Viajes Mar Business and Tourism SASlegally constituted business company for Simplified Shares, withNIT 900.586.716-4domiciled in theCalle 11 #22 – 23 CC Puerta Grande Local  C-112, Bogota, complying with the rules contained in theLaw 1581 of 2012, in Decree 1377 of 2013and in the other concordant regulations by which general provisions are issued for the protection of personal data, and in view of its capacity as Responsible for the Processing of Personal Data in accordance with the aforementioned regulations, it is allowed to publicize this Privacy Policy and Protection of Personal Data (hereinafter the "Policy") to regulate the collection, storage, treatment, administration, transfer, transmission, protection and deletion of information received from the owners of personal data or from third parties through the different data collection channels that it has arranged in the development of its activities.

Definitions

In accordance with the concepts and criteria of theStatutory Law 1581 of 2012 and regulatory decree 1377 of 2103and/or for the purposes of this Policy, the words that are defined below will have the meaning assigned in this chapter, whether or not they are written in capital letters, or that they are in the plural or singular, they will be developed and applied under a systematic and comprehensive interpretation established in the aforementioned regulations.

Yo)Notice of Privacy:Verbal or written communication generated by the Responsible Party, addressed to the Owner for the Processing of their personal data, through which they are informed about the existence of the Information Processing policies that will be applicable to them, the way to access them and the purposes of the Treatment that is intended to be given to personal data.

ii)Authorization:Prior, express and informed consent of the Owner to carry out the Processing of Personal Data.

iii)Database:Organized set of Personal Data that is subject to Treatment, which can be stored and/or processed on servers located in computer centers or physical stationery, whether owned or contracted with third parties, located in the national territory or in different countries.

iv)Personal Data:Any information linked or that can be associated with one or several determined or determinable natural persons.

v)Public data:It is the data that is not semi-private, private or sensitive. Public data is considered, among others, data related to the marital status of people, their profession or trade and their quality as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not  subject to confidentiality.

saw)Sensitive Data:Sensitive data is understood to be those that affect the privacy of the Owner or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations, of human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data, among others.

vii)Treatment Manager:Natural or legal person, public or private, that by itself or in association with others, performs the Processing of Personal Data on behalf of the Person Responsible for the Processing of Personal Data.

viii)Responsible for the Treatment:Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Treatment of the data. Who For the purposes of this Policy, the Responsible will beViajes Mar Business and Tourism SAS.

ix)Headline:Natural person whose personal data is subject to Treatment and Legal Entity in the event of Treatment of their data of a financial nature, whether they hold the quality of clients, employees, suppliers or another class of denomination before the company.

x)Transfer:Data transfer takes place when the person in charge and/or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is located inside or outside the country. .

xi)Transmission:processing of personal data that involves the communication of los themselves inside or outside the territory of theRepublic  from Colombia when its purpose is processing by the person in charge on behalf of a single controller.

xii)Treatment:Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion. 

​

Beginning.

In the development, interpretation and application of theLaw 1581 of two thousand and twelve (2012)by la which general provisions are issued for the protection of personal data and the standards that complement, modify or add to it, will be applied in a harmonious and integral way
the following guiding principles:

Principle of Purpose:the treatment must obey a legitimate purpose according to with the Constitution and the Law, which must be reported to the owner. 

Freedom Principle:Treatment can only be exercised with prior consent, express, and informed of the owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent.

Principle of Truth or Quality:the information subject to treatment must be truthful, complete, exact, up-to-date, verifiable and understandable. The treatment of  is prohibitedpartial, incomplete, fractional or misleading data.

Principle of Transparency:in the treatment the right of the owner must be guaranteed a Obtain from the data controller or data processor, at any moment and without restrictions, information about the existence of data that le concern.

Principle of Access and Restricted Circulation:the treatment is subject to the limits that se derive from the nature of personal data, from the provisions of the law and the Constitution. In this sense, the treatment can only be done by authorized persons by the owner and/or by the persons provided for by law. Personal data, except for public information, may not be available on internet or other means of dissemination or mass communication, unless the access is technically controllable to provide restricted knowledge only to the holders o authorized third parties.

Safety Principle:the information subject to treatment byViajes Mar Business and Tourism SAS, it must be handled with the necessary technical, human and administrative measures to grant security to the records avoiding their adulteration, loss, consultation, use o unauthorized or fraudulent access.

Confidentiality Principle: Viajes Mar Negocios y Turismo SAS, is obliged to guarantee the confidentiality of the information, even after the end of its relationship with any of the tasks that includes the treatment, being able to only supply or communicate data personal when it corresponds to the development of activities authorized by law.

​

Authorization to carry out the Processing of Personal Data Authorization.

​

The collection, storage, use, circulation or deletion of personal data byViajes Mar Business and Tourism SASrequires the free, prior, express and informed consent of the owner thereof.Viajes Mar Business and Tourism SASIn its capacity as the person responsible for the processing of personal data, it has provided the necessary mechanisms to obtain the authorization of the owners, always guaranteeing the possibility of verifying the granting of said authorization.

 

Form and Mechanisms to Grant Authorization:Authorization will be requested from mas late at the time ofharvest of personal data, thisauthorization may include in a physical, electronic document or in any other format, which allows guaranteeing its subsequent consultation. The authorization can be granted by the owner (i) in writing, (ii) by  orally or (iii) through unequivocal behavior of the owner that allows the conclusion of de reasonable manner in which authorization was granted. In no case can silence be assimilated to
unequivocal conduct.

The authorization formats and texts will be issued byViajes Mar Business and Tourism SASand will be made available to the owner, prior to the processing of their personal data, in accordance with lo which establishes theLaw 1581 of 2102and its regulatory decrees.

In order for the owner to make informed decisions regarding their personal data and control the use of your personal information. The authorization formats and texts are una statement that informs the owner of the personal data:

1. Identification, physical or electronic address and telephone number of the Responsible del Treatment.
2. The mention of the presentpolitics  of personal data processing and its location the institutional website.
3.Discrimination de personal data is collected.
4. Purpose of the personal data it collects.
5. How to exercise rights of access, correction, update or deletion of data personal supplied
6. In the event that sensitive data is collected or about the data of girls, boys and teenagers, theindication of the optional nature of providing these data.

With the consented authorization procedure, it is guaranteed that en  has been enteredknowledge of the owner of the personal data, the fact that your personal information will be collected and used for specific and known purposes, such as having the option de know any alteration to them and the specific use that has been made of them.

Proof of authorization:The areas responsible for the treatment inViajes Mar Business and Tourism SAS they must have the necessary measures to keep records of when and how they obtained authorization from the holders of personal data for the treatment of los themselves.

Notice of Privacy:The Privacy Notice is the physical, electronic or en  documentany other format, which is made available to the Owner for the processing of their personal data, when it cannot be made availableprovision lapolitics of privacy. This document communicates to the Holder the information regarding the existence of the information processing policies that will be applicable to him, the way to access them and the characteristics of the treatment that is intended to be given to personal data.

In order to guarantee in all cases that the authorization includes all of elements that allow the owner to duly exercise their rights, in the Privacy Notice ofViajes Mar Business and Tourism SASmust include the following information:

1. Company name ofViajes Mar Business and Tourism SASand your contact details.
2. The Treatment to which the data will be submitted and its purpose.
3. The rights that assist the owner.
4. The mechanisms arranged byViajes Mar Business and Tourism SASso that the owner knows the data privacy treatment policy.
5. The optional nature of the answer to the questions that are asked, when these They are about sensitive data or about the data of girls, boys and adolescents;

Sensitive Data.

Sensitive data is considered to be those that affect the Owner's privacy or whose use misuse can generate discrimination. Among them are those revealed by una person's racial or ethnic origin, political orientation, religious convictions o philosophical, belonging to unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees opposition political parties as well as data relating to health, sexual life and biometric data.

Viajes Mar Business and Tourism SASis committed to protecting privacy during the processing of your personally identifiable and sensitive data. Therefore, in the event that the owners of the information expressly authorize the use of sensitive data,Viajes Mar Business and Tourism SASundertakes to use them in accordance with the rules established in their regulatory decrees. Faced with data collection events sensitive, we will always proceed guaranteeing at least the following actions:

1. Inform the owner that because it is sensitive data, he is not obliged to authorize its ttreatment.
2. In the event that the Owner and he/she is physically or legally incapacitated Se verify whether treatment is necessary to safeguard the vital interest of theHeadline and yes If so, authorization will be requested from the legal representatives;
3. Inform the owner explicitly and in advance, in addition to the general requirements de the authorization for the collection of any type of personal data, which of the Data that will be subject to Treatment are sensitive and the purpose of the Treatment.
4. Getconsent expreso for the treatment of sensitive data.
5. No activity may be conditioned to the Owner supplying personal data sensitive.

Special requirements for the treatment of personal data of children and adolescents.

The Processing of personal data of children and adolescents is prohibited, except in the case of data of a public nature, in accordance with the provisionsin the Article 7 of Law 1581 of 2012and when said Treatment complies with the following parameters and requirements:

1. That responds to and respects the best interest of children and adolescents.
2. That the respect of their fundamental rights be ensured.

Viajes Mar Business and Tourism SAS, will advance data processing of minors only when these conditions are presented. For authorization purposes, the legal representative of the  boy, girl or adolescent may give it guaranteeing that as far as possible se will listen to the minor and their opinion will be valued taking into account their maturity, autonomy and ability to understand the matter.

Rights that assist the owner of the information

The owner of the personal data will have the following rights:

1. Know, update and rectify your personal data in front ofViajes Mar Business and Tourism SAS in his capacity as data controller. This right may be exercised, between others, against partial, inaccurate, incomplete, fractional data, which lead to a error, or those whose treatment is expressly prohibited or has not been authorized.

2. Consult your personal data for free at least once a month calendar, and whenever there are substantial changes to the Policies de Treatment.

3. Request proof of authorization granted toViajes Mar Business and Tourism SAS, in its capacity as data controller, except when expressly excepted is a requirement for treatment (cases in which la  is not necessaryauthorization).

4. Be informed byViajes Mar Business and Tourism SAS, upon request, regarding the use that has been given to your personal data.

5. Submit complaints for infractions to the Superintendence of Industry and Commerce at your disposalin law 1581 of two thousand and twelve (2012)and the other regulations that la modify, add or supplement.

6. Revoke the authorization and/or request the deletion of the data when in the treatment constitutional and legal principles, rights and guarantees are not respected.

7. Free access to your personal data that has been subject to treatment.

Duties Of the holders of the information.

The Owner of the Personal Data will have the duty to keep his information updated and guarantee, at all times, its veracity.Viajes Mar Business and Tourism SASwill not be held responsible, in any case, for any type of liability derived from the information inaccuracy.

Duties of Viajes Mar Negocios y Turismo SAS

By virtue of this personal data treatment and protection policy, it is the duty ofViajes Mar Business and Tourism SASthe following:

1. Guarantee the owner, at all times, the full and effective exercise of the right of habeas dating.
2. Request and keep a copy of the respective authorization granted by the owner.
3. Duly inform the owner about the purpose of collection and rights that assist you by virtue of the authorization granted.
4. Respect the security and privacy conditions of the owner's information.
5. Allow access to information only to people who may have access to it.
6. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
7. Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Headlines.
8. Guarantee that the information is true, complete, exact, updated, verifiable and understandable.
9. Inform at the request of the owner about the use given to his data.
10. Update the information, thus addressing all the news regarding de the owner's data, within 5 business days of receipt of the news. Additionally, all necessary measures must be implemented so that the
information is kept up to date.
11. Process the queries and claims made by the owners.
12. Register in the database the legend "claim in process" within two days working days following receipt of the complete claim.
13. Correct the information when it is incorrect and communicate what is pertinent.
14. Comply with the requirements and instructions issued by the Superintendency de Industry and Commerce on the subject in particular.
15. Identify when certain information is under discussion by the headline.
16. Insert the legend "information under judicial discussion" into the database once notified by the competent authority about legal proceedings related to the quality of personal data.
17. Refrain from circulating information that is being disputed by the Owner y whose blocking has been ordered by the Superintendence of Industry and Commerce.
18. Use only data whose treatment is previously authorized de accordance with the expectedin law 1581 of two thousand and twelve (2012).

Events in which the authorization of the owner of the data is not necessary personal.

​

The authorization of the owner of the information will not be necessary in the case of:

1. Information required by a public or administrative entity in exercise of sus legal functions or by court order.
2. Data of a public nature.
3. Cases of medical or health urgency. Treatment of information authorized by law for historical, statistical purposes or scientists.
5. Data related to the Civil Registry of people.

Legitimation for the exercise of the owner's right.

The rights of the holders may be exercised by the following persons:

1. By the owner, who must prove his identity sufficiently by the different means that he makes available to him.Viajes Mar Business and Tourism SAS.
2. By the successors in title of the owner (in cases where the owner is absent due to death o disability), who must prove such quality.
3. By the representative and/or legal representative of the owner, prior accreditation of la corresponding representation or power.
4. By stipulation in favor of another or for another.

The rights of children and adolescents will be exercised by authorized persons
to represent them.

Treatment to which the personal data will be submitted

The Treatment of the data that is collected by virtue of the provisions of the present policy will be carried out and will be in force as long as the purpose for which it is maintained personal data was collected and may, among others, i) designate one or more Persons in Charge of the Processing of Personal Data, ii) transfer and/or transmit the Data Personnel subject to Treatment to companies that are part of its business group, that is, to parent companies, affiliates or subsidiaries, as well as to any other third party, inside or outside the national territory, whether legal or natural persons, nationals o foreign, even when the country where the recipient is located does not have standards that  establish a data protection standard similar to those in force in the territory national, iii) provide said Personal Data to agents, subcontractors and others third parties to achieve the purposes listed in the following section, and iv) reveal information when required by public authorities duly empowered
by administrative or judicial order.

Personal data will be processed for pre-contractual, contractual purposes, pos contractual, commercial, customer service, marketing, advertising, processing, research, training, accreditation, consolidation, organization, updating, reporting, statistics, surveys, attention and processing, granting of benefits as well as the control and preservation of security inViajes Mar Business and Tourism SASto carry out statistical, commercial, strategic, financial, social, technical and de  analysisrate risk.

Likewise, to be shared or sent to its parent company, affiliates and subsidiaries, as well as with third parties with whom you make alliances or contracts for related commercial purposes with the execution of the activities included within its corporate purpose or entrust conducting studies or data processing, as well as for reporting and consulting a Credit risk centers legally constituted in Colombia.

All of the above includes the transfer of this data to third countries such as, sin limit Peru, Ecuador, Bolivia, for purposes of storage and treatment.

Security measures for the Protection of Personal Data

Viajes Mar Business and Tourism SASwill adopt the security techniques that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or access no authorized or fraudulent. Said measures will respond to the minimum requirements made by current legislation and its effectiveness will be evaluated periodically. However, Viajes Mar Business and Tourism SASwill not respond in the event of a violation of its security systems when there is force majeure or a fortuitous event.

Area responsible for handling requests, queries and claims

​

Viajes Mar Business and Tourism SAShas designated as the person responsible for ensuring compliance with this policy within the institution the Customer Service area, who will be available for the attention of requests, queries and claims by the
holders and to carry out any update, rectification and deletion of data personal.

Likewise, the Customer Service area or the legal area will answer any questions or concerns that any of our employees have, through the email que is listed in the header of this document.

Procedures for access, consultation and claim

Right of access:The power of disposition or decision that the holder has over the information that concerns you, necessarily entails the right to access and know if Your personal information is being processed, as well as the scope, conditions and generalities of said treatment.

To comply with the aboveViajes Mar Business and Tourism SAS, It will guarantee the right of access as follows:

• The holder will be able to know the effective existence of the treatment to which his  are subjectedpersonal information.
• The holder will be able to access his personal data that is in the possession ofViajes Mar Business and Tourism SAS.
• Know the purposes that justify the processing of your data.

For the exercise of this rightViajes Mar Business and Tourism SASprior accreditation of the identity of the owner or personality of his representative will be necessary, once exhausted this will be made available to him, free of charge, the detail of personal data a through electronic means that allow the Owner direct access to them.

For consultations whose periodicity is greater than one per calendar month,Viajes Mar Business and Tourism SASwill only charge the costs of sending, reproducing, or certifying documents.

inquiries

The holders or those authorized according to this policy may consult the personal information of the Holder that rests in any database that it manages.Viajes Mar Business and Tourism SAS

For the attention of requests for consultation of personal dataViajes Mar Business and Tourism SAS
ensures that you have the following channels enabled:

1. Emailsoporte@viajesmar.com.co, where las  will be receivedapplications which must contain the necessary documents that prove sufficiently the identity of the owner.
2. The physical addressCalle 11 #22 – 23 CC Puerta Grande Local  C-112, Bogota, where requests will be received, which must be addressed to the customer service area, in its capacity as responsible for la attention to complaints, inquiries and claims. Likewise, they must contain the necessary documents that sufficiently prove the identity of the holder.

Queries will be answered within a maximum term of ten (10) business days counted a from the date of its receipt. When it is not possible to answer the query within said term, the interested party will be informed before the expiration of the 10 days, expressing los reasons for the delay and indicating the date on which your query will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

claims

The holders or those authorized in this policy who consider that the information contained in one of the databasesViajes Mar Business and Tourism SAS, should be object de correction, update or deletion, or when they notice the alleged breach of any of the duties contained in itto Law 1581 of 2012or in this policy, may file a claim with theViajes Mar Business and Tourism SAS, which will be processed under the following rules:

1. The claim can be submitted directly to the email address
soporte@viajesmar.com.co

2. The physical addressCalle 11 #22 – 23 CC Puerta Grande Local  C-112, Bogota, where the claims will be received, which must be addressed to the customer service area, in its capacity as responsible for the attention to complaints, queries and claims.

Claims must contain the necessary documents that sufficiently prove la identity of the owner, the description of the facts that give rise to the claim, the address, y accompanying the documents that you want to enforce, the interested party will be required within  five (5) days following its receipt to correct the failures. After two (2) months from the date of the request without the applicant submitting the information requested, it will be understood that the claim has been withdrawn.

If for any circumstanceViajes Mar Business and Tourism SASreceives a claim about personal information whose treatment it is not responsible for, it will transfer it to the appropriate person in a maximum term of two (2) business days and will inform the interested party of the situation.

Once the complete claim is received, it will be included in the database maintained byViajes Mar Business and Tourism SASa legend that says "claim in process" and the reason for it, within a term of no more than two (2) business days. Said legend must be maintained until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days counted a from the day following the date of receipt. When it is not possible to serve you within Said term will be informed to the interested party before the expiration of the aforementioned term.
reasons for the delay and the date on which your claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Data deletion

The holder has the right, at all times, to requestSea Business and Tourism SAS the deletion (elimination) of your personal data when:

a) Consider that they are not being treated in accordance with the principles, duties and obligations set forth in theLaw 1581 of 2012.
 

b) They have ceased to be necessary or pertinent for the purpose for which they were collected.

c) The period necessary for the fulfillment of the purposes for which   has been exceededthey were collected.
This deletion implies the elimination of personal information in accordance with what is requested by the owner in the records, databasesViajes Mar Business and Tourism SAS.

​

Viajes Mar Business and Tourism SAS will not proceed with the deletion of the information and the revocation of the authorization will not proceed when the Holder has a legal or contractual duty de stay in the database.

It is important to note that the right to cancel is not absolute.Viajes Mar Business and Tourism SASYou can deny the exercise of the same when:

1. The request to delete the information will not proceed when the owner has un legal or contractual duty to remain in the database.

2. The deletion of data hinders judicial or administrative actions linked to tax obligations, investigation and prosecution of crimes or la updating of administrative sanctions.

3. The data is necessary to protect the legally protected interests of the headline; to perform an action based on the public interest, or to comply with an obligation legally acquired by the owner.

In case of being appropriate the cancellation of the personal data,Viajes Mar Business and Tourism SASoperatively performs the deletion in such a way that the deletion does not allow recovery of the information.

To exercise this right, the detailed request must be sent to the emailsoporte@viajesmar.com.coor to the physical addressCalle 11 #22 – 23 CC Puerta Grande Local  C-112, Bogota, where the communication should be directed to the customer service area.

Policy Modification

Viajes Mar Business and Tourism SASmay modify or amend this Policy at its discretion. When modifications or changes are made to it, its date will be updated, y that modification or amendment will be effective as of the update date. Se recommends periodically reviewing this Policy to be informed about las changes that may occur.

Validity of the Policy

This Policy will enter into force as of its publication, that is,July 19, 2021. Both the Policy and the Databases containing the information provided may remain in force for up to the term of the company.Viajes Mar Business and Tourism SAS Notwithstanding that this policy may be modified at any time and unilaterally byViajes Mar Business and Tourism SAS.

​