Official website of Sites in Colombia
Rights and duties
Pursuant to Article 15 of the Colombian Constitution, Law 1581 of 2012, and Decree 1074 of 2015, Sites Hospitality Group S.A.S. (hereinafter, "Sites") adopts this Personal Data Processing Policy. This Policy governs the collection, storage, use, disclosure, transmission, transfer, retention, and deletion of personal data for which Sites determines the purposes and means of Processing. It applies to the operations, hotels, locations, service channels, and websites associated with Sites Medellín, Sites Barranquilla, and Sites Montería.
1. PURPOSE AND SCOPE
This Policy sets out the rules governing Sites' Processing of personal data and identifies the Controller, the Data Subjects, the categories and sources of data, and the purposes of Processing. It also addresses authorization, Sensitive Personal Data, children's and adolescents' data, domestic and international data disclosures, security, retention, and the procedures for exercising data protection (habeas data) rights.
This Policy applies to personal data held in physical or digital form relating to guests, prospective guests, accompanying guests, visitors, website and Wi-Fi users, event participants, corporate clients, job applicants, employees, former employees, apprentices, contractors, suppliers, business partners, representatives, and other individuals connected with Sites' operations.
If an entity other than Sites Hospitality Group S.A.S. determines the purposes and means of a particular Processing activity, the relevant privacy notice will identify that entity as the Controller and provide its contact channels. If two or more entities jointly determine those purposes and means, the notice will explain their respective responsibilities and the applicable channels. Platforms that independently determine how personal data is processed may act as separate Controllers under their own policies.
2. IDENTITY OF THE DATA CONTROLLER
Legal name: Sites Hospitality Group S.A.S.
Tax Identification Number (NIT): 900504453-1
Registered office and principal place of business: Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia.
Email for data protection matters: contabilidad@sitesgroup.co
Telephone: (+57) 604 605 0006
Department responsible for handling Data Subject inquiries and claims: Administrative and Financial Department, or the department that assumes its responsibilities.
Digital channels covered by this Policy: https://www.sitesmedellin.com, https://www.sitesbarranquilla.com, and https://www.sitesmonteria.com, including their subdomains, forms, and booking engines, where Sites determines the purposes and means of Processing.
3. DEFINITIONS
Authorization: the Data Subject's prior, express, and informed consent to the Processing of personal data.
Privacy Notice: an oral, written, or electronic communication informing the Data Subject that this Policy exists, how to access it, the purposes of Processing, and the channels available for exercising their rights.
Database: an organized set of personal data subject to Processing.
Cookie: a file or similar technology that a website places on or accesses through a user's device to remember information, enable functionality, measure usage, or support advertising, as applicable.
Personal Data: any information relating to, or capable of being associated with, an identified or identifiable individual.
Public Data: data classified as public by law or the Constitution and that is not semi-private, private, or sensitive.
Sensitive Personal Data: data that affects a Data Subject's privacy or whose misuse could result in discrimination, including information concerning health, sex life, racial or ethnic origin, political affiliation, religious or philosophical beliefs, trade union membership, and biometric data.
Data Processor: an individual or legal entity that processes personal data on behalf of the Controller.
Data Controller: an individual or legal entity that determines the purposes and means of Processing or makes decisions concerning a database.
Data Subject: the individual to whom the personal data relates.
Processing: any operation or set of operations performed on personal data, including collection, recording, storage, consultation, use, disclosure, analysis, updating, transmission, transfer, deletion, or destruction.
Transfer: the disclosure of personal data by a Controller or Processor located in Colombia to another Controller located in Colombia or abroad.
Transmission: the disclosure of personal data to a Processor for Processing on behalf of the Controller, whether in Colombia or abroad.
4. DATA PROTECTION PRINCIPLES
Sites applies the principles of lawfulness, purpose limitation, freedom, accuracy and data quality, transparency, restricted access and disclosure, security, and confidentiality established in Law 1581 of 2012. Sites also implements accountability measures and seeks to ensure that each Processing activity is necessary and proportionate to the purpose disclosed to the Data Subject.
• Lawfulness: each Processing activity is conducted in accordance with the Constitution, applicable law, and the instructions of the competent authority.
• Purpose limitation: personal data is processed only for legitimate, specific purposes disclosed to the Data Subject.
• Freedom: unless a legal exception applies, Processing requires the Data Subject's prior, express, and informed authorization. Silence does not constitute consent.
• Data quality: personal data must be truthful, complete, accurate, up to date, verifiable, and understandable.
• Transparency: Data Subjects may obtain information about whether and how their personal data is being processed.
• Restricted access and disclosure: non-public data is accessible only to authorized persons or those legally entitled to access it.
• Security and confidentiality: reasonable safeguards are applied to prevent loss, alteration, unauthorized access, disclosure, or misuse, including after the relationship with Sites has ended.
• Necessity and proportionality: Sites seeks to collect only the personal data relevant to each purpose and to retain it only for as long as necessary.
5. DATA SUBJECTS, CATEGORIES OF DATA, AND SOURCES
5.1 Guests, prospective guests, accompanying guests, and visitors
Sites may process names, surnames, identification type and number, signatures, dates of birth, nationality, country of residence, contact details, booking and stay information, accompanying guest details, preferences, requests, billing and payment information, limited transaction details, incidents, images, and access records. For foreign guests, Sites may process the immigration and travel information required by the competent authorities. Where necessary, Sites may also process health information, reduced-mobility requirements, allergies, or other assistance needs, as well as personal data relating to children and adolescents.
Personal data may be obtained directly from the Data Subject; from the person making or paying for the booking; from family members or accompanying guests; from companies arranging accommodation; from travel agencies, tour operators, and booking platforms; from public authorities; or from public sources that may lawfully be used. If a third party provides another person's data, Sites will take reasonable steps to verify that the third party is authorized to do so and, where applicable, will inform the Data Subject and obtain authorization for any purpose not covered by a legal or contractual obligation. Data required for hotel registration or another legal obligation will be used only for that purpose.
5.2 Website, Wi-Fi, and social media users
Sites may process names, surnames, email addresses, telephone numbers, message content, booking information, IP addresses, device and browser identifiers, language settings, browsing activity, interactions with advertisements, cookie preferences, and technical connection data. On social media platforms, the platform provider may independently determine certain Processing activities.
5.3 Job applicants, employees, former employees, apprentices, and beneficiaries
Sites may process identification and contact details; résumés; education, experience, and references; contractual, salary, banking, tax, social security, family, disciplinary, and performance information; access records and images; and, where applicable, Sensitive Personal Data relating to occupational health, disability, or biometrics.
5.4 Suppliers, contractors, business partners, and corporate clients
Sites may process identification and contact details; representation, commercial, contractual, tax, and banking information; payment information; due diligence, security, and compliance records; and personal data relating to individuals involved in the business relationship.
6. AUTHORIZATION AND PRIVACY NOTICES
Unless a legal exception applies, Sites obtains authorization before collecting personal data or, at the latest, at the time of collection. Authorization may be given in writing, orally, electronically, or through unambiguous conduct that reasonably demonstrates the Data Subject's consent. Silence does not constitute authorization.
The authorization request or Privacy Notice states, at a minimum, the Processing activities and their purposes; the Data Subject's rights; the optional nature of answering questions concerning Sensitive Personal Data or children's and adolescents' data; the identity and contact channels of the Controller; and how to access this Policy.
Sites retains evidence of the authorization and of the information provided to the Data Subject. Acknowledging receipt of this Policy or stating that it has been read
does not, by itself, constitute authorization for Processing. Contact and booking forms, check-in and hotel registration processes, supplier onboarding, recruitment and hiring, Wi-Fi access, events, and other points of collection include a contextual Privacy Notice and, where required, a prior, express, and informed authorization covering the relevant purposes.
Before sending advertising or commercial communications, Sites verifies the Data Subject's authorization and communication preferences, consults the Registry of
Excluded Numbers (Registro de Números Excluidos) where applicable, and complies with the restrictions governing channels, timing, frequency, and opt-outs under Law 2300 of 2023 and the regulations issued by the Communications Regulation Commission. Marketing authorization is separate and optional, and no boxes are preselected. Each communication includes a free, simple, and effective opt-out mechanism. Refusing or withdrawing marketing authorization does not affect a booking, stay, or other requested service.
6.1 Circumstances in which authorization is not required
Authorization is not required for information requested by a public or administrative authority in the exercise of its statutory powers or under a court order; Public Data; medical or health emergencies; Processing authorized by law for historical, statistical, or scientific purposes; or data relating to the Civil Registry. All other applicable legal limits and obligations continue to apply.
7. SENSITIVE PERSONAL DATA AND CHILDREN'S AND ADOLESCENTS' DATA
7.1 Sensitive Personal Data
As a general rule, the Processing of Sensitive Personal Data is prohibited and may take place only in the circumstances set out in Article 6 of Law 1581 of 2012. Before collecting Sensitive Personal Data, Sites expressly identifies the data as sensitive, explains the specific purpose and the optional nature of providing it, and obtains prior, express, and informed authorization where required. Sites applies the principles of necessity and proportionality, restricts access, and uses enhanced security measures. No activity or service is conditional on a Data Subject providing Sensitive Personal Data.
Health, accessibility, and allergy information is processed only to the extent strictly necessary to address a specific request, comply with an employment obligation, or respond to a medical or health emergency. Sites offers a reasonable alternative that does not require the Sensitive Personal Data, limits Processing to the minimum necessary, and keeps a record of the authorization or applicable legal exception.
7.2 Children and adolescents
As a general rule, the Processing of children's and adolescents' personal data is prohibited, except for Public Data and in the circumstances permitted by the Constitution and applicable law. Any such Processing must respect their best interests and fundamental rights; be lawful, necessary, and proportionate; take their views into account in light of their age and maturity; and, where applicable, be based on the prior and informed authorization of their legal representative. When requesting authorization, Sites explains that answering questions concerning children's and adolescents' data is optional. Data that must be processed by law for hotel or immigration registration is identified separately, used only for that purpose, and processed under the applicable legal authority. Sites does not knowingly use this data for behavioral advertising, profiling, or non-essential technologies.
8. PURPOSES OF PROCESSING
8.1 Guests, prospective guests, accompanying guests, and clients
• Manage inquiries, quotes, availability, bookings, modifications, cancellations, payments, guarantees, billing, refunds, and receipts.
• Identify and register guests, accompanying guests, and visitors; complete check-in and check-out; and manage rooms, keys or access cards, purchases, services, and requests during the stay.
• Comply with hotel, tourism, immigration, tax, accounting, health, and consumer protection obligations, including guest records and the reports required by the competent authorities.
• Register guests and companions in the Accommodation Registration Card (TRA), transmit or report the information required to the Tourism Accommodation Information System (SIAT), and address statistical or tourism obligations before the Ministry of Commerce, Industry and Tourism, with accuracy, minimization, and subject to legal limits.
• Register and report to Migración Colombia, through the Foreign Resident Reporting Information System (SIRE), the entry and departure of foreign guests and the information required for immigration control, verifying the document and limiting its use to that legal obligation.
• Prevent, detect, and report situations of commercial sexual exploitation of children and adolescents associated with tourism, apply the code of conduct, and address requirements from the competent authorities.
• Address accessibility, dietary, health, and assistance needs; respond to emergencies; and protect the life, health, and safety of guests and third parties.
• Coordinate requested services, including transportation, events, food and beverage, laundry, experiences, and services provided by business partners, and disclose personal data where necessary to provide those services.
• Provide support, customer care, and after-sales service; and manage requests, complaints, claims, compliments, surveys, and disputes.
• Monitor service quality, prepare statistics, analyze occupancy and demand, and improve processes, facilities, products, and services, using aggregated or anonymized information whenever it is sufficient for the purpose.
• Maintain records of the relationship and reasonable guest preferences to facilitate future stays, within the purposes disclosed and the scope of the Data Subject's authorization.
8.2 Marketing and commercial communications
• Send information about accommodation, rates, promotions, events, contests, loyalty programs, and travel- and hospitality-related services only with the Data Subject's prior, express, and informed authorization or a documented legal exception applicable to the specific circumstances.
• Segment communications based on city, interaction history, or preferences, without using sensitive data for advertising except with explicit authorization and legal justification.
• Measure campaign effectiveness and manage opt-out requests. Each communication includes a free and simple opt-out mechanism. Sites retains evidence of the authorization, channel, source, date, and version, and applies Law 2300 of 2023 and the Registry of Excluded Numbers where applicable.
8.3 Job applicants, employees, and former employees
• Manage recruitment, reference checks, hiring, onboarding, training, performance reviews, compensation, payroll, benefits, well-being, social security, and termination of employment or engagement.
• Comply with employment, occupational health and safety, tax, accounting, immigration, judicial, and reporting obligations to authorities.
• Manage access, assets, tools, corporate communications, physical and information security, internal investigations, and business continuity.
• Retain records to issue certifications, establish or defend legal rights, and comply with post-termination obligations.
8.4 Suppliers, contractors, business partners, and corporate clients
• Conduct onboarding, due diligence, identity verification, compliance and risk management, negotiation, contracting, contract performance, payments, billing, accounting, audits, and termination of the relationship.
• Manage contacts, access, support, quality, security, incidents, and claims related to the business relationship.
8.5 General purposes
• Respond to requests from competent authorities; establish, exercise, or defend legal rights; prevent and address fraud or unlawful conduct; and support audits and investigations.
• Transmit personal data to service providers and, where applicable, transfer it to third parties in connection with corporate reorganizations or transactions, subject to the safeguards set out in this Policy and applicable law.
9. VIDEO SURVEILLANCE, AUDIO RECORDINGS, AND BIOMETRIC DATA
Sites may use video surveillance at entrances, in common and operational areas, and around property perimeters to protect people and assets, manage access, prevent and investigate incidents, and support operational security. Visible notices identify the purposes of the surveillance and the channels available for exercising Data Subject rights.
Cameras and microphones are not installed in guest rooms, bathrooms, changing rooms, or other areas where individuals have a heightened expectation of privacy. Access to recordings is restricted, and recordings are retained only for as long as necessary for the relevant purpose, unless they must be preserved in connection with an incident, claim, or legal obligation.
Customer service calls may be recorded in limited circumstances for specific quality, security, or evidentiary purposes. Data Subjects receive prior notice, and authorization is obtained where required. Sites does not make indiscriminate ambient audio recordings on its premises. Any additional use of a recording requires a documented assessment of necessity, proportionality, risk, and legal basis.
Before implementing fingerprint scanning, facial recognition, or another biometric system, Sites documents its necessity, suitability, proportionality, and risks; confirms that no less intrusive method is reasonably available; obtains separate, prior, express, and informed authorization where required; applies enhanced security measures; and offers a reasonable non-biometric alternative at no cost and without disadvantage or adverse effect on the service for anyone who declines or withdraws authorization. Access to a service is not conditional on the use of biometric data.
10. DIGITAL CHANNELS, COOKIES, WI-FI, AND THIRD PARTIES
In contact and booking forms, Sites processes the information entered by users to respond to inquiries, provide quotations, manage bookings, and deliver the requested services. Mandatory fields are limited to the personal data necessary for the request. Optional authorizations, particularly for marketing, are presented separately and without preselected boxes.
The websites use cookies and similar technologies to enable secure browsing, manage privacy preferences, submit forms, and complete bookings. Non-essential technologies used for preferences, analytics, advertising, or third-party content are activated only after the user has made a prior and informed choice. If a technology processes personal data, Sites obtains authorization or relies on an applicable, documented legal exception. Further information about cookie categories, service providers, available controls, and the current inventory is provided in the Cookie Policy and the Cookie Settings panel on each website.
When Sites provides Wi-Fi access, it may process device identifiers, authentication details, connection dates and times, duration, and technical logs required for security, support, and legal compliance. Sites does not use the content of communications for purposes incompatible with providing the service.
Links to travel agencies, payment gateways, social media platforms, maps, or other third-party websites may result in Processing independently determined by those third parties. Users should review the relevant third-party policies. Sites is responsible for the Processing activities it determines directly or entrusts to a service provider.
11. DATA SHARING AND RECIPIENTS
Sites may disclose, transmit, or transfer personal data, depending on the recipient's legal role and only to the extent necessary for the purposes disclosed, to providers of hosting, cloud services, technical support, booking engines, customer relationship management systems, email, and messaging services; travel agencies and tour operators; financial institutions and payment service providers; accountants, auditors, legal advisers, and insurers; security, video surveillance, transportation, event, laundry, and maintenance providers; social security and human resources entities; business partners requested by the Data Subject; affiliated companies; and other independent Controllers that have been duly disclosed.
Data Processors receive documented instructions, process personal data only for the contracted purpose, maintain confidentiality, apply appropriate security measures, and return or delete the information when the services end, unless a legal obligation requires its retention.
Sites discloses personal data to public or judicial authorities only in response to a valid request, statutory authority, court or administrative order, or reporting obligation. Recipients may include the Ministry of Commerce, Industry and Tourism for TRA/SIAT reporting and Migración Colombia for SIRE reporting. Any disclosure is limited to the relevant data and documented where appropriate. This Policy does not authorize discretionary disclosures.
In connection with a merger, spin-off, acquisition, reorganization, or transfer of a business unit, personal data may be disclosed subject to confidentiality obligations and the continued protection of the purposes and rights described in this Policy.
12. INTERNATIONAL DATA TRANSFERS AND TRANSMISSIONS
Some technology providers, booking engines, and cloud, messaging, analytics, security, or advertising service providers may process personal data in other countries. Before enabling an international data flow, Sites determines whether it constitutes a transfer or an international transmission and applies Law 1581 of 2012, Decree 1074 of 2015, the Single Circular, and the current instructions issued by the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio or "SIC").
Personal data is transferred internationally to another Controller only: (i) to a country recognized by the SIC as providing an adequate level of data protection; (ii) under an exception set out in Article 26 of Law 1581 of 2012, including, where applicable, the Data Subject's express and unambiguous authorization for the transfer; or (iii) under a declaration of conformity issued by the SIC. International transmissions to Data Processors are governed by a data transmission agreement that complies with Decree 1074 of 2015.
As an additional contractual accountability measure, Sites may use the standard contractual clauses adopted by the SIC in External Circular 003 of 2025, or any provisions that amend or replace it. Use of those clauses is voluntary and does not replace the analysis of the recipient country's level of protection, the applicable legal exception or authorization, a declaration of conformity, or the data transmission agreement required for each data flow.
Data Subjects may request general information about the categories of recipients, the country or region in which Processing takes place, and the safeguards that apply, subject to legitimate commercial, contractual, and security confidentiality requirements.
13. INFORMATION SECURITY AND INCIDENT MANAGEMENT
Sites implements reasonable administrative, organizational, human, and technical safeguards proportionate to the nature of the personal data and the level of risk. These measures include access and permission management, authentication, confidentiality controls, backups, system updates, event logging, physical security, training, service provider management, and incident response procedures.
Anyone who becomes aware of the loss, unauthorized access, disclosure, alteration, unavailability, or misuse of personal data must report it immediately through the designated internal channels. Sites acts to contain the incident, preserve evidence, assess its scope and risk, implement corrective measures, and document its decisions.
Sites reports notifiable incidents to the Superintendence of Industry and Commerce within fifteen (15) business days after the incident is detected and brought to the attention of the person or department responsible for handling it. Reports are submitted through the National Database Registry (RNBD) or the application designated by the authority, as applicable. Sites also notifies affected Data Subjects when required by law, the competent authority, or the level of risk.
14. RETENTION, ARCHIVING, AND DELETION
Personal data is retained for as long as necessary for the purpose disclosed and, thereafter, for any applicable statutory, contractual, accounting, tax, employment, tourism, immigration, limitation, or legal-defense period. Sites establishes and periodically reviews internal retention schedules or criteria for each business process.
• Bookings, hotel registration, purchases, billing, and payments: for the duration of the relationship and the periods required to comply with legal, accounting, tax, tourism, and contractual obligations and to handle claims.
• Employment and social security information: for the duration of the relationship and any statutory or archival period required to demonstrate compliance with employment, pension, and occupational health and safety obligations and rights.
• Suppliers and contractors: for the duration of the relationship and the periods required for accounting, tax, contractual, compliance, and legal-defense purposes.
• Video and audio recordings: for the shortest period consistent with security and operational needs, unless preservation is required because of an incident, investigation, claim, or order from a competent authority.
• Marketing information: until the Data Subject withdraws authorization, opts out, or the purpose is no longer applicable, without prejudice to retaining the minimum information necessary to honor and demonstrate the opt-out request.
• Cookies and digital identifiers: for the duration indicated in the Cookie Policy and the settings panel.
• Health, allergy, and accessibility information: deleted or blocked at the end of the stay once it is no longer necessary, unless an incident, legal obligation, or separate authorization supports its continued retention for future preferences.
Once the applicable retention period has expired, personal data is deleted or anonymized. A request for deletion or revocation may be denied only with respect to the minimum personal data that must be processed or retained to comply with an applicable legal or contractual obligation, an order from a competent authority, or another valid legal basis. Sites provides the Data Subject with a reasoned decision and, where appropriate, blocks or restricts access to the data until the applicable legal or limitation period expires. Sites maintains an internal retention schedule identifying the triggering event, retention period, legal basis, final disposition, and responsible person or department for each process.
15. DATA SUBJECT RIGHTS
• Access, review, update, and correct their personal data.
• Request proof of the authorization, except in cases where the law exempts this requirement.
• Be informed, upon request, about the use given to their data.
• Submit inquiries and claims and receive a response within the statutory time limits.
• Withdraw authorization or request deletion where permitted and where no legal or contractual obligation requires the information to be retained.
• Access their personal data free of charge at least once each calendar month and whenever substantial changes to this Policy justify a new request, in accordance with applicable law.
• File a complaint with the Superintendence of Industry and Commerce after completing the applicable inquiry or claim process with Sites concerning the disputed matter.
• Decline to answer questions concerning Sensitive Personal Data or children's and adolescents' data.
16. PERSONS ENTITLED TO EXERCISE DATA SUBJECT RIGHTS
Rights may be exercised by the Data Subject; their heirs or successors in interest, upon proof of that status; their duly authorized representative or attorney-in-fact; or a person acting under a stipulation for the benefit of another or on another person's behalf. For children and adolescents, the legal representative exercises these rights, taking into account the child's or adolescent's views in light of their maturity.
Before disclosing information or making a requested change, Sites takes reasonable steps to verify the requester's identity and authority. Any department that receives a request forwards it promptly to the department responsible for responding. The statutory response period begins when Sites receives the request, and Data Subjects are not adversely affected by internal routing.
17. CHANNELS AND PROCEDURES FOR INQUIRIES AND CLAIMS
Requests should be submitted to the Administrative and Financial Department by email at contadora@sitesgroup.co, by mail or hand delivery to Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia, or by telephone at (+57) 604 605 0006. Sites may make additional channels available and publish them on its websites.
17.1 Required information
A request must include the Data Subject's name and identification; contact details for the response; a clear description of the inquiry, relevant facts, or right being exercised; any supporting documents; and, if a third party submits the request, proof of representation or legal standing. Sites does not require information that is unnecessary to process the request.
17.2 Inquiries
Sites responds to inquiries within ten (10) business days of receipt. If a response cannot be provided within that period, Sites informs the requester before the period expires, explains the reason for the delay, and states the response date, which may not be more than five (5) additional business days after the initial deadline.
17.3 Claims
If a claim is incomplete, Sites asks the claimant to provide the missing information within five (5) days of receipt. If the claimant does not respond within two (2) months, the claim is deemed withdrawn. If Sites is not the appropriate party to handle the claim, it forwards the claim to the competent party within two (2) business days, if known, and informs the claimant.
Once a complete claim is received, Sites adds a "claim pending" notation and the reason for the claim to the relevant database within two (2) business days. Sites responds to the claim within fifteen (15) business days of receipt. If a response cannot be provided within that period, Sites explains the reason for the delay and provides a new response date, which may not be more than eight (8) additional business days after the initial deadline.
17.4 Withdrawal of authorization and deletion
The Data Subject must indicate whether authorization is being withdrawn entirely or only for a particular purpose, such as marketing. A request for deletion or revocation may be denied only with respect to the minimum personal data that must be processed or retained to comply with an applicable legal or contractual obligation, an order from a competent authority, or another valid legal basis. Sites explains the reasons for its decision, notifies the Data Subject, and restricts access to the data where appropriate.
18. COMPLAINTS TO THE SUPERINTENDENCE OF INDUSTRY AND COMMERCE
A Data Subject or successor in interest may file a complaint with the Superintendence of Industry and Commerce after completing the applicable inquiry or claim process with Sites concerning the disputed matter, in accordance with Article 16 of Law 1581 of 2012.
19. OBLIGATIONS OF SITES AND ITS DATA PROCESSORS
When acting as Controller, Sites upholds Data Subject rights; requests and retains evidence of authorization where required; discloses the purposes of Processing and the Data Subject's rights; maintains the quality and security of personal data; updates, corrects, and deletes data where appropriate; responds to inquiries and claims; requires appropriate safeguards from its Data Processors; manages security incidents; and complies with instructions issued by the SIC.
When acting as a Data Processor, Sites processes personal data in accordance with the Controller's instructions; maintains security, confidentiality, and restricted access; promptly updates, corrects, or deletes information; adds any legally required notations; handles the requests for which it is responsible; reports incidents to the Controller; and complies with all other applicable legal obligations.
Agreements with Data Processors define, based on risk, the purpose and duration of Processing, security measures, subcontracting, data location, transfers or transmissions, return or deletion of personal data, audit rights, incident management, and cooperation in responding to Data Subject requests.
20. DATA GOVERNANCE AND THE NATIONAL DATABASE REGISTRY
The Administrative and Financial Department coordinates implementation of this Policy with the Quality, Technology, Human Resources, Operations, Marketing, Security, and other departments that process personal data. Sites maintains internal procedures, an inventory of databases and data flows, a purpose matrix, authorization forms, third-party management processes, training, and compliance controls.
Appointing a responsible person or department facilitates administration of this Policy but does not transfer or reduce the legal obligations of Sites Hospitality Group S.A.S. as a Data Controller or Data Processor.
If Sites is subject to the registration requirements under Decree 1074 of 2015, as amended by Decree 90 of 2018, it registers its databases with the National Database Registry, keeps the registrations current, and submits all required reports. For private companies, this obligation depends, among other statutory criteria, on the applicable asset threshold; it does not arise solely because the company processes Sensitive Personal Data or children's or adolescents' data.
21. CHANGES TO THIS POLICY
Sites may update this Policy to reflect changes in law, technology, or its operations. The current version is published at https://www.sitesmedellin.com/es/politica-privacidad/, https://www.sitesbarranquilla.com/es/politica-privacidad/, and https://www.sitesmonteria.com/es/politica-privacidad/ and is available through Sites' service channels. Sites communicates any material change before it takes effect. If a change introduces a new purpose of Processing, Sites informs the Data Subject and obtains new authorization before Processing begins for that purpose, unless an express legal exception applies.
22. GOVERNING LAW, EFFECTIVE DATE, AND VERSION
This Policy is governed by Article 15 of the Colombian Constitution, Law 1581 of 2012, Decree 1074 of 2015, Law 2300 of 2023, applicable regulations issued by the Communications Regulation Commission, instructions issued by the Superintendence of Industry and Commerce, and any provisions that amend, supplement, or replace them.
This is version 02 of the Policy, updated on September 16, 2026. It takes effect upon approval and publication and replaces the previous version in full. Personal data is retained only for as long as the purposes disclosed remain applicable or a legal or contractual basis justifies its continued retention, in accordance with Section 14.
1. PURPOSE AND SCOPE
This Policy sets out the rules governing Sites' Processing of personal data and identifies the Controller, the Data Subjects, the categories and sources of data, and the purposes of Processing. It also addresses authorization, Sensitive Personal Data, children's and adolescents' data, domestic and international data disclosures, security, retention, and the procedures for exercising data protection (habeas data) rights.
This Policy applies to personal data held in physical or digital form relating to guests, prospective guests, accompanying guests, visitors, website and Wi-Fi users, event participants, corporate clients, job applicants, employees, former employees, apprentices, contractors, suppliers, business partners, representatives, and other individuals connected with Sites' operations.
If an entity other than Sites Hospitality Group S.A.S. determines the purposes and means of a particular Processing activity, the relevant privacy notice will identify that entity as the Controller and provide its contact channels. If two or more entities jointly determine those purposes and means, the notice will explain their respective responsibilities and the applicable channels. Platforms that independently determine how personal data is processed may act as separate Controllers under their own policies.
2. IDENTITY OF THE DATA CONTROLLER
Legal name: Sites Hospitality Group S.A.S.
Tax Identification Number (NIT): 900504453-1
Registered office and principal place of business: Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia.
Email for data protection matters: contabilidad@sitesgroup.co
Telephone: (+57) 604 605 0006
Department responsible for handling Data Subject inquiries and claims: Administrative and Financial Department, or the department that assumes its responsibilities.
Digital channels covered by this Policy: https://www.sitesmedellin.com, https://www.sitesbarranquilla.com, and https://www.sitesmonteria.com, including their subdomains, forms, and booking engines, where Sites determines the purposes and means of Processing.
3. DEFINITIONS
Authorization: the Data Subject's prior, express, and informed consent to the Processing of personal data.
Privacy Notice: an oral, written, or electronic communication informing the Data Subject that this Policy exists, how to access it, the purposes of Processing, and the channels available for exercising their rights.
Database: an organized set of personal data subject to Processing.
Cookie: a file or similar technology that a website places on or accesses through a user's device to remember information, enable functionality, measure usage, or support advertising, as applicable.
Personal Data: any information relating to, or capable of being associated with, an identified or identifiable individual.
Public Data: data classified as public by law or the Constitution and that is not semi-private, private, or sensitive.
Sensitive Personal Data: data that affects a Data Subject's privacy or whose misuse could result in discrimination, including information concerning health, sex life, racial or ethnic origin, political affiliation, religious or philosophical beliefs, trade union membership, and biometric data.
Data Processor: an individual or legal entity that processes personal data on behalf of the Controller.
Data Controller: an individual or legal entity that determines the purposes and means of Processing or makes decisions concerning a database.
Data Subject: the individual to whom the personal data relates.
Processing: any operation or set of operations performed on personal data, including collection, recording, storage, consultation, use, disclosure, analysis, updating, transmission, transfer, deletion, or destruction.
Transfer: the disclosure of personal data by a Controller or Processor located in Colombia to another Controller located in Colombia or abroad.
Transmission: the disclosure of personal data to a Processor for Processing on behalf of the Controller, whether in Colombia or abroad.
4. DATA PROTECTION PRINCIPLES
Sites applies the principles of lawfulness, purpose limitation, freedom, accuracy and data quality, transparency, restricted access and disclosure, security, and confidentiality established in Law 1581 of 2012. Sites also implements accountability measures and seeks to ensure that each Processing activity is necessary and proportionate to the purpose disclosed to the Data Subject.
• Lawfulness: each Processing activity is conducted in accordance with the Constitution, applicable law, and the instructions of the competent authority.
• Purpose limitation: personal data is processed only for legitimate, specific purposes disclosed to the Data Subject.
• Freedom: unless a legal exception applies, Processing requires the Data Subject's prior, express, and informed authorization. Silence does not constitute consent.
• Data quality: personal data must be truthful, complete, accurate, up to date, verifiable, and understandable.
• Transparency: Data Subjects may obtain information about whether and how their personal data is being processed.
• Restricted access and disclosure: non-public data is accessible only to authorized persons or those legally entitled to access it.
• Security and confidentiality: reasonable safeguards are applied to prevent loss, alteration, unauthorized access, disclosure, or misuse, including after the relationship with Sites has ended.
• Necessity and proportionality: Sites seeks to collect only the personal data relevant to each purpose and to retain it only for as long as necessary.
5. DATA SUBJECTS, CATEGORIES OF DATA, AND SOURCES
5.1 Guests, prospective guests, accompanying guests, and visitors
Sites may process names, surnames, identification type and number, signatures, dates of birth, nationality, country of residence, contact details, booking and stay information, accompanying guest details, preferences, requests, billing and payment information, limited transaction details, incidents, images, and access records. For foreign guests, Sites may process the immigration and travel information required by the competent authorities. Where necessary, Sites may also process health information, reduced-mobility requirements, allergies, or other assistance needs, as well as personal data relating to children and adolescents.
Personal data may be obtained directly from the Data Subject; from the person making or paying for the booking; from family members or accompanying guests; from companies arranging accommodation; from travel agencies, tour operators, and booking platforms; from public authorities; or from public sources that may lawfully be used. If a third party provides another person's data, Sites will take reasonable steps to verify that the third party is authorized to do so and, where applicable, will inform the Data Subject and obtain authorization for any purpose not covered by a legal or contractual obligation. Data required for hotel registration or another legal obligation will be used only for that purpose.
5.2 Website, Wi-Fi, and social media users
Sites may process names, surnames, email addresses, telephone numbers, message content, booking information, IP addresses, device and browser identifiers, language settings, browsing activity, interactions with advertisements, cookie preferences, and technical connection data. On social media platforms, the platform provider may independently determine certain Processing activities.
5.3 Job applicants, employees, former employees, apprentices, and beneficiaries
Sites may process identification and contact details; résumés; education, experience, and references; contractual, salary, banking, tax, social security, family, disciplinary, and performance information; access records and images; and, where applicable, Sensitive Personal Data relating to occupational health, disability, or biometrics.
5.4 Suppliers, contractors, business partners, and corporate clients
Sites may process identification and contact details; representation, commercial, contractual, tax, and banking information; payment information; due diligence, security, and compliance records; and personal data relating to individuals involved in the business relationship.
6. AUTHORIZATION AND PRIVACY NOTICES
Unless a legal exception applies, Sites obtains authorization before collecting personal data or, at the latest, at the time of collection. Authorization may be given in writing, orally, electronically, or through unambiguous conduct that reasonably demonstrates the Data Subject's consent. Silence does not constitute authorization.
The authorization request or Privacy Notice states, at a minimum, the Processing activities and their purposes; the Data Subject's rights; the optional nature of answering questions concerning Sensitive Personal Data or children's and adolescents' data; the identity and contact channels of the Controller; and how to access this Policy.
Sites retains evidence of the authorization and of the information provided to the Data Subject. Acknowledging receipt of this Policy or stating that it has been read
does not, by itself, constitute authorization for Processing. Contact and booking forms, check-in and hotel registration processes, supplier onboarding, recruitment and hiring, Wi-Fi access, events, and other points of collection include a contextual Privacy Notice and, where required, a prior, express, and informed authorization covering the relevant purposes.
Before sending advertising or commercial communications, Sites verifies the Data Subject's authorization and communication preferences, consults the Registry of
Excluded Numbers (Registro de Números Excluidos) where applicable, and complies with the restrictions governing channels, timing, frequency, and opt-outs under Law 2300 of 2023 and the regulations issued by the Communications Regulation Commission. Marketing authorization is separate and optional, and no boxes are preselected. Each communication includes a free, simple, and effective opt-out mechanism. Refusing or withdrawing marketing authorization does not affect a booking, stay, or other requested service.
6.1 Circumstances in which authorization is not required
Authorization is not required for information requested by a public or administrative authority in the exercise of its statutory powers or under a court order; Public Data; medical or health emergencies; Processing authorized by law for historical, statistical, or scientific purposes; or data relating to the Civil Registry. All other applicable legal limits and obligations continue to apply.
7. SENSITIVE PERSONAL DATA AND CHILDREN'S AND ADOLESCENTS' DATA
7.1 Sensitive Personal Data
As a general rule, the Processing of Sensitive Personal Data is prohibited and may take place only in the circumstances set out in Article 6 of Law 1581 of 2012. Before collecting Sensitive Personal Data, Sites expressly identifies the data as sensitive, explains the specific purpose and the optional nature of providing it, and obtains prior, express, and informed authorization where required. Sites applies the principles of necessity and proportionality, restricts access, and uses enhanced security measures. No activity or service is conditional on a Data Subject providing Sensitive Personal Data.
Health, accessibility, and allergy information is processed only to the extent strictly necessary to address a specific request, comply with an employment obligation, or respond to a medical or health emergency. Sites offers a reasonable alternative that does not require the Sensitive Personal Data, limits Processing to the minimum necessary, and keeps a record of the authorization or applicable legal exception.
7.2 Children and adolescents
As a general rule, the Processing of children's and adolescents' personal data is prohibited, except for Public Data and in the circumstances permitted by the Constitution and applicable law. Any such Processing must respect their best interests and fundamental rights; be lawful, necessary, and proportionate; take their views into account in light of their age and maturity; and, where applicable, be based on the prior and informed authorization of their legal representative. When requesting authorization, Sites explains that answering questions concerning children's and adolescents' data is optional. Data that must be processed by law for hotel or immigration registration is identified separately, used only for that purpose, and processed under the applicable legal authority. Sites does not knowingly use this data for behavioral advertising, profiling, or non-essential technologies.
8. PURPOSES OF PROCESSING
8.1 Guests, prospective guests, accompanying guests, and clients
• Manage inquiries, quotes, availability, bookings, modifications, cancellations, payments, guarantees, billing, refunds, and receipts.
• Identify and register guests, accompanying guests, and visitors; complete check-in and check-out; and manage rooms, keys or access cards, purchases, services, and requests during the stay.
• Comply with hotel, tourism, immigration, tax, accounting, health, and consumer protection obligations, including guest records and the reports required by the competent authorities.
• Register guests and companions in the Accommodation Registration Card (TRA), transmit or report the information required to the Tourism Accommodation Information System (SIAT), and address statistical or tourism obligations before the Ministry of Commerce, Industry and Tourism, with accuracy, minimization, and subject to legal limits.
• Register and report to Migración Colombia, through the Foreign Resident Reporting Information System (SIRE), the entry and departure of foreign guests and the information required for immigration control, verifying the document and limiting its use to that legal obligation.
• Prevent, detect, and report situations of commercial sexual exploitation of children and adolescents associated with tourism, apply the code of conduct, and address requirements from the competent authorities.
• Address accessibility, dietary, health, and assistance needs; respond to emergencies; and protect the life, health, and safety of guests and third parties.
• Coordinate requested services, including transportation, events, food and beverage, laundry, experiences, and services provided by business partners, and disclose personal data where necessary to provide those services.
• Provide support, customer care, and after-sales service; and manage requests, complaints, claims, compliments, surveys, and disputes.
• Monitor service quality, prepare statistics, analyze occupancy and demand, and improve processes, facilities, products, and services, using aggregated or anonymized information whenever it is sufficient for the purpose.
• Maintain records of the relationship and reasonable guest preferences to facilitate future stays, within the purposes disclosed and the scope of the Data Subject's authorization.
8.2 Marketing and commercial communications
• Send information about accommodation, rates, promotions, events, contests, loyalty programs, and travel- and hospitality-related services only with the Data Subject's prior, express, and informed authorization or a documented legal exception applicable to the specific circumstances.
• Segment communications based on city, interaction history, or preferences, without using sensitive data for advertising except with explicit authorization and legal justification.
• Measure campaign effectiveness and manage opt-out requests. Each communication includes a free and simple opt-out mechanism. Sites retains evidence of the authorization, channel, source, date, and version, and applies Law 2300 of 2023 and the Registry of Excluded Numbers where applicable.
8.3 Job applicants, employees, and former employees
• Manage recruitment, reference checks, hiring, onboarding, training, performance reviews, compensation, payroll, benefits, well-being, social security, and termination of employment or engagement.
• Comply with employment, occupational health and safety, tax, accounting, immigration, judicial, and reporting obligations to authorities.
• Manage access, assets, tools, corporate communications, physical and information security, internal investigations, and business continuity.
• Retain records to issue certifications, establish or defend legal rights, and comply with post-termination obligations.
8.4 Suppliers, contractors, business partners, and corporate clients
• Conduct onboarding, due diligence, identity verification, compliance and risk management, negotiation, contracting, contract performance, payments, billing, accounting, audits, and termination of the relationship.
• Manage contacts, access, support, quality, security, incidents, and claims related to the business relationship.
8.5 General purposes
• Respond to requests from competent authorities; establish, exercise, or defend legal rights; prevent and address fraud or unlawful conduct; and support audits and investigations.
• Transmit personal data to service providers and, where applicable, transfer it to third parties in connection with corporate reorganizations or transactions, subject to the safeguards set out in this Policy and applicable law.
9. VIDEO SURVEILLANCE, AUDIO RECORDINGS, AND BIOMETRIC DATA
Sites may use video surveillance at entrances, in common and operational areas, and around property perimeters to protect people and assets, manage access, prevent and investigate incidents, and support operational security. Visible notices identify the purposes of the surveillance and the channels available for exercising Data Subject rights.
Cameras and microphones are not installed in guest rooms, bathrooms, changing rooms, or other areas where individuals have a heightened expectation of privacy. Access to recordings is restricted, and recordings are retained only for as long as necessary for the relevant purpose, unless they must be preserved in connection with an incident, claim, or legal obligation.
Customer service calls may be recorded in limited circumstances for specific quality, security, or evidentiary purposes. Data Subjects receive prior notice, and authorization is obtained where required. Sites does not make indiscriminate ambient audio recordings on its premises. Any additional use of a recording requires a documented assessment of necessity, proportionality, risk, and legal basis.
Before implementing fingerprint scanning, facial recognition, or another biometric system, Sites documents its necessity, suitability, proportionality, and risks; confirms that no less intrusive method is reasonably available; obtains separate, prior, express, and informed authorization where required; applies enhanced security measures; and offers a reasonable non-biometric alternative at no cost and without disadvantage or adverse effect on the service for anyone who declines or withdraws authorization. Access to a service is not conditional on the use of biometric data.
10. DIGITAL CHANNELS, COOKIES, WI-FI, AND THIRD PARTIES
In contact and booking forms, Sites processes the information entered by users to respond to inquiries, provide quotations, manage bookings, and deliver the requested services. Mandatory fields are limited to the personal data necessary for the request. Optional authorizations, particularly for marketing, are presented separately and without preselected boxes.
The websites use cookies and similar technologies to enable secure browsing, manage privacy preferences, submit forms, and complete bookings. Non-essential technologies used for preferences, analytics, advertising, or third-party content are activated only after the user has made a prior and informed choice. If a technology processes personal data, Sites obtains authorization or relies on an applicable, documented legal exception. Further information about cookie categories, service providers, available controls, and the current inventory is provided in the Cookie Policy and the Cookie Settings panel on each website.
When Sites provides Wi-Fi access, it may process device identifiers, authentication details, connection dates and times, duration, and technical logs required for security, support, and legal compliance. Sites does not use the content of communications for purposes incompatible with providing the service.
Links to travel agencies, payment gateways, social media platforms, maps, or other third-party websites may result in Processing independently determined by those third parties. Users should review the relevant third-party policies. Sites is responsible for the Processing activities it determines directly or entrusts to a service provider.
11. DATA SHARING AND RECIPIENTS
Sites may disclose, transmit, or transfer personal data, depending on the recipient's legal role and only to the extent necessary for the purposes disclosed, to providers of hosting, cloud services, technical support, booking engines, customer relationship management systems, email, and messaging services; travel agencies and tour operators; financial institutions and payment service providers; accountants, auditors, legal advisers, and insurers; security, video surveillance, transportation, event, laundry, and maintenance providers; social security and human resources entities; business partners requested by the Data Subject; affiliated companies; and other independent Controllers that have been duly disclosed.
Data Processors receive documented instructions, process personal data only for the contracted purpose, maintain confidentiality, apply appropriate security measures, and return or delete the information when the services end, unless a legal obligation requires its retention.
Sites discloses personal data to public or judicial authorities only in response to a valid request, statutory authority, court or administrative order, or reporting obligation. Recipients may include the Ministry of Commerce, Industry and Tourism for TRA/SIAT reporting and Migración Colombia for SIRE reporting. Any disclosure is limited to the relevant data and documented where appropriate. This Policy does not authorize discretionary disclosures.
In connection with a merger, spin-off, acquisition, reorganization, or transfer of a business unit, personal data may be disclosed subject to confidentiality obligations and the continued protection of the purposes and rights described in this Policy.
12. INTERNATIONAL DATA TRANSFERS AND TRANSMISSIONS
Some technology providers, booking engines, and cloud, messaging, analytics, security, or advertising service providers may process personal data in other countries. Before enabling an international data flow, Sites determines whether it constitutes a transfer or an international transmission and applies Law 1581 of 2012, Decree 1074 of 2015, the Single Circular, and the current instructions issued by the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio or "SIC").
Personal data is transferred internationally to another Controller only: (i) to a country recognized by the SIC as providing an adequate level of data protection; (ii) under an exception set out in Article 26 of Law 1581 of 2012, including, where applicable, the Data Subject's express and unambiguous authorization for the transfer; or (iii) under a declaration of conformity issued by the SIC. International transmissions to Data Processors are governed by a data transmission agreement that complies with Decree 1074 of 2015.
As an additional contractual accountability measure, Sites may use the standard contractual clauses adopted by the SIC in External Circular 003 of 2025, or any provisions that amend or replace it. Use of those clauses is voluntary and does not replace the analysis of the recipient country's level of protection, the applicable legal exception or authorization, a declaration of conformity, or the data transmission agreement required for each data flow.
Data Subjects may request general information about the categories of recipients, the country or region in which Processing takes place, and the safeguards that apply, subject to legitimate commercial, contractual, and security confidentiality requirements.
13. INFORMATION SECURITY AND INCIDENT MANAGEMENT
Sites implements reasonable administrative, organizational, human, and technical safeguards proportionate to the nature of the personal data and the level of risk. These measures include access and permission management, authentication, confidentiality controls, backups, system updates, event logging, physical security, training, service provider management, and incident response procedures.
Anyone who becomes aware of the loss, unauthorized access, disclosure, alteration, unavailability, or misuse of personal data must report it immediately through the designated internal channels. Sites acts to contain the incident, preserve evidence, assess its scope and risk, implement corrective measures, and document its decisions.
Sites reports notifiable incidents to the Superintendence of Industry and Commerce within fifteen (15) business days after the incident is detected and brought to the attention of the person or department responsible for handling it. Reports are submitted through the National Database Registry (RNBD) or the application designated by the authority, as applicable. Sites also notifies affected Data Subjects when required by law, the competent authority, or the level of risk.
14. RETENTION, ARCHIVING, AND DELETION
Personal data is retained for as long as necessary for the purpose disclosed and, thereafter, for any applicable statutory, contractual, accounting, tax, employment, tourism, immigration, limitation, or legal-defense period. Sites establishes and periodically reviews internal retention schedules or criteria for each business process.
• Bookings, hotel registration, purchases, billing, and payments: for the duration of the relationship and the periods required to comply with legal, accounting, tax, tourism, and contractual obligations and to handle claims.
• Employment and social security information: for the duration of the relationship and any statutory or archival period required to demonstrate compliance with employment, pension, and occupational health and safety obligations and rights.
• Suppliers and contractors: for the duration of the relationship and the periods required for accounting, tax, contractual, compliance, and legal-defense purposes.
• Video and audio recordings: for the shortest period consistent with security and operational needs, unless preservation is required because of an incident, investigation, claim, or order from a competent authority.
• Marketing information: until the Data Subject withdraws authorization, opts out, or the purpose is no longer applicable, without prejudice to retaining the minimum information necessary to honor and demonstrate the opt-out request.
• Cookies and digital identifiers: for the duration indicated in the Cookie Policy and the settings panel.
• Health, allergy, and accessibility information: deleted or blocked at the end of the stay once it is no longer necessary, unless an incident, legal obligation, or separate authorization supports its continued retention for future preferences.
Once the applicable retention period has expired, personal data is deleted or anonymized. A request for deletion or revocation may be denied only with respect to the minimum personal data that must be processed or retained to comply with an applicable legal or contractual obligation, an order from a competent authority, or another valid legal basis. Sites provides the Data Subject with a reasoned decision and, where appropriate, blocks or restricts access to the data until the applicable legal or limitation period expires. Sites maintains an internal retention schedule identifying the triggering event, retention period, legal basis, final disposition, and responsible person or department for each process.
15. DATA SUBJECT RIGHTS
• Access, review, update, and correct their personal data.
• Request proof of the authorization, except in cases where the law exempts this requirement.
• Be informed, upon request, about the use given to their data.
• Submit inquiries and claims and receive a response within the statutory time limits.
• Withdraw authorization or request deletion where permitted and where no legal or contractual obligation requires the information to be retained.
• Access their personal data free of charge at least once each calendar month and whenever substantial changes to this Policy justify a new request, in accordance with applicable law.
• File a complaint with the Superintendence of Industry and Commerce after completing the applicable inquiry or claim process with Sites concerning the disputed matter.
• Decline to answer questions concerning Sensitive Personal Data or children's and adolescents' data.
16. PERSONS ENTITLED TO EXERCISE DATA SUBJECT RIGHTS
Rights may be exercised by the Data Subject; their heirs or successors in interest, upon proof of that status; their duly authorized representative or attorney-in-fact; or a person acting under a stipulation for the benefit of another or on another person's behalf. For children and adolescents, the legal representative exercises these rights, taking into account the child's or adolescent's views in light of their maturity.
Before disclosing information or making a requested change, Sites takes reasonable steps to verify the requester's identity and authority. Any department that receives a request forwards it promptly to the department responsible for responding. The statutory response period begins when Sites receives the request, and Data Subjects are not adversely affected by internal routing.
17. CHANNELS AND PROCEDURES FOR INQUIRIES AND CLAIMS
Requests should be submitted to the Administrative and Financial Department by email at contadora@sitesgroup.co, by mail or hand delivery to Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia, or by telephone at (+57) 604 605 0006. Sites may make additional channels available and publish them on its websites.
17.1 Required information
A request must include the Data Subject's name and identification; contact details for the response; a clear description of the inquiry, relevant facts, or right being exercised; any supporting documents; and, if a third party submits the request, proof of representation or legal standing. Sites does not require information that is unnecessary to process the request.
17.2 Inquiries
Sites responds to inquiries within ten (10) business days of receipt. If a response cannot be provided within that period, Sites informs the requester before the period expires, explains the reason for the delay, and states the response date, which may not be more than five (5) additional business days after the initial deadline.
17.3 Claims
If a claim is incomplete, Sites asks the claimant to provide the missing information within five (5) days of receipt. If the claimant does not respond within two (2) months, the claim is deemed withdrawn. If Sites is not the appropriate party to handle the claim, it forwards the claim to the competent party within two (2) business days, if known, and informs the claimant.
Once a complete claim is received, Sites adds a "claim pending" notation and the reason for the claim to the relevant database within two (2) business days. Sites responds to the claim within fifteen (15) business days of receipt. If a response cannot be provided within that period, Sites explains the reason for the delay and provides a new response date, which may not be more than eight (8) additional business days after the initial deadline.
17.4 Withdrawal of authorization and deletion
The Data Subject must indicate whether authorization is being withdrawn entirely or only for a particular purpose, such as marketing. A request for deletion or revocation may be denied only with respect to the minimum personal data that must be processed or retained to comply with an applicable legal or contractual obligation, an order from a competent authority, or another valid legal basis. Sites explains the reasons for its decision, notifies the Data Subject, and restricts access to the data where appropriate.
18. COMPLAINTS TO THE SUPERINTENDENCE OF INDUSTRY AND COMMERCE
A Data Subject or successor in interest may file a complaint with the Superintendence of Industry and Commerce after completing the applicable inquiry or claim process with Sites concerning the disputed matter, in accordance with Article 16 of Law 1581 of 2012.
19. OBLIGATIONS OF SITES AND ITS DATA PROCESSORS
When acting as Controller, Sites upholds Data Subject rights; requests and retains evidence of authorization where required; discloses the purposes of Processing and the Data Subject's rights; maintains the quality and security of personal data; updates, corrects, and deletes data where appropriate; responds to inquiries and claims; requires appropriate safeguards from its Data Processors; manages security incidents; and complies with instructions issued by the SIC.
When acting as a Data Processor, Sites processes personal data in accordance with the Controller's instructions; maintains security, confidentiality, and restricted access; promptly updates, corrects, or deletes information; adds any legally required notations; handles the requests for which it is responsible; reports incidents to the Controller; and complies with all other applicable legal obligations.
Agreements with Data Processors define, based on risk, the purpose and duration of Processing, security measures, subcontracting, data location, transfers or transmissions, return or deletion of personal data, audit rights, incident management, and cooperation in responding to Data Subject requests.
20. DATA GOVERNANCE AND THE NATIONAL DATABASE REGISTRY
The Administrative and Financial Department coordinates implementation of this Policy with the Quality, Technology, Human Resources, Operations, Marketing, Security, and other departments that process personal data. Sites maintains internal procedures, an inventory of databases and data flows, a purpose matrix, authorization forms, third-party management processes, training, and compliance controls.
Appointing a responsible person or department facilitates administration of this Policy but does not transfer or reduce the legal obligations of Sites Hospitality Group S.A.S. as a Data Controller or Data Processor.
If Sites is subject to the registration requirements under Decree 1074 of 2015, as amended by Decree 90 of 2018, it registers its databases with the National Database Registry, keeps the registrations current, and submits all required reports. For private companies, this obligation depends, among other statutory criteria, on the applicable asset threshold; it does not arise solely because the company processes Sensitive Personal Data or children's or adolescents' data.
21. CHANGES TO THIS POLICY
Sites may update this Policy to reflect changes in law, technology, or its operations. The current version is published at https://www.sitesmedellin.com/es/politica-privacidad/, https://www.sitesbarranquilla.com/es/politica-privacidad/, and https://www.sitesmonteria.com/es/politica-privacidad/ and is available through Sites' service channels. Sites communicates any material change before it takes effect. If a change introduces a new purpose of Processing, Sites informs the Data Subject and obtains new authorization before Processing begins for that purpose, unless an express legal exception applies.
22. GOVERNING LAW, EFFECTIVE DATE, AND VERSION
This Policy is governed by Article 15 of the Colombian Constitution, Law 1581 of 2012, Decree 1074 of 2015, Law 2300 of 2023, applicable regulations issued by the Communications Regulation Commission, instructions issued by the Superintendence of Industry and Commerce, and any provisions that amend, supplement, or replace them.
This is version 02 of the Policy, updated on September 16, 2026. It takes effect upon approval and publication and replaces the previous version in full. Personal data is retained only for as long as the purposes disclosed remain applicable or a legal or contractual basis justifies its continued retention, in accordance with Section 14.