• In line with CITE HOTEL commitment to sustainability management, the following policies are defined to be applied by employees, customers, guests and suppliers:
• CITE HOTEL is committed to reducing the negative impacts generated in the development of its activities and, at the same time, promoting and maintaining the positive impacts. We are committed to taking care of water and energy in rooms, common areas, lounges and the restaurant.
• At CITE HOTEL, we work to minimize polluting atmospheric emissions, visual pollution and sources of noise pollution.
• Our purchases are made from suppliers who fulfill their duties towards sustainability. In addition, we are committed to managing the classification of solid and hazardous waste derived from our activities.
• We show respect for cultural values and traditions, respect for vulnerable populations and the care of our children and adolescents among our employees, customers and guests.
• We promote the improvement of our employees’ skills.
• We ensure that our activities are carried out in compliance with the national legislation in force, as applicable to our activities.

CITÉ HOTEL IS COMMITTED TO COMPLYING WITH:

• FAUNA AND FLORA LAWS:

Law 99 / 1993. Which created the Ministry of the Environment, reorganized the Public Sector in charge of the management and conservation of the environment and renewable natural resources, organized the National Environmental System (SINA for its Spanish acronym), and issued other provisions. 
Law 1333 of July 21, 2009. Which establishes the environmental sanctions proceedings and the ownership of the sanctioning power in environmental matters to impose and enforce the preventive and sanctioning measures that the country needs.

• LAWS FOR THE PROTECTION OF CULTURAL HERITAGE:

Law 397 / 1997, ruling on Cultural Heritage and creating the Ministry of Culture.
Law 1185 / 2008, amending Law 397 / 1997, General Law of Culture, and adding other provisions.

• CHILD PROTECTION ACT:

LAW 1336 / 2009. Adding and strengthening Law 679 / 2001, on the fight against exploitation, pornography and sex tourism with children and
 

CITÉ HOTEL complies with Law 1336 of July 21, 2009, adopting the code of conduct model, in order to prevent and deter exploitation, pornography and sex tourism with children and adolescents.

• CODE OF CONDUCT: TOURIST SERVICES.

Minimum commitments to be contained in the Code of Conduct to be adopted and complied with by tourism service suppliers
In compliance with the provisions of Article 1 of Law 1336 / 2009, the Ministry of Commerce, Industry and Tourism has developed a model of Codes of Conduct, which, in accordance with the provisions of this Law, must be adopted and complied with by all tourism service suppliers. The commitments enshrined in this Code of Conduct were presented to representatives of the emblematic associations of the sector, who made contributions and recommendations at a meeting held on October 21, 2009, at the facilities of the Ministry of Commerce, Industry and Tourism. In response to the contributions received at this meeting, the minimum commitments that must be contained in the Code of Conduct that tourism service suppliers must adopt and comply with were drafted as follows:

• Refrain from offering plans for the sexual exploitation of children and adolescents in tourism promotion programs and tourist plans, expressly or by interposed persons.
• Refrain from giving information to tourists, directly or through interposed persons, about places from which they coordinate or where commercial sexual exploitation of children and adolescents is practiced.
• Refrain from taking tourists, directly or through third parties, to establishments or places where the commercial sexual exploitation of children is practiced, as well as taking them to places where tourists are staying, even if they are places located on the high seas, for the purpose of commercial sexual exploitation of children and adolescents.
• Refrain from providing vehicles on tourist routes for the purpose of exploitation or sexual abuse of children and adolescents. 
• Prevent children and adolescents from entering hotels or places of accommodation and lodging, bars, similar businesses and other establishments in which tourist services are provided, for the purpose of sexual exploitation or abuse.
• Adopt measures to prevent personnel that is linked in any capacity to the company, from offering tourist services that allow sexual activity with children and adolescents.
• Protect national or foreign children and adolescents from all forms of exploitation and sexual violence caused by national or foreign tourists.
• Report to the Ministry of Commerce, Industry and Tourism and other competent authorities on the facts of which they have become aware by any means, as well as the suspicion of these, related to the sexual exploitation of children and adolescents and ensure that within the company there are channels to report such facts to the competent authorities.
• Design and disclose a policy in which the supplier establishes measures to prevent and counteract all forms of sexual exploitation of children and adolescents in travel and tourism, within the company and with its suppliers of goods and services.
• Train all active personnel linked to the company, as well as suppliers who, due to the nature of their activities, have contact with tourists, on the issue of prevention of commercial sexual exploitation of children and adolescents.
• Inform its users about the legal consequences of the sexual exploitation and abuse of children and adolescents in Colombia.
• Post this Code of Conduct and any other commitments that the supplier wishes to assume to protect children and adolescents in a public and conspicuous place in the commercial premises.
• In addition, CITE HOTEL is currently in the process of achieving certification in The Code.
• The Code is an international Code of Conduct of corporate social responsibility for the protection of children and adolescents from commercial sexual exploitation associated with travel and tourism, it is an initiative led by the private sector to promote responsible, regulated, and safe tourism.
• The Code was created in 1997 by Scandinavian tour operators and ECPAT Sweden, with the support of the World Tourism Organization and has been recognized by UNICEF.

1. LEGAL BASIS AND SCOPE OF APPLICATION
This personal data processing policy is developed in compliance with Articles 15 and 20 of the Political Constitution, as well as based on Articles 17 literal k) and 18 literal f) of Statutory Law 1581 of 2012, which issues general provisions for the Protection of Personal Data, and in compliance with Article 2.2.2.25.1.1 Section 1 Chapter 25 of Decree 1074 of 2015, which partially regulates Law 1581 of 2012.
This policy shall apply to all personal data registered in databases that are subject to processing by the Data Controller.
1.1. Scope
This document shall apply to all personal data used by or resting in the databases and files of INVERSIONES DEL VIRREY S.A - CITÉ HOTEL, complying with the criteria for collection, storage, use, circulation, and final disposal of personal data established in Law 1581 of 2012 and its regulatory Decrees. Additionally, the obligations and guidelines of INVERSIONES DEL VIRREY S.A - CITÉ HOTEL for the administration and processing of personal data stored in its databases and files are set forth. This Policy applies to all processes of INVERSIONES DEL VIRREY S.A - CITÉ HOTEL in which data processing (public data, semi-private data, private data, sensitive data, data of children and adolescents) is necessary, acting as Controller and/or Processor.
1.2. Applicable Regulations
Political Constitution of Colombia
Law 1581 of 2012
Decree 1074 of 2015 Chapter 25 and Chapter 26 compiling the decrees:
Decree 1377 of 2013
Decree 886 of 2014
Law 1266 of 2008 "By which general Habeas Data provisions are enacted."
Administrative acts issued by the Superintendency of Industry and Commerce (SIC).

2. DEFINITIONS
The following definitions are established in Article 3 of Law 1581 of 2012 and Article 2.2.2.25.1.3 Section 1 Chapter 25 of Decree 1074 of 2015 (Article 3 of Decree 1377 of 2013):
2.1. Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of personal data.
2.2. Database: Organized set of personal data subject to processing, belonging to the same context and systematically stored for subsequent use.
2.3. Personal Data: Any information linked or that can be associated with one or several specific or determinable natural persons. These data are classified into public, semi-private, private, and sensitive:
2.3.1. Public Data: Data determined as such by law or the Political Constitution, as well as all those that are not semi-private, private, or sensitive. Public data include, among others, data regarding civil status, profession or trade, and status as a merchant or public servant. By their nature, public data may be contained in public records, public documents, official gazettes and bulletins, and non-confidential court rulings, among others.
2.3.2. Semi-private Data: Data that does not have an intimate, reserved, or public nature, and whose knowledge or disclosure may interest not only its Data Subject but a certain sector or group of people or society in general, such as databases containing financial, credit, commercial, service information, and information from third countries.
2.3.3. Private Data: Personal data that, due to its intimate or reserved nature, is only of interest to its Data Subject, and its processing requires prior, informed, and express authorization.
2.3.4. Sensitive Data: Sensitive data refers to data that affects the privacy of the Data Subject or whose misuse may generate discrimination, such as data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations, or promoting the interests of any political party, or guaranteeing the rights and guarantees of opposition political parties, as well as health data, sexual life data, and biometric data.
2.4. Data Processor: Natural or legal person, public or private, who, by itself or in association with others, processes personal data on behalf of the Data Controller.
2.5. Data Controller: Natural or legal person, public or private, who, by itself or in association with others, decides on the database and/or data processing.
2.6. Person Responsible for Database Management: Employee in charge of controlling and coordinating the adequate application of data processing policies once stored in a specific database, as well as implementing guidelines issued by the Data Controller and the Data Protection Officer.
2.7. Data Protection Officer: The natural person who assumes the role of coordinating the implementation of the legal framework for personal data protection and processing Data Subject requests for exercising their rights under Law 1581 of 2012.
2.8. Data Subject: Natural person whose personal data is subject to processing.
2.9. Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.
2.10. Privacy Notice: Verbal or written communication generated by the Controller, addressed to the Data Subject for the processing of their personal data, informing them about the existence of applicable information processing policies, how to access them, and the intended processing purposes.
2.11. Transfer: Data transfer takes place when the Data Controller and/or Processor, located in Colombia, sends personal data or information to a recipient who is also a Data Controller, located inside or outside the country.
2.12. Transmission: Processing of personal data that involves communicating data inside or outside the territory of the Republic of Colombia when its purpose is for a Processor to conduct processing determined on behalf of the Controller.

3. DATA PROTECTION PRINCIPLES
Article 4 of Law 1581 of 2012 establishes principles for personal data processing, which must be applied harmoniously and comprehensively in developing, interpreting, and applying the Law:
3.1. Principle of Legality: Data processing is a regulated activity subject to Law 1581 of 2012, Decree 1377 of 2013 Compiled in Chapter 25 of Decree 1074 of 2015, and other developing provisions.
3.2. Principle of Purpose: Processing must serve a legitimate purpose in accordance with the Constitution and Law, which must be communicated to the Data Subject.
3.3. Principle of Freedom: Processing can only be exercised with the prior, express, and informed consent of the Data Subject. Personal data cannot be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate waiving consent. Processing requires prior and informed authorization via means allowing subsequent consultation.
3.4. Principle of Truthfulness or Quality: Information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. Processing partial, incomplete, fractionated, or misleading data is prohibited.
3.5. Principle of Transparency: Processing must guarantee the Data Subject's right to obtain information from the Controller or Processor at any time and without restriction regarding the existence of data concerning them. When requesting authorization, the Controller must clearly and explicitly inform the Data Subject of:
The processing and purpose thereof.
The optional nature of answers regarding sensitive data or data of children and adolescents.
Their rights as a Data Subject.
The identification, physical address, email, and telephone number of the Data Controller. (Proof of compliance with this duty must be preserved.)
3.6. Principle of Restricted Access and Circulation: Processing is subject to limits derived from the nature of personal data, Law 1581 of 2012, and the Constitution. Processing can only be conducted by persons authorized by the Data Subject and/or permitted by Law. Except for public information, personal data shall not be available on the Internet or mass media unless access is technically controllable to restrict knowledge only to Data Subjects or authorized third parties.
3.7. Principle of Security: Information subject to processing by the Controller or Processor must be handled with technical, human, and administrative measures necessary to ensure security to records, preventing alteration, loss, unauthorized or fraudulent consultation, use, or access. The Controller is responsible for implementing corresponding security measures and informing personnel with direct or indirect access. System users must understand and comply with security rules established in PL-02 Internal Security Policies. Any modification to security measures must be communicated to users.
3.8. Principle of Confidentiality: All persons involved in processing non-public personal data are obligated to guarantee confidentiality even after their relationship with processing tasks ends, disclosing or communicating personal data only when it corresponds to activities authorized under Law 1581 of 2012.

4. AUTHORIZATION FOR USE OF PERSONAL DATA
In accordance with Article 9 of Law 1581 of 2012, processing personal data requires authorization from the Data Subject, except in cases explicitly exempted by data protection rules. Prior to or at the time of collecting personal data, INVERSIONES DEL VIRREY S.A - CITÉ HOTEL will request the Data Subject's authorization for its collection and processing, specifying the purpose through automated, written, or oral technical means that preserve proof of authorization and/or unequivocal conduct described in Article 2.2.2.25.2.4 Section 2 Chapter 25 of Decree 1074 of 2015.
Authorization is not required for:
Information requested by a public or administrative entity in the exercise of its legal functions or by court order.
Data of a public nature.
Medical or health emergencies.
Processing authorized by law for historical, statistical, or scientific purposes.
Data related to the Civil Registry of persons.

5. REQUEST FOR AUTHORIZATION FROM THE DATA SUBJECT
Authorization for the use and/or processing of data will be managed by INVERSIONES DEL VIRREY S.A - CITÉ HOTEL through mechanisms guaranteeing subsequent consultation and expression of will via:
In writing.
Orally.
Automated channels.
Unequivocal conduct by the subject allowing reasonable conclusion that authorization was granted.
Prior to or at the time of collection, INVERSIONES DEL VIRREY S.A - CITÉ HOTEL will clearly and expressly inform the Data Subject of:
The Processing and purpose applied to personal data.
The optional nature of answering questions concerning sensitive data or data of children and adolescents.
The rights assisting them as Data Subjects.
The identification, physical/electronic address, and telephone of INVERSIONES DEL VIRREY S.A - CITÉ HOTEL.

6. DATA CONTROLLER
The Controller of the databases subject to this policy is INVERSIONES DEL VIRREY S.A - CITÉ HOTEL, whose contact details are:
Address: CR 15 88 10, BOGOTÁ D.C - DISTRITO CAPITAL
Email: datospersonales@citehotel.com
Telephone: 6467777 - 3228100228

7. PROCESSING AND PURPOSES OF DATABASES
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL, in the development of its corporate purpose, processes personal data relating to natural persons in databases intended for legitimate purposes, complying with the Constitution and Law. Such processing includes collection, storage, use, circulation, or final disposal according to authorized purposes.
Annex 2: Purposes of Databases contains information regarding the organization's databases and assigned processing purposes.

8. TERM OF VALIDITY OF THE DATABASE
Personal data in databases will remain valid for the timeframe necessary to fulfill the authorized processing purposes pursuant to Article 2.2.2.25.2.8 of Decree 1074 of 2015 and applicable regulatory preservation rules.

9. RIGHTS OF DATA SUBJECTS
Pursuant to Article 8 of Law 1581 of 2012, Data Subjects may exercise rights regarding personal data:
a) Know, update, and rectify personal data before Controllers or Processors. This applies against partial, inaccurate, incomplete, fractionated, or misleading data, or processing expressly prohibited/unauthorized.
b) Request proof of authorization granted to the Controller, except when exempted under Article 10 of Law 1581.
c) Be informed by the Controller or Processor, upon request, regarding data usage.
d) File complaints before the Superintendency of Industry and Commerce for legal infractions.
e) Revoke authorization and/or request data deletion when processing fails to respect constitutional and legal principles. Deletion proceeds once SIC determines non-compliant conduct by Controller/Processor.
f) Access personal data free of charge.
Per Article 2.2.2.25.4.1 of Decree 1074 of 2015, these rights may be exercised by:
The Data Subject (accrediting identity).
Assignees/Successors in interest (accrediting status).
Representatives/Attorneys-in-fact (accrediting power of attorney).
Stipulation in favor of/for another.
Rights of children or adolescents shall be exercised by authorized legal representatives.
9.1. Right of Access or Consultation
The right of the Data Subject to be informed, upon request, about the origin, use, and purpose of their personal data.
9.2. Rights of Complaints and Claims
The Law distinguishes four types of claims:
Correction Claim: Updating, rectifying, or modifying partial, inaccurate, incomplete, or misleading data.
Deletion Claim: Deleting inadequate, excessive, or non-compliant data.
Revocation Claim: Revoking prior authorization granted for processing.
Infraction Claim: Requesting remediation for failure to comply with Data Protection regulations.
9.3. Right to Request Proof of Authorization Granted to the Controller
Data Subjects or successors may request physical or digital proof of granted authorization.
9.4. Right to File Complaints before the Superintendency of Industry and Commerce
Data Subjects or successors may file complaints with the SIC only after exhausting consultation or claim procedures directly with the Controller or Processor.

10. PROCESSING OF DATA OF MINORS
Pursuant to Article 7 of Law 1581 of 2012 and Article 2.2.2.25.2.9 of Decree 1074 of 2015 (Article 12 of Decree 1377 of 2013), INVERSIONES DEL VIRREY S.A - CITÉ HOTEL processes personal data of children and adolescents observing the following criteria:
Data use responds to and respects the best interests of minors.
Data use ensures respect for fundamental rights.
Once fulfilled, authorization is requested from the legal representative after exercising the minor's right to be heard (evaluating maturity and capacity). The Controller/Processor ensures compliance with Law 1581 principles and identifies collected sensitive data to heighten protection.

11. DUTIES AS DATA CONTROLLER
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL, as Data Controller, shall fulfill:
11.1. Regarding the Data Subject:
Guarantee full and effective exercise of habeas data rights at all times.
Request and retain copies of granted authorizations.
Duly inform Data Subjects regarding collection purposes and rights.
Process consultations and claims within legal timelines.
Inform Data Subjects about data usage upon request.
11.2. Regarding the Data Processor:
Guarantee that information supplied to Processors is truthful, complete, accurate, updated, and understandable.
Timely communicate information updates and novelties to Processors.
Rectify incorrect information and notify Processors.
Inform Processors when specific data is under Subject dispute.
Provide Processors only with authorized data.
Require Processors to respect security and privacy conditions.
Ensure Processors comply with Data Processing Policies.
11.3. Regarding Principles and Other Obligations:
Observe principles of Legality, Purpose, Freedom, Quality, Truthfulness, Transparency, Restricted Access/Circulation, Security, and Confidentiality.
Adopt an internal policies manual guaranteeing compliance with Law 1581/2012.
Report security code violations and data management risks to the Data Protection Authority.
Comply with instructions and requests issued by the SIC.
Store information under necessary security conditions to prevent alteration, loss, or unauthorized access.

12. DUTIES AS DATA PROCESSOR
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL, as Data Processor, shall fulfill:
Guarantee full exercise of habeas data rights at all times.
Safeguard data under security conditions preventing alteration, loss, or unauthorized access.
Perform timely updates, rectifications, or deletions within legal terms.
Update information reported by Controllers within five (5) business days of receipt.
Process Data Subject consultations and claims.
Adopt an internal procedures manual for handling claims.
Register the legend "claim in progress" (reclamo en trámite) in databases when applicable.
Insert the legend "information under judicial dispute" upon notification of court proceedings.
Refrain from circulating controverted information blocked by the SIC.
Restrict access strictly to authorized personnel.
Inform the SIC of security code violations or risks.
Comply with instructions issued by the SIC.
Comply with Data Processing Policies established by Controllers.

13. DATA SUBJECT ATTENTION
For processing requests, consultations, and claims, INVERSIONES DEL VIRREY S.A - CITÉ HOTEL has appointed a Data Protection Officer. Data Subjects may submit requests through:
Email: datospersonales@citehotel.com
Address: CR 15 88 10, BOGOTÁ D.C - DISTRITO CAPITAL
Telephone: 6467777 - 3228100228

14. PROCEDURES TO EXERCISE THE RIGHTS OF THE DATA SUBJECT
14.1. Right of Access or Consultation
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL guarantees free consultation of personal data (Article 2.2.2.25.4.2 of Decree 1074 of 2015):
At least once per calendar month.
Whenever substantial changes to processing policies warrant new consultations.
For frequencies higher than once per calendar month, shipping, reproduction, or document certification costs may be charged, not exceeding material retrieval costs.
Requests must be sent in writing to datospersonales@citehotel.com (Subject: "Exercise of the right of access or consultation") or via post to CR 15 88 10, BOGOTÁ D.C., containing:
Full name of Data Subject.
Copy of Identity Document (and representative documentation, if applicable).
Specific consultation/access request details.
Notification address, date, and signature.
Supporting documents.
Available response forms: Screen display, written copy/photocopy, email/electronic media, or other digital mechanisms. Requests will be answered within ten (10) business days. If an extension is needed, an additional five (5) business days may be granted upon notifying the applicant (Article 14, Law 1581 of 2012). Once exhausted, complaints may be raised to the SIC.
14.2. Rights of Complaints and Claims
Claims (correction, deletion, revocation, infraction) must be sent to datospersonales@citehotel.com (Subject: "Exercise of the right of complaint or claim") or to CR 15 88 10, BOGOTÁ D.C., specifying full details, description of facts, address, signature, and supports.
Incomplete claims: Applicant requested to cure defects within five (5) days. Abandonment is assumed after two (2) months of inaction.
Legend insertion: "Claim in progress" added within two (2) business days until resolved.
Resolution timeframe: Maximum fifteen (15) business days. Extensions up to eight (8) additional business days are allowed upon notice.
14.3. Persons Authorized to Receive Information
Information will be supplied to Data Subjects, successors/representatives, public/administrative entities under legal authority, and authorized third parties (Article 13, Law 1581 of 2012).
14.3.1. Verification of Authority to Request or Receive Information
Required verification documents:
Subject: Copy of Identity Document.
Successor: Applicant Identity Document, Subject Death Certificate, proof of legal standing, copy of Subject ID.
Representative/Attorney-in-fact: Applicant ID, Power of Attorney document, copy of Subject ID.

15. DATA PROCESSING IN VIDEO SURVEILLANCE SYSTEMS
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL informs individuals of surveillance systems using visible notices placed at entryways and inside monitored areas. Notices indicate the Data Controller, processing purposes, Data Subject rights, exercise channels, and policy publication locations.
Images are retained only for strictly necessary periods and registered in the RNBD. Image access or disclosure is permitted only by written request from judicial or administrative authorities.

16. PERSONAL DATA PROCESSING IN ARTIFICIAL INTELLIGENCE (AI) SYSTEMS
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL may employ Artificial Intelligence (AI) technologies for data processing, provided processing remains within authorized limits and complies with Law 1581 of 2012.
The organization will refrain from using AI systems when processing represents a risk of significantly impacting Data Subjects, following suitability, necessity, reasonableness, and proportionality criteria outlined in SIC Circular 002 of 2024. AI tools must incorporate legality, purpose, security, confidentiality, and demonstrated accountability principles with technical/administrative safeguards.

17. SECURITY MEASURES
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL protects personal and sensitive data using adequate measures ensuring confidentiality, integrity, and availability. Sensitive data covers health, financial, biometric, and legally classified sensitive information.
Controls implemented (Annex 1 PL-01 Organization Databases) include: data encryption in transit and at rest, multi-factor authentication (MFA), network segregation, periodic audits, personnel training, penetration testing, vulnerability assessments, and an Incident Response Plan. Transmission contracts bind third-party processors to equivalent standards.

18. COOKIES OR WEB BUGS
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL collects personal data during website, application, or landing page usage. First and third-party cookies analyze visitor interaction, navigation patterns, user authentication, preference retention, and personalized offers.
Users can modify browser settings to block or delete cookies (Chrome, Safari, Edge, Firefox, etc.). Disabling cookies may limit functionality.
Cookie Categories:
Essential: Strictly necessary for web functionality.
Functional: Evaluate and improve performance.
Analytics/Statistical: Track behavior for statistical analysis.
Marketing: Track navigation behavior to deliver relevant ads.

19. GUIDELINES FOR NOTIFICATION, MANAGEMENT, AND RESPONSE TO SECURITY INCIDENTS
The organization maintains an Incident Reporting Procedure governing communications between employees, DPO, Processors, Data Subjects, regulatory bodies, and judicial entities. Security incidents include security failures permitting unauthorized access, document loss, partial/total data destruction, database relocation, credential leaks, or unauthorized modifications.
Response Steps & Protocols:
Containment and mitigation strategy.
Risk assessment for Data Subjects.
Legal/contractual verification with vendors.
Authority notification evaluation (Fiscalía, SIC, CSIRT, Police Cyber Center, etc.).
Monitoring timelines and progress.
Post-incident response evaluation and corrective action plans.
Documentation and mandatory reporting to the SIC via the RNBD within fifteen (15) business days of detection.

20. MANAGEMENT OF RISKS ASSOCIATED WITH DATA PROCESSING
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL identifies processing risks and applies controls (PL-02 Internal Security Policies). Risk management assesses threats from technology, human resources, infrastructure, and processes, considering:
Criminality: Human actions violating the law.
Physical Events: Natural or technical occurrences.
Negligence & Institutional Decisions: Actions, omissions, or human behavior risks.

21. DISCLOSURE OF PERSONAL DATA TO AUTHORITIES
When public or administrative authorities legally request data access, INVERSIONES DEL VIRREY S.A - CITÉ HOTEL verifies request legality and data relevance. Data delivery is documented, formally advising the authority of their obligation to preserve security, confidentiality, and restricted circulation.

22. INTERNATIONAL TRANSFER AND TRANSMISSION OF PERSONAL DATA
International transfers are made only to countries providing adequate protection levels per SIC standards, except for:
Express/unequivocal Data Subject authorization.
Medical data exchanges for health reasons.
Bank or stock exchange transfers.
International treaty frameworks.
Necessary contract executions between Subject and Controller.
Legal requirements for public interest or judicial claims.
Unlisted target countries require a conformity declaration from the SIC. International transmissions between Controller and Processor require formal Data Transmission Contracts defining scopes, responsibilities, and Colombian regulatory compliance.

23. PROCESSING OF BIOMETRIC DATA
Biometric data (fingerprints, voice recognition, facial features) are collected strictly for security, identity verification, and access control. Biometric database management incorporates technical security measures guaranteeing confidentiality, privacy, and statutory compliance.

24. NATIONAL REGISTRY OF DATABASES – RNBD
INVERSIONES DEL VIRREY S.A - CITÉ HOTEL maintains registered databases and updates its database inventory annually between January 2 and March 31 in the RNBD managed by the SIC (Article 25, Law 1581 of 2012). Data Subjects may consult minimal registered information per Article 5 of Decree 886 of 2014.

25. INFORMATION AND PERSONAL DATA SECURITY
The organization prioritizes privacy and security, implementing policies, guidelines, and standards protecting data integrity, confidentiality, and availability. Technological practices include secure transmission protocols, infrastructure hardening, role-based access restrictions, system backups, and secure software development practices. Third-party data handlers must execute transmission contracts incorporating strict confidentiality commitments.

26. DOCUMENT MANAGEMENT
Physical and digital documents containing personal data must be easily retrievable, documented by storage location, inspected frequently, and preserved under controlled environmental and risk conditions. Retention periods follow legal requirements or internal operational needs, specifying final disposition (recycling, destruction, digitization).
Documents must be coded, version-controlled, protected against internal/external alterations (PL-02), and tracked upon distribution. A designated custodian ensures physical and digital protection.

27. EFFECTIVE DATE
This Policy update is effective starting 2026-08-31. Databases managed by INVERSIONES DEL VIRREY S.A - CITÉ HOTEL will remain active for the timeframe reasonable and necessary to fulfill authorized purposes.
 

GUESTS AND CLIENTS DUTIES

• To rationally use energy while utilizing the establishment´s premises.
• To rationally use water while using the bathrooms in the establishment.
• To deposit trash and solid residues in their respective containers and not in flower pots or ornaments in order to facilitate its recycling.  
• To not smoke in unauthorized zones (Resolution 1956 of 2008).
• To avoid causing noise and using sound amplifiers.
• To take care and respect gardens and green areas.
• To take care of the regional heritage, to not extract or damage cultural goods.
• When visiting natural areas, respect and follow the established signs. They serve a very important purpose for your safety and the conservation of resources.
• When visiting natural or cultural areas, abstain from collecting, extracting or buying hand crafts that contain animal parts or any other type of biological material.
• To comply with the current laws related to the protection of flora and fauna, as well as cultural heritage.
• To not exceed tolerable noise during events.

GUESTS AND CLIENTS RIGHTS

• To receive quality services.
• To have the necessary safety during their stay in the Hotel.
• To be treated politely when making requests to the Hotel.
• To decide their participation in the environmental programs carried out by the Hotel.
• To be able to taste typical dishes in the establishment or in gastronomical establishments promoted by Cite Hotel.
• To receive accurate information about tourist sites to visit.
• To not be discriminated for any condition in the Hotel or in the tourist sites they visit.
• The right to visit safe touristic sites.
• To be heard regarding complaints and suggestions.
• To express their level of satisfaction regarding the services offered.
• To fairly negotiate commercial conditions for both parties.

SUPPLIERS DUTIES

• To maintain the quality of the products or services offered to the Hotel.
• To not have discriminatory practices towards vulnerable populations.
• While possible, to use ecologic o renewable raw materials.
• To not exceed the use of plastic bags and packaging in their deliveries.
• To not make declarations that may affect the good reputation of Cité Hotel.
• To not promote the gastronomic commercialization of prohibited fauna species or species in risk of extinction.  
• To maintain fair commercial conditions with their own suppliers.
• To provide their services with qualified personnel.

SUPPLIERS RIGHTS

• To promptly receive payment for the services or products provided.
• To negotiate the commercial conditions of delivery and supply in a fair environment for both parties.
• To be treated politely by the staff of Cité Hotel.
• To be heard regarding proposals that benefit the Sustainability of Cité Hotel.
• To not be discriminated for any condition.

EMPLOYEE DUTIES

• To rationally use energy while utilizing the establishment´s premises.
• To rationally use water while using the bathrooms in the establishment.
• To not pour food remains, oils, chemical products, paper or plastic in drains or sewers.
• To execute practices that promote and support the conservation of water, air and energy.
• To immediately inform if equipment from the water system or electricity system requires maintenance.
• To use biodegradable cleaning products that do not pollute.
• To turn off equipment and appliances that are not in use.
• During nights or weekends to turn off work equipment, as well as printers and screens; this helps to reduce energy use.
• To only print if it is completely necessary. While printing, print on both sides or even 2 pages per sheet.  

EMPLOYEE RIGHTS

• To receive fair treatment from their employer.
• To not be discriminated by any condition.
• The right to be heard regarding proposals that benefit the Sustainability of Cité Hotel.
• To work in a healthy and safe environment.
• To receive uniforms, work supplies or personal protection gear that are necessary.
• To continuously receive training for the improvement of their job competencies.