PROCESSING POLICY FOR THE PROTECTION PERSONAL DATA

In compliance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, MR BABOON HOSTEL adopts this policy for personal data processing, which will be reported to all owners of the collected data or those to be collected in the future in the provision of tourist services.

Thus, MR BABOON HOSTEL declares that it guarantees the rights to privacy, good reputation and autonomy in terms of personal data processing, and, consequently, all its actions will be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency , access and restricted circulation, security and confidentiality.

All persons who, in the exercise of different contractual, commercial, labor activities, among others – whether permanent or occasional – MR BABOON HOSTEL with any type of information or personal data, may know, update and rectify it.

I. IDENTIFICATION OF THE PERSON IN CHARGE OF DATA PROCESSING
COMPANY’S NAME: MR BABOON HOSTEL, hereinafter referred to MR BABOON HOSTEL, natural person or legal entity, identified with the Tax Identification Number 900588713-1. Registered in Santa Marta’s Chamber of Commerce.

REGISTERED OFFICE AND ADDRESS: MR BABOON HOSTEL’s registered office is located in Santa Marta (Magdalena), at calle 17 #3-99 (Historic Center).

E-MAIL ADDRESS: support@mrbaboonhostel.com

TELEPHONE NUMBERS: (+57) (5) 421 58 20 – (+57) 315 221 0149 – (+57) 314 571 3645

II. LEGAL FRAMEWORK
Political Constitution, article 15.

Law 1266 of 2008

Law 1581 of 2012

Regulatory Decrees 1727 of 2009 and 2952 of 2010,

Partial Regulatory Decree 1377 of 2013

Rulings C – 1011 of 2008, and C – 748 of 2011, by the Constitutional Court

III. SCOPE OF APPLICATION
This policy will be applicable to the personal data registered in any MR BABOON HOSTEL‘s database whose owner is a natural person.

IV. DEFINITIONS

For the purposes of this policy and in accordance with current regulations on the protection of personal data, the following definitions will be taken into account
Authorization: Owner’s prior, express and informed consent for personal data processing.

Privacy notice: Verbal or written communication generated by the person in charge, addressed to the Owner for the processing of their personal data, by means of which they are informed about the existence of the information processing policies that will be applicable to them, how to access them and the processing purposes for the personal data.

Database: Organized set of personal data subject to processing.

Successor: person who has succeeded another one due to their death (heir).

Personal data: Any information linked or that may be linked with one or several specific or determinable natural persons.

Public data: It is the data that is not semi-private, private or sensitive. Public data are, among others, the data relating to people’s marital status, profession or job and their status as merchant or public servant. Due to their nature, public data may be contained, among others, in public records, public documents, official gazettes and newsletters and duly enforced judicial rulings that are not subject to reservation.

Sensitive data: Sensitive data are those that affect the Owner’s privacy or whose improper use can generate their discrimination; for instance, they may reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social and human rights organizations or those that promote the interests of any political party or safeguard the rights and guarantees of opposition political parties, as well as those data related to health, sexual life and biometric data.

Data processor: Natural person or legal entity – public or private – who, by themselves or in association with others, processes personal data on behalf of the Person in Charge of the Data Processing.

Person in Charge of the Data Processing: Natural person or legal entity – public or private – who, by themselves or in association with others, decides on the database and/or the data processing.

Owner: Natural person whose personal data are subject to processing.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Transfer: The transfer of data takes place when the person in charge and/or responsible for the personal data processing, in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the processing and is in the country or abroad.

Transmission: Personal data processing that implies their communication in Colombia or abroad when the person in charge intends to perform a processing on behalf of the person responsible for it.

V. PRINICIPLES

In order to guarantee the protection of personal data, MR BABOON HOSTEL will apply the following principles harmoniously and comprehensively, in light of which the processing, transfer and transmission of personal data must be carried out:
Principle of legality regarding data processing: Data processing is a regulated activity, which should be subject to the current and applicable legal provisions that govern the matter.

Principle of purpose: The personal data processing carried out by MR BABOON HOSTEL or to which it may have access, will have a legitimate purpose in accordance with the Political Constitution of Colombia, which must be informed to the respective owner of the personal data.

Principle of freedom: The personal data processing can only be carried out with the Owner’s prior, express and informed consent. Personal data may not be obtained or disclosed without prior authorization, or without a legal, statutory, or judicial mandate that replaces the consent.

Principle of truthfulness or quality: The information subject to personal data processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractional or error-inducing data is prohibited.

Principle of transparency: When processing personal data, MR BABOON HOSTEL will guarantee the Owner’s right to obtain, at any time and without restrictions, information about the existence of any type of information or personal data concerning their interest or ownership.

Principle of access and restricted circulation: Personal data processing is subject to the limits derived from their nature, the provisions of the law and the Constitution. Consequently, the processing may only be carried out by people authorized by the owner and/or by the people provided by law. Personal data, except public information, may not be available on the internet or other means of disclosure or mass communication, unless access is technically controllable to provide restricted knowledge only to owners or third parties authorized by law. For these purposes, MR BABOON HOSTEL’s obligation will be to serve as a means.

Principle of security: The information subject to processing by MR BABOON HOSTEL must be used in accordance with the technical, human and administrative measures that may be necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

Principle of confidentiality: All people who administer, manage, update or have access to any information stored in Databases at MR BABOON HOSTEL, are obliged to guarantee the secrecy of the information; therefore, they undertake to keep strictly confidential and not to disclose to third parties, all the information that they may know when performing their functions; except in the case of activities expressly authorized by the data protection law. This obligation persists and will be kept even after the end of their relation with any of the tasks included in the processing.

VI. OWNER’S RIGHTS
In accordance with the provisions of current regulations applicable to data protection, these are the owners’ rights concerning their personal data:

  1. To access, know, update and rectify their personal data before MR BABOON HOSTEL as the person responsible for the processing. This right may be exercised, among others, for partial, inaccurate, incomplete, fractional, error-inducing data, or those whose processing is expressly prohibited or has not been authorized.
  2. To request the proof of authorization granted to MR BABOON HOSTEL for the data processing, by any valid means, except in cases where authorization is not necessary
  3. To be informed by MR BABOON HOSTEL, via previous request, of how their personal data have been used.
  4. To submit, at the Superintendence of Industry and Commerce or the corresponding entity, complaints concerning infractions to the provisions of Law 1581 of 2012 and the other regulations that modify, add or supplement it, after the prior inquiry or request at MR BABOON HOSTEL.
  5. To revoke the authorization and/or request the deletion of the data when the constitutional and legal principles, rights and guarantees are not respected in the processing.

To revoke the authorization and/or request the deletion of the data when the constitutional and legal principles, rights and guarantees are not respected in the processing.These rights may be exercised by:

  • The owner, who must prove their identity via the different means offered by MR BABOON HOSTEL
  • The owner’s successors, who must prove their status.
  • The owner’s representative and/or proxy, via a previous certification for the representation or power of attorney.
  • Another determined by the owner.

Children’s and adolescents’ rights

When processing personal data, respect for the prevailing rights of minors will be guaranteed.

The processing of minors’ personal data is outlawed, except for public data, in which case the processing must comply with the following parameters:

  1. To respond and respect the best interests of minors
  2. To guarantee the respect for the fundamental rights of minors.

It is the State’s and all educational entities’ duty to provide information and train legal representatives and guardians on the possible risks faced by children and adolescents regarding the improper processing of their personal data, and provide information about children’s and adolescents’ responsible and safe use of their personal data, their right to privacy and protection of their personal information and that of others.

VII. DUTIES OF THE COMPANY AS THE ENTITY RESPOSIBLE AND IN CHARGE OF THE PERSONAL DATA PROCESSING


MR BABOON HOSTEL acknowledges that people own their own personal data and consequently they can exclusively decide on them. Therefore, MR BABOON HOSTEL will use personal data for the fulfillment of the purposes expressly authorized by the owner or by current regulations.

When processing and protecting personal data, MR BABOON HOSTEL will have the following duties, without prejudice to others included in the provisions that regulate or get to regulate this matter:

  1. To guarantee the owner the full and effective exercise of the right of habeas data, at all times.
  2. To request and keep a copy of the respective authorization granted by the owner for the personal data processing.
  3. To duly inform the owner about the purpose of the collection and their rights by virtue of the granted authorization.
  4. To keep the information under the necessary security conditions in order to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
  5. To guarantee that the information is truthful, complete, accurate, updated, verifiable and understandable.
  6. To promptly update the information, taking into account all the news regarding the owner’s data. Additionally, all the necessary measures must be implemented, so that the information is kept up to date.
  7. To rectify the information when it is incorrect and communicate the relevant information.
  8. To respect the security and privacy conditions regarding the owner’s information.
  9. To process the inquiries and claims formulated in accordance with law.
  10. To identify when certain information is being discussed by the owner.
  11. To inform, at the owner’s request, about how their data have been used.
  12. To inform the data protection authority when there are violations of security codes and there are risks regarding the management of the owners’ information.
  13. To comply with the requirements and instructions given by the Superintendence of Industry and Commerce on the particular matter.
  14. To only use data whose processing is previously authorized in accordance with the provisions of Law 1581 of 2012.
  15. To ensure the proper use of children’s and adolescents’ personal data, in those cases in which the processing of their data is authorized.
  16. To register the lines “claim in process” in the database in accordance with law.
  17. To insert the line “information in judicial discussion” in the database once notified by the competent authority about judicial processes related to the quality of personal data.
  18. To refrain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce.
  19. To allow access to information only to people who may have access to it.
  20. To use the owner’s personal data only for those purposes for which they are duly authorized, respecting the current regulations on protection of personal data.

VIII. OWNER’S AUTHORIZATION AND CONSENT
MR BABOON HOSTEL requires the free, prior, express and informed consent of the owner of the personal data in order to be processed, except in cases expressly authorized by law, namely:

  1. Information requested by a public or administrative entity in exercising their legal functions or in accordance with a court order.
  2. Public data.
  3. Cases of medical or health emergency.
  4. Information processing authorized by law for historical, statistical or scientific purposes.
  5. Data related to the people’s Civil Registration.

Authorization statement

The authorization to MR BABOON HOSTEL for personal data processing will be granted by:

  • The owner, who must prove their identity as determined by MR BABOON HOSTEL
  • The owner’s successors, who must prove their status.
  • The owner’s representative and/or proxy, proving their representation or power of attorney.
  • Another determined by the owner.

Means to grant the authorization

MR BABOON HOSTEL will obtain authorization through different means, including the physical or electronic document, data message, Internet, Websites, or in any other format which allows obtaining consent through clear behaviors through which it is concluded that If it had not been provided by the owner or the person entitled to it, the data would not have been stored or captured in the database.

The authorization will be requested by MR BABOON HOSTEL prior to the personal data processing.

Proof of authorization

MR BABOON HOSTEL will keep the proof of the authorization granted by the owners of the personal data for processing, for which it will use the current mechanisms available as well as it will adopt the necessary actions to keep the record on the way and date on which it was obtained. Consequently, MR BABOON HOSTEL may establish physical files or electronic repositories made directly or through third parties contracted for this purpose.

Revocation of authorization.

The owners of personal data may at any time revoke the authorization granted to MR BABOON HOSTEL for processing their personal data or request their deletion, as long as it is not prevented by a legal or contractual provision. MR BABOON HOSTEL will establish simple and free mechanisms that allow the owner to revoke their authorization or request the deletion of their personal data, at least through the same means by which it was granted.

For doing so, it should be taken into account that the revocation of consent can be expressed, on the one hand, totally regarding the authorized purposes, and therefore MR BABOON HOSTEL must cease any activity related to data processing; and, on the other hand, partially regarding certain types of processing, in which case these will be the ones that will cease processing activities, such as for advertising purposes, among others. In the latter case, MR BABOON HOSTEL may continue to process personal data for those purposes in relation to which the owner had not revoked his consent.

IX. PROCESSING TO WHICH THE DATA WILL BE SUBJECT AND ITS PURPOSE The processing of the personal data of employees, providers, clients or any person with whom MR BABOON HOSTEL may establish or has established a permanent or occasional relation, will be carried out within the legal framework that regulates the matter.

In any case, the personal data may be collected and processed to:

  1. Send information related to programs, activities, news, content by area of interest, products and other goods and services offered by MR BABOON HOSTEL.
  2. Comply with the regulations applicable to providers and contractors, including but not limited to tax and trade regulations.
  3. Comply with the provisions of the Colombian legal system on labor matters and social security, among others, applicable to former employees, current employees and people to be hired.
  4. Conduct surveys related to MR BABOON HOSTEL’s goods and services.
  5. Comply with contractual commitments.

In order to process children’s and adolescents’ personal data, the provisions of this policy regarding their rights will be followed.

Sensitive data

In the case of sensitive personal data, MR BABOON HOSTEL may use and process them when:

  1. The owner has given their express authorization, except in cases in which such an authorization is not requested by law.
  2. The processing is necessary to safeguard the owner’s vital interest when they are physically or legally incapacitated. In this case, the legal representatives must grant their authorization.
  3. The processing is carried out during legitimate activities and with the due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided they refer exclusively to their members or to people who maintain regular contacts due to their purpose. In these events, the data cannot be provided to third parties without the owner’s authorization.
  4. The processing refers to data that may be necessary to acknowledge, exercise or defend a right in a judicial process.
  5. The processing has a historical, statistical or scientific purpose. In this event, the measures leading to the deletion of the owners’ identity must be adopted.

Without prejudice to the exceptions provided by law, the processing of sensitive data requires the owner’s prior, express and informed authorization, which must be obtained by any means that may be subject to subsequent consultation and verification.

X. PRIVACY NOTICEThe Privacy Notice is the physical document, electronic document or in any other format, made available to the owner in order to inform them about the processing of their personal data. Through this document, the owner is informed of the information related to the existence of MR BABOON HOSTEL’s information processing policies that will be applicable to them, how to access them and the processing characteristics intended for personal data.

The privacy notice must have at least the following information:

  1. The identity, address and contact information of the person responsible for the processing.
  2. The type of processing to which the data will be subject and its purpose.
  3. The owner’s rights.
  4. The general mechanisms provided by the person in charge so that the owner knows the information processing policy and the substantial changes that may occur. In all cases, the owner must be informed about how to access or consult the information processing policy.
  5. The optional nature of the answer regarding questions about sensitive data.

XI. GUARANTEES OF THE RIGHT OF ACCESSIn order to guarantee the right of access of the owner of the data, MR BABOON HOSTEL will make available to the latter, prior proof of their identity, legitimacy, or personality of their representative, at no cost or expense, in a detailed manner, the respective personal data through all kinds of means, including the electronic means that allow the owner’s direct access to them. Such access should be offered without any limit and should allow the owner the possibility to know and update them online.

XII. PROCEDURE FOR INQUIRIES, CLAIMS, REQUESTS FOR RECTIFICATIONS, UPDATE AND DELETION OF DATA

  1. Inquiries:The owners or their successors may inquire the owner’s personal information stored in MR BABOON HOSTEL, that will provide all the information contained in the individual record or that is linked to the owner’s identification.Regarding the requests for personal data inquiry, the COMPANY guarantees that:
    • It will provide electronic or other means of communication that it deems relevant.
    • It will establish forms, systems and other simplified methods, which must be informed in the privacy notice.
    • it will use customer services or claim services in operation.
    • In any case, regardless of the mechanism implemented for processing requests for inquiries, they will be answered within a maximum term of ten (10) business days counted from the date of receipt. When it is not possible to answer the inquiry within this term, the interested party will be informed before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which their inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first term.
    • The inquiries may be sent to the e-mail address admin@magictourcolombia.com.
  2.  Claims
    The owner or their successors who consider that the information contained in a database must be subject to correction, update or deletion, or when they notice the alleged breach of any of the duties contained in the law, they may file a claim at MR BABOON HOSTEL, which will be processed in accordance with the following rules:

  1. The owner’s claim will be made by request addressed to MR BABOON HOSTEL via the e-mail address calidad@magictourcolombia.com or written communication addressed to the quality department or area with the owner’s identification, the description of the facts that give rise to the claim, the address, and the corresponding documents. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim in order to correct the failures. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that they have given up the claim. In the event that the person receiving the claim is not competent to resolve it, they will transfer it to the corresponding party within a maximum period of two (2) business days and inform the interested party of the situation.
  2. Once the complete claim is received, it will be tagged with the label “claim in process” and the reason for it, in a term not exceeding two (2) business days. This label will be maintained until the claim is decided.
  3. The maximum term to respond to the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within this term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
  4. Request for update and/or rectification MR BABOON HOSTEL will rectify and update, at the owner’s request, the information that turns out to be incomplete or inaccurate, in accordance with the procedure and the terms indicated above, for which it will be taken into account:
    1. The owner must send the request to the e-mail address calidad@magictourcolombia.com or physically, addressed to the quality department, indicating the update and/or rectification to be made and will provide the documentation that supports their request.
    2. MR BABOON HOSTEL may enable mechanisms that facilitate the exercise of this right to the owner, provided that they benefit from it. Consequently, electronic or other means that they deem relevant may be enabled, which will be informed in the privacy notice and will be made available to those interested, in the website.
  5.  Request for deletion of data
    The owner of the personal data has the right to request MR BABOON HOSTEL their deletion in any of the following events:
    1. It is considered that the data are not being processed in accordance with the principles, duties and obligations provided in the current regulations.
    2. They are no longer necessary or relevant for the purpose for which they were collected.
    3. The period necessary for the fulfillment of the purposes for which they were collected has been exceededThis deletion implies the total or partial elimination of personal information as requested by the owner in the records, files, databases or processing carried out by MR BABOON HOSTEL. However, this right of the owner is not absolute and consequently MR BABOON HOSTEL may deny its exercise when:
      1. The owner has the legal or contractual duty to remain in the database.
      2. The elimination of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the update of administrative sanctions.
      3. The data are necessary to protect the owner’s legally protected interests; to perform an action based on the public interest, or to fulfill an obligation legally acquired by the owner.

XIII. NATIONAL REGISTER OF DATABASES
MR BABOON HOSTEL reserves, in the events contemplated in the law and in its internal statutes and regulations, the power to maintain and tag certain information stored in its databases as confidential in accordance with current regulations.

MR BABOON HOSTEL will proceed, in accordance with current regulations and regulations issued by the National Government for such purpose, to register its databases, at the National Register of Databases (RNBD) that will be administered by the Superintendence of Industry and Commerce. The RNBD is the public directory of the databases subject to processing that operate in the country, which may be consulted by citizens, in accordance with the regulations issued by the National Government for this purpose.

XIV. INFORMATION SECURITY AND SECURITY MEASURES
In compliance with the principle of security established in current regulations, MR BABOON HOSTEL will adopt the technical, human and administrative measures that may be necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

XV. INTERNATIONAL USE AND TRANSFER OF PERSONAL DATA AND PERSONAL INFORMATION BY THE COMPANY
In compliance with MR BABOON HOSTEL’s mission, and taking into account the nature of the permanent or occasional relations that any person who owns personal data may have for MR BABOON HOSTEL, the latter may transfer and transmit, even internationally, all personal data, as long as the applicable legal requirements are met; and, consequently, the owners, after accepting this policy, expressly authorize to transfer and transmit, even internationally, personal data. The data will be transferred, for all the relations that may be established with MR BABOON HOSTEL.

For the international transfer of the owners’ personal data, MR BABOON HOSTEL will take the necessary measures, so that third parties know and undertake to observe this policy, under the understanding that the personal information they receive, may only be used for matters directly related to MR BABOON HOSTEL and only while it lasts and may not be used or intended for a different purpose. For the international transfer of personal data, the provisions of article 26 of Law 1581 of 2012 will be observed.

The international transmissions of personal data carried out by MR BABOON HOSTEL will not require to be informed to the owner or have their consent when there is a contract for the transmission of personal data in accordance with article 25 of Decree 1377 of 2013.

MR BABOON HOSTEL may also exchange personal information with the government or other public authorities (including judicial or administrative authorities, tax authorities and criminal, civil, administrative, disciplinary and fiscal investigation agencies, among others), and third parties involved in civil legal proceedings and their accountants, auditors, lawyers and other advisors and representatives, because it is necessary or appropriate: (a) to comply with current laws, including laws other than those of their country of residence; (b) to comply with legal processes; (c) to respond to requests from public and government authorities, and to respond to requests from public and government authorities other than those of their country of residence; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect our rights, privacy, security or property, theirs or those of third parties; and (g) to receive the applicable compensations or to limit the damages that may affect us.

XVI. PERSON RESPONSIBLE AND IN CHARGE OF THE PERSONAL DATA PROCESSING MR BABOON HOSTEL will be responsible for the personal data processing.

XVII. EFFECT This policy is effective as of October 1, 2019 and revokes the special regulations or manuals that may have been adopted by administrative authorities at MR BABOON HOSTEL.