Personal data treatment policy

> Language notice: this English text is provided for the convenience of international guests. S&J operates in Colombia and the Spanish version, Colombian law and the version accepted with the booking remain the controlling legal references.

S&J Hospedajes Owner: Migda Rosa Torrecilla Meza NIT: 33220419 National Tourism Registry (RNT): 254341 WhatsApp: +57 312 500 2575 Email: [email protected]

Service locations:

• Apartamentos S & J: Calle 13 B # 5C-2, second floor, Santa Cruz de Mompox, Bolívar, Colombia.
• SYJ Apartment and Casa S&J: Carrera 3 # 3-92, Santa Cruz de Mompox, Bolívar, Colombia.

This policy is adopted under Colombian Law 1581 of 2012 and the regulations compiled in Decree 1074 of 2015.

1. Data controller

The controller is the owner identified above. Data-protection requests may be sent to [email protected] or WhatsApp +57 312 500 2575.

2. Processing and purposes

S&J may collect, store, consult, use, update, transmit and delete personal data to manage bookings and accommodation, verify identity and occupancy, complete legally required guest records, respond to communications, meet legal obligations, manage security and fraud, and exercise or defend legal rights.

3. Categories of data

Data may include identity, contact, booking, occupancy, nationality, legally required guest-registration documents, communications and technical security information.

4. Data-subject rights

The data subject may know, update and correct their data; request evidence of authorisation where applicable; ask how data has been used; file complaints before the Superintendence of Industry and Commerce; revoke authorisation or request deletion where legally available; and access personal data free of charge.

5. Queries

Queries should identify the data subject, describe the information requested and provide a response channel. They will be answered within ten (10) business days. If additional time is legally required, the reason and new response date will be communicated, with an extension of no more than five (5) additional business days.

6. Complaints

Correction, update, deletion, revocation or non-compliance complaints must identify the data subject, describe the facts and include relevant supporting documents. A complete complaint is answered within fifteen (15) business days from the day after receipt. If additional time is required, S&J will communicate the reason and a new date within the legal maximum extension.

7. Authorisation and evidence

When consent is legally required, the website requests a clear affirmative action. Booking checkboxes are not preselected. The system records the time and the exact policy version accepted.

8. Guest registration

Tourist accommodation providers must maintain the guest records required by Colombian law and the systems designated by the authorities. Information collected for that purpose is used to provide the service and comply with those obligations.

9. International providers

Where technology providers process information outside Colombia, S&J applies the Colombian rules governing data transmission or international transfers as applicable.

10. Validity

This policy remains in force while legitimate or legal processing purposes exist. Material changes are published as a new version.