Grand Sirenis Cartagena in Cartagena, Official Website

Privacy Policy

1. Objective – Responsible for Data Processing

This Policy sets forth the way in which HOTEL KARMAIRÍ CARTAGENA DE INDIAS / VILLA CALAMARY S.A.S. identified with TIN. 901.828.566-1, as the party responsible for the data, processes the personal data of its employees, clients, users/visitors of its web pages, suppliers and contractors, allies and third parties in general.

In order to guarantee the protection of personal data, including the right of the data subjects to know, update and rectify the data contained in the databases, VILLA CALAMARY S.A.S. informs that its registered address is Anillo Vial Manzanillo del Mar Km 3 - 750, in the city of Cartagena, Colombia, with email protecciondedatoskarmairi@oxohotel.com and phone number (57 605) 6549210.

This Policy reflects the requirements of Colombian law and professional responsibility for the way in which VILLA CALAMARY S.A.S. collects, stores and uses the personal data it manages.

2. Scope

This Policy regulates all the organizational processes of VILLA CALAMARY S.A.S. that involve the processing of personal data, and seeks to inform in general all the people who have provided, or who in the future will provide their personal data to VILLA CALAMARY S.A.S., about the Policy that is applicable to all the databases and personal data contained in them.
This Policy was developed based on the provisions contained in articles 15 and 20 of the Political Constitution, Law 1581 of 2012 ‘By which general provisions are issued for the protection of personal data’ and its regulatory decrees compiled in Decree 1074 of 2015 Sole Regulatory Decree of the Industry, Commerce and Tourism sector.
3. Legal Framework
The following is the legal framework that regulates the processing of personal data in the Republic of Colombia.
a) The Political Constitution of the Republic of Colombia, Article 15
b) Law 1266 of 2008.
c) Law 1581 of 2012
d) Decree 1727 of 2009
e) Decree 2952 of 2010
f) Decree 1377 of 2013
g) Decree 1074 of 2015 Sole Regulatory Decree of the Commerce, Industry and Tourism sector
h) Decree 2157 of 2021
i) Any regulation that repeals, complements, modifies or adds to the legislation in force regarding the exercise of the right to Habeas Data and the protection of personal data
4. Definitions
For the purposes of this Policy, the following terms shall have the following meanings:
● Authorization: Prior explicit and informed consent from the data subject in order to carry out the processing of personal data.
● Privacy Notice: Verbal or written communication issued by VILLA CALAMARY S.A.S. addressed to the data subject for the processing of their personal data, informing them of the existence of this Policy for the handling and processing of personal data of VILLA CALAMARY S.A.S., how to access it and the purposes of the processing of personal data by the company.
The privacy notice is used only in the event that VILLA CALAMARY S.A.S. is unable to make this Policy available to the public.

● Database: Organized set of personal data that is subject to processing.

● Personal Data: Any data related or that can be associated to one or several determined individuals.

● Publicly Available Personal Data: Data that is neither semi-private, nor private, nor sensitive, and which by its nature may be found in public records, public documents, official gazettes, official bulletins and/or duly executed court rulings that are not subject to confidentiality.
Publicly available data includes, among others, data related to the civil registry of individuals, their profession or trade and/or their status as merchants or public employees.

● Confidential Personal Data: It is the data that is only relevant to its subject.

● Non-sensitive Personal Data: Data whose knowledge or disclosure may be of interest to the data subject and to a certain sector or group of people.

● Sensitive Personal Data: Data that might affect the privacy of the data subject or whose misuse may result in discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or those that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life and biometric data.

● Party in Charge of Processing: Individual or legal entity, public or private, that by itself or in association with others, carries out the Processing of personal data on behalf of the Party Responsible.

● Party Responsible for the Data: Individual or legal entity, public or private, that by itself or in association with others, decides on the database and/or the processing of the data.

● Data Subject: Individual whose personal data is the subject of processing.

● Processing: Any action or set of actions taken over personal data, such as collection, storage, use, distribution or deletion.

● Transfer: It occurs when the Party Responsible, located in Colombia, sends personal data to a third party recipient, located within or outside the country, and which in turn becomes the Party Responsible for the Data.

● Transmission: It occurs when the Party Responsible for the Data that is located within or outside the country, shares personal data for its processing by the Party in Charge of the Processing located within or outside the country.

5. Principles

a) Principle of Legality in Data Processing: Data processing is a regulated activity that must be subject to the provisions of the law and other provisions that implement it.

b) Principle of Purpose: Processing must be carried out for a legitimate purpose in accordance with the Constitution and the law, which the Data Subject must be informed of.

c) Principle of Freedom: Processing may only be carried out with the prior explicit and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent.

d) Principle of Veracity or Quality: The data subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fragmented or misleading data is prohibited.

e) Principle of Transparency: The data subject has the right to obtain information about their data at any time, without restriction, from the party responsible for it or the one in charge of its processing, in accordance with the applicable regulations.

f) Principle of Restricted Access and Distribution: Processing is bound by the limits derived from the nature of the personal data, the law and the Constitution. In this sense, the processing may only be done by persons authorized by the data subject and/or by persons authorized by law; Personal data, except for public information, shall not be available on the Internet or other means of distribution or mass communication, unless access is technically controllable to provide restricted knowledge only to data subjects or authorized third parties.

g) Principle of Security: The data subject to processing by the party responsible for it or in charge of its processing shall be handled with the technical, human and administrative measures necessary to ensure the security of the records, avoiding their adulteration, loss, unauthorized or fraudulent consultation, use or access.

h) Principle of Confidentiality: All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the data, even after the end of their participation in any of the tasks involved in the processing, and may only provide or communicate personal data when it corresponds to the performance of the authorized activities.
6. Information About the Party Responsible for the Data

Legal Name: VILLA CALAMARY S.A.S.
Address: Anillo Vial Manzanillo del Mar Km 3 – 750, Cartagena
E-mail: protecciondedatoskarmairi@oxohotel.com
Phone: (57 605) 6549210
Website: https://www.oxohotel.com

The Responsible Party may appoint a third party to manage the hotel unit or the hotel and its business in its capacity as operator. The third party may enter into and execute all necessary and inherent acts related to the commercial activities of the ordinary course of business of the hotel.

7. Processing and Purpose of Personal Data.

VILLA CALAMARY S.A.S. carries out the processing of personal data with the main objective of fulfilling its functions, always acting in accordance with the purposes set forth in the Law that regulates its operation, in this Policy and in the authorizations previously and expressly granted by the data subjects.

In order to carry out such purposes, VILLA CALAMARY S.A.S. may collect, use, share and store the personal data of the data subjects.

In any case, if necessary, at the time of collection of personal data by VILLA CALAMARY S.A.S., the purposes for the specific processing will be informed to the data subject prior to the granting of their authorization.

a. Publicly Available Data Processing

It is possible that VILLA CALAMARY S.A.S. processes personal data that is publicly available without the prior authorization of the Data Subject, collecting it from public records, public documents, gazettes, official bulletins and/or duly executed court rulings.

This situation does not imply that the necessary measures are not adopted to ensure compliance with the principles and obligations under Law 1581 of 2012 and its regulatory decrees.

b. Processing of Personal Data in the Management and Operation of Hotels

VILLA CALAMARY S.A.S. may use the personal data in order to offer a service appropriate to meet the needs of the hotels whose management and operation has been entrusted to it, within the framework of the law 1581 of 2012 and regulatory standards.

c. Processing of Guests’ Personal Data

VILLA CALAMARY S.A.S. may carry out the processing of the personal data of its customers for the purposes of engaging and providing professional services contracted by them. In this sense, they will be processed within the framework of the object of the services contracted by the guest, in order to comply with the business relationship entered into with this, consisting of the collection, storage, use, distribution, transmission or deletion of these data from our databases for the following purposes: Administrative management, administrative procedures, customer loyalty, booking management, internal statistics management, opinion surveys, collection and payment management, billing management, economic and accounting management, tax management, marketing, commercial prospecting, data update campaigns, data transmission and/or transfer, information queries, processing that in any case falls within the following activities:

Establish a smooth, current and constant communication in relation to services, products, promotions, programming and everything related to the corporate purpose. To carry out marketing, promotion and/or advertising activities of its own or of third parties repeatedly in accordance with the provisions of Law 2300 of 2023, sales, billing, collection, schedules, market intelligence, service improvement, verifications and consultations, control, behavior, habit, and enabling of means of payment, fraud prevention, as well as any other related to the products and services, current and future, for the fulfillment of the contractual obligations and the corporate purpose, which users and/or clients expressly authorize to be sent through any means of communication, virtual, social networks, mail, voice, SMS, instant messaging applications and any other that is developed for the massive or personal sending of information in accordance with the provisions of Law 2300 of 2023 and Law 1581 of 2012, that is, unless they indicate that they do not authorize any of the indicated channels.

Evaluate the quality of products and services, and conduct studies on consumption habits, preference, purchase interest, product testing, concept, service evaluation, satisfaction and others related to services and products. Carry out everything that is necessary to comply with the obligations inherent to the contracted services and products. Comply with the obligations contracted with customers, users, suppliers, partners, subsidiaries, distributors, subcontractors, outsourcing and other public and/or private third parties, directly or indirectly related to the corporate purpose of the company.

Inform about changes in products and services related to the ordinary course of business of the company. The data provided by the booking holder may be processed, collected, stored, used, circulated, deleted, shared, updated, transmitted, in accordance with the terms and conditions of the above Privacy Policies as applicable, mainly to enable the provision of its services, for reports to control and surveillance authorities, and also use for administrative, commercial and advertising purposes and contact with the data subjects.

VILLA CALAMARY S.A.S. may transfer or share the personal contact data of the data subjects with allied companies, for the purpose of sending them commercial information of all types of products and services through e-mails, text messages and phone calls in accordance with the provisions of Law 2300 of 2023.

The data related to the payment method is used to request the collection authorization from the respective entities. Therefore, the data provided in the portal by users and/or customers such as personal data, card number, expiration dates, at no time is stored or recorded. Confidentiality agreements are subscribed in any remission of this type of data to a third party and authorized entity, and the users and/or clients authorize this processing.

Due to the security applicable to the gateway, no data related to credit and/or debit cards, or any other electronic means of payment will ever be stored or saved, for which reason the guest and/or user is obliged to enter all the data related to the card or means of payment he/she will use, each time he/she makes a transaction on the gateway.

d. Processing of Personal Information in the Commercial and Marketing Operations

VILLA CALAMARY S.A.S. may use the personal data collected, as well as the data received from the managed hotels for the following purposes:

a) To offer the data subjects newsletters, promotions and special offers, as well as to share other marketing messages such as surveys, draws and contests.
b) Store it in VILLA CALAMARY S.A.S. physical and/or digital databases.
c) Conduct commercial prospecting and analysis of commercial preferences.
d) Perform administrative management.
e) Offering goods and services.
f) Keep it for statistical and historical purposes and / or keep them to comply with legal obligations in terms of storage of data.
g) Respond to requests, complaints and/or claims, as well as the requirements of authorities in the exercise of their functions.
h) Send communications and advertising of VILLA CALAMARY S.A.S. by digital, physical means or text messages.

The communications may be made through e-mail, physical mail, online advertisements, telephone calls, text messages (including SMS and MMS), and other means, unless explicitly stated that any of the above channels is not authorized in accordance with the provisions of Law 2300 of 2023.

This data will be stored physically and digitally in the database(s) created for the purposes required for its collection, which are within the internal database inventory of VILLA CALAMARY S.A.S., and its processing will be carried out:

i. For the time during which the purposes for which it was collected are still in effect; and/or
ii. For the time during which the contractual relationship remains in force; and/or
iii. For as long as the legal accounting and archiving obligations of VILLA CALAMARY S.A.S. remain in force.

e. Processing of Personal Data of Candidates and Employees

Via the different channels of communication or the documents provided for this purpose, through which the selection process is initiated and/or the labor relationship is formalized, personal data of candidates interested in working at VILLA CALAMARY S.A.S. and/or its employees is collected and stored.

This data is provided directly by the data subjects and processed in accordance with this Policy, within the contextual framework of Law 1581 of 2012 and its regulations, as well as under the purposes enshrined in the authorizations granted, among which are the following:

a) To carry out promotion and personnel selection processes.
b) Verify the data related to the educational level and work experience with the work and personal references provided by the same data subject and/or through public and/or private sources.
c) Conduct psycho-technical tests, knowledge tests, security studies, home visits, medical examinations and other activities aimed at validating the candidate's profile; carry out the processes and activities related to hiring and management of employment relationships.
d) Train employees.
e) Conduct administrative and/or disciplinary investigations when necessary.
f) Comply with legal obligations in terms of affiliations to the social security system, accounting and archiving of data.
g) Share them with third parties in charge of the processing for the exercise of these same purposes authorized by the data subject.
The data provided by active workers, including that of their family group and beneficiaries, shall remain stored physically, in electronic media or other means available for the term indicated by labor and accounting regulations.
The data provided by applicants or candidates to become employees of VILLA CALAMARY S.A.S. and that is collected in the course of the selection process, has the purpose of proceeding with the i) verification, comparison, evaluation of labor and personal skills of the prospects with respect to the selection criteria of VILLA CALAMARY S.A.S.; ii) schedule interviews and application of tests to applicants; evaluate directly or through third parties the selection tests of the applicants; iii) report the overall results of the selection process; iv) consult and evaluate all the data about the applicant for the position that is stored in the databases of judicial or security backgrounds legitimately constituted, of state or private, national or foreign nature and in any case, the data will be eliminated from the data systems of VILLA CALAMARY S.A.S. when such applicants or candidates are not selected by VILLA CALAMARY S.A.S. and/or when for any reason a work contract is not entered into with it.

f. Processing of Personal Data of Suppliers and Contractors

Via the different channels of communication or the documents provided for this purpose, through which the linking of suppliers and contractors is formalized, personal data is collected and stored from the suppliers that provide their services to VILLA CALAMARY S.A.S.

VILLA CALAMARY S.A.S. uses the personal data collected particularly from its contractors in order to carry out activities related to human management and payroll processes, control management of their daily activities within the company, as well as to comply with payments and legal, accounting and registration obligations.

This data is provided directly by the data subjects or their legal representatives, and is processed in accordance with this Policy within the contextual framework of Law 1581 of 2012 and regulatory standards, under the purposes set forth in the authorizations granted.

In the event that the data of suppliers and contractors correspond to legal entities, although they are not considered personal data under national legislation, VILLA CALAMARY S.A.S. will treat them under all security and confidentiality measures.

Suppliers and contractors, when authorizing by any means the use of their data, accept that VILLA CALAMARY S.A.S. uses, keeps, transfers, collects, stores and uses their data with the following purposes:

a) To perform all activities related to the selection, contracting and evaluation of suppliers.
b) Enter your data into VILLA CALAMARY S.A.S.'s supplier database.
c) Verify the financial, legal and commercial feasibility of an eventual commercial relationship, and/or to maintain a current relationship.
d) Verify the data provided by suppliers and contractors, potential and/or contracted, before credit bureaus, private and/or public sources, and other lists considered pertinent to verify their suitability.
e) Execute and/or comply with contractual obligations.
f) Comply with legal obligations in accounting and archiving of data.
g) Deliver data to governmental or judicial entities that require it.
h) Provide support in external and internal auditing processes.
i) Share them with third parties in charge of the processing for the exercise of these same purposes authorized by the data subject.

a) For the time during which the purposes for which it was collected are still in effect; and/or
b) For the time during which the contractual relationship remains in force; and/or
c) For as long as the legal accounting and archiving obligations of VILLA CALAMARY S.A.S. remain in force.

g. Treatment of Personal Data in Customer Service Operations

For the process of Customer Service and attention to requests, complaints and claims VILLA CALAMARY S.A.S. collects and stores personal data of its customers / potential customers and third parties in general.

The data received by the company is delivered by the data subjects and will be treated in accordance with this policy, within the contextual framework of law 1581 of 2012 and law 1755 of 2015 (regulating the fundamental right to petition) and its regulatory standards, as well as under the purposes enshrined in the authorizations granted by the data subject, these being the following:

a) To process the request, complaint or claim.
b) Respond to requests from authorities in the exercise of their functions.
c) Generate biannual reports in response to the legal obligations that must be fulfilled by VILLA CALAMARY S.A.S.
d) Keep it for statistical, historical or control purposes.

This data will be stored in the database(s) generated for the purposes that its collection requires, and its processing will be continued as long as the purposes of its collection and knowledge are maintained.

h. Processing of Sensitive Data

VILLA CALAMARY S.A.S., in the normal development of its operations, does not process sensitive data; however, in case it is imperative to do so (as is the treatment of medical disabilities of its employees and contractors), it will have the corresponding authorizations, prior to having informed the data subject: i) That it is not obliged to authorize the processing of sensitive data. ii) That it is optional to answer questions that deal with sensitive data. iii) The sensitive data to be processed. iv) The processing and the purposes thereof.

This data will be stored in the database(s) created for the purposes that its collection requires, and its processing will be maintained as long as the purposes of its collection and/or the legal obligation to maintain the storage of such data is maintained, with the understanding that VILLA CALAMARY S.A.S. may not condition any activity to the provision of sensitive personal data unless it is absolutely necessary for the corresponding activity.

i. Photographic or Video Image Processing
VILLA CALAMARY S.A.S., as part of its welfare and marketing activities, takes photographs and/or videos of its employees and/or clients.

These images are collected with prior explicit authorization of the data subject, or of the legal representative in case the data subject is a minor, to collect, use, store in its physical and/or digital databases, and in general to carry out the processing of the photographic and/or video image, with the purpose of:

a. Use it in commercial campaigns and/or publications, social networks, newsletters, internal or external communications, media, photographic works, audiovisual or advertising pieces, or through any other means known or to be known for informational, advertising and institutional purposes, both in print and digital media.
b. Reproduce it through various internal or external, physical or digital media.
c. Share it with third party suppliers or allies, located inside or outside the Colombian territory, in order to comply with the purposes mentioned in the previous points.
d. To attend petitions, complaints and/or claims; as well as requirements of authorities in the exercise of their functions.
e. To store it for control and historical purposes.

“Image” means the total figure, physiognomy of the body and/or face and/or any other physical characteristic that allows to establish the identity of the data subject.

These images will be stored in the database(s) generated for the purposes that their collection requires, and their processing will be maintained as long as the purposes of their collection and/or the obligations related to the control of activities carried out are maintained.

j. Processing of Personal Data of Minors

VILLA CALAMARY S.A.S. does not normally collect or process data from minors. However, in case of doing so and in compliance with the personal data protection regulations in force in Colombia, it will have all the guarantees so that minors can exercise their right to freedom of expression, free development of personality and data.

Thus, in the event that data must be obtained about minors, its provision by the legal representative or guardian of the minor will be optional.

VILLA CALAMARY S.A.S. reserves the possibility of bringing to the attention of the authorities situations that, in its opinion, may endanger the integrity of a minor.

This data will be stored in the database(s) generated for the purposes that its collection requires, and its processing will be maintained as long as the purposes of its collection and knowledge are maintained.

k. Processing of Personal Data of Website Users
VILLA CALAMARY S.A.S. collects through the contact channels available on its web page www.oxohotel.com personal data of those who are interested in establishing contact with VILLA CALAMARY S.A.S. These channels are composed of a registration and personal data collection form, as well as an authorization checkbox through which the data subjects give VILLA CALAMARY S.A.S. their consent for their personal data to be processed.

This data will be disclosed to the data subject, to third parties with the express authorization of the data subject, or when requested by a Competent Authority.

The purposes for which these personal data are used are:

a) To process the request, complaint or claim included in the message of the web contact form;
b) Send information from VILLA CALAMARY S.A.S., from allied companies, or that which is considered of interest, for commercial and marketing purposes, via email, text messages (SMS), instant messaging tools or by phone to the contact phone number provided.
c) To meet the requirements of authorities in the exercise of their functions.
d) Keep it for statistical and historical purposes and/or to comply with legal obligations regarding the conservation of data and documents.
e) Conduct surveys of knowledge and satisfaction of the service provided.
This data will be stored digitally in the database(s) generated for the purposes required for its collection, which are within the inventory of internal databases of VILLA CALAMARY S.A.S., and its processing will be carried out:

a) For the time during which the purposes that led to its collection are maintained; and/or
b) For the time that the relationship between the data subject(s) and VILLA CALAMARY S.A.S. remains in force; and/or
c) For as long as the legal obligations of VILLA CALAMARY S.A.S. that led to the collection, storage and processing of this personal data remain in force; among others, in accounting, tax, commercial and/or data filing matters.

l. Data Processing in Video Surveillance Systems

VILLA CALAMARY S.A.S. also has security cameras in its facilities, through which your personal image will be recorded every time you visit the facilities. Only the Security Department of VILLA CALAMARY S.A.S. will have access to these images in case of violation or suspicion of violation of the security measures implemented.
The personal images of the people who visit our facilities will be recorded in our DVR for a period of thirty (30) days and then will be automatically deleted. VILLA CALAMARY S.A.S. will only use the personal data in order to guarantee the security of entry to the facilities, register visitors and carry out administrative or criminal investigations in those cases in which this is necessary for security reasons. In the event that a crime is detected, the images may be extracted and kept for a longer period of time and will be shared only by order of a competent authority or for security purposes of the entity.

m. Processing by Party in Charge of Processing
VILLA CALAMARY S.A.S. in the exercise of its corporate purpose may rely on third parties that collaborate with the execution of its activities, and to that extent will instruct them so that the collection and processing of personal data, whatever it may be, is always preceded by all relevant authorizations and has all the necessary security and confidentiality measures according to its nature.
However, in case of breach of the obligations by such third parties, the obligation will not be assumed by the company, which acts as a third party in good faith, so that its actions will always be based on the conviction that such third parties have the necessary authorizations to process the data in accordance with the purposes for which it is delivered and keep the data on which it acts as party in charge of the processing under special security and confidentiality measures, in accordance with legal and contractual guidelines.

n. Third Party Data

The data received by VILLA CALAMARY S.A.S. through sources such as managed hotels, commercial allies and third parties in general will be collected taking into account Law 1581 of 2012 and other rules that regulate this matter. Likewise, the use given to this data will be within the purposes authorized by the data subjects and the activity of VILLA CALAMARY S.A.S.

If the third party provides THE BLOCK or its service providers with personal data relating to other persons, that third party declares that it has the authority to do so and permits the information to be used in accordance with this Privacy Policy.

On the other hand, the website, messages or documents of VILLA CALAMARY S.A.S. may contain information or links to third party sites. In such a case, VILLA CALAMARY S.A.S. shall not be responsible for the collection, use, maintenance, distribution or disclosure of data and information by such third parties. If the data subject provides information on third party sites and uses such sites, the privacy policy and terms of use of such sites shall apply.

8. Purposes of Data Processing

In each case of collection of personal information by VILLA CALAMARY S.A.S., the purposes for the specific processing will be informed to the data subject prior to the granting of his or her authorization. However, all purposes will be included within the following:

● Providing services as a hotel operator.
● Marketing and advertising activities including promotional offers, periodic customer satisfaction surveys, market research, commercial prospecting activities and customer profiling.
● Sending information about products, services, promotions, events, prizes, alliances and offers of the hotels operated by VILLA CALAMARY S.A.S.
● Carrying out all activities related to the management of the contractual relationship with employees, collaborators or contractors that VILLA CALAMARY S.A.S. may have with the data subjects.
● Activities related to the selection of personnel, study of resumes, verification of data provided by the candidate, application of psycho-technical and knowledge tests
● Labor and social welfare activities with the collaborators.
● Attention and processing of requests, complaints, queries and claims made by current or potential customers.
● Activities such as accounting and financial management regarding information providers.

In no case will VILLA CALAMARY S.A.S. alienate or deliver this information to a third party, other than:

● Operated hotels that require it for the proper development of their activities.
● Hotel service providers on behalf of VILLA CALAMARY S.A.S.
● Service providers on behalf of VILLA CALAMARY S.A.S.

It should be noted that the information will not be shared with these third parties unless it is necessary for the proper fulfillment of the stated purposes, this based on contracts or hotel management agreements, transmission or transfer of data. VILLA CALAMARY S.A.S. may perform statistical, historical and marketing analysis based on the personal data processed, in which case it may deliver the results to third parties, but in doing so, it will not provide personal data without the authorization of the data subjects.

9. Obligations of the Party Responsible for the Data

VILLA CALAMARY S.A.S. as the party responsible for the data shall comply with the following obligations, without prejudice to the other provisions set forth in Law 1581 of 2012 and others that govern its activity:

a. Guarantee the data subject, at all times, the full and effective exercise of the right of Habeas Data.
b. Request and keep, under the conditions provided by law, a copy of the respective authorization granted by the data subject.
c. Duly inform the data subject about the purpose of the collection and the rights they are entitled to by virtue of the authorization granted.
d. Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
e. Guarantee that the information provided to the party in charge of the processing is truthful, complete, accurate, updated, verifiable and understandable.
f. Update the data, communicating in a timely manner to the party in charge of the processing, all changes regarding the data previously provided and take other necessary measures to ensure that the information provided to them is kept up to date.
g. Rectify the data when it is incorrect and communicate the pertinent to the party in charge of the processing.
h. Provide to the party in charge of the processing, as the case may be, only data whose processing is previously authorized in accordance with the provisions of the law.
i. Require the party in charge of the processing at all times to respect the conditions of security and privacy of the data subject's data.
j. Process queries and claims submitted in accordance with the terms set forth in the law.
k. Adopt an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, for the handling of queries and claims.
l. Inform the party in charge of the processing when certain information is under discussion by the data subject, once the claim has been filed and the respective process has not been completed.
m. Inform at the request of the data subject about the use given to their data.
n. Inform the data protection authority when there are violations to the security codes and there are risks in the management of the data subjects' data.

10. Rights of Data Subjects

In accordance with the provisions of Article 8 of Law 1581 of 2012, the data subject shall have the following rights:

a. To know, update and rectify their personal data before VILLA CALAMARY S.A.S. as the party responsible for the data. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading data, or those whose processing is explicitly prohibited or has not been authorized.
b. Request proof of the authorization granted to VILLA CALAMARY S.A.S. except when expressly exempted as a requirement for the processing, in accordance with the provisions of Article 10 of the law.
c. To be informed by VILLA CALAMARY S.A.S., as the party responsible for the data, upon request, regarding the use given to their personal data;
d. File complaints before the Superintendence of Industry and Commerce for violations of the provisions of the law on protection of personal data and the other rules that modify, add or complement it.
e. To revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the processing. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that, in the processing, VILLA CALAMARY S.A.S. as the party responsible for the processing has incurred in conduct contrary to law and the Constitution.
f. To have access free of charge to their personal data that has been subject to processing.

The rights of the data subjects may be exercised by the following persons:

● By the Data Subject, who must prove his or her identity sufficiently by the different means made available to him or her by VILLA CALAMARY S.A.S., which, for the purpose may maintain mechanisms for validation of the information.
● By their assignees, who will have to prove such quality.
● By the representative and/or attorney-in-fact of the Data Subject, prior accreditation of the representation or power of attorney.

The Data Subject may exercise their right to know, update, rectify or delete their Personal Data and revoke the consent given to VILLA CALAMARY S.A.S. for the processing of their personal data by contacting the email protecciondedatoskarmairi@oxohotel.com with the internal Privacy Officer in charge of responding.

11. Area Responsible for the Exercise of the Rights of the Data Subjects

The administrative area of VILLA CALAMARY S.A.S. will be responsible for attending to the petitions, complaints and claims made by the data subject in exercise of the rights contemplated in numeral 9 of the present policy. For such purposes, the data subject or whoever exercises its representation may send its request, complaint or claim from Monday to Friday from 8:00 a.m. to 5:00 p.m. to the email protecciondedatoskarmairi@oxohotel.com or call the service helpline at the telephone number (605) 6549210 or file it at the following address: Anillo Vial Manzanillo del Mar Km 3 - 750, in the city of Cartagena, Colombia.

12. Procedures for the Attention of Petitions, Complaints and Claims

VILLA CALAMARY S.A.S. through the Privacy Officer, will attend all requests, queries, complaints and / or claims of the data subject, related to the rights established by law to know, update, rectify and delete their personal data. In accordance with Article 14 of Law 1581 of 2012, queries will be answered within a maximum period of ten (10) working days from the date of receipt.

When it is not possible to attend the consultation within said term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term.

If the data subjects or their assignees consider that the information contained in a database of VILLA CALAMARY S.A.S. is subject to correction, updating or deletion, or if they consider that the company is not complying with its obligations established in Law 1581 of 2012, the data subjects may file a complaint addressed to the Privacy Officer, which will be processed under the following rules:

a. The claim shall be submitted by means of a request addressed to the Party Responsible for the Data, with the identification of the Data Subject, the description of the facts that lead to the claim, the address, and accompanied by the documents that are intended to be used. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to fix the mistakes. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned.

In the event that the person who receives the claim is not competent to decide it, it will be transferred to the corresponding person within a maximum term of two (2) business days. The interested party will be informed of the situation.

b. Once the complete claim has been received, a legend will be included in the database stating “claim in progress” and the reason for the claim, within a term no longer than two (2) business days. Said legend shall be maintained until the claim is decided.

c. The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the claim within that term, the interested party will be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first term.

13. Authorizations and Consent

The collection, storage, use, distribution or deletion of personal data by VILLA CALAMARY S.A.S., requires prior free, express and informed consent of the data subject.
a. Methods for Granting Authorization

The authorization may be stated in a physical or electronic document, text message, voice recordings, internet, web sites, or by means of a suitable technical or technological mechanism that allows to express or obtain the consent via click or double click, or in any other format that allows to guarantee its subsequent consultation.
b. Authorization for Processing of Sensitive Data

When it comes to the collection of sensitive data, the following requirements must be met:

- The authorization must be explicit.
- The data subject must be informed that they are not obliged to authorize the processing of such data unless it is absolutely necessary for the provision of VILLA CALAMARY S.A.S. services.
- The data subject must be informed explicitly and in advance which of the data to be processed is sensitive and the purposes of the processing.

c. Proof of Authorization

VILLA CALAMARY S.A.S. will use the mechanisms it currently has, and will implement and adopt the necessary actions to maintain records or technical or technological mechanisms suitable for the conservation of the authorization of the data subjects for the processing of their personal data. To comply with the above, physical files or electronic repositories may be established directly or through third parties contracted for this purpose.

d. Revocation of Authorization

Data subjects may revoke their consent to the use and processing of their personal data at any time, as long as it is not prevented by a legal or contractual provision. The revocation may be partial or total, which is why the scope of the revocation must be clarified by the data subject at the time of requesting the revocation.

e. Authorization to Process Data of Minors

In the case of the collection and processing of data of minors, the following requirements must be complied with:

- Authorization must be granted by individuals who are authorized to represent the minor. The minor's representative must guarantee the right to be heard and assess their opinion of the process, taking into account their maturity, autonomy and capacity to understand the matter.
- Notice should be given that this data is an optional response.
- The processing must respect the best interests of the minor and ensure respect for their fundamental rights.

f. Instances in Which Authorization Is Not Required
The authorization of the data subject will not be necessary when it concerns:
a. Information required by a public or administrative entity in the exercise of its legal functions or by court order
b. Data of a public nature
c. Cases of medical or health emergency
d. Processing of data authorized by law for historical, statistical or scientific purposes
e. Data related to the Civil Registry of Persons
In any case, the processing of personal data that do not require prior authorization will be carried out in compliance with all the provisions included in the law.

14. Request of Judicial or Administrative Authorities

For the provision of data to judicial or administrative authorities, the Constitutional Court's ruling C-748 of 2011 must be followed:

• The public or administrative entity must justify its request indicating the link between the need to obtain the data and the fulfillment of its constitutional or legal functions.
• Secondly, with the delivery of the data, the public or administrative entity will be informed that it has the duty to comply with the obligations and requirements imposed by Law 1581 of 2012, as the party responsible for the data, or in charge of its processing in certain cases.
• The receiving administrative entity must comply with all legal mandates that exist for the date of receipt of the data, especially the principles of purpose, legitimate use, restricted distribution, confidentiality and security.

15. Databases

VILLA CALAMARY S.A.S. stores the personal data it collects for the purposes mentioned in this Policy and in the respective authorizations, in physical and/or digital databases, which are identified within an internal inventory generated in compliance with the Principle of Demonstrated Responsibility.

In case of being an obliged subject under the provisions of the Superintendence of Industry and Commerce, VILLA CALAMARY S.A.S. will register the databases on which it acts as party responsible before the National Registry of Databases, as well as the monthly, semi-annual and/or annual reports that may be required.

The databases, as well as the data contained therein, will be available in accordance with the execution of the activities for which they were collected, and in accordance with the processing and storage parameters informed in the previous paragraph and the execution of the rights of the data subjects in the manner mentioned below.

16. Safety Measures

Pursuant to the principle of security established in the current regulations on privacy and protection of personal data, VILLA CALAMARY S.A.S. will adopt the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

In particular, all VILLA CALAMARY S.A.S. employees, contractors and those in charge of the use of personal data that are not of a public nature, are obliged at all times to guarantee the confidentiality of the data.

17. National and International Transfer and Transmission of Personal Data.

In the case that VILLA CALAMARY S.A.S. carries out the international transfer or transmission of personal data, in addition to having the explicit and unequivocal authorization of the data subject, the company will make sure to sign a contract or agreement with the party responsible for the data that is located outside the national territory, and that the country to which the data is transferred or transmitted, provides adequate levels of data protection, according to the list of countries considered as safe harbors established by the Superintendence of Industry and Commerce in its Sole Circular.

18. Restrictions on Use of this Policy

This Policy is for the exclusive use of VILLA CALAMARY S.A.S., therefore, its copy, reproduction, distribution, transfer, publication and/or translation is forbidden, for security reasons and in order to respect intellectual property, as a creation protected by national and international legislation.

19. Policy Effective Date

This policy is effective as of February 2023 and in any case VILLA CALAMARY S.A.S. may collect, store, use or circulate personal data during the time that is reasonable and necessary, according to the purposes that justified the processing, taking into account the provisions applicable to the subject in question and the administrative, accounting, fiscal, legal and historical aspects of the data.

Once the purpose or purposes of the processing have been fulfilled, and notwithstanding any legal provisions to the contrary, the personal data in its possession shall be deleted. However, personal data must be retained when required for compliance with a legal obligation or contractual obligation.

20. Amendments

This Policy may be amended by VILLA CALAMARY S.A.S. in accordance with Decree 1377 of 2013.

Any substantial change will be communicated in a timely manner to the data subjects in an efficient manner, no later than the time when the new policy is implemented.