Legal Notice

PERSONAL INFORMATION PROCESSING POLICIES:

FIRST: GENERAL PROVISIONS

We are particularly interested in protecting and respecting your personal information and data, and for this reason, we have designed these information processing policies, within the framework of Law 1581 of 2012 and regulatory Decree 1377 of 2013.

1.1.- Introduction.

Travelers Apartamentos & Suites SAS may collect personal data from its users, guests, or visitors through various means intended for accessing the services it provides. In any case, data collection will be carried out with the express authorisation of the data subject, and its processing will be subject to the provisions of the law.

The personal information subject to the considerations established herein may be collected by Travelers Apartamentos & Suites SAS through the website www.travelers.com.co, by visiting or acquiring services offered on the platform, or directly at hotels linked or associated with Travelers Apartamentos & Suites SAS.

The considerations established herein will be understood as accepted by the Data Subject when they visit or use the website www.travelers.com.co and/or when they enter personal data or information through the functions established for this purpose, regardless of the purpose.

1.2- General principles.

The obtaining and collection of personal data, as well as its use, processing, exchange, transfer, and transmission by Travelers Apartamentos & Suites SAS or any of the operating companies of Travelers Apartamentos & Suites SAS hotels, will always be guided by principles of legality, freedom, veracity, transparency, security, confidentiality, and restricted access and circulation.

1.3- Legal definitions.

In accordance with Law 1581 of 2012 and Decree 1377 of 2013, the following definitions will govern the personal information processing policies.

1.3.1.- Data Processor: A data processor is a natural or legal person, public or private, who, alone or in association with others, processes personal data on behalf of the Data Controller;

1.3.2.- Data Controller: A data controller is a natural or legal person, public or private, who, alone or in association with others, decides on the database and/or the processing of data;

1.3.3.- Database: A database is an organised set of personal data that is subject to processing;

1.3.4.- Personal data: Personal data is any information linked or that can be associated with one or more determined or determinable natural persons;

1.3.5.- Sensitive data: Sensitive data is data that affects the privacy of the Data Subject or whose improper use may generate discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social organisations, human rights organisations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.

1.3.6.- Public data: This is data that is not semi-private, private, or sensitive. Public data includes, among others, data relating to the civil status of individuals, their profession or occupation, and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial sentences that are not subject to reservation.

1.3.7.- Transfer: Data transfer occurs when the Data Controller and/or Data Processor of personal data, located in Colombia, sends the information or personal data to a recipient, who is in turn a Data Controller and is located inside or outside the country.

1.3.8- Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when its purpose is to carry out processing by the Data Processor on behalf of the Data Controller.

SECOND: AUTHORISATION OF THE DATA SUBJECT:

The data provided will be subject to authorised processing, granted in advance, expressly, and informed by the Data Subject, directly to Travelers Apartamentos & Suites SAS, or through Travelers Apartamentos & Suites SAS hotels or the companies that operate them.

However, visiting, accessing, or using the website www.travelers.com.co constitutes, in itself, prior, express, and informed authorisation for the storage, collection, and processing of information in accordance with the data processing policy contained herein.

In any case, data collection will be limited to personal data that is relevant and adequate for the purpose pursued.

THIRD: INFORMATION PROCESSING:

3.1- Data collected.

The collection of data for the development of the Processing and its purposes will cover the personal data received and stored by Travelers Apartamentos & Suites SAS and the companies and hotels linked or associated with Travelers Apartamentos & Suites SAS, and will include all information provided or supplied during a visit to the website www.travelers.com.co, as well as all information related to services or reservations made, and accommodation and lodging data supplied to Travelers Apartamentos & Suites SAS or any of its associated hotels.

Without prejudice to the fact that in some cases it may be public data, the information collected will correspond to name, national identification number, profession, nationality, date of birth, email address, personal preferences and interests, work or activity, consumption habits or travel habits, among others. If a reservation is made through the website www.travelers.com.co, information corresponding to the credit card provided for the purposes of the reservation and stay will be collected.

3.2- Processing to which the data will be subjected and its purpose.

The data and information obtained and collected by Travelers Apartamentos & Suites SAS, by Travelers Apartamentos & Suites SAS hotels, or by the operating companies of such hotels, will be used in the normal course of their commercial activities solely for the purpose established in these information processing policies, in order to create direct and effective communication with the client, leading to a closer relationship.

The processing consists of sending digital information through different communication channels, with the intention of contacting the data subject to send them service surveys after each stay to allow for service rating, and to communicate invitations, offers, promotions, service portfolio, or information about the Hotel or the hotels that are part of Travelers Apartamentos & Suites SAS, without their data ever being provided, transferred, or delivered to persons other than or unrelated to the Hotel that collected the information, or to the hotels and activities linked to Travelers Apartamentos & Suites SAS and the activities it carries out. Additionally, data collection aims to: make, process, manage, and/or complete reservations or purchases of hotel nights or other services; conduct internal studies on tourism habits; evaluate the quality of our services; send surveys and questionnaires regarding the services provided; promptly address your requests, petitions, or needs; communicate invitations, offers, promotions, and general information about the service portfolio offered by natural or legal persons directly linked to hotel operations and specifically to the services provided by Travelers Apartamentos & Suites SAS and the companies and hotels that operate them.

The information or data provided that is collected, gathered, or stored in accordance with these policies may be shared, transmitted, updated, and/or deleted between Travelers Apartamentos & Suites SAS, Travelers Apartamentos & Suites SAS hotels, and their operating companies for the purpose defined in these policies, to be used in the manner established herein. By accessing the website www.travelers.com.co, you authorise your information and data to be shared with the tourism providers to whom your reservations and/or requests refer and with whom they are processed.

It is assumed that all information or data supplied or deposited through the website www.travelers.com.co is true, accurate, and complete, and may be withdrawn at any time if it is considered harmful or prejudicial to your interests or the interests of a third party.

The data and general information received when you access the website www.travelers.com.co may belong to you or to the device from which you are accessing. In order to optimise and make your experience visiting www.travelers.com.co more efficient, cookies and/or web beacons may be used, and information about the visited internet pages, your IP address, and the operating system of the device from which you are accessing may be obtained and stored through a recognition and tracking process that allows identifying your preferences and identifying you when you visit the page again and storing certain records, based on your IP address. The IP address is not associated or linked to your name or your personal data.

3.3.- Sensitive data and data corresponding to children and adolescents.

Neither Travelers Apartamentos & Suites SAS nor the operating companies of Travelers Apartamentos & Suites SAS hotels will process data considered sensitive, nor is data collection aimed at collecting sensitive information.

The collection of data corresponding to underage children and adolescents, and the respective authorisation, must always be given through their legal representative, after the minor has exercised their right to be heard. The processing of data corresponding to children and adolescents must respond to and respect the best interests of children and adolescents, and their fundamental rights. In the event that for any reason a question may lead to the answer being about sensitive data or data of children and adolescents, the answer to such a question will be optional.

3.4.- Duties of the data controller.

The data controllers, and/or data controllers and processors of personal data, undertake to: a) Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data; b) Request and retain, under the conditions provided by law, a copy of the respective authorisation granted by the Data Subject; c) Duly inform the Data Subject about the purpose of the collection and the rights they have by virtue of the authorisation granted; d) Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorised or fraudulent use or access; e) Guarantee that the information supplied to the Data Processor is true, complete, accurate, updated, verifiable, and understandable; f) Update the information, promptly communicating to the Data Processor all new developments regarding the data previously supplied and adopting other necessary measures to keep the information supplied to them updated; g) Rectify the information when it is incorrect and communicate the relevant information to the Data Processor; h) Supply the Data Processor, as the case may be, only data whose Processing is previously authorised in accordance with the provisions of this law; i) Demand from the Data Processor at all times, respect for the security and privacy conditions of the Data Subject’s information; j) Process inquiries and claims formulated in the terms indicated in the law; k) Inform the Data Processor when certain information is under discussion by the Data Subject, once the claim has been filed and the respective procedure has not ended; l) Inform, at the request of the Data Subject, about the use given to their data; m) Inform the data protection authority when security code violations occur and there are risks in the administration of the Data Subjects’ information. n) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

FOURTH: RIGHTS AND POWERS OF THE DATA SUBJECT:

4.1.- Rights of the data subject.

Once the Data Subject has granted authorisation for the corresponding processing, they have the right to: a) Know, update, and rectify their personal data. This right may be exercised with respect to partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or has not been authorised; b) Request proof of the authorisation granted, except when expressly exempted as a requirement for processing, in accordance with the provisions of Article 10 of Law 1581 of 2012; c) Be informed by the data controller and/or processor, upon request, of the use given to their personal data; d) File complaints with the Superintendence of Industry and Commerce for infringements of the provisions of the law; e) Revoke the authorisation and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the processing has incurred in conduct contrary to this law and the Constitution; f) Request, at any time from the controller or processor, the deletion of their personal data and/or revoke the authorisation granted for its processing, by filing a claim, which will not proceed when the Data Subject has a legal or contractual duty to remain in the database. g) Access their personal data that has been processed free of charge: (i) at least once every calendar month, and (ii) whenever there are substantial modifications to the Information Processing Policies that motivate new inquiries. In the case of requests whose frequency is greater than one per calendar month, the controller and/or processor may charge the Data Subject for shipping, reproduction, and, where applicable, certification of documents.

4.2.- Legitimacy for exercising the rights of the data subject.

The following persons are also legitimate to exercise the rights of the data subject: a). The data subject themselves, who must sufficiently prove their identity by the means made available by the controller; b). Their successors in title, who must prove such status; c). The representative and/or attorney-in-fact of the Data Subject, after proving the representation or power of attorney; d). By stipulation in favour of another or for another; e). The rights of children or adolescents will be exercised by the persons authorised to represent them, after proving the power of representation.

4.3.- Area responsible for the attention and support of the data subject.

The legal department will be responsible for attending to and responding to inquiries, requests, and claims from Data Subjects regarding any aspect of the processing. The Data Subject who wishes to know, update, rectify, request proof of the authorisation granted; be informed of the use given to their personal data; revoke the authorisation and/or request the deletion of the data; and/or access their personal data that has been processed free of charge, must request it in writing directly to the email address contacto@travelers.com.co or send the communication to Calle 127 # 15 36. In either case, the following must be indicated: a) full name; b) identity document; c) physical address and email; d) contact telephone number; e) brief description of the information and data referred to, expressly indicating the scope and content of the request; and, f) attach the documents considered to support their request.

4.4.- Procedure for exercising the rights to know, update, rectify or delete information and revoke authorisation.

The procedures for accessing, updating, deleting, and rectifying personal data, and for revoking authorisation, may be carried out through inquiries or claims, addressed to the email address contacto@travelers.com.co or to the address Calle 127 # 15 36, depending on the purpose, establishing, at a minimum, the legitimacy to make the request and clearly and concretely stating what is intended.

All petitions, suggestions, and recommendations related to information processing must be sent to the email address contacto@travelers.com.co. The data subject or the legitimate person must attach to their written request proof of the capacity in which they are acting, and must provide the data and documents necessary to prove their identity and capacity.

The email must specify the reason or purpose of the communication, and for this, it will be sufficient to indicate in the text that the right to know, update, rectify, delete, or revoke the granted authorisation is being exercised.

4.5.- Procedure for the correction, update or deletion of data and for filing complaints and claims.

Anyone legitimately entitled by law, who considers that the information contained should be corrected, updated, or deleted; or who considers that the processing of personal data infringes legal norms, may file claims, in accordance with Article 15 of Law 1581 of 2012, to the email address contacto@travelers.com.co.

Complaints and claims will be processed under the following rules:

4.5.1.- The claim will be formulated by means of a request addressed to the Data Controller or the Data Processor, with the identification of the Data Subject, a description of the facts giving rise to the claim, and the address, accompanied by the documents to be relied upon. If the claim is incomplete, the interested party will be required, within five (5) business days following receipt of the claim, to rectify the deficiencies. If two (2) months have passed since the date of the request without the applicant submitting the required information, it will be understood that they have withdrawn the claim. In the event that the person receiving the claim is not competent to resolve it, it will be transferred to the appropriate party within a maximum period of two (2) business days, and the interested party will be informed of the situation.

4.5.2.- Once the complete claim is received, a legend stating “claim in process” and the reason for it will be included in the database within a maximum of two (2) business days. This legend must be maintained until the claim is decided.

4.5.3.- The maximum period for addressing the claim will be fifteen (15) business days from the day following its receipt. If it is not possible to address the claim within this period, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial period.

4.6.- Consultation and access to information.

Inquiries about personal data contained in the Travelers Apartamentos & Suites SAS database will be handled by written request via email to contacto@travelers.com.co. Inquiries will be answered within a maximum of ten (10) business days from the date of receipt. If it is not possible to answer the inquiry within this period, the interested party will be informed before the expiry of ten (10) business days, stating the reasons for the delay and indicating the date on which the inquiry will be answered, which in no case may exceed five (5) business days following the expiry of the initial period.

FIFTH: SECURITY.

5.1.- Security in information handling.

The collected data will always be processed within a framework of confidentiality, so it will not be provided, transferred, or delivered to persons other than or unrelated to the Hotel, Travelers Apartamentos & Suites SAS, or Travelers Apartamentos & Suites SAS operating companies, or anyone with legitimate authorisation to do so.

5.2.- Data transfer and transmission.

In the event that a contract is signed with a third party professional with experience in the management and use of databases, the controller will sign the personal data transmission contract referred to in Article 25 of Decree 1377 of 2013.

SIXTH: DISSEMINATION AND VALIDITY.

6.1.- Means of disseminating information processing policies and privacy notice.

This document, which establishes the information processing policies for collected personal data, will be permanently published at the information processing URL so that it can be consulted by anyone interested. When requesting the Data Subject’s express authorisation for data processing, they will be informed of the specific purposes for which consent is obtained and will be made aware of the Processing Policy and their rights as a Data Subject.

6.2.- Entry into force of the information processing policies.

The collection, storage, use, and circulation of personal data, in development of the considerations established herein, will be carried out and maintained as long as the need for direct communication with the client remains valid and there are no more efficient ways to do so, in accordance with the purposes proposed by the Processing. In the event that the purpose cannot be achieved through the Processing given to the personal data, these will be permanently deleted from the database. This document comes into force on 22 February 2016.

6.3.- Procedure for policy modification events.

In the event that modifications are made to the personal data processing policies enshrined herein, they will be notified and communicated through this same website, prior to their entry into force.

6.4.- Incorporation of the terms of use of the website www.travelers.com.co.

In accordance with applicable regulations, the information processing policy forms an integral part of the terms and conditions of use of the website www.travelers.com.co.

6.5. – Information Controller.

Travelers Apartamentos & Suites SAS, with NIT 860352521-6, acts as the controller and processor of personal data, along with each of the linked operating companies that have collected the information. When the information has been received or collected by one of its linked companies, with express authorisation for transfer, Travelers Apartamentos & Suites SAS will be responsible for the processing.

Any communication may be addressed to Calle 127 # 15 36, or to the email address contacto@travelers.com.co.