirements issued by the SIC.

• Register its databases in the National Database Registry (RNBD), when required, and keep that registration up to date.

12. Transmission and transfer of data; processors and third parties

To fulfill the purposes of this Policy, D'ACOSTA Hoteles y Resorts may:

• Transmit data to Data Processors (for example, reservation system providers, payment gateways, cloud hosting services, contact centers, travel agencies, banks, insurers, and technology providers), through transmission contracts that oblige the Processor to process the data in accordance with this Policy, to apply adequate security measures, and to maintain confidentiality.

• Transfer or transmit data outside Colombia, including to companies of the corporate group [indicate countries, for example Brazil] and to technology providers located in other countries, provided that the receiving country offers adequate levels of data protection according to the standards set by the SIC, or that one of the exceptions in Article 26 of Law 1581 of 2012 is met (for example, express and unequivocal authorization of the Data Subject, or performance of a contract to which the Data Subject is a party). When none of these conditions is met, a declaration of conformity will be requested from the SIC.

• Provide information to administrative, oversight, police, or judicial authorities by virtue of a legal or regulatory requirement, and use or disclose it in defense of its rights.

• Allow access to auditors or other third parties engaged for internal or external audit processes.

D'ACOSTA Hoteles y Resorts does not sell Data Subjects' personal data.

13. Procedure for exercising rights: inquiries and claims

13.1. Service channels

The Data Subject, their successors, representative, or attorney may exercise their rights through:

• Email: [personal data email]

• Telephone: (57) 1 6234992

• Written communication addressed to [physical address] or filed at [the hotels' registration points].

• [Form on the website, if enabled.]

13.2. Request requirements

The request must contain at a minimum: (i) the first and last names of the Data Subject; (ii) type and number of identity document; (iii) telephone and email or address to receive a response; (iv) country; (v) a clear and precise description of the data with respect to which the right is sought to be exercised and of the facts giving rise to the request; (vi) the documents they wish to submit; and (vii) the documents proving representation, if acting on behalf of another person.

The right may be exercised only by the Data Subject or their successors, upon proof of their identity (or through electronic instruments that allow them to be identified), or by their representative or attorney, upon proof of representation. If the request is made by a person other than the Data Subject without proving representation, it will be deemed not submitted. The exercise of rights is free of charge.

13.3. Inquiries

The Data Subject may consult the personal information held in any of the company's databases. The inquiry will be answered within a maximum of ten (10) business days from the date of receipt. When it is not possible to answer within that period, the interested party will be informed, before the period expires, of the reasons for the delay and the date on which it will be answered, which may not exceed five (5) additional business days after the expiration of the first period.

13.4. Claims

Data Subjects or their successors who consider that the information contained in a database should be corrected, updated, or deleted, or who notice an alleged breach of the duties under the law, may submit a claim, which will be processed as follows:

Receipt and completeness. If the claim is incomplete, the interested party will be required, within five (5) business days of receipt, to correct the deficiencies. If two (2) months pass from the request without the information being provided, the claim will be deemed withdrawn.

Misdirected claims. If the company receives a claim that is not within its competence, it will forward it to the appropriate party within a maximum of two (2) business days and inform the interested party.

"Claim in process" legend. Once the complete claim is received, the legend "claim in process" and the reason will be included in the database within no more than two (2) business days. The legend will remain until the claim is decided.

Response time. The claim will be answered within a maximum of fifteen (15) business days counted from the day after receipt. If it is not possible to answer within that period, the interested party will be informed of the reasons for the delay and the date on which it will be answered, which may not exceed eight (8) additional business days after the expiration of the first period.

13.5. Prerequisite

The Data Subject or successor may file a complaint with the Superintendence of Industry and Commerce only after having exhausted the inquiry or claim procedure with D'ACOSTA Hoteles y Resorts.

13.6. Rectification and updating

At the request of the Data Subject, the company will rectify and update information that is incomplete or inaccurate. The Data Subject must indicate the corrections to be made and provide documentation supporting their request. The company may enable electronic mechanisms or simplified forms that facilitate the exercise of this right, provided they benefit the Data Subject, and will announce them on its website.

13.7. Deletion of data and revocation of authorization

The Data Subject may request at any time the deletion of their personal data and/or revoke the authorization granted when: (a) they consider that the data is not being processed in accordance with the principles, duties, and obligations of the law; (b) it has ceased to be necessary or relevant for the purpose for which it was collected; or (c) the period necessary to fulfill the purposes for which it was collected has been exceeded.

Revocation may be total (the company stops processing the Data Subject's data entirely) or partial (for example, only for advertising or market research purposes), and the Data Subject must indicate in their request which applies. Deletion implies the total or partial elimination of the data, so that its recovery is not possible.

The request for deletion or revocation will not proceed when the Data Subject has a legal or contractual duty to remain in the database, when the deletion would obstruct judicial or administrative proceedings linked to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions, or when the data is necessary to protect the Data Subject's legally protected interests, to carry out an action in the public interest, or to fulfill an obligation legally acquired by the Data Subject. In these cases, the company will inform the Data Subject with reasons.

14. Information security

D'ACOSTA Hoteles y Resorts has adopted reasonable technical, human, and administrative measures, proportionate to the risk, to protect personal data against tampering, loss, or unauthorized or fraudulent consultation, use, or access, including:

• Mandatory security protocols for personnel with access to personal data and information systems, with defined functions and obligations.

• Access controls based on the need-to-know principle, and authentication and encryption mechanisms, as appropriate.

• Backup and data recovery procedures.

• A security incident management and response procedure, including notification to the SIC within the deadlines and by the means it establishes, and communication to affected Data Subjects when appropriate.

• Confidentiality agreements and data protection clauses in contracts with third parties (contractors, consultants, temporary staff, and Data Processors), obliging them to comply with this Policy and the company's security protocols.

• Measures for the transport, disposal, or reuse of media and documents containing personal data.

• Periodic controls to verify compliance with security procedures, and review and updating of them whenever relevant changes occur in the information systems or the organization.

Although the company uses reasonable and current security methods, no system is completely invulnerable. Accordingly, the company will answer in accordance with the law for any breach of its security duties, without prejudice to events of force majeure or acts of third parties that could not have been foreseen or avoided with due diligence.

15. Cookies and similar technologies

The website of D'ACOSTA Hoteles y Resorts [uses / may use] cookies and similar technologies for its operation, to remember preferences, for statistical analysis and, with prior authorization, for advertising purposes. The Data Subject may configure their browser to reject or delete cookies, or manage their preferences through [the site's cookie panel]. [Detail cookies, purposes, and providers.]

16. Video surveillance

The facilities have video surveillance systems for the security of persons, property, and facilities. Visible notices inform the public of their existence. Images are kept for [period, for example 30 days], unless they are required by an authority or for the defense of rights in a proceeding, and access is limited to authorized personnel. Cameras are not installed in places where privacy could be affected, such as rooms or bathrooms.

17. Truthfulness of the information provided

Data Subjects must provide truthful, complete, and up-to-date information to make the provision of services possible. The company presumes the good faith of the information provided, without prejudice to its duty to adopt reasonable measures to keep it accurate and up to date and to the verifications required by law, such as the identification of guests. The Data Subject will be responsible for damages arising from the deliberate provision of false information or from identity impersonation on their part.

18. National Database Registry

D'ACOSTA Hoteles y Resorts will register and keep its databases up to date in the National Database Registry administered by the SIC, [if it is an obligated party under Decree 090 of 2018 or the rule that modifies it], and will report updates and claims received within the deadlines established by the authority.

19. Retention period

Personal data will be kept for the time necessary to fulfill the purposes for which it was collected and the applicable legal, contractual, accounting, fiscal, and tax obligations. Once these periods have expired, the data will be securely deleted or anonymized, unless there is a legal or contractual obligation requiring its retention.

Reference periods: [define by data category with legal advice, for example accounting and tax information under the Commercial Code and the Tax Statute; guest records under tourism regulations; video surveillance images according to the period indicated in section 16; résumés of unselected candidates, for the period to be defined].

20. Policy´s Modifications

D'ACOSTA Hoteles y Resorts may modify this Policy to address legislative or case-law changes, instructions from the authority, internal policies, or new requirements for the provision of its services. When changes are substantial and relate to the identification of the Data Controller or the purposes of the Processing, they will be communicated in a timely manner to Data Subjects, no later than the time the new policies are implemented, by efficient means (email, website, or others), and, when the law requires it, a new authorization will be requested. The current version will always be published at [URL].

21. Effective date

This Policy takes effect as of [date] and replaces previous versions. The databases will remain in force for the reasonable time necessary to fulfill their purposes, in accordance with section 19.

Annex A. Model authorization for the time of reservation or registration

☐ I authorize [Company name] (NIT [NIT]), data controller, with address at [address], email [email], and telephone (57) 1 6234992, to process my personal data to manage my reservation and stay, comply with legal and registration obligations, process payments, guarantee security, and handle my requests, in accordance with the Personal Data Processing Policy available at [URL].

☐ I authorize, on an optional basis, the use of my data to receive advertising, offers, and commercial communications from [Company name], its affiliated companies, and business partners, through the channels I indicate: ☐ email ☐ telephone ☐ messaging.

☐ I authorize, on an optional basis, the use of my data for surveys, market studies, and loyalty programs.

I am aware of my rights to know, update, rectify, and delete my data, request proof of authorization, revoke it, and file complaints with the Superintendence of Industry and Commerce. I understand that I am not obliged to authorize the processing of sensitive data or data of minors and that optional authorizations do not condition the provision of the service.

Annex B. Privacy notice

Privacy notice. D'ACOSTA HOTELES Y RESORTS is the data controller of your personal data. We will use it to manage your reservation and stay, process payments, comply with legal obligations, guarantee security, and handle your requests. If you authorize it, we will also use it to send you offers, promotions, and commercial communications. You have the right to know, update, rectify, and delete your data, request proof of authorization, revoke it, and file complaints with the Superintendence of Industry and Commerce. You may exercise these rights by writing to callcenter@grupodacosta.com.br or calling (57) 1 6234992. Read our full Personal Data Processing Policy at [link to the policy].