Data Processing Policy

COFFEE AND ADVENTURE S.A.S (hereinafter, «The Hotel») undertakes to carry out its activities in compliance with Law 1581 of 2012, Regulatory Decree 1377 of 2013, Decree 886 of 2014, and other regulations that make up the Personal Data Protection Regime of Colombia, as well as with the highest applicable standards in this matter. The Hotel guarantees the security of the personal data of its clients, contractors, suppliers, employees, and the general public.

This Policy is publicly accessible, so that any person may learn the standards and procedures established by COFFEE AND ADVENTURE S.A.S in relation to the Processing of Personal Data and the protection of the information contained in its Databases. All workers linked to The Hotel must comply with this Policy, as must the agents, representatives, advisors, contractors, and persons who act on behalf of the company and carry out the Processing of Personal Data. These are referred to as «Hotel Personnel».

• Authorization: Prior, express, and informed consent of the Data Subject for the Processing of Personal Data.
• Database: Organized set of Personal Data in digital, electronic, or physical form.
• Personal Data: Information that identifies a natural person or that can be associated with one or several persons.
• Private Personal Data: Reserved information that concerns only the Data Subject.
• Sensitive Personal Data: Data that affect the privacy of the Data Subject and whose improper use may generate discrimination (racial origin, political orientation, religious convictions, health, sexual life, biometric data, etc.).
• Public Data: Information that is not private, semi-private, or sensitive, such as marital status, profession, or occupation.
• Data Processor (Encargado del Tratamiento): Natural or legal person who carries out the Processing of Personal Data on behalf of The Hotel.
• Hotel Personnel: Persons linked to COFFEE AND ADVENTURE S.A.S who process personal data.
• Data Controller (Responsable del Tratamiento): COFFEE AND ADVENTURE S.A.S, who decides on the purposes and the Processing of Personal Data.
• Data Subject (Titular): Natural person whose Personal Data are subject to Processing.
• Transfer: Sending of Personal Data to a data controller within or outside Colombia.
• Transmission: Communication of Personal Data within or outside Colombia by the Data Processor.
• Processing: Operations such as collection, storage, use, circulation, or deletion of Personal Data.

• Legality: The Processing shall conform to Colombian laws.
• Purpose: The Processing shall have a legitimate purpose informed to the Data Subject.
• Freedom: The Processing requires the prior, express, and informed consent of the Data Subject.
• Truthfulness or Quality: The information shall be truthful, complete, accurate, and up to date.
• Transparency: The Data Subject may access their Personal Data at any time.
• Restricted Access and Circulation: Personal Data shall not be publicly available without control.
• Security: Technical and administrative measures shall be implemented to protect the data.
• Confidentiality: Hotel Personnel shall guarantee the confidentiality of the data.

The Data Subject authorizes The Hotel to collect, store, use, circulate, transmit, and/or transfer their personal data when accessing the hotel's services. This includes:

• Registration at reception.
• Use of digital platforms.
• Participation in loyalty programs.
• Contact for complaints, claims, or suggestions.
• Capture of images and videos on the premises.

The Data Subject may exercise their rights to know, update, rectify, object to, and request the deletion of their data. If they do not agree with the Processing, they may refrain from providing their data.

Personal Data may be shared internally with Hotel Personnel and, in necessary cases, with commercial partners or service providers, always complying with this Policy and the applicable laws.

The Processing of Personal Data has the following purposes:

• To develop the corporate purpose of COFFEE AND ADVENTURE S.A.S.
• To provide contracted services and keep Data Subjects informed.
• To execute contracts with workers, suppliers, and clients.
• To send commercial and advertising information.
• To carry out satisfaction campaigns and evaluate the quality of services.
• To comply with labor and contractual obligations.
• To carry out statistical or accounting studies.

The Hotel guarantees the confidentiality and security of Personal Data, implementing technical and administrative measures to prevent its adulteration, loss, or unauthorized access.

The Hotel does not collect Personal Data of minors under 18 years of age without the authorization of their legal representative, respecting their fundamental rights and their best interest.

The Hotel will avoid the Processing of Sensitive Data, unless it is absolutely necessary, informing the Data Subject explicitly and in advance.

In the event of needing to transmit Personal Data to third parties, The Hotel will guarantee that they comply with the same standards of protection and security.

The Data Subject authorizes the use of their image for advertising and marketing purposes by The Hotel and its commercial partners.

The Hotel will retain Personal Data for a reasonable time after the end of the contractual relationship, unless the Data Subject requests its deletion.

The Data Subject may revoke their authorization for the Processing of their Personal Data, except when there is a legal or contractual obligation that prevents it.

Data Subjects have the right to:

• Know, update, and rectify their Personal Data.
• Request proof of the authorization.
• Be informed about the use of their data.
• Revoke the authorization and request the deletion of their data.
• Access their Personal Data free of charge.
• File complaints before the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio).
• Refrain from answering questions about sensitive data.

Requests or inquiries must be addressed to:

Email: gerenciahotel@lapalmayeltucan.com

The Hotel will respond within a maximum period of 10 business days.

Claims must be sent to:

Email: gerenciahotel@lapalmayeltucan.com

The Hotel will address the claim within a maximum period of 15 business days.

The Hotel will only provide information to:

• The Data Subjects, their successors, or legal representatives.
• Public or administrative entities in the exercise of their functions.
• Third parties authorized by the Data Subject or by law.

• Company name: COFFEE AND ADVENTURE S.A.S.
• NIT: 901.017.282-3
• Address: Bogotá, Colombia
• Email: gerenciahotel@lapalmayeltucan.com
• Website: https://lapalmayeltucanhotel.com/

This Policy may be modified at any time. It is recommended to review it periodically on the Hotel's website.