Official website of Sites in Colombia
Rights and duties
Pursuant to Law 1581 of 2012 and Decree 1074 of 2015, Sites Hospitality Group S.A.S. ("Sites") provides this General Privacy Notice to inform Data Subjects about its Personal Data Processing Policy, the primary purposes for which their Personal Data is processed, and the procedures available to exercise their rights.
This Notice applies to guests, prospective guests, accompanying guests, visitors, website and Wi-Fi users, event participants, corporate clients, job applicants, employees, former employees, suppliers, contractors, business partners, and any other individuals whose Personal Data is processed in connection with the operations of Sites Medellín, Sites Barranquilla, and Sites Montería.
Because this Notice is general in scope, it does not replace the specific privacy notices or authorizations provided at each point of data collection, including inquiries and reservations, hotel check-in and guest registration, video surveillance, Wi-Fi access, events, recruitment, employment, and supplier onboarding. Personal Data will be processed in accordance with the Policy and any applicable specific notice, without limiting the rights of Data Subjects.
1. IDENTITY OF THE DATA CONTROLLER
Legal name: Sites Hospitality Group S.A.S.
Tax Identification Number (NIT): 900504453-1
Registered office: Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia.
Contact details: contabilidad@sitesgroup.co and (+57) 604 605 0006.
2. CATEGORIES OF PERSONAL DATA PROCESSED
Depending on the Data Subject's relationship with Sites, the Personal Data processed may include identification and contact details; location, reservation, stay, accompanying guest, and preference information; billing, payment, payment confirmation, transaction, request, and complaint records; employment, educational, professional, contractual, tax, banking, and social security information; images, access logs, and video surveillance footage; and IP addresses, device identifiers, browsing information, cookies, and technical logs. The specific Personal Data collected will depend on the relevant point of collection and will be limited to what is necessary for the disclosed purpose.
Data Subjects are not required to authorize the processing of Sensitive Personal Data or to answer questions concerning such data. If Sites needs to collect health, accessibility, allergy, disability, or biometric information for a lawful and necessary purpose, it will separately explain the purpose and the consequences of providing the information, obtain explicit authorization where required, and offer a reasonable, non-invasive alternative. Refusal to provide Sensitive Personal Data will not, by itself, prevent access to the service, and Sites will explain any reasonable alternatives that do not require such data. Where a statutory exception applies, including in a medical or health emergency, Sites will process only the information strictly necessary and will document the legal basis for doing so.
Sites will process the Personal Data of children and adolescents only when lawful, necessary, and proportionate for a reservation, accommodation, security purpose, or compliance with a legal obligation. Sites will safeguard their best interests and fundamental rights, take their views into account based on their age and maturity, and obtain authorization from their legal representative where applicable. When requesting authorization, Sites will explain that answering questions concerning this information is optional. Information whose processing is expressly required or permitted by law for hotel or immigration registration will be identified separately, used only for that purpose, and processed under the applicable legal basis. Sites will not knowingly use this information for behavioral advertising, profiling, or any unnecessary technology.
3. PRIMARY PURPOSES OF PROCESSING
3.1 Guests, users, and visitors
• Respond to inquiries and requests for quotations; manage reservations, changes, cancellations, payments, invoicing, refunds, check-in, check-out, accommodation, purchases, events, and other requested services.
• Identify and register guests, accompanying guests, and visitors; manage access; and comply with applicable hotel, tourism, immigration, tax, public health, accounting, and consumer protection requirements.
• Record guests and accompanying guests on the Accommodation Registration Card and submit the reports required through SIAT, using accurate and limited information solely for the applicable legal purposes.
• Report the arrival and departure of foreign guests, together with the information required by law for immigration control, to Migración Colombia through SIRE.
• Prevent, identify, and report the commercial sexual exploitation of children and adolescents in the travel and tourism sector, and comply with the applicable code of conduct.
• Handle accessibility, health, and assistance requests; respond to emergencies; and protect individuals, property, and facilities.
• Address petitions, complaints, and claims; assess service quality; and improve processes, using aggregated information whenever it is sufficient for the purpose.
• Operate the websites and Wi-Fi networks; remember technical preferences selected by the user; prevent fraud; and, with the user's prior, express, and informed authorization, enable non-essential preferences, analytics, advertising, or third-party content.
• Publish a review, name, or testimonial only with the Data Subject's specific and optional authorization, or in anonymized form.
3.2 Job applicants, employees, and former employees
• Manage recruitment, hiring, payroll, benefits, social security, employee wellbeing, training, performance, occupational health and safety, and the termination of the employment relationship.
3.3 Suppliers, contractors, business partners, and corporate clients
• Manage onboarding, due diligence, contracting, performance of contractual obligations, payments, invoicing, accounting, audits, compliance, security, and risk.
3.4 Optional marketing communications
• Send marketing communications only with the Data Subject's prior, express, and informed authorization, or where a clearly identified statutory exception applies. Marketing authorization will be requested separately from the provision of services, will allow the Data Subject to select the communication channels they wish to authorize, and may be withdrawn at any time, free of charge, through a simple opt-out mechanism included in each communication. Where applicable, Sites will comply with Law 2300 of 2023 and the Registry of Excluded Numbers (Registro de Números Excluidos).
4. DISCLOSURE AND RECIPIENTS
Depending on the recipient's role, Sites may disclose, transmit, or transfer Personal Data to service providers that support technology hosting, cloud services, booking platforms, customer relationship management, email and messaging, payments, security, video surveillance, transportation, events, maintenance, human resources, accounting, auditing, and professional advisory services. Sites may also disclose Personal Data to competent authorities in response to a valid request or order, or when required by law. Data Processors will be bound by Sites' instructions and the applicable data processing agreements. Disclosures to independent Data Controllers, whether located in Colombia or abroad, will be made only with the required authorization or under an applicable statutory exception, and subject to all required safeguards.
Some service providers may process Personal Data outside Colombia. Before allowing such processing, Sites will verify the provider's role, the destination country, the purpose of the processing, and the applicable transfer mechanism; restrict access to what is necessary; require appropriate confidentiality and security measures; and comply with Colombian requirements governing international transfers and transmissions of Personal Data.
5. DATA SUBJECT RIGHTS
• Access their Personal Data free of charge and request that it be updated or corrected.
• Request evidence of their authorization, where authorization is required, and obtain information about how their Personal Data has been used.
• Submit inquiries and complaints and receive a response within the statutory time limits.
• Withdraw their authorization or request the deletion of their Personal Data where permitted, provided that no current legal or contractual obligation requires Sites to retain the minimum information necessary.
• File a complaint with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio), after first completing the applicable inquiry or complaint procedure with Sites in relation to the disputed matter.
• Decline to authorize the processing of Sensitive Personal Data or to answer questions concerning Sensitive Personal Data or the Personal Data of minors, subject to applicable law.
6. HOW TO EXERCISE YOUR RIGHTS
Inquiries, complaints, and other requests concerning Personal Data may be submitted to the Administrative and Financial Department by email at contabilidad@sitesgroup.co, in writing at Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia, or by telephone at (+57) 604 605 0006. The request must identify the Data Subject, provide contact details for the response, clearly describe the request, and include any relevant supporting documents. Sites will respond in accordance with Law 1581 of 2012, Decree 1074 of 2015, and its Personal Data Processing Policy.
7. PRIVACY POLICIES AND COOKIE SETTINGS
The Personal Data Processing Policy is available at https://www.sitesmedellin.com/es/politica-privacidad/, https://www.sitesbarranquilla.com/es/politica-privacidad/, and https://www.sitesmonteria.com/es/politica-privacidad/. The Cookie Policy is available at https://www.sitesmedellin.com/es/cookies/, https://www.sitesbarranquilla.com/es/cookies/, and https://www.sitesmonteria.com/es/cookies/. Each website will provide a permanent link to its 'Cookie Settings.'
8. EFFECTIVE DATE AND TERM
This is version 01 of the Notice, updated on September 16, 2026. It takes effect upon approval and publication and remains in force until amended. Personal Data will be retained only as long as necessary for the stated purposes, applicable legal or contractual obligations, or the establishment, exercise, or defense of legal claims.
This Notice applies to guests, prospective guests, accompanying guests, visitors, website and Wi-Fi users, event participants, corporate clients, job applicants, employees, former employees, suppliers, contractors, business partners, and any other individuals whose Personal Data is processed in connection with the operations of Sites Medellín, Sites Barranquilla, and Sites Montería.
Because this Notice is general in scope, it does not replace the specific privacy notices or authorizations provided at each point of data collection, including inquiries and reservations, hotel check-in and guest registration, video surveillance, Wi-Fi access, events, recruitment, employment, and supplier onboarding. Personal Data will be processed in accordance with the Policy and any applicable specific notice, without limiting the rights of Data Subjects.
1. IDENTITY OF THE DATA CONTROLLER
Legal name: Sites Hospitality Group S.A.S.
Tax Identification Number (NIT): 900504453-1
Registered office: Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia.
Contact details: contabilidad@sitesgroup.co and (+57) 604 605 0006.
2. CATEGORIES OF PERSONAL DATA PROCESSED
Depending on the Data Subject's relationship with Sites, the Personal Data processed may include identification and contact details; location, reservation, stay, accompanying guest, and preference information; billing, payment, payment confirmation, transaction, request, and complaint records; employment, educational, professional, contractual, tax, banking, and social security information; images, access logs, and video surveillance footage; and IP addresses, device identifiers, browsing information, cookies, and technical logs. The specific Personal Data collected will depend on the relevant point of collection and will be limited to what is necessary for the disclosed purpose.
Data Subjects are not required to authorize the processing of Sensitive Personal Data or to answer questions concerning such data. If Sites needs to collect health, accessibility, allergy, disability, or biometric information for a lawful and necessary purpose, it will separately explain the purpose and the consequences of providing the information, obtain explicit authorization where required, and offer a reasonable, non-invasive alternative. Refusal to provide Sensitive Personal Data will not, by itself, prevent access to the service, and Sites will explain any reasonable alternatives that do not require such data. Where a statutory exception applies, including in a medical or health emergency, Sites will process only the information strictly necessary and will document the legal basis for doing so.
Sites will process the Personal Data of children and adolescents only when lawful, necessary, and proportionate for a reservation, accommodation, security purpose, or compliance with a legal obligation. Sites will safeguard their best interests and fundamental rights, take their views into account based on their age and maturity, and obtain authorization from their legal representative where applicable. When requesting authorization, Sites will explain that answering questions concerning this information is optional. Information whose processing is expressly required or permitted by law for hotel or immigration registration will be identified separately, used only for that purpose, and processed under the applicable legal basis. Sites will not knowingly use this information for behavioral advertising, profiling, or any unnecessary technology.
3. PRIMARY PURPOSES OF PROCESSING
3.1 Guests, users, and visitors
• Respond to inquiries and requests for quotations; manage reservations, changes, cancellations, payments, invoicing, refunds, check-in, check-out, accommodation, purchases, events, and other requested services.
• Identify and register guests, accompanying guests, and visitors; manage access; and comply with applicable hotel, tourism, immigration, tax, public health, accounting, and consumer protection requirements.
• Record guests and accompanying guests on the Accommodation Registration Card and submit the reports required through SIAT, using accurate and limited information solely for the applicable legal purposes.
• Report the arrival and departure of foreign guests, together with the information required by law for immigration control, to Migración Colombia through SIRE.
• Prevent, identify, and report the commercial sexual exploitation of children and adolescents in the travel and tourism sector, and comply with the applicable code of conduct.
• Handle accessibility, health, and assistance requests; respond to emergencies; and protect individuals, property, and facilities.
• Address petitions, complaints, and claims; assess service quality; and improve processes, using aggregated information whenever it is sufficient for the purpose.
• Operate the websites and Wi-Fi networks; remember technical preferences selected by the user; prevent fraud; and, with the user's prior, express, and informed authorization, enable non-essential preferences, analytics, advertising, or third-party content.
• Publish a review, name, or testimonial only with the Data Subject's specific and optional authorization, or in anonymized form.
3.2 Job applicants, employees, and former employees
• Manage recruitment, hiring, payroll, benefits, social security, employee wellbeing, training, performance, occupational health and safety, and the termination of the employment relationship.
3.3 Suppliers, contractors, business partners, and corporate clients
• Manage onboarding, due diligence, contracting, performance of contractual obligations, payments, invoicing, accounting, audits, compliance, security, and risk.
3.4 Optional marketing communications
• Send marketing communications only with the Data Subject's prior, express, and informed authorization, or where a clearly identified statutory exception applies. Marketing authorization will be requested separately from the provision of services, will allow the Data Subject to select the communication channels they wish to authorize, and may be withdrawn at any time, free of charge, through a simple opt-out mechanism included in each communication. Where applicable, Sites will comply with Law 2300 of 2023 and the Registry of Excluded Numbers (Registro de Números Excluidos).
4. DISCLOSURE AND RECIPIENTS
Depending on the recipient's role, Sites may disclose, transmit, or transfer Personal Data to service providers that support technology hosting, cloud services, booking platforms, customer relationship management, email and messaging, payments, security, video surveillance, transportation, events, maintenance, human resources, accounting, auditing, and professional advisory services. Sites may also disclose Personal Data to competent authorities in response to a valid request or order, or when required by law. Data Processors will be bound by Sites' instructions and the applicable data processing agreements. Disclosures to independent Data Controllers, whether located in Colombia or abroad, will be made only with the required authorization or under an applicable statutory exception, and subject to all required safeguards.
Some service providers may process Personal Data outside Colombia. Before allowing such processing, Sites will verify the provider's role, the destination country, the purpose of the processing, and the applicable transfer mechanism; restrict access to what is necessary; require appropriate confidentiality and security measures; and comply with Colombian requirements governing international transfers and transmissions of Personal Data.
5. DATA SUBJECT RIGHTS
• Access their Personal Data free of charge and request that it be updated or corrected.
• Request evidence of their authorization, where authorization is required, and obtain information about how their Personal Data has been used.
• Submit inquiries and complaints and receive a response within the statutory time limits.
• Withdraw their authorization or request the deletion of their Personal Data where permitted, provided that no current legal or contractual obligation requires Sites to retain the minimum information necessary.
• File a complaint with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio), after first completing the applicable inquiry or complaint procedure with Sites in relation to the disputed matter.
• Decline to authorize the processing of Sensitive Personal Data or to answer questions concerning Sensitive Personal Data or the Personal Data of minors, subject to applicable law.
6. HOW TO EXERCISE YOUR RIGHTS
Inquiries, complaints, and other requests concerning Personal Data may be submitted to the Administrative and Financial Department by email at contabilidad@sitesgroup.co, in writing at Carrera 45 No. 5-15, El Poblado, Medellín, Antioquia, or by telephone at (+57) 604 605 0006. The request must identify the Data Subject, provide contact details for the response, clearly describe the request, and include any relevant supporting documents. Sites will respond in accordance with Law 1581 of 2012, Decree 1074 of 2015, and its Personal Data Processing Policy.
7. PRIVACY POLICIES AND COOKIE SETTINGS
The Personal Data Processing Policy is available at https://www.sitesmedellin.com/es/politica-privacidad/, https://www.sitesbarranquilla.com/es/politica-privacidad/, and https://www.sitesmonteria.com/es/politica-privacidad/. The Cookie Policy is available at https://www.sitesmedellin.com/es/cookies/, https://www.sitesbarranquilla.com/es/cookies/, and https://www.sitesmonteria.com/es/cookies/. Each website will provide a permanent link to its 'Cookie Settings.'
8. EFFECTIVE DATE AND TERM
This is version 01 of the Notice, updated on September 16, 2026. It takes effect upon approval and publication and remains in force until amended. Personal Data will be retained only as long as necessary for the stated purposes, applicable legal or contractual obligations, or the establishment, exercise, or defense of legal claims.