The implementation of this policy aims to guarantee the confidentiality of information and the security of its treatment for all clients, suppliers, employees, and third parties from whom Colecciones el Dorado Mundial SAS has legally obtained information and personal data in accordance with the guidelines established by the law regulating the right to Habeas Data. Furthermore, the issuance of this policy complies with the provisions of Section K of Article 17 of the aforementioned law.

Authorization: Prior, express, and informed consent of the data subject to carry out processing. This may be written, verbal, or through unequivocal conduct that allows us to reasonably conclude that the data subject has granted authorization.

Database : It is the organized set of Personal Data that is subject to processing, electronic or not, regardless of the method of its formation, storage, organization and access.

Query: Request by the data subject or by persons authorized by the data subject or by law to access the information held about them in databases or files.

Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons. This data is classified as sensitive, public, private, and semi-private.

Sensitive personal data: Information that affects a person's privacy or whose misuse may lead to discrimination, such as information that reveals racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data (fingerprints, among others).

For the purposes of this policy, Colecciones el Dorado Mundial SAS warns that the data subject has the discretion to provide this type of information in cases where it may be requested.

Public personal data: Data classified as such according to the mandates of the law or the Political Constitution, and all data that are not semi-private or private. Public data includes, among others, data contained in public documents, public registries, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality, data relating to a person's marital status, profession or trade, and status as a merchant or public servant. Personal data held in the commercial register of the Chambers of Commerce (Article 26 of the Civil Code) are public data.

Likewise, public data is data that, by virtue of a decision of the data subject or a legal mandate, is contained in files that are freely accessible and accessible. This data may be obtained and offered without reservation, regardless of whether it refers to general, private, or personal information.

Private personal data: Data that, due to its intimate or confidential nature, is only relevant to the data subject. Examples: merchant's books, private documents, information obtained from a home inspection.

Semi-private personal data: Semi-private data is data that is not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of people or to society in general, such as, among others, data relating to the fulfillment and non-fulfillment of financial obligations or data relating to relationships with social security entities.

Data Controller: Person who, either alone or in association with others, decides on the database and/or the processing of data.

Data processor: Person who processes data on behalf of the data controller.

"Authorized" refers to Colecciones el Dorado Mundial SAS and all persons under its responsibility who, by virtue of their authorization and the Policy, are entitled to process the data subject's personal data. Authorized includes those designated as authorized.

“Authorization” or being “Authorized” is the legitimacy that Colecciones el Dorado Mundial SAS expressly grants in writing, through a contract or document that acts as such, to third parties, in compliance with applicable law, for the processing of personal data, making such third parties responsible for the processing of the personal data delivered or made available.

Complaint: A request from the data subject or persons authorized by the data subject or by law to correct, update, or delete their personal data, or when they become aware of a suspected breach of the data protection regime, pursuant to Article 15 of Law 1581 of 2012.

Data owner: This is the natural person to whom the information refers.

Processing: Any operation or set of operations on personal data such as, but not limited to, the collection, storage, use, circulation or deletion of such information.

Transmission: Processing of personal data that involves communicating the same within (national transmission) or outside Colombia (international transmission) and whose purpose is to carry out processing by the data processor on behalf of the controller.

Transfer: Data transfer occurs when the controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient, who is in turn the controller and is located within or outside the country.

Admissibility requirement: The owner or beneficiary may only file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim process with the data controller or data processor, as provided for in Article 16 of Law 1581 of 2012.

• Political Constitution, article 15.
• Law 1266 of 2008.
• Law 1581 of 2012.
• Regulatory Decrees 1727 of 2009 and 2952 of 2010.
• Partial Regulatory Decree No. 1377 of 2013.
• Constitutional Court rulings C – 1011 of 2008 and C – 748 of 2011.

El Dorado Mundial SAS Collections, located at Carrera 43C 18-20, El Buque Neighborhood, Villavicencio, Meta, Colombia. Cell phones: +57 321 934 8117 - +57 310 576 2462, Email: contacto@coleccioneseldorado.com – Institutional website: www.coleccioneseldorado.com

Without prejudice to the exceptions provided for by law, processing requires the prior, express, and informed authorization of the data subject, which must be obtained by any means that can be subsequently consulted and verified.

Cases in which authorization is not required:

The authorization of the Holder will not be necessary when it comes to:

• a) Information required by a public or administrative entity in the exercise of its functions
  legal or by court order.
• b) Data of a public nature.
• c) Cases of medical or health emergencies.
• d) Processing of information authorized by law for historical, statistical or scientific purposes.
• e) Data related to the Civil Registry of Persons.

The processing of personal data must be carried out in compliance with the general and specific regulations on the subject matter and for activities permitted by law. Consequently, the following principles apply for the purposes of this policy:

Principle of legality: Data processing is a regulated activity that must comply with the provisions of the law and other implementing regulations.

Principle of purpose: The processing must comply with a legitimate purpose in accordance with the Constitution and the Law.

Principle of freedom: Processing may only be carried out with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial order that waives consent.

Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.

Transparency Principle: In the processing of data, the right of the data subject to obtain from the data controller, at any time and without restrictions, information about the existence of data concerning him or her must be guaranteed.

Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of the personal data, the provisions of the law, and the Constitution. In this regard, processing may only be carried out by persons authorized by the data subject and/or by the persons provided for by law.

Security Principle: Information subject to processing by the Data Controller or Data Processor referred to in this law must be handled with the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, unauthorized or fraudulent access, or consultation.

Confidentiality Principle : All persons involved in the processing of personal data that are not public in nature are required to guarantee the confidentiality of the information, even after their relationship with any of the tasks comprising the processing has ended, and may only provide or communicate personal data when this corresponds to the development of the activities authorized by this law and under the terms thereof.

In accordance with current legal provisions, the rights of personal information holders are as follows:

The right to know, update, rectify, and consult your personal data at any time with Colecciones el Dorado Mundial SAS regarding data you consider to be partial, inaccurate, incomplete, fragmented, or misleading.

The right to request proof of the authorization granted to Colecciones el Dorado Mundial SAS at any time, except in those cases in which the Controller is legally exempt from having authorization to process the data subject's data.

Right to be informed by Colecciones el Dorado Mundial SAS upon request by the data owner, regarding the use that has been given to the data.

The right to file any complaints you deem relevant to the Superintendency of Industry and Commerce to assert your right to Habeas Data.

The right to revoke authorization and/or request the deletion of any data when you consider that Colecciones el Dorado Mundial SAS has not respected your constitutional rights and guarantees.

Right to access free of charge the personal data that you voluntarily decide to share with Colecciones el Dorado Mundial SAS

The information and/or personal data we collect from you are the following:

Type of person:

Natural: first and last names, type of identification, identification number, gender, date of birth, email, address, cell phone number, country, city, and financial information (bank accounts).

Legal: company name, NIT, RNT (when applicable), address, telephone, cell phone, email, country, city, financial data (bank accounts).

Information necessary to facilitate purchases or other services, name and surname of the buyer (type of document, document number, date of birth, name, surname, gender, email, nationality, names and surnames, telephone number).

Cardholder information: document type, document number, phone number, address, email address, name, card number, expiration date, and bank.

Quote request: first name, last name, phone number, city, and email.

Chat “online help”: name, email, what is your question?

Claim request: first name, last name, ID number, address, phone number, city, email, and comments.

This data may be stored and/or processed on servers located in data processing centers, whether our own or contracted with suppliers, located in different countries. This is authorized by our clients/users upon accepting this personal data processing and protection policy.

Colecciones el Dorado Mundial SAS reserves the right to improve, update, modify, or delete any type of information, content, domain, or subdomain that may appear on the website without prior notice. It is understood that publication on the Colecciones el Dorado Mundial SAS website is sufficient for the resolution of legal or internal requests and for the provision or offering of new services or products.

In processing, the prevailing rights of children and adolescents will be respected. Colecciones el Dorado Mundial SAS is prohibited from processing personal data of children and adolescents, except for data that is public.

Colecciones el Dorado Mundial SAS informs data subjects that the data collected from our clients, contractors, and suppliers may be used for the following purposes. Colecciones el Dorado Mundial SAS may process the data directly or through its contractors, consultants, advisors, and/or third parties responsible for processing personal data, so that they may carry out any operation or set of operations such as the collection, storage, use, circulation, deletion, classification, transfer, and transmission (the "Processing") of all or part of your personal data:

• The support of the contractual relationship established with Colecciones el Dorado Mundial SAS
• The provision of services related to the products and services offered.
• All activities related to the service or product will be included in an email list for newsletter delivery.
• Send information about changes to the terms of purchased services and products, and notify you about new services or products.
• Manage your requests, clarifications, and investigations.
• Develop studies and programs that are necessary to determine consumer habits
• Refining security filters and business rules for commercial transactions; confirming and processing these transactions with your financial institution, our service providers, and yourself.
• Conduct periodic evaluations of our products and services in order to improve their quality.
• The sending, by traditional and electronic means, of technical, operational and commercial information on products and services offered by Colecciones el Dorado Mundial SAS , its partners or suppliers, currently and in the future.
• The request for satisfaction surveys, which you are not obliged to answer.
• Transmit and/or transfer data to other companies, business partners, or third parties in order to fulfill our obligations. This transmission and transfer may also be made to third countries that may have a different level of protection than Colombia, when necessary to fulfill our obligations.
• To fulfill the obligations contracted by Colecciones el Dorado Mundial SAS with its customers when they acquire our services and products.
• Respond to inquiries, requests, complaints, and claims made by regulatory agencies and other authorities that, pursuant to applicable law, must receive personal data.
• Any other activity of a similar nature to those previously described that is necessary to develop the corporate purpose of Colecciones el Dorado Mundial SAS

The Personal Data collected will be processed manually or automatically and incorporated into the corresponding files or databases (hereinafter, the "File") of Colecciones el Dorado Mundial SAS , either as the data processor or data protection officer. To determine the processing term, the regulations applicable to each purpose and the administrative, accounting, tax, legal, and historical aspects of the information will be considered.

When providing the service, when the data subject is accompanied by minors or persons considered to have disabilities, and their personal data is being collected, VIAJES HIPERMUNDOS will always request authorization from the minor's legal representative. However, if personal information of the population mentioned here is provided without being the legal representative, you declare that you have the authorization of the respective legal representative, and you directly assume the responsibility for this. Colecciones el Dorado Mundial SAS will strive to ensure that their rights and best interests are respected at all times. The representative must guarantee their right to be heard and assess their opinion on the processing, taking into account the maturity, autonomy, and capacity of the minors. Representatives are informed of the optional nature of answering questions about data relating to minors. The data of minors, who fall into a special protection category, will be processed in accordance with applicable legislation and in accordance with our personal data policy.

If you choose to delete your information, to the extent permitted by law, we will retain certain personal information for accounting and tax purposes, transactional data, fraud prevention, dispute resolution, investigation of disputes or incidents, enforcement of our terms and conditions of use, and compliance with legal requirements.

However, if you decide to revoke your authorization, the information stored will no longer be used for the purposes set forth herein, but only for the purposes strictly necessary and defined in the preceding paragraph.

Security Risks You Should Be Aware of When Transacting Online:

A user may be tricked by emails or DNS server scams into visiting a fake site with the same design, but with card details uploaded to the fake system, thereby stealing cardholder information. Therefore, it's important to foster a culture where users should access known domains directly when making transactions to reduce risk.

It is possible that the computer where the user is conducting the transaction may have spyware or malware installed without prior knowledge, which captures all keyboard input or information from input devices and sends it to a network or internet host. Therefore, it is recommended that the transaction be conducted on a home or office computer, if possible.

Identity theft could occur if the account holder denies having sent and/or received the transaction and it is used by a third party.

It is recommended that you have an updated and active antivirus program on the device where you conduct electronic transactions to mitigate the risk of fraud.

• Guarantee the holder, at all times, the full and effective exercise of the right to habeas data.
• Request and retain, under the conditions provided for in this law, a copy of the respective authorization granted by the owner.
• Properly inform the owner about the purpose of the collection and the rights to which they are entitled by virtue of the authorization granted.
• Keep information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
• Process queries and complaints submitted in accordance with the terms set forth in this law.
• Adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, to address inquiries and complaints.
• Inform the owner, upon request, about the use given to their data.
• Inform the data protection authority when security code violations occur and when there are risks in the management of data subjects' information.

Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

• Guarantee the holder, at all times, the full and effective exercise of the right to habeas data.
• Keep information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
• Promptly update, rectify or delete data in accordance with this law.
• Update the information reported by those responsible for the treatment within five (5) business days from its receipt.
• Process queries and complaints submitted by the owners in accordance with the terms set forth in this law.
• Refrain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendency of Industry and Commerce.
• Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

To receive requests, complaints, and inquiries related to the handling and processing of personal data, Colecciones el Dorado Mundial SAS has designated the email address contacto@coleccioneseldorado.com to channel, review, and respond to them. Therefore, you may send your requests to this address, which will be processed in accordance with Law 1581:

Inquiries: Owners or their successors in title may consult the owner's personal information stored in our database. Colecciones el Dorado Mundial SAS will provide them with all the information contained in the individual record or that is linked to the owner's identification. The inquiry will be answered within a maximum of ten (10) business days from the date of receipt. When it is not possible to answer the inquiry within this period, the interested party will be informed, and the date on which their inquiry will be answered will be indicated, which in no case may exceed five (5) business days following the expiration of the first term.

Claims: The owner or his successors in title who consider that the information contained in a database should be subject to correction, updating or deletion, or when they notice the alleged non-compliance with any of the duties contained in the law, may file a claim with Colecciones el Dorado Mundial SAS , which will be processed under the following rules:

1. The claim will be made by means of a request addressed to Colecciones el Dorado Mundial SAS with the identification of the owner, the description of the facts that give rise to the claim, the address, and accompanying the documents that wish to be asserted. If the claim is incomplete, Colecciones el Dorado Mundial SAS will require the interested party within five (5) days following receipt of the claim to correct the deficiencies. After two (2) months from the date of the request, if the applicant does not present the required information, it will be understood that he has withdrawn the claim.
2. Once the complete claim has been received, a legend stating "claim in process" and the reason for the claim will be added to the database within a period of no more than two (2) business days. This legend must remain in effect until the claim is decided.
3. The maximum term for addressing the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within this term, the interested party will be informed and the date on which their claim will be addressed will be indicated, which in no case may exceed eight (8) business days following the expiration of the first term.
4. In any case, the owner or the beneficiary may only file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim process with Colecciones el Dorado Mundial SAS .

The Privacy Notice is the physical, electronic, or other known or future document made available to the Data Subject for the processing of their personal data. This document informs the Data Subject regarding the existence of the information processing policies applicable to them, how to access them, and the characteristics of the intended processing of their personal data.

Colecciones el Dorado Mundial SAS publishes the privacy notice for users of its procedures and services on its website. It also physically notifies its employees and contractors of the privacy and confidentiality of data, requesting their written authorization for such processing.

If you have any questions or queries about the collection, processing, or transfer of your personal information, or if you believe that the information contained in a database should be corrected, updated, or deleted, please send us a message to the following email address: contacto@coleccioneseldorado.com

Colecciones el Dorado Mundial SAS may only collect, store, use, or distribute personal data for as long as is reasonable and necessary, in accordance with the purposes justifying the processing, in compliance with the provisions applicable to the subject matter in question and the administrative, accounting, tax, legal, and historical aspects of the information. Once the purpose(s) of the processing have been fulfilled, and without prejudice to legal regulations that provide otherwise, the personal data in its possession will be deleted. Notwithstanding the foregoing, personal data must be retained when required to comply with a legal or contractual obligation.

In accordance with the security principle established in Law 1581 of 2012, Colecciones el Dorado Mundial SAS will adopt the necessary technical, human, and administrative measures to ensure the security of records, preventing their alteration, loss, unauthorized or fraudulent access, use, or consultation. The personnel processing personal data will follow established protocols to guarantee the security of the information.

Colecciones el Dorado Mundial SAS reserves the right to modify this policy to adapt it to new legislation or jurisprudence, as well as to best practices in the tourism sector. In such cases, Colecciones el Dorado Mundial SAS will announce the changes on this page with reasonable notice before their implementation.

This policy was posted on the Colecciones el Dorado Mundial SAS website on February 15, 2025, and is effective as of the date of posting.