Data processing

In accordance with Statutory Law 1581 of 2012 on Data Protection and Decree 1377 of 2013, the user is informed that once he or she gives his or her authorization, the data recorded on our platform will be incorporated into a database that will be under the responsibility of www.laplayitaislafuerte.com

1. OBJECTIVE

Promote by LA PLAYITA DE LA ISLA SAS, identified with NIT 901.032.850-1, an adequate management in the protection of Personal Data in compliance with the provisions of Law 1581 of 2012 "By which general provisions are dictated for the protection of personal data" and Decree 1377 of 2013, "By which Law 1581 of 2012 is partially regulated."

In consideration of the above, LA PLAYITA DE LA ISLA SAS formulates the following Personal Data Processing Policy, which is mandatory for the recipients of this.

2. SCOPE

This Policy will apply to the Processing of Personal Data carried out in Colombian territory, or when the regulation is applicable to the Controller and/or Data Processor located outside of Colombian territory, by virtue of international treaties, contractual relationships, etc.

The principles and provisions contained in this policy will apply to the Databases that contain personal information and that are under the custody of LA PLAYITA DE LA ISLA SAS, either as Controller and/or as Data Processor.

All organizational processes of LA PLAYITA DE LA ISLA SAS that involve the Processing of Personal Data must be subject to the provisions of this document.

3. POLICY MANAGERS

This Policy is mandatory and must be strictly complied with by the following persons:

• Legal representatives of LA PLAYITA DE LA ISLA SAS

• Workers of LA PLAYITA DE LA ISLA SAS

• Contractors and third parties acting on behalf of LA PLAYITA DE LA ISLA SAS or providing services to it, under any type of contractual modality, by virtue of which there is Processing of Personal Data.

• Shareholders and auditors.

• Other persons established by law.

Failure to comply with this Policy will result in labor, criminal or civil sanctions, as the case may be.

4. DEFINITIONS

In accordance with current legislation on the matter, the following definitions are adopted:

• Owner: natural person whose Personal Data is subject to Processing.

• Authorization: Prior, express and informed consent of the Owner to carry out the Processing of Personal Data.

• Database: Organized set of Personal Data that is subject to Processing.

• Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons.

• Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to the civil status of individuals, their profession or occupation, and their status as a merchant or public servant. By its nature, public data may be contained in, among others, public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality.

• Sensitive Data: Sensitive data is understood to be data that affects the privacy of the Data Subject or whose misuse may lead to discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life and biometric data.

• Data Processor: Natural or legal person, public or private, who by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller.

• Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the Database and/or the Processing of Personal Data.

• Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

• Transfer: The transfer of Personal Data takes place when the Controller and/or Processor of Personal Data, located in Colombia, sends the information or Personal Data to a recipient, who in turn is the Controller of the Processing and is located within or outside the country.

• Transmission: Processing of Personal Data that involves the communication of the same within or outside the territory of the Republic of Colombia when its purpose is to carry out Processing by the Processor on behalf of the Controller.

• Privacy Notice: Verbal or written communication generated by the Data Controller, addressed to the Owner for the Processing of his/her Personal Data, through which he/she is informed about the existence of the Information Processing policies that will be applicable to him/her, the way to access them and the purposes of the Processing that is intended to be given to the Personal Data.

5. PRINCIPLES

In accordance with current legislation on the matter, the following principles are adopted:

• Principle of Legality in the Processing of Personal Data: The Processing of Personal Data in Colombia is a regulated activity and therefore the business processes and recipients of the regulation must be subject to the provisions thereof.

• Principle of Freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal Data may not be obtained, processed or disclosed without prior Authorization, or in the absence of a legal or judicial mandate that waives consent.

• Principle of Purpose: The Treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Owner in a specific, precise and prior manner so that he/she may express his/her informed consent.

• Principle of Truthfulness or Quality: The information subject to Processing must be truthful, complete, accurate, up-to-date, verifiable and understandable. The Processing of partial, incomplete, fractional or misleading Personal Data is prohibited.

• Principle of Transparency: In the Processing, the right of the Owner to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of data that concerns him/her must be guaranteed.

• Principle of Restricted Access and Circulation: Processing is subject to the limits arising from the nature of the Personal Data, the provisions of the law and the Constitution. In this regard, Processing may only be carried out by persons authorized by the Owner and/or by the persons provided for by law.

• Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties in accordance with the provisions herein.

• Security Principle: The information subject to processing by the Data Controller or Data Processor referred to in the law must be handled with the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

• Confidentiality Principle: All persons involved in the Processing of Personal Data that are not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks that comprise the Processing has ended, and may only provide or communicate Personal Data when this corresponds to the development of the activities authorized by law and under the terms thereof.

6. DUTIES OF THE RECIPIENTS OF THE POLICY

The duties of the recipients of this Policy are those stated below, without prejudice to any additional duties imposed by Law 1581 of 2012 and Decree 1377 of 2013:

6.1. When is the Controller of Personal Data?

a. Guarantee the Owner, at all times, the full and effective exercise of the right to habeas data, that is, to know, update or rectify his/her Personal Data.

b. Request and retain, under the conditions provided in this Policy, a copy of the respective Authorization granted by the Owner.

c. Inform the Data Subject in a clear, sufficient and prior manner about the purpose of the information provided.

d. Collect only Personal Data that is relevant and appropriate for the purpose for which it is collected.

e. Process queries and complaints made under the terms set out in this Policy.

f. Observe the principles set forth in this Policy.

g. Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.

h. Update the information, communicating in a timely manner to the Data Processor all new developments regarding the Personal Data that you have previously provided and adopt the other measures necessary to ensure that the information provided to the Data Processor remains up to date.

i. Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.

j. Provide the Data Processor, as applicable, only with Personal Data whose Processing has been previously authorized.

k. Demand that the Data Processor respect the security and privacy conditions of the Owner's information at all times.

l. Process queries and complaints made under the terms set out in this Policy.

m. Adopt an internal manual of policies and procedures to ensure the proper processing of Personal Data in accordance with the provisions applicable to the subject matter in question, as well as the instructions issued in this regard by the Superintendency of Industry and Commerce.

n. Inform the Data Processor when certain information is being disputed by the Owner, once the claim has been submitted and the respective process has not been completed.

o. Inform the Data Subject, upon request, about the use given to his/her Personal Data.

p. Inform the Personal Data Protection Authority when security codes are breached and there are risks in the management of the information of the Holders.

q. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

6.2 When You Are The Controller Of Personal Data

a. Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.

b. Keep the information under the security conditions necessary to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.

c. Timely update, rectify or delete Personal Data in accordance with the terms of this law.

d. Update the information reported by the Data Controllers within five (5) business days from receipt.

e. Process queries and complaints made by the Owners.

f. Adopt an internal manual of policies and procedures to ensure the proper processing of Personal Data in accordance with the provisions applicable to the subject matter in question, as well as the instructions issued in this regard by the Superintendency of Industry and Commerce.

g. Register the legend “claim in process” in the Database in the manner regulated by law.

h. Insert into the Database the legend “information under judicial discussion” once notified by the competent authority about judicial proceedings related to the quality of the Personal Data.

i. Refrain from circulating information that is being disputed by the Owner and whose blocking has been ordered by the Superintendency of Industry and Commerce.

j. Allow access to information only to people who can access it.

k. Inform the Superintendency of Industry and Commerce when security code violations occur and there are risks in the management of the information of the Holders.

l. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

7. RIGHTS OF PERSONAL DATA OWNERS

a. To know, update and rectify your Personal Data with regard to the Data Controllers or Data Processors. This right may be exercised, among others, with regard to partial, inaccurate, incomplete, fragmented data that may lead to error, or data whose processing is expressly prohibited or has not been authorized.

b. Request proof of the Authorization granted to the Data Controller, except when it is expressly excepted as a requirement for the Treatment (cases in which Authorization is not necessary).

c. Be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been given to your Personal Data.

d. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add to or complement it.

e. Revoke the Authorization and/or request the deletion of Personal Data when the Processing does not respect the constitutional and legal principles, rights and guarantees.

f. Access free of charge to your Personal Data that have been subject to Processing.

8. LEGITIMATION FOR THE EXERCISE OF THE RIGHTS OF THE OWNER

The rights of the Holders may be exercised by the following persons:

a. By the Owner, who must sufficiently prove his/her identity through the various means made available to him/her by the Data Controller.

b. By their successors in title, who must prove such status.

c. By the representative and/or agent of the Owner, upon prior accreditation of the representation or power of attorney.

d. By stipulation in favor of another or for another.

e. The rights of children and adolescents shall be exercised by persons authorized to represent them.

9. PERSONS TO WHOM THE PERSONAL DATA OF THE OWNER MAY BE PROVIDED

a. To the Holders, their successors in title or their legal representatives.

b. To public or administrative entities in the exercise of their legal functions or by court order;

c. To third parties authorized by the Owner or by law.

10. PURPOSES OF THE TREATMENT

In compliance with the Principle of Purpose, the Processing of Personal Data by LA PLAYITA DE LA ISLA SAS, as controller or person in charge of this, will be governed by the following parameters:

10.1. Personal Data Related to Human Resource Management

a. Before the contractual relationship.

LA PLAYITA DE LA ISLA SAS collects, stores, consults, uses and processes the information and Personal Data of the candidates for employment, informing them in advance of the rules applicable to the Processing of Personal Data that they provide. In any case, the purpose of the delivery of the Personal Data is limited to their participation in the selection process and subsequent traceability, so their use for different purposes is prohibited.

The information provided by candidates for a vacant position at LA PLAYITA DE LA ISLA SAS will remain stored for a period of five (5) years from the date of the last Treatment, to comply with the applicable provisions in administrative, accounting, fiscal, legal and historical matters of the information and any other legal obligation.

The Personal Data and information obtained from the selection process regarding the selected workers or contractors will be stored by LA PLAYITA DE LA ISLA SAS under strict security measures.

b. During and after termination of the contractual relationship.

LA PLAYITA DE LA ISLA SAS collects, stores, consults, uses, shares, exchanges, transmits, transfers, circulates and processes the personal information that its employees have provided for the purpose of executing and developing the employment contract, as well as applying the legislation, jurisprudence and regulations on labor, social security, occupational risks, granting benefits to the employee and their beneficiaries and any other purpose that is necessary for the proper performance of the employee-employer relationship. LA PLAYITA DE LA ISLA SAS also stores, uses, shares, exchanges, transmits, transfers, circulates and processes the information and Personal Data of retired employees, pensioners, related third parties, family groups, beneficiaries and other persons who have or have had an employment contract with LA PLAYITA DE LA ISLA SAS

LA PLAYITA DE LA ISLA SAS will store the Personal Data of its employees in a folder identified with the name of each of them. Access to this folder is limited to the Human Resources Department and the Legal Department of LA PLAYITA DE LA ISLA SAS, with the sole purpose of managing the contractual relationship.

The information will remain stored physically or in electronic media, following the provisions of article 264 of the Substantive Labor Code, or stored for the maximum term necessary to comply with the legal and/or contractual obligations under our responsibility, especially in accounting, contractual, fiscal and tax matters.

10.2. Personal Data of Suppliers

LA PLAYITA DE LA ISLA SAS collects, stores, consults, uses, shares, exchanges, transmits, transfers, circulates and processes the personal information that its suppliers have provided as part of the acquisition process of the goods or services supplied to LA PLAYITA DE LA ISLA SAS, before, during and after the contractual relationship.

LA PLAYITA DE LA ISLA SAS will collect the Personal Data of the provider's employees whenever this is necessary for security reasons in accordance with the nature of the contracted service.

10.3. Personal Data of Clients

a. Processing and rectification of information necessary to process reservations at LA PLAYITA DE LA ISLA SAS

b. Updating or correcting information during your stay at LA PLAYITA DE LA ISLA SAS

c. Offering, entering into and executing contracts for accommodation and any other service related to the guest's travel experience at LA PLAYITA DE LA ISLA SAS

d. Offering, celebration and execution of banquet and hall rental contracts within the facilities of LA PLAYITA DE LA ISLA SAS

e. Control and prevention of fraud, money laundering and terrorist financing.

f. Preparation of market and statistical studies.

g. Sending information or offering services associated with the corporate purpose of LA PLAYITA DE LA ISLA SAS

h. Sending offers and/or commercial or service communications to the physical or email address indicated in the data registration forms completed by the guest.

i. Contact with the guest by telephone, for notification of offers and/or commercial or service communications

j. Sending satisfaction surveys to find out the quality of the services provided by LA PLAYITA DE LA ISLA SAS

The Holder of Personal and/or Sensitive Data authorizes LA PLAYITA DE LA ISLA SAS to transfer his/her personal information to its parent companies, subsidiaries and affiliates, as well as to any other company of LA PLAYITA DE LA ISLA SAS

10.4. Personal Data of the Community in General

The collection of Personal Data of natural persons that LA PLAYITA DE LA ISLA SAS carries out in the development of its corporate purpose will be subject to the provisions of this Policy.

11. INTERNATIONAL TRANSFER OF PERSONAL DATA

The transfer of personal data to countries that do not provide adequate levels of protection of personal data is prohibited. Safe countries are those that comply with the standards set by the Superintendence of Industry and Commerce.

Notwithstanding the foregoing, Transfer is exceptionally permitted when:

• The Owner of the Personal Data has expressly and unequivocally authorized it.

• Bank or stock transfers, in accordance with the applicable legislation.

• Transfers agreed upon within the framework of international treaties to which Colombia is a party, based on the principle of reciprocity.

• Transfers necessary for the execution of a contract between the Owner and the Data Controller.

• Transfers legally required to safeguard the public interest or to recognise, exercise or defend a right in a judicial process.

12. PERSON OR AREA RESPONSIBLE FOR THE PROTECTION OF PERSONAL DATA

The commercial management will ensure compliance with this Policy within LA PLAYITA DE LA ISLA SAS and will process the requests of the Owners, who can be contacted at the email info@laplayitaislafuerte.com to exercise the rights referred to in Law 1581 of 2012, Decree 1377 of 2013 and this Policy.

13. TEMPORALITY OF PERSONAL DATA

The permanence of the Personal Data in the information systems of LA PLAYITA DE LA ISLA SAS will be determined by the purpose of the Processing. Once the purpose has been exhausted, LA PLAYITA DE LA ISLA SAS will proceed to its destruction or return, unless the law imposes an obligation to retain it for a longer period, for which the Document Retention Table of the area responsible for data processing will be taken into account.

14. INFORMATION SECURITY

In the handling of information, the guarantees and confidentiality imposed by the Colombian Political Constitution, the regulations on the protection of personal data and other concordant and complementary regulations will be maintained. For these purposes, LA PLAYITA DE LA ISLA SAS has adopted the legally required levels of security for the protection of personal data, installing the necessary technical and organizational measures to prevent the loss, misuse, adulteration, consultation, unauthorized or fraudulent use or access, and theft of the data provided.

LA PLAYITA DE LA ISLA SAS is not responsible for any consequences arising from improper access by third parties to its web pages, or for any technical failure in its operation. Likewise, it does not assume responsibility for inaccurate data or typographical errors that may be contained in the content uploaded to the network by the administrator of the portal.

15. HANDLING QUERIES

The User of the information provided may exercise at any time the rights granted to him/her by Article 8 of Law 1581 of 2012, which include requesting information; knowing, updating, rectifying and requesting the deletion of his/her personal data; and requesting proof of the authorization granted and revoking it. Notwithstanding the foregoing, personal data must be retained when required for the fulfillment of a legal or contractual obligation, in accordance with Law 1581 of 2012, its regulatory decrees and other regulations that complement or modify it.

The User who does not wish to be contacted after providing his/her information or personal data must:

1. Express such decision when filling out the data collection forms.

2. When you receive information via email, you can unsubscribe from the contact list by clicking on the secure subscription link, which will be clearly indicated.

3. Expressly request your decision not to receive further information by contacting the email address info@laplayitaislafuerte.com with the subject “unsubscribe”.

The area responsible for channeling requests regarding data protection at LA PLAYITA DE LA ISLA SAS is the Customer Service area, which will be responsible for providing personalized attention to all Users and Information Holders.

16. DATA OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

Name: THE BEACH OF SAS ISLAND

Tax ID: 901.032.850-1,

Address: La Playita, Puerto Limon, Fuerte Island

Email: info@laplayitaislafuerte.com

This Policy was last updated on July 18, 2023