Alko Hoteles’s Privacy Policy in Colombia

POLICIES AND PROCEDURES FOR THE PROCESSING OF PERSONAL DATA OF INVERSIONES NEGOCIOS Y SERVICIOS S.A.S.
CONTENTS

I. Purpose of the Treatment Policy
II. Definitions for the purposes of the Treatment Policy
III. Principles for the Treatment of Personal Data
IV. Authorization
V. Purposes of the Treatment
SAW. Procedures for the Treatment of Personal Data
VII. Information and mechanisms provided by the Company as Data Controller
VII. Area responsible for the Processing of Personal Data
IX. Rights of the Holder of Personal Data
X. Duties of the Data Controller
XI. Validity of the Treatment Policy and the Databases
XII. Other provisions

I. OBJECTIVE OF THE TREATMENT POLICY

INVERSIONES NEGOCIOS Y SERVICIOS S.A.S., (hereinafter "INVERSIONES NEGOCIOS Y SERVICIOS S.A.S.", or the "Company"), committed to the security of the personal information of its users, customers, suppliers, contractors, employees and the general public and to the In order to strictly comply with the current regulations on the protection of Personal Data, especially as established in Law 1581 of 2012, Decree 1377 of 2013 and in the other provisions that modify, add or complement them, it is allowed to present the Policies Treatment regarding the protection of Personal Data (hereinafter the "Policy") of the Company, in relation to the collection, storage, use, circulation and deletion of the same, by virtue of the authorization granted by the Holders of information.

In this Policy, the Company details I) the general corporate guidelines that are taken into account in order to protect the Personal Data of the Holders, II) the purpose of collecting the information, III) the rights of the Holders, IV) the area responsible for dealing with complaints and claims, and V) the procedures that the Holder must follow to know, update, rectify and delete the information subject to treatment.
The Company, in compliance with the constitutional right to Habeas Data, only collects Personal Data, when it has been previously authorized by its Owner, implementing for this purpose, clear measures on confidentiality and privacy of Personal Data.

II. DEFINITIONS FOR THE PURPOSES OF THE TREATMENT POLICY

For the purposes of this Policy, the definitions outlined below shall be taken into account:

a) Data Subject: Natural or legal person whose Personal Data is subject to Processing.
b) Controller or Data Processor: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the Processing of the data. In this case the Company.
c) Personal Data: Any information linked or that may be associated to one or several determined or determinable natural persons.
d) Public Data: Data that is not semi-private, private or sensitive. Public data includes, among others, data related to the marital status of individuals, their profession or trade, and their status as merchants or public servants. Due to their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins and court rulings.
e) Sensitive Data: Data that affect the privacy of the Data Subject or whose improper use may lead to discrimination.
f) Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or suppression.
g) Processing Policies regarding the protection of Personal Data: Refers to this document.

III. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

Pursuant to Article 4 of Law 1581 of 2012, the principles governing the Processing of Personal Data are:

(a) Principle of legality in matters of Data Processing: The Processing referred to in Law 1581 is a regulated activity that must be subject to the provisions set forth therein and in the other provisions that develop it, as well as to the provisions of this Policy.
b) Principle of purpose: Processing must obey the legitimate purposes set forth in this Policy, which must be informed to the Data Subject.
c) Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal Data shall not be obtained or disclosed without prior authorization, unless there is a legal or judicial mandate that relieves the consent.
d) Principle of truthfulness or quality: The information subject to Processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.
e) Principle of transparency: In the Processing, the right of the Data Subject to obtain from the Controller or Processor, at any time and without restrictions, information about the existence of data concerning him/her, shall be guaranteed.
f) Principle of restricted access and circulation: The Processing shall be subject to the limits derived from the nature of the Personal Data. In this sense, the Processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for in the Law.
g) Security Principle: The information subject to Processing by the Controller and/or Data Processor shall be handled with the technical, human and administrative measures necessary to provide security to the records, avoiding their adulteration, loss, consultation, unauthorized or fraudulent use or access.
h) Principle of confidentiality: All persons involved in the Processing of Personal Data are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that comprise the Processing, and may only provide or communicate Personal Data when it corresponds to the development of the activities authorized by law.

IV. AUTHORIZATION

Taking into account that the Company's databases have been collected since 2017 and has many Data Holders, in order to guarantee the access of all of them to this Policy and to make effective the exercise of the right to Habeas Data by them, the Company implemented the following measures to make known to the Data Holders the Processing of their Personal Data and the conditions under which such Processing takes place and carried out the following steps:

a) "Privacy Notice" was published on the Company's website and at the Company's facilities.
b) A link was published from the corporate portal www.alkohotel.com, where users can view the contents of this Policy. The portal can be viewed in 100% of the national territory and from all browsers.
c) A notice was published in the company's facilities, which contains the contents of this Policy.
As of this date, the Company, at the time of collecting Personal Data, will request authorization from the Data Controllers, informing them of the specific purposes of the Processing for which such consent is obtained.
The authorization of the Data Subjects may be expressed by any of the following means: (i) in writing, (ii) orally or (iii) through unequivocal conduct that allows to reasonably conclude that the authorization was granted.
The Company shall keep proof of such authorizations in an appropriate manner, respecting the principles of confidentiality and privacy of information.
In accordance with the provisions of Article 10 of Law 1581 of 2012, this authorization shall not be necessary when dealing with: (i) Information required by a public or administrative entity in the exercise of its legal functions or by court order; (ii) Public Data; (iii) Cases of medical or health emergency;
(iv) Processing of information authorized by law for historical, statistical or scientific purposes; and (v) Data related to the Civil Registry of Persons.

V. PURPOSES OF THE PROCESSING
The Personal Data of the Data Controllers are collected, stored, used, and exceptionally, put into circulation, by the Company in the development of its corporate purpose, in order to:
(a) Provide its products and/or services.
b) Inform about changes in its products and/or services.
c) To achieve an efficient communication related to its products, services, offers, alliances, studies, contests, contents, as well as those of its related companies, and to facilitate general access to their information.
d) Evaluate the quality of its products and/or services.
e) To carry out marketing campaigns to offer discounts or promotions of its own products or services or those of third parties.
f) Prepare market studies.
g) Prepare statistical studies.
h) To carry out commercial agreements, events or institutional programs, directly or in association with third parties.
i) Verify data through consultation of public databases or credit bureaus.
j) Send information about activities developed by the Company or send information considered of interest through different means.
k) To comply with the legal obligations of information to the administrative entities, as well as to the competent authorities that require it.
l) Share with third parties that collaborate with the Company and that for the fulfillment of their functions must have access to some extent to the information.
m) Support the Company's auditing processes.
n) To guarantee the correct execution of the contract entered into with the Personal Data Subject.
o) To comply with the obligations contracted with its customers, suppliers and employees.
p) To correctly execute the Company's corporate purpose.
Any other purpose that may result from the development of the contract or commercial or labor relationship existing between the Company and the Data Subject.
The information provided by the Holder, will only be used for the purposes stated herein and once the need for the processing of Personal Data ceases, they must be removed from the Company's databases, unless by law they must be retained, or filed in secure terms in order to only be disclosed when required by law.

The Company, within its corporate purpose and in order to develop the aforementioned activities, collects from its Owners information regarding their Personal Data, such as: Name, address, telephone, identity document, e-mail, employment data, family data, academic data, medical data, financial data, among others. The above is justified because INVERSIONES NEGOCIOS Y SERVICIOS S.A.S., is a company whose main corporate purpose is to develop business and activities.
Sustainability: https://www.alkohotelboutique.com/es-es/sostenibilidad

INVERNESER SAS, is committed to comply with the Sectoral Technical Standard NTS-TS 002 through the sustainability policy that achieves:

• Mitigate the negative environmental impacts generated by its operation.
• Promote responsible behavior with the natural environment among its suppliers, collaborators and customers.
• Promote and conserve the cultural heritage of the regions and destinations it markets.
• Reject commercial sexual exploitation of children and adolescents in its operations.
• To hire locally based collaborators and suppliers under fair and equitable conditions in accordance with market availability and current applicable legislation.
• We have designed the following sustainability programs to comply with our sustainability policy:
Efficient use of water.
• Energy saving.
• Integral waste management.
• Maintenance.
• Training.
• Socio-cultural and economic.

Legislation:
Traffic in cultural heritage
LAW 397 OF 1997
Culture is the set of distinctive, spiritual, material, intellectual and emotional traits that characterize human groups and that includes, beyond arts and letters, ways of life, human rights, value systems, traditions and beliefs.

2. Culture, in its various manifestations, is the foundation of nationality and an activity proper to Colombian society as a whole, as a process generated individually and collectively by Colombians. These manifestations constitute an integral part of Colombian identity and culture.

3. The State shall promote and stimulate cultural processes, projects and activities within a framework of recognition and respect for the diversity and cultural variety of the Colombian Nation.

4. In no case shall the State exercise censorship over the form and ideological and artistic content of cultural achievements and projects.

5. It is the obligation of the State and of individuals to value, protect and disseminate the Cultural Heritage of the Nation.

6. The State guarantees to the ethnic and linguistic groups, to the Black and Raizal communities and to the indigenous peoples the right to conserve, enrich and disseminate their identity and cultural heritage, to generate knowledge of them according to their own traditions and to benefit from an education that ensures these rights.

The Colombian State recognizes the specificity of the Caribbean culture and shall provide special protection to its diverse expressions.

7. The State shall protect Spanish as the official language of Colombia and the languages of the indigenous peoples and the Black and Raizal communities in their territories. Likewise, it shall promote the strengthening of the Amerindian and Creole languages spoken in the national territory and shall commit itself to the respect and recognition4 of these languages in the rest of society.

8. Economic and social development shall be closely linked to cultural, scientific and technological development. The National Development Plan shall take into account the National Culture Plan formulated by the Government. Public resources invested in cultural activities shall have, for all legal purposes, the character of public social expenditure.

9. Respect for human rights, coexistence, solidarity, interculturalism, pluralism and tolerance are fundamental cultural values and an essential basis for a culture of peace.

10. The State shall guarantee free research and shall encourage research talent within the parameters of quality, rigor and academic coherence.

11. The State shall promote the creation, expansion and adaptation of artistic and cultural infrastructure and shall guarantee access to it for all Colombians.

12. The State shall promote the interaction of national culture with universal culture.

13. The State, in formulating its cultural policy, shall take into account both the creator, the manager and the receiver of culture and shall guarantee the access of Colombians to cultural manifestations, goods and services on an equal opportunity basis, giving special treatment to persons with physical, sensory or mental limitations, the elderly, children and youth, and the neediest social sectors.

Article 2 - The role of the State in relation to culture. The functions and services of the State in relation to culture shall be fulfilled in accordance with the provisions of the preceding Article, taking into account that the primary objective of the State policy on the matter is the preservation of the Cultural Heritage of the Nation and the support and encouragement to individuals, communities and institutions that develop or promote artistic and cultural expressions at the local, regional and national levels.

Article 3º.- The Ministry of Culture will coordinate the action of the State for the formation of the new citizen as established by articles 1 to 8 of Law 188 of 1995, National Development Plan.

Fauna and Flora Trafficking
LAW 17 OF 1981 AND RESOLUTION 1367 OF 2000
All trade in specimens of species included in Appendix I shall be carried out in accordance with the provisions of this article.

2. The export of any specimen of a species included in Appendix I shall require the prior granting and presentation of an export permit, which shall only be granted once the following requirements have been met:

a. That a scientific authority of the State of export has advised that such export will not be detrimental to the survival of such species.

b. That an administrative authority of the State of export has verified that the specimen was not obtained in contravention of the legislation in force in that State on the protection of its fauna and flora.

c. That a Management Authority of the State of export has verified that any living specimen will be conditioned and transported in a manner that minimizes the risk of injury, damage to its health or mistreatment.

d. That a Management Authority of the State of export has verified that an import permit for the specimen has been granted.

3. The import of any specimen of a species included in Appendix I shall require the prior grant and presentation of an import permit and an export permit or re-export certificate. The import permit shall only be granted after the following requirements have been met:

a. That a scientific authority of the State of import has stated that the purpose of the import will not be detrimental to the survival of that species.

b. That a scientific authority of the State of import has verified that the proposed recipient of a live specimen will be able to house and care for it adequately.

c. That a Management Authority of the State of import has verified that the specimen will not be used for primarily commercial purposes.

4. The re-export of any specimen of a species included in Appendix I shall require the prior grant and presentation of a re-export certificate which shall only be granted upon satisfaction of the following requirements.

a. That a Management Authority of the State of re-export has verified that the specimen was imported into that State in accordance with the provisions of this Convention.

b. That a Management Authority of the State of re-export has verified that any living specimen will be so prepared and transported as to minimize the risk of injury, damage to health, or mistreatment.

c. That a Management Authority of the State of re-export has verified that an import permit for any living specimen has been granted.

5. The introduction from the sea of any specimen of a species included in Appendix I shall require the prior grant of a certificate issued by a Management Authority of the State of introduction. A certificate shall only be granted after the following requirements have been met:

a. That a scientific authority of the State of introduction has stated that the introduction will not be detrimental to the survival of that species.

b. That a Management Authority of the State of introduction has verified that the proposed recipient of a live specimen will be able to house and care for it adequately.

c. A Management Authority of the State of introduction has verified that the specimen will not be used for primarily commercial purposes.

• Sexual exploitation of minors
• LAW 679 OF 2001
• The purpose of this law is to dictate protection measures against exploitation, pornography, sexual tourism and other forms of sexual abuse with minors, through the establishment of preventive and sanctioning norms, and the issuance of other provisions in development of article 44 of the Constitution.
• In addition to the infractions foreseen in article 71 of Law 300 of 1996, the providers of tourist services may be subject to administrative sanctions, without prejudice to criminal sanctions, when they incur in any of the following conducts:
• 1. Using advertising that expressly or surreptitiously suggests the provision of sexual tourism services with minors.
• 2. Providing information to tourists, directly or through their employees, about places from where sexual services with minors are coordinated or where they are provided.
• 3. To lead tourists to establishments or places where prostitution of minors is practiced.
• 4. Driving minors, directly or through their employees, to places where tourists are staying, even if they are located at sea, for the purpose of prostitution of minors.
• 5. Renting or using vehicles on tourist routes for the purpose of prostitution or sexual abuse of minors.
• 6. Allowing minors to enter hotels or places of lodging and lodging, bars, similar businesses and other tourist establishments for purposes of prostitution or sexual abuse of minors.

Discrimination or acts of racism
LAW 1752 OF 2015 AND LAW 1482 OF 211.
The law aims to criminally punish acts of discrimination for reasons of race, ethnicity, religion, nationality, political or philosophical ideology, sex or sexual orientation, disability and other reasons of discrimination.