Privacy policy

Data Controller: GRUPO HOTELERO EL MIRADOR SAS NIT: 900643828

General principles and postulates

GRUPO HOTELERO EL MIRADOR SAS respects the legal system and individual rights and therefore adopts this Information Processing Policy, which aims to establish guidelines to guarantee the right to Habeas Data of all natural persons whose data are collected by GRUPO HOTELERO EL MIRADOR SAS at any time as a result of fulfilling its corporate purpose. The information will be processed in accordance with the principles of freedom, legality, purpose, accuracy, transparency, restricted access and circulation, security, confidentiality, proportionality, temporality, and good faith; thus providing appropriate mechanisms to delete personal information when the data subject so requests.

Applicable regulations

These policies were prepared based on the regulatory provisions set out in Article 15 of the Political Constitution of Colombia, Law 1581 of 2012, and the Single Regulatory Decree 1074 of 2015.

Scope of application

This policy applies to personal data collected by virtue of the operations of GRUPO HOTELERO EL MIRADOR SAS, which include the provision of services and the distribution of its own products and those of third parties.

Definitions

The following definitions are provided in order to clarify the scope of this policy and the applicable regulatory framework.

a. Authorization:

Prior, express, and informed consent given by the data subject to carry out the Processing of Personal Data.

b. Privacy notice:

Verbal or written communication generated by the controller and addressed to the data subject for the processing of their personal data. This document informs you of the existence of the information processing policies that will apply to your information and how you may access them.

c. Database:

An organized set of personal data that is subject to processing.

d. Personal data:

Any information linked to or that may be associated with one or more identified or identifiable natural persons.

e. Public data:

Data classified as such under the mandates of the law or the Political Constitution, and data that are not semi-private, private, or sensitive. Public data are those that may be obtained without any restriction.

f. Private data:

Data that, due to its intimate or reserved nature, is only relevant to the data subject.

g. Sensitive data:

Sensitive data are understood to be those that affect the data subject’s privacy or whose improper use may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or organizations that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life, and biometric data.

h. Processing:

Any action on personal data such as collection, storage, or use.

i. Data processor: A natural or legal person, public or private, who, on their own behalf or in association with others, carries out the processing of personal data.

j. Data controller A natural or legal person, public or private, who, on their own behalf or in association with others, makes decisions regarding personal data databases.

k. Data subject: A natural person whose personal data are subject to processing.

Processing to which personal data will be subject

In the course of its corporate purpose, GRUPO HOTELERO EL MIRADOR SAS will process any personal data collected by the company in a responsible manner.

Such processing will depend on the purposes for which the various personal data were provided, which in turn depend on the nature of the relationship through which the data subject is linked to GRUPO HOTELERO EL MIRADOR SAS (commercial, employment, or other). Based on the foregoing, the data subjects’ personal data will be collected, stored, used, and/or deleted for any of the following purposes:

• Internal statistics management
• Management of sanctions, reprimands, warnings, exclusions
• Granting and management of permits, leave, and authorizations
• Profile analysis
• Timekeeping
• Staff training
• Payroll management
• Human resources management
• Matters related to the Comprehensive Social Security System
• Occupational risk prevention
• Employment promotion and management
• Staff promotion and management
• Video surveillance
• Those aimed at maintaining an adequate flow of communication with the data subject
• Customer loyalty
• Statistical purposes
• Administrative, customer, collections and payments, invoicing, supplier, economic, accounting, and tax management.
• Maintaining records of business relationships
• Marketing
• Opinion surveys, commercial prospecting
• Own advertising
• Distance selling
• Incoming and outgoing document log

In addition to the foregoing, GRUPO HOTELERO EL MIRADOR SAS, may process the personal data in the above databases for any other related purpose necessary for the proper development of the company’s corporate purpose, as well as for compliance with its legal and contractual obligations.

The above purposes may be modified in accordance with the business dynamics of GRUPO HOTELERO EL MIRADOR SAS in the development of its corporate purpose.

In any case, the purposes of personal data processing will be the material limit thereof; therefore, GRUPO HOTELERO EL MIRADOR SAS, will not use the data subject’s personal data for purposes other than those stated, unless the data subject expressly authorizes it. Likewise, GRUPO HOTELERO EL MIRADOR SAS, undertakes to inform the data subject, as soon as possible, of any modification regarding the processing to which their personal data are subject. This is so that the data subject may exercise the rights recognized by law and under this policy.

In any case, it must be taken into account that personal data will be processed only for as long as is strictly necessary to fulfill the purpose for which the information was provided. GRUPO HOTELERO EL MIRADOR SAS will delete personal data whose life cycle has already been completed, without needing to obtain the data subject’s authorization for this. When it has not previously advised otherwise, GRUPO HOTELERO EL MIRADOR SAS will notify the data subject of the data to be deleted, of the cessation of its status as data controller in respect of such data, indicating the reason for this.

Authorization for the processing of personal data

The collection, circulation, and use of personal data that GRUPO HOTELERO EL MIRADOR SAS requires in the course of its operations requires the free, prior, and informed consent of the data subject. GRUPO HOTELERO EL MIRADOR SAS, as the controller of such data, has the necessary mechanisms to obtain authorization from data subjects, which is fully verifiable.

Granting of authorization

In accordance with Law 1581 of 2012, authorization will be obtained prior to the collection and processing of personal data; the procedures to which your data will be subject and the purposes for which they will be used will also be communicated.

The main tool used by GRUPO HOTELERO EL MIRADOR SAS to obtain the respective authorizations from personal data subjects is a written communication, which may be sent by electronic or physical means, ensuring in all cases that there is evidence that the data subject has consented to provide such authorization.

In any case, the existence of the aforementioned form does not exclude the possibility that, depending on the particularities of the case, GRUPO HOTELERO EL MIRADOR SAS may use the other means provided for by DUR 1074 of 2015 to obtain such authorizations, namely “orally or through unequivocal conduct by the data subject that reasonably allows one to conclude that authorization was granted.” (Article 7).

Along the same lines, under the provisions of DUR 1074 of 2015, the following are authorized to exercise the data subject’s rights and therefore to provide the corresponding authorizations for the processing of personal data:

• The data subject
• Their successors in title
• The data subject’s representative or attorney-in-fact
• A third party unrelated to the data subject, through the mechanism of “stipulation in favor of another,” in accordance with the regulation contained in Article 1506 of the Civil Code.

In all cases, authorizations, regardless of the means by which they are obtained, will be made in accordance with the minimum requirements demanded by DUR 1074 of 2015, that is, stating the purposes for which personal data are being collected and will be processed.

Verification and proof of authorization

Personal data subjects may, while GRUPO HOTELERO EL MIRADOR SAS remains the controller of such data, request evidence of the authorization they have provided.

To this end, in accordance with document management rules, GRUPO HOTELERO EL MIRADOR SAS, will digitize all authorizations granted using the physical form adopted by the company. Data subjects who wish to obtain a copy must submit the corresponding request based on the provisions set out in the section on the procedure for exercising the rights contained in this policy. This will be the applicable procedure for cases in which authorizations were granted by non-written means.

Cases in which authorization is not required

In accordance with the applicable regulations, GRUPO HOTELERO EL MIRADOR SAS, will not request authorization for the processing of personal data under the following circumstances:

1) When the data processed are public in nature, including data related to the Civil Registry of persons.

2) In cases of medical or health emergencies.

3) When the processing of information has been authorized by law for historical, statistical, or scientific purposes.

In the processing that the above companies may carry out of the personal data transferred to them, they will be governed by the Information Processing Policy that each of them has adopted, provided that it does not conflict with this policy.

In the event of a conflict between different information processing policies, this Information Processing Policy shall prevail; failing that, the criteria set out in Law 1581 of 2012 and any rules that develop, supplement, or amend it shall be applied.

Rights of data subjects

GRUPO HOTELERO EL MIRADOR SAS, in its capacity as controller of personal data processing, recognizes the following rights for all data subjects whose information is being processed by the company:

• To know, update, and rectify your personal data with GRUPO HOTELERO EL MIRADOR SAS
• To request proof of the authorization granted to GRUPO HOTELERO EL MIRADOR SAS
• To be informed by GRUPO HOTELERO EL MIRADOR SAS, upon request, about the use that has been made of your personal data.
• To file complaints with the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012, once you have exhausted the consultation or complaint procedure with GRUPO HOTELERO EL MIRADOR SAS,, as set out in the section “Procedure for the Exercise of Data Subjects’ Rights” of this policy.
• To revoke authorization and/or request deletion of the data when, in the processing, constitutional and legal principles, rights, and guarantees are not respected.
• To access, free of charge, your personal data that have been subject to processing.

Area responsible for exercising data subjects’ rights

GRUPO HOTELERO EL MIRADOR SAS has designated as responsible for handling requests related to the exercise of the rights recognized for data subjects whose information is being processed by the company the person holding the position of MANAGER. This will be done via the email address reservas@hotelelmiradordearboletes.com. For this purpose, the responsible party will strictly follow the procedure adopted in this policy so that data subjects may exercise their rights to know, update, rectify, and delete data and to revoke authorization, by submitting petitions, inquiries, and complaints.

Procedure for exercising data subjects’ rights

All personal data processors of GRUPO HOTELERO EL MIRADOR SAS must strictly follow the procedure below when a data subject’s personal data are recorded in any of the company’s databases.

Contact channels

GRUPO HOTELERO EL MIRADOR SAS, has established the following contact channels for data subjects

to exercise their rights:

• Website: www.hotelelmiradordearboletes.com
• Email: reservas@hotelelmiradordearboletes.com

Inquiries

Data subjects or their successors in title, acting on their own or through an attorney-in-fact, may inquire about the information that is held in the databases managed by GRUPO HOTELERO EL MIRADOR SAS. Data subjects must prove their identity by attaching a copy of their national ID to the written request they submit. Successors in title must prove such status by attaching the civil birth registry of the deceased and the successor, the civil death registry, and a copy of their identity document. Status may also be proven by a copy of the deed opening the succession proceedings, the order recognizing the heirs, or a copy of the will, always submitting their identity document.

Attorneys-in-fact must submit a copy of the power of attorney granted, which will be presumed authentic, and a copy of their identity document.

Once GRUPO HOTELERO EL MIRADOR SAS, receives the information request, it will review the individual record corresponding to the data subject’s name and the identity document number provided. If it finds any discrepancy between these two data points, it will inform the requester within five (5) business days of receipt so that the requester may clarify it.

If, after reviewing the document provided and the data subject’s name, it is found that they match, a response will be provided within ten (10) business days.

If GRUPO HOTELERO EL MIRADOR SAS, considers that it requires more time to respond to the inquiry, it will inform the data subject of this situation and will respond within a period not exceeding five (5) business days following the expiration of the initial term.

Complaints

The data subject or their successors in title who consider that the information contained in a database managed by GRUPO HOTELERO EL MIRADOR SAS should be corrected, updated, or deleted, or who notice non-compliance by the company or any of its processors, may file a complaint with GRUPO HOTELERO EL MIRADOR SAS or the processor.

The complaint must be submitted to GRUPO HOTELERO EL MIRADOR SAS, exclusively by email sent to reservas@hotelelmiradordearboletes.com, accompanied by the document identifying the data subject, a clear description of the facts giving rise to the complaint, the address where you wish to receive notifications (physical or electronic), and the documents you intend to rely on.

Successor-in-title and attorney-in-fact status must be proven as explained in the previous section.

If the complaint is incomplete, the interested party will be required within five (5) days following receipt of the complaint to correct the deficiencies.

If two (2) months elapse from the date of the request without the applicant providing the required information, it will be understood that the complaint has been withdrawn.

If GRUPO HOTELERO EL MIRADOR SAS, or the processor to whom it is addressed, is not competent to resolve it, it will forward it to the appropriate party within a maximum of two (2) business days and will inform the interested party of the situation.

GRUPO HOTELERO EL MIRADOR SAS, will use a single email address for these purposes so that it is possible to identify when the matter is forwarded and the corresponding response or confirmation of receipt. If GRUPO HOTELERO EL MIRADOR SAS does not know the person to whom it should be forwarded, it will immediately inform the data subject, copying the Superintendence of Industry and Commerce.

Once the complete complaint has been received, the corresponding database must include, in the observation field of the tables EMPLOYEES, CUSTOMERS, SUPPLIERS, or SYSTEMS, the note “complaint in process”; this must occur within a maximum of two (2) business days.

The maximum term to respond to the complaint is fifteen (15) business days. If it is not possible to do so within this term, the interested party will be informed of the reasons for the delay and the date on which it will be addressed, which may not exceed eight (8) business days following the expiration of the initial term.

Complaints to the Superintendence of Industry and Commerce

The data subject, successor in title, or attorney-in-fact must first exhaust this inquiry or complaint procedure with the information controller before approaching the Superintendence of Industry and Commerce to file a complaint.

Special provisions

Data deletion: Data deletion will not proceed when:

• The data subject has a legal or contractual duty to remain in the database.
• Data deletion hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions.
• The data are necessary to protect the data subject’s legally protected interests; to carry out an action in the public interest; or to comply with a legally acquired obligation of the data subject.

Revocation of authorization:

Personal data subjects may revoke authorization for the processing of their personal data, in whole or in part, at any time, provided that this is not prevented by a legal or contractual provision.

To do so, in the request the data subject must indicate the reason for requesting revocation and the type of withdrawal, whether total or partial, with respect to a specific purpose. In cases where, by contractual provision between the data subject and GRUPO HOTELERO EL MIRADOR SAS, revocation is not permitted, the obligation that gave rise to the authorization must first be terminated.

Processing of sensitive data and data of children and adolescents

In principle, GRUPO HOTELERO EL MIRADOR SAS will not process personal information that, in accordance with the definitions incorporated in this policy, is considered SENSITIVE DATA. However, if any data that may be classified within these categories should eventually become subject to processing, GRUPO HOTELERO EL MIRADOR SAS will use them exclusively for any of the following purposes:

• Processing is necessary to safeguard the data subject’s vital interest and the data subject is physically or legally incapacitated. In these events, the legal representatives of the latter must grant authorization.
• Processing relates to data necessary for the recognition, exercise, or defense of a right in judicial proceedings.
• Processing has a historical, statistical, or scientific purpose. In this event, measures must be adopted to remove the data subjects’ identity.

In any case, with regard to the collection of sensitive personal data from data subjects, GRUPO HOTELERO EL MIRADOR SAS will inform them that providing such data is voluntary, and their processing will be subject to the data subject’s express authorization for such purposes.

Likewise, the processing of personal data of children and adolescents will always be subject to the express authorization of their legal representative.

Prior to processing and the granting of authorization by the latter, GRUPO HOTELERO EL MIRADOR SAS, will allow the child or adolescent whose data will be processed to express their agreement with the processing, in light of its purposes. This activity will not be applicable when, pursuant to Article 10 of Law 1581 of 2012, the information of the child or adolescent

1. a) Is required by a public or administrative entity in the exercise of its legal functions or by court order;
2. b) Corresponds to data of a public nature;
3. c) Is obtained in cases of medical or health emergencies;
4. d) Is related to their Civil Registry.

Information security and confidentiality measures

Based on the security principle of Law 1581 of 2012 and in order to comply with its provisions, GRUPO HOTELERO EL MIRADOR SAS has implemented a set of automated and administrative practices to prevent unauthorized access, tampering, or loss of the personal data collected.

These consist of restricted access to the physical files located on the company’s premises, which are safeguarded by a mechanical security device. This role limits possible access within the system and the functions (administration, configuration, consultation, deletion, etc.) that each user will have.

Information Security Incidents

An information security or personal data security incident is considered to have occurred when, accidentally or intentionally, the data have not been properly processed or the security measures have been breached, in accordance with this document.

GRUPO HOTELERO EL MIRADOR SAS, as the controller of personal data processing, must report the incident(s) on the platform provided for this purpose by the Superintendence of Industry and Commerce. In addition, GRUPO HOTELERO EL MIRADOR SAS will assess the impact and relevance of the incident and, together with the processors of each database, will determine how the situation will be handled in order to prevent future incidents.

Final provisions

GRUPO HOTELERO EL MIRADOR SAS may make changes or updates to the policies, which will remain in force as determined by management or by legal or administrative provision; in all cases informing personal data subjects of the modifications.

Current national legislation

It is important to reiterate that the activities related to the processing of personal data carried out by GRUPO HOTELERO EL MIRADOR SAS, are regulated by the Superintendence of Industry and Commerce. Likewise, in this same matter, Law 1581 of 2012, DUR 1074 of 2015, and, as applicable, Law 1266 of 2008 regarding financial and credit data and consultation and reporting to credit bureaus will apply, as well as any other rules that regulate, supplement, or amend them.

Effective date of the processing policy

This Information Processing Policy began to be developed in the month MONTH and was published on # MONTH 2025, as version 1.0.