PRIVACY AND DATA PROCESSING POLICIES

MANUAL OF PRIVACY POLICIES AND PERSONAL DATA PROCESSING – JALO HASHTAG 98 HOTEL.  For JALO HASHTAG 98 HOTEL, the conservation, protection, integrity and confidentiality of its clients' personal data is very important. For this, we have designed a policy for the storage and processing of the information that our clients provide through the various marketing channels of our products and services (such as websites, call centers), and we are committed to the protection and proper management of the same, in accordance with the legal regime for the protection of personal data applicable in each territory where we operate. CHAPTER I GENERAL PROVISIONS ARTICLE 1. DEFINITIONS. For the purposes of applying the rules contained in this manual and in accordance with the provisions of Article 3 of Law 1581 of 2012, the following is understood: a) Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data. b) Privacy notice: Verbal or written communication generated by the Controller addressed to the Owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, the form of access them and the purposes of the Treatment that is intended to be given to personal data. c) Database: Organized set of personal data that is subject to Treatment. d) Personal data: Any information linked or that can be associated with one or several specific or determinable natural persons. e) Private data: It is the data that, due to its intimate or reserved nature, is only relevant to the owner. f) Sensitive data: Sensitive data is understood to be data that affects the privacy of the Owner or whose improper use may generate discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data. g) Data Processor: Natural or legal person, public or private, who, by themselves or in association with others, carries out the Processing of personal data on behalf of the Data Controller. h) Responsible for the Treatment: Natural or legal person, public or private, who alone or in association with others, decides on the database and/or the Processing of the data. i) Owner: Natural person whose personal data is the subject of Treatment. j) Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion thereof. ARTICLE 2. PURPOSE. The purpose of this document is to regulate the procedures for the collection, handling and processing of personal data carried out in order to JALO HASHTAG 98 HOTEL guarantee and protect the fundamental right of habeas data of its guests, visitors, clients, users and suppliers within the framework of what is established by law. All of the above in compliance with the provisions of literal (k) of Article 17 of Law 1581 of 2012, which regulates the duties that assist those responsible for the processing of personal data, among which is the obligation to adopt a manual. internal policies and procedures to guarantee adequate compliance with the law and, especially, to respond to queries and complaints. ARTICLE 3. SCOPE OF APPLICATION. This manual will be applicable to the personal data registered and to be registered in the different databases managed by JALO HASHTAG 98 HOTEL, that is, to the databases of our guests, visitors, clients and suppliers, who provide us with their data to commercial purposes. The information collected by JALO HASHTAG 98 HOTEL may include, in whole or in part depending on the needs of each product and/or service, among others, the following data: • Names and surnames. • Type and identification number. • Nationality and country of residence. • Date of birth and gender. • Marital status and/or relationship in relation to minors or disabled people requesting our services. • Landlines and contact cell phones (personal and/or work). • Postal and electronic addresses (personal and/or work). • Profession or trade • Company in which you work and position. • Origin and destination • Reason for your trip • Credit card(s) information (number, bank, expiration date). • Personal data of the cardholder (names and surnames, type and identification number). • Information about the address where the cardholder receives their bank statements. These data may be stored and/or processed on servers located in computer centers, whether owned or contracted with third-party providers, which is authorized by our guests, visitors, clients, users and suppliers by accepting this Privacy Policy. ARTICLE 4. TRUTHFULNESS OF THE INFORMATION. Our guests, visitors, clients, users and suppliers must provide truthful information about their personal data in order to make the provision of services by JALO HASHTAG 98 HOTEL possible. and under which condition they agree to deliver the required information JALO HASHTAG 98 HOTEL presumes the veracity of the information provided and does not verify, nor assumes the obligation to verify, the identity of the guests, visitors, clients, users and suppliers, nor the veracity, validity, sufficiency and authenticity of the data that each of them provides. Therefore, it does not assume responsibility for damages and/or losses of any kind that may arise from the lack of veracity, validity, sufficiency or authenticity of the information, including damages that may be due to homonymy or identity theft. . ARTICLE 5. APPLICABLE LEGISLATION. This manual was prepared taking into account the ordinances of Law 1581 of 2012 “By which general provisions are issued for the protection of personal data” and Decree number 1377 of 2013 “By which Law 1581 of 2012 is partially regulated” . ARTICLE 6. INFORMATION OF MINOR CHILDREN AND ADOLESCENTS. JALO HASHTAG 98 HOTEL will ensure the appropriate use of the personal data of minor boys, girls and adolescents, guaranteeing that the processing of their data respects their best interest, and their fundamental rights and, as far as possible, taking take into account your opinion, as owners of your personal data. ARTICLE 7. PURPOSES OF THE PROCESSING OF PERSONAL DATA The information collected is used to process, confirm, fulfill and provide the services and/or products acquired, directly and/or with the participation of third party providers of products or services, as well as to promote and advertise our activities, products and services, carry out transactions, make reports to the different national or international administrative control and surveillance authorities, police authorities or judicial authorities, banking entities and/or insurance companies, for internal administrative and/or commercial purposes. such as market research, audits, accounting reports, statistical analysis, billing, and offering and/or recognition of benefits of our loyalty programs. By accepting this Privacy and Treatment Policy, our guests, visitors, clients, users and suppliers, in their capacity as owners of the data collected, authorize JALO HASHTAG 98 HOTEL to process them, partially or totally, including the collection, storage, recording, use, circulation, processing, deletion, for the execution of activities related to the services and products purchased, such as making reservations, modifications, cancellations and changes thereof, refunds, attention to queries, complaints and claims, payment of compensation and indemnities, accounting records, correspondence, processing and verification of credit cards, debit cards and other payment instruments, identification of fraud and prevention of money laundering and other criminal activities and/or for the operation of loyalty programs and other purposes indicated in this document. The foregoing, without prejudice to other purposes that have been informed in this document and in the terms and conditions of each of the products and services of each of our business units. We warn that third-party providers may be involved in these activities (such as reservation system providers, travel agencies, call centers, banking entities, insurance companies. Additionally, our travelers, clients and users, in their capacity as owners of the data collected, By accepting this privacy policy, you authorize us to: • Use the information received from them for marketing purposes of their products and services, and the products and services of third parties with whom JALO HASHTAG 98 HOTEL maintains a business relationship. • Provide personal data to the police or judicial control and surveillance authorities, pursuant to a legal or regulatory requirement and/or use or disclose this information and personal data in defense of your rights and/or your assets in relation to said defense. is related to the products and/or services contracted by its travelers, clients and users. • Allow access to information and personal data to auditors or third parties hired to carry out internal or external audit processes specific to the commercial activity we carry out. • Consult and update personal data, at any time, in order to keep said information updated. • Contract with third parties the storage and/or processing of information and personal data for the correct execution of the contracts entered into with us, under the security and confidentiality standards to which we are obliged. CHAPTER II AUTHORIZATION ARTICLE 8. AUTHORIZATION. The collection, storage, use, circulation or deletion of personal data by JALO HASHTAG 98 HOTEL requires the free, prior, express and informed consent of the owner of the same JALO HASHTAG 98 HOTEL, in his capacity as responsible for the processing of personal data, has provided the necessary mechanisms to obtain the authorization of the owners, guaranteeing in all cases that it is possible to verify the granting of said authorization. With the aforementioned authorization, the client accepts the policies and conditions established in this document. ARTICLE 9. FORM AND MECHANISMS TO GRANT THE AUTHORIZATION. The authorization of the owner of the information will appear in each of the data collection channels and mechanisms of JALO HASHTAG 98 HOTEL, and may appear in a physical, electronic document or in any other format that guarantees its subsequent consultation. The authorization will be issued by the owner prior to the processing of their personal data, in accordance with the provisions of Law 1581 of 2102. The consent authorization procedure guarantees that the owner of the personal data has been made aware of both the fact that your personal information will be collected and used for certain and known purposes, such as that you have the option of knowing any alternative to them and the specific use that has been given to them. The foregoing in order for the owner to make informed decisions in relation to his personal data and control the use of his personal information. CHAPTER III RIGHTS AND DUTIES ARTICLE 10. RIGHTS OF INFORMATION OWNERS. In accordance with the provisions of article 8 of Law 1581 of 2012, the owner of personal data has the following rights: a) Know, update and rectify their personal data against JALO HASHTAG 98 HOTEL in its capacity as data controller. b) Request proof of the authorization granted to JALO HASHTAG 98 HOTEL, in its capacity as Data Controller. c) Be informed by JALO HASHTAG 98 HOTEL upon request, regarding the use that has been given to your personal data. d) Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012, once the consultation or claim process has been exhausted before the Data Controller. e) Revoke the authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights and guarantees. f) Access free of charge to your personal data that has been processed. ARTICLE 11. DUTIES OF JALO HASHTAG 98 HOTEL IN RELATION TO THE PROCESSING OF PERSONAL DATA. JALO HASHTAG 98 HOTEL will keep in mind, at all times, that the personal data are the property of the people to whom they refer and that only they can decide on them. In this sense, you will use them only for those purposes for which you are duly authorized, and in all cases respecting Law 1581 of 2012 on the protection of personal data. In accordance with the provisions of article 17 of Law 1581 of 2012, JALO HASHTAG 98 HOTEL undertakes to permanently comply with the following duties: a) Guarantee to the Owner, at all times, the full and effective exercise of the right of habeas data. b) Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access. c) Carry out in a timely manner, this is in the terms provided in articles 14 and 15 of Law 1581 of 2012, the updating, rectification or deletion of the data. d) Process the queries and claims made by the Owners in the terms indicated in article 14 of Law 1581 of 2012. e) Insert in the database the legend “information under judicial discussion” once notified by the competent authority on judicial processes related to the quality or details of personal data. f) Refrain from circulating information that is being controversial by the Owner and whose blocking has been ordered by the Superintendence of Industry and Commerce. g) Allow access to information only to people who can have access to it. h) Inform the Superintendency of Industry and Commerce when violations of security codes occur and there are risks in the administration of the Owners' information. i) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce. CHAPTER IV ACCESS, CONSULTATION AND CLAIM PROCEDURES ARTICLE 13. RIGHT OF ACCESS: The power of disposition or decision that the owner has over the information that concerns him, necessarily entails the right to access and know if his personal information is being processed. , as well as the scope, conditions and generalities of said treatment. Likewise, the owner has the right to request their rectification if they are inaccurate or incomplete and to cancel them when they are not being used in accordance with legal or contractual purposes and terms or according to the purposes and terms contemplated in this Privacy Policy. JALO HASHTAG 98 HOTEL will guarantee the right of access when, after accreditation of the identity of the owner or his representative or agent, he requests it in accordance with the provisions of Law 1581 of 2012. Clients and users can exercise their rights to know, update, rectify and delete your personal data by sending your request to the email: luissalamanca@jalo.com.co (General Manager) in accordance with this Privacy Policy. You must include the following information in the request: • Names and surnames. • Document type. • Document number. • Phone. • Email. • Country. • Affair. ARTICLE 13. RESPONSE TO QUERIES. In any case, regardless of the mechanism implemented to respond to consultation requests, they will be responded to within a maximum period of ten (10) business days from the date of receipt. When it is not possible to attend to the query within said term, the interested party will be informed before the expiration of the 10 days, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case may exceed five days. (5) business days following the expiration of the first term. ARTICLE 14. CLAIMS. In accordance with the provisions of article 14 of Law 1581 of 2012, the Owner or his successors who consider that the information contained in a database must be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, may submit a claim to the Data Controller, which will be processed under the following rules: 1. The claim may be submitted by the Owner in the formats provided for this purpose by JALO HASHTAG 98 HOTEL. in your Hotel registry. If the claim received does not have complete information that allows it to be processed, that is, with the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to assert, the interested party within five (5) days of receipt to correct any defects. If two (2) months have elapsed from the date of the request without the applicant presenting the required information, it will be understood that he has withdrawn the claim. If for any reason the Company receives a claim that should not actually be directed against it, it will notify the appropriate party within a maximum period of two (2) business days and will inform the interested party of the situation. 2. Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database maintained by JALO HASHTAG 98 HOTEL, within a period of no more than two (2) business days. Said legend must be maintained until the claim is decided. 3. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to attend to it within said term, the interested party will be informed before the expiration of the aforementioned period of the reasons for the delay and the date on which their claim will be attended to, which in no case may exceed eight (8) business days following the expiration of the first term. ARTICLE 15. IMPLEMENTATION OF PROCEDURES TO GUARANTEE THE RIGHT TO SUBMIT CLAIMS. At any time and free of charge, the owner or his representative may request JALO HASHTAG 98 HOTEL to rectify, update or delete their personal data, after proving their identity. The rights of rectification, updating or deletion may only be exercised by: • The owner or his successor in title, after proving his identity, or through electronic instruments that allow him to identify himself. • his representative, after accreditation of the representation. When the request is made by a person other than the owner and it is not proven that the request is acting on behalf of the owner, it will be considered not submitted. The request for rectification, updating or deletion must be submitted through the means enabled by JALO HASHTAG 98 HOTEL indicated in the privacy notice and contain, at a minimum, the following information: 1. The name and address of the owner or any other means to receive the response 2. Documents that prove the identity or personality of your representative. 3. The clear and precise description of the personal data with respect to which the owner seeks to exercise any of the rights. 4. If necessary, other elements or documents that facilitate the location of personal data. PARAGRAPH 1. RECTIFICATION AND UPDATE OF DATA. JALO HASHTAG 98 HOTEL has the obligation to rectify and update, at the request of the owner, the latter's information that turns out to be incomplete or inaccurate, in accordance with the procedure and terms indicated above. In this regard, the following will be taken into account: In requests for rectification and updating of personal data, the owner must indicate the corrections to be made and provide the documentation that supports his request. JALO HASHTAG 98 HOTEL Consequently, electronic or other means that are considered relevant may be enabled. JALO HASHTAG 98 HOTEL. may establish forms, systems and other simplified methods, which must be informed in the privacy notice and which will be made available to interested parties on the website. JALO HASHTAG 98 HOTEL will use the customer service or customer service that it has in operation, as long as the response times are not longer than those indicated by article 15 of Law 1581 of 2012. JALO HASHTAG 98 HOTEL. PARAGRAPH 2. DELETION OF DATA. The owner has the right, at all times, to request JALO HASHTAG 98 HOTEL to delete (eliminate) their personal data when: a.) They consider that they are not being treated in accordance with the principles, duties and obligations provided for in the Law 1581 of 2012. b.) They have ceased to be necessary or relevant for the purpose for which they were collected. c.) The period necessary to fulfill the purposes for which they were collected has been exceeded. This deletion implies the total or partial elimination of personal information in accordance with what is requested by the owner in the records, files, databases or treatments performed by JALO HASHTAG 98 HOTEL. It is important to keep in mind that the right of cancellation is not absolute and the person responsible may deny its exercise when: • The request to delete the information will not proceed when the owner has a legal or contractual duty to remain in the database. . • The deletion of data hinders judicial or administrative actions linked to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions. • The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner. If the cancellation of personal data is appropriate, JALO HASHTAG 98 HOTEL must carry out the deletion operatively in such a way that the deletion does not allow the recovery of the information. ARTICLE 16. REVOCATION OF AUTHORIZATION. The owners of personal data may revoke consent to the processing of their personal data at any time, as long as this is not prevented by a legal provision. To do this, they must contact JALO HASHTAG 98 HOTEL., by email: luissalamanca@jalo.com.co (General Manager). It should be taken into account that there are two modalities in which the revocation of consent can occur. The first may be for all of the consented purposes, that is, JALO HASHTAG 98 HOTEL must completely stop processing the owner's data; The second can occur on specific types of processing, such as for advertising or market research purposes. With the second modality, that is, the partial revocation of consent, other purposes of the treatment that the controller, in accordance with the authorization granted, can carry out and with which the owner agrees, are kept safe. Due to the above, it will be necessary for the owner to submit the request for revocation of consent to JALO HASHTAG 98 HOTEL., Indicate in this request whether the revocation he intends to make is total or partial. In the second hypothesis, it must be indicated which treatment the holder does not agree with. There will be cases in which consent, due to its necessary nature in the relationship between the owner and person responsible for the fulfillment of a contract, cannot be revoked by legal provision. The mechanisms or procedures that JALO HASHTAG 98 HOTEL establishes to address requests for revocation of consent may not exceed the deadlines provided for addressing claims as indicated in article 15 of Law 1581 of 2012. CHAPTER V INFORMATION SECURITY ARTICLE 17 . SECURITY MEASURES. In development of the security principle established in Law 1581 of 2012, JALO HASHTAG 98 HOTEL has adopted the technical, human and administrative measures that are necessary to provide security to the records, preventing their adulteration, loss, consultation, use or unauthorized access or fraudulent. However, the client assumes the risks that arise from delivering this information in a medium such as the Internet, which is subject to various variables – attacks from third parties, technical or technological failures, among others. JALO HASHTAG 98 HOTEL will make its best technological effort to guarantee the security of the personal information of all its clients and/or users, using reasonable and current security methods to prevent unauthorized access, to maintain the accuracy of the data and guarantee the correct use of information. ARTICLE 18. IMPLEMENTATION OF SECURITY MEASURES. will maintain mandatory security protocols for personnel with access to personal data and information systems. The procedure must consider, at a minimum, the following aspects: a) Third parties hired by JALO HASHTAG 98 HOTEL will be required to adhere to and comply with the information security policies and manuals, as well as the security protocols that we apply. to all our processes. JALO HASHTAG 98 HOTEL that involves the processing of personal information and data, will include a confidentiality agreement that details its commitments for the protection, care, security and preservation of its confidentiality, integrity and privacy. c) Scope of application of the procedure with detailed specification of the protected resources. d) Measures, norms, procedures, rules and standards aimed at guaranteeing the level of security required in Law 1581 of 2012. e) Functions and obligations of personnel. f) Structure of personal databases and description of the information systems that process them. g) Procedure for notification, management and response to incidents. h) Procedures for making backup copies and data recovery. i) Periodic controls that must be carried out to verify compliance with the provisions of the security procedure that is implemented j) Measures to be adopted when a medium or document is going to be transported, discarded or reused. k) The procedure must be kept updated at all times and must be reviewed whenever relevant changes occur in the information system or its organization. l) The content of the procedure must be adapted at all times to the current provisions regarding the security of personal data CHAPTER VI FINAL PROVISIONS ARTICLE 19. MODIFICATIONS TO THE PRIVACY POLICY. JALO HASHTAG 98 HOTEL reserves the right to make modifications or updates to this Privacy Policy at any time, to address legislative developments, internal policies or new requirements for the provision or offering of its services or products. ARTICLE 20. VALIDITY OF THE PROCESSING OF PERSONAL INFORMATION AND DATA. The information provided by clients and users will remain stored for up to fifteen (15) years from the date of the last treatment, to allow us to comply with the legal and/or contractual obligations under their responsibility, especially in accounting matters. fiscal and tax.