Privacy Policy

DATA PRIVACY AND INFORMATION MANAGEMENT POLICIES

DATA PRIVACY AND INFORMATION MANAGEMENT POLICIES LAW 1581 OF 2012 AND REGULATORY DECREE 1377 OF 2013

DATA CONTROLLER

NAME: Travelers Apartamentos & Suites SAS

TAX ID: 860352521-6

ADDRESS: Calle 127 # 15 36

EMAIL: contacto@travelers.com.co

WEBSITE: www.travelers.com.co

1. OBJECTIVE

To establish and disseminate the Information Processing and Personal Data Protection Policies implemented by Travelers Apartamentos & Suites SAS, in order to ensure proper compliance with Law 1581 of 2012 and Decree 1377 of 2013, which aim to develop the constitutional right of all individuals to know, update, and rectify information collected about them in databases or files, and other constitutional rights, freedoms, and guarantees referred to in Article 15 of the Political Constitution “Habeas Data”; as well as the right to information enshrined in Article 20 thereof.

Travelers Apartamentos & Suites SAS adopts an internal manual of policies and procedures to ensure compliance with this precept and these regulatory provisions.

2. SCOPE:

This document applies to personal data registered in any database managed by the company and subject to processing.

3. DEFINITIONS:

3.1. Authorisation: prior, express, and informed consent of the Data Subject to carry out the processing of personal data.

3.2. Database: organised set of personal data that is subject to processing.

3.3. Personal data: any information linked or that can be associated with one or more specific or determinable natural or legal persons.

3.4. Data Processor: natural or legal person, public or private, who, alone or in association with others, performs the processing of personal data on behalf of the Data Controller.

3.5. Data Controller: natural or legal person, public or private, who, alone or in association with others, decides on the database and/or the processing of such data.

3.6. Data Subject: natural or legal person whose personal data is subject to processing.

3.7. Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

3.8. Enquiries: request for the Data Subject’s personal information held in any database, which Travelers Apartamentos & Suites SAS is obliged to provide to the Data Subject or their successors, all information contained in the individual record or linked to the Data Subject’s identification.

3.9. Complaint: request for correction, update, or deletion of information contained in a database processed by Travelers Apartamentos & Suites SAS. or a request for alleged non-compliance with any of the duties contained in Law 1581 of 2012, made by the Data Subject or their successors.

3.10. Public data: data that is not semi-private, private, or sensitive. Public data includes, among others, data relating to the civil status of individuals, their profession or trade, and their status as a merchant or public servant. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial sentences that are not subject to reservation.

3.11. Sensitive data: personal data that reveals racial or ethnic origin, political opinions, religious or moral convictions, trade union membership, health or sexual life information, or any other data that may, by its nature or context, lead to discriminatory treatment of the data subject. This data is specially protected.

3.12. Habeas data: fundamental right that allows individuals to know, update, and rectify information stored about them in databases and files of public and private entities. 3.13. Successor: person who has succeeded or been subrogated by any title in the right of another or others.

4. GENERAL GUIDELINES

4.1 The policies contemplated in this document are mandatory for Travelers Apartamentos & Suites SAS as a data information source, as well as for the processors who carry out the processing of personal data on behalf of the Company.

4.2 Both the controller and the processors must safeguard the databases containing personal data and maintain confidentiality regarding their processing.

5. REGULATORY BACKGROUND

5.1 Article 15 of the Political Constitution.

“All individuals have the right to their personal and family privacy and to their good name, and the State must respect and enforce them. Likewise, they have the right to know, update, and rectify information collected about them in databases and files of public and private entities. In the collection, processing, and circulation of data, freedom and other guarantees enshrined in the Constitution shall be respected.”

5.2 Article 20 of the Political Constitution.

“Every person is guaranteed the freedom to express and disseminate their thoughts and opinions, to inform and receive truthful and impartial information, and to establish mass media. These are free and have social responsibility. The right to rectification under equitable conditions is guaranteed. There shall be no censorship.”

6. Travelers Apartamentos & Suites SAS IN THE REGULATIONS

We are an information source.

6.1 WHY ARE WE AN INFORMATION SOURCE?

Given that Travelers Apartamentos & Suites SAS is a company responsible for collecting credit information from users to whom services are offered through credit and cash payment systems, it constitutes one of the so-called information sources referred to in literal (b) of Article 3 of Law 1266 of 2008. (…)

“It is the person, entity or organisation that receives or knows personal data of the data subjects, by virtue of a commercial or service relationship or of any other nature and that, by reason of legal authorisation or of the data subject, supplies such data to an information operator, who in turn will deliver them to the end user. If the source delivers the information directly to the users and not through an operator, it will have the dual status of source and operator and will assume the duties and responsibilities of both. The information source is responsible for the quality of the data supplied to the operator, which, inasmuch as it has access to and supplies personal information of third parties, is subject to compliance with the duties and responsibilities provided to guarantee the protection of the data subject’s rights”(…)

6.2 DUTIES OF INFORMATION SOURCES ARTICLE 8, LAW 1266 OF 2008:

Information sources must comply with the following obligations, without prejudice to compliance with other provisions set forth in this law and in others governing their activity:

a. Guarantee that the information supplied to database operators or users is truthful, complete, accurate, updated, and verifiable.
b. Periodically and promptly report to the operator all new developments regarding the data previously supplied and adopt other necessary measures to keep the information supplied to it updated.
c. Rectify information when it is incorrect and inform the operators accordingly.
d. Design and implement effective mechanisms to promptly report information to the operator.
e. Request, where applicable, and keep a copy or evidence of the respective authorisation granted by the data subjects, and ensure that no data whose supply is not previously authorised is supplied to the operators, when such authorisation is necessary, in accordance with the provisions of this law.
f. Certify, semi-annually to the operator, that the information supplied has the authorisation in accordance with the provisions of this law.
g. Resolve the data subject’s complaints and petitions in the manner regulated in this law.
h. Inform the operator that certain information is under discussion by its data subject, when the request for rectification or update of the same has been submitted, so that the operator includes a mention to that effect in the database until said procedure has been finalised.
i. Comply with the instructions issued by the control authority in relation to compliance with this law.
j. Any others derived from the Constitution or this law.

7. PROCESSING OF PERSONAL DATA

7.1 Principles for the processing of personal data.

The following principles will be taken into account by Travelers Apartamentos & Suites SAS in the process of personal data management.

7.1.1 Legality in data processing.

Data processing must comply with the provisions contained in Law 1581 of 2012 and any rule that develops or regulates such provision.

7.1.2 Purpose and processing.

Data processing must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject. The data processing and the purpose of the information in the Travelers Apartamentos & Suites SAS databases are based on the provision of the service, the contractual relationship, commercial and/or advertising purposes. Travelers Apartamentos & Suites SAS may transmit the information to third parties, suppliers, and authorities.

Processing can only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorisation, or in the absence of a legal or judicial mandate that waives consent.

7.1.3 Veracity or quality.

The information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.

7.1.4 Transparency.

In processing, the Data Subject’s right to obtain information from Travelers Apartamentos & Suites SAS or the data processor, at any time and without restrictions, about the existence of data concerning them must be guaranteed.

7.1.5 Acceso y circulación restringida.

Processing is subject to the limits derived from the nature of personal data, the provisions of Law 1581 of 2012, and the Constitution. In this sense, processing may only be carried out by persons authorised by the Data Subject and/or by persons provided for in the Law.

Personal data, except public information, may not be available on the Internet or other mass dissemination or communication media, unless access is technically controllable to provide restricted knowledge only to Data Subjects or third parties authorised in accordance with the Law.

7.1.6 Security

The information subject to processing by the controller or data processor must be handled by taking reasonable technical, human, and administrative measures to ensure the security of the records, seeking to prevent their alteration, loss, consultation, unauthorised or fraudulent use or access.

7.1.7 Confidencialidad.

All persons involved in the processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks included in said procedure has ended, being able to supply or communicate personal data only when this corresponds to the development of the activities authorised by Law and in its terms.

7.2 Special categories of data.

7.2.1 Sensitive data.

These are data that affect the Data Subject’s privacy or whose improper use may lead to discrimination, such as those revealing racial or ethnic origin, political orientation, religious or philosophical convictions, trade union membership, social organisations, human rights organisations or those that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.

7.2.1.1 The processing of sensitive data is prohibited, except when:

a. The Data Subject has given their explicit authorisation for such processing, except in cases where, by law, such authorisation is not required. Processing is necessary to safeguard the vital interest of the Data Subject and they are physically or legally incapacitated. In these events, legal representatives must grant their authorisation.
b. Processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association, or any other non-profit organisation, whose purpose is political, philosophical, religious, or trade union, provided that they refer exclusively to its members or to persons who maintain regular contact by reason of its purpose.
c. In these events, the data may not be supplied to third parties without the Data Subject’s authorisation.
d. Processing refers to data that is necessary for the recognition, exercise, or defence of a right in a judicial process. e. Processing has a historical, statistical, or scientific purpose. In this event, measures must be adopted to suppress the identity of the Data Subjects.
f. In the processing of sensitive personal data, when such processing is possible in accordance with the exceptions cited above contained in Article 6 of Law 1581 of 2012, the following obligations must be met:

Inform the Data Subject that, as it involves sensitive data, they are not obliged to authorise its processing. Inform the Data Subject explicitly and in advance, in addition to the general requirements for authorising the collection of any type of personal data, which of the data to be processed are sensitive and the purpose of the Processing, as well as obtaining their express consent.

7.2.2 Rights of children and adolescents.

In processing, respect for the prevailing rights of children and adolescents will be ensured. The processing of personal data of children and adolescents is prohibited, except for data that is public in nature. 7.2.3 Rights of Data Subjects:

7.2.3.1 To know, update, and rectify their personal data before Travelers Apartamentos & Suites SAS, or before the designated data processor. This right may be exercised, among others, with respect to partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or has not been authorised.

7.2.3.2 To request proof of the authorisation granted to Travelers Apartamentos & Suites SAS, except when expressly exempted as a requirement for processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.

7.2.3.3 To be informed by Travelers Apartamentos & Suites SAS, or by the designated data processor, upon request, regarding the use made of their personal data.

7.2.3.4 To file complaints with the Superintendence of Industry and Commerce for infringements of the provisions of Law 1581 of 2012 and other rules that modify, add to, or complement it.

7.2.3.5 To revoke authorisation and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the processing, Travelers Apartamentos & Suites SAS or the designated processor, have engaged in conduct contrary to Law 1581 of 2012 and the Constitution.

7.2.3.6 To access, free of charge under the conditions defined in this document, their personal data that has been subject to processing.

8. CONDITIONS FOR DATA PROCESSING

8.1 Authorisation

In development of the principles of purpose and freedom, the collection of data carried out by Travelers Apartamentos & Suites SAS must be limited to personal data that is pertinent and adequate for the purpose for which it is collected or required in accordance with current regulations, except in cases expressly provided for by Law.

8.2 Data Subject’s Authorisation

For Travelers Apartamentos & Suites SAS to carry out any personal data processing action, the Data Subject’s prior and informed authorisation is required, which must be obtained by any means that can be subject to subsequent consultation. These mechanisms may be predetermined through technical means that facilitate the Data Subject’s automated manifestation or may be in writing or orally. Authorisations from Data Subjects will be registered as follows:

Travelers Apartamentos & Suites SAS requests authorisation for information processing from all its data subjects, always provided that such collection involves the processing of information by Travelers Apartamentos & Suites SAS, or third parties (with prior authorisation). This authorisation request is made at the time commercial relationships are generated with clients (Credit and Cash Sales), purchase of products and services with suppliers, and hiring of personnel for the performance of tasks inherent to the organisation. Travelers Apartamentos & Suites SAS adopts procedures to request, at the latest at the time of data collection, the Data Subject’s authorisation for the processing of the same and will inform of the personal data that will be collected as well as all the specific purposes of said processing for which consent is obtained.

Personal data found in public access sources, regardless of the means by which access is obtained, understood as data or databases that are available to the public, may be processed by Travelers Apartamentos & Suites SAS, provided that, by their nature, they are public data.

In case of substantial changes in the content of the Processing Policies, referring to the identification of Travelers Apartamentos & Suites SAS and the purpose of personal data processing, which may affect the content of the authorisation, Travelers Apartamentos & Suites SAS will communicate these changes to the Data Subjects, at least 3 days before the entry into force of the new policy, and will also obtain new authorisation from the Data Subject when the change refers to the Purpose of Processing. For the communication of the changes and the authorisation.

8.2.1 Cases where authorisation is not necessary

a. Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
b. Data of a public nature.
c. Cases of medical or health emergency.
d. Processing of information authorised by law for historical, statistical, or scientific purposes.
e. Data related to the Civil Registry of persons.

8.3 Suministro de la información

The information requested by the Data Subject will be provided by Travelers Apartamentos & Suites SAS, and may be supplied by any means, including electronic, as required by the Data Subject. The information must be easy to read, without technical barriers that prevent access, and must correspond in its entirety to that contained in the database.

8.4 Duty to inform the Data Subject

Travelers Apartamentos & Suites SAS, when requesting authorisation from the Data Subject, must clearly and expressly inform them of the following: The processing to which their personal data will be subjected and the purpose of the same. The optional nature of the answer to questions asked, when these deal with sensitive data or data of children and adolescents. The rights they have as Data Subject. The identification, physical or electronic address, and telephone number of the data controller.

8.5 Persons to whom information may be supplied:

Information about personal data that has been processed by Travelers Apartamentos & Suites SAS, may be supplied to the following persons: To Data Subjects, their successors, or their legal representatives. To public or administrative entities in the exercise of their legal functions or by judicial order. To third parties authorised by the Data Subject or by law.

9. DERECHOS DEL TITULAR

9.1 Revocation of authorisation and/or deletion of data:

Data Subjects may at all times request Travelers Apartamentos & Suites SAS to delete their personal data and/or revoke the authorisation granted for the processing of the same, by submitting a complaint, in accordance with the provisions of Article 15 of Law 1581 of 2012. The request for deletion of information and revocation of authorisation WILL NOT PROCEED WHEN THE DATA SUBJECT HAS A LEGAL OR CONTRACTUAL DUTY TO REMAIN IN THE Travelers Apartamentos & Suites SAS DATABASE. The procedure will be as established in this document for submitting complaints.

9.2 Consultas y reclamos:

The Data Subject or their successors have the right to submit enquiries and/or complaints to Travelers Apartamentos & Suites SAS, after validating their identity, through any of the following customer service mechanisms available nationwide. Travelers Apartamentos & Suites SAS, will respond to the enquiry and/or complaint by the same means it was submitted.

9.2.1 Consulta:

Data Subjects or their successors may consult the Data Subject’s personal information held in the Travelers Apartamentos & Suites SAS database. Travelers Apartamentos & Suites SAS will provide the applicant with all the information contained in the individual record or linked to the Data Subject’s identification.

The Data Subject may consult their personal data free of charge:

At least one (1) time every calendar month. Whenever there are substantial modifications to the Information Processing Policies that warrant new enquiries. For enquiries with a frequency greater than one (1) per calendar month, Travelers Apartamentos & Suites SAS, will only charge for shipping, reproduction, and, where applicable, document certification costs. Reproduction costs may not exceed the recovery costs of the corresponding material.

Response to enquiries

For the purpose of responding to enquiries, Travelers Apartamentos & Suites SAS, has a period of ten (10) business days from the date of receipt of the same. If it is not possible to respond to the enquiry within this period, the interested party will be informed, stating the reasons for the delay and indicating the date on which their enquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial period.

Complaints

The Data Subject or their successors who consider that the information contained in a database should be corrected, updated, or deleted, or when they notice an alleged breach of any of the duties contained in Law 1581 of 2012, may file a complaint with Travelers Apartamentos & Suites SAS, which will be processed under the following rules and will be formulated by means of a request addressed to Travelers Apartamentos & Suites SAS, with at least the following information:

Name of the Data Controller or the Data Processor.
Name of the petitioner.
Identification number of the petitioner.
Facts on which the request is based.
Purpose of the petition.
Correspondence address.
Provide the documents intended to be used.

If the complaint is incomplete, the interested party will be required within five (5) days following receipt of the complaint to rectify the deficiencies. If two (2) months have passed since the date of the requirement, without the applicant submitting the required information, it will be understood that they have withdrawn the complaint. In the event that the person receiving the complaint is not competent to resolve it, they will transfer it to the appropriate party within a maximum period of two (2) business days and inform the interested party of the situation. Once the complete complaint is received, a legend stating “complaint in process” and the reason for it will be included in the database within a maximum period of two (2) business days. This legend must be maintained until the complaint is resolved. The maximum period to address the complaint will be fifteen (15) business days from the day following its receipt. If it is not possible to address the complaint within this period, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial period.

9.2.3 Admissibility requirement:

The Data Subject or successor may only file a complaint with the Superintendence of Industry and Commerce once they have exhausted the enquiry or complaint procedure before the data controller or data processor.

9.2.4 Procedimiento para consultas y reclamos.

In compliance with the above, Travelers Apartamentos & Suites SAS, will respond to the enquiry and/or complaint by the same means it was formulated.

The procedure established by Travelers Apartamentos & Suites SAS, for submitting complaints, making enquiries, and/or exercising your rights as the data subject of the collected information is the following.

9.2.4.1 Receipt of the complaint or enquiry at any of the complexes, these can be identified on the Websites www.travelers.com.co, or a letter can be sent directly to the administrative offices at Calle 127 # 15 36
9.2.4.2 Complaints or enquiries can also be sent via email: contacto@travelers.com.co, in accordance with Section Two, Literal Two, ARTICLE 16 Law 1266 of 2008 – Section Two, Article 15, Law 1581 of 2012.
9.2.4.3 For petitions or enquiries, there are 10 business days from receipt to respond; if necessary, the response can be extended by 5 more business days.
9.2.4.4 For complaints, there are 15 business days to resolve it, Section three of Article 16 of Law 1266 of 2008.
9.2.4.5 Exceptionally, there are 8 additional business days to the first 15, to respond to the right of petition, always provided that the person making the petition is notified.
9.2.4.6 Travelers Apartamentos & Suites SAS, within 2 business days following the receipt of the complaint, will place a record or legend in the operator’s database indicating that the “complaint is in process”.
9.2.4.7 If not competent, there are 2 business days to transfer the information to the competent entity.
9.2.4.8 Once the response to the enquiry or complaint raised by the client is available, it will be sent to the address provided in the request and/or by the means through which the enquiry was made.
9.2.4.9 In case of doubts or questions about the procedure for submitting complaints, making enquiries, and/or exercising your rights as the data subject of the data collected by Travelers Apartamentos & Suites SAS, general information can be requested through the Customer Service department via email contacto@travelers.com.co.

10. DEBERES DE Travelers Apartamentos & Suites SAS EN EL TRATAMIENTO DE DATOS

a. Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.
b. Request and keep, under the conditions provided by Law, a copy of the respective authorisation granted by the Data Subject.
c. Duly inform the Data Subject about the purpose of the collection and the rights they have by virtue of the authorisation granted.
d. Take measures aimed at preserving the information under security conditions to prevent its alteration, loss, consultation, unauthorised or fraudulent use or access.
e. Ensure that the information supplied to the data processor is truthful, complete, accurate, updated, verifiable, and understandable.
f. Update the information, promptly communicating to the data processor, all new developments regarding the data previously supplied and adopt other necessary measures to keep the information supplied to it updated.
g. Rectify the information when it is incorrect and communicate the relevant information to the data processor.
h. Supply the data processor, as the case may be, only data whose processing is previously authorised in accordance with the provisions of the Law.
i. Demand from the data processor at all times, respect for the security and privacy conditions of the Data Subject’s information.
j. Process enquiries and complaints formulated in the terms indicated in the law.
k. Adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, for handling enquiries and complaints.
l. Inform the data processor when certain information is under discussion by the Data Subject, once the complaint has been filed and the respective procedure has not been finalised.
m. Inform, at the Data Subject’s request, about the use made of their data.
n. Inform the data protection authority when security code violations occur and there are risks in the administration of the Data Subjects’ information.
o. The instructions and requirements issued by the Superintendence of Industry and Commerce.

10.1 Duties of the data processor:

Data processors must comply with the following duties, without prejudice to other provisions set forth in the Law and in others governing their activity:
a. Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.
b. Take measures to preserve the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorised or fraudulent use or access.
c. Timely carry out the update, rectification, or deletion of data in the terms of this law.
d. Update the information reported by the data controllers within five (5) business days from its receipt.
e. Process enquiries and complaints formulated by the Data Subjects in the terms indicated in the Law.
f. Adopt a document that guarantees proper compliance with the Law and, in particular, for handling enquiries and complaints from Data Subjects.
g. Register in the database the legend “complaint in process” in the manner regulated in the Law.
h. Insert in the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of the personal data.
i. Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.
j. Allow access to information only to persons who can have access to it.
k. Inform the Superintendence of Industry and Commerce when security code violations occur and there are risks in the administration of the Data Subjects’ information.
l. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
m. Safeguard the databases in which personal data is contained.
n. Maintain confidentiality regarding the Processing of personal data.

11. MEDIDAS DE SEGURIDAD

Travelers Apartamentos & Suites SAS takes all reasonable precautions and technical, administrative, and organisational measures to guarantee the security of Data Subjects’ personal data, mainly those aimed at preventing its alteration, loss, and unauthorised processing or access. Security measures apply to both files and processing. The application of security measures aims to ensure the preservation, confidentiality, integrity, and availability of data.

12. MODIFICACIONES

Travelers Apartamentos & Suites SAS reserves the right to modify these Information Processing Policies, in whole or in part. In case of substantial changes in the Processing Policies referring to the identification of Travelers Apartamentos & Suites SAS and the purpose of personal data Processing, which may affect the content of the authorisation, Travelers Apartamentos & Suites SAS will communicate these changes to the data subject at the latest at the time of implementing the new policies.