Data Protection

PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. Applicable Regulations

CJM INVERSIONES SAS – Black Tower Premium Hotel is committed to complying with the regulations in force in Colombia regarding personal data protection, through an established program aimed at implementing appropriate, effective, and verifiable measures. Below are the main regulations incorporated into our policies and manuals:

Article 15 of the Political Constitution of Colombia Law 1581 of 2012
Regulatory Decrees:
• Decree 1377 of 2013
• Decree 1074 of 2015

2. Data Controller (Owner of the Personal Data Database)

CJM INVERSIONES SAS
Tax ID (NIT): 900504404-0
Address: Avenida Calle 24 No. 43A-21, Bogotá, Colombia
Phone: +57 601 7424758

3. Definitions

Transmission: Processing of Personal Data that involves communicating such data to a third party, when the purpose is for the Data Processor to carry out processing on behalf of the Data Controller.

Privacy Notice: A verbal or written communication generated by the Controller and addressed to the Data Subject, informing them of the existence of the Personal Data Processing Policy, how to access it, and the purposes of the processing.

Processing of Personal Data of children and adolescents: Black Tower Hotel will process personal data of individuals under 18 years of age only with prior, express, and informed consent from parents or legal guardians, who may revoke or modify such authorization as described in this Policy.

4. Handling of Requests, Inquiries, and Complaints

The Quality Assurance Department is responsible for processing requests from data subjects to ensure the exercise of their rights.

5. Response Time for Requests

Inquiries will be answered within a maximum of ten (10) business days from receipt. If this is not possible, the interested party will be informed of the reasons for the delay and the date when the inquiry will be addressed, which will not exceed five (5) additional business days.

Requests or complaints will be answered within fifteen (15) business days from the day following receipt. If not possible, the interested party will be informed of the delay and the new response date, which will not exceed eight (8) additional business days.

6. Validity and Amendments

This annex was approved on September 26, 2025, and is effective from that date.

This Policy may be modified by Black Tower Premium Hotel without prior notice if the changes are not substantial; otherwise, they will be communicated in advance to the Data Subjects.

This Personal Data Processing Policy has been automatically translated from Spanish into English using artificial intelligence. The translation may contain inaccuracies or errors. Black Tower Premium Hotel does not guarantee its accuracy and is not responsible for any damages arising from its use. The official Spanish version shall prevail in case of discrepancies.

PERSONAL DATA PROCESSING POLICY

I. INTRODUCTION

CJM INVERSIONES SAS (hereinafter “BLACK TOWER HOTEL”) recognizes the importance of privacy and is committed to protecting the personal data of guests, clients, visitors, employees, suppliers, and any third party interacting with the Hotel.

This Policy aims to inform the public about how BLACK TOWER HOTEL processes personal data contained in its databases.

II. PURPOSE

To establish general guidelines for the protection and processing of personal data, inform data subjects of their rights, and provide mechanisms to exercise them.

III. SCOPE

This Policy applies to all personal data processed by BLACK TOWER HOTEL as Data Controller.

IV. DEFINITIONS

Authorization: Prior, express, and informed consent of the Data Subject.

Database: Organized set of personal data subject to processing.

Candidates: Individuals applying for a position.

Employees: Individuals providing services under an employment contract.

Financial Data: Data related to monetary obligations.

Personal Data: Any information linked to identifiable individuals.

Public Data: Data not classified as private or sensitive under applicable law.

Sensitive Data: Data affecting privacy or that may lead to discrimination (health, biometrics, beliefs, etc.).

Processor: Entity processing data on behalf of the Controller.

Controller: Entity deciding on data processing.

Data Subject: Individual whose data is processed.

Transfer: Sending data to another controller domestically or internationally.

Processing: Any operation performed on personal data (collection, storage, use, deletion, etc.).

V. PRINCIPLES

BLACK TOWER HOTEL processes personal data under the following principles:

  • Accountability

  • Legality

  • Freedom (consent-based processing)

  • Purpose limitation

  • Data quality and accuracy

  • Transparency

  • Restricted access and circulation

  • Storage limitation

  • Security

  • Confidentiality

VI. PERSONAL DATA PROCESSING

Personal data is collected, stored, used, transferred, and managed according to specific purposes.

6.1 Types of Data and Purposes

Includes databases for:

  • Guests/Clients (reservations, billing, marketing, security, surveys, etc.)

  • Candidates (recruitment processes)

  • Employees (HR management)

  • Suppliers (contract and service management)

  • Property Owners

  • Video Surveillance (security purposes)

Processing may be automated or manual and collected through forms, electronic means, or direct interaction.

6.2 Refusal to Provide Data

If required identification data is not provided, the Hotel may be unable to deliver its services.

VII. DATA SHARING

Personal data may be shared with third parties (affiliates, suppliers, partners) to ensure proper service delivery, including international transfers in compliance with applicable laws.

Data may also be disclosed to authorities for legal, immigration, or security purposes.

VIII. DATA SUBJECT RIGHTS

Data Subjects have the right to:

  • Access their data

  • Rectify inaccurate data

  • Request deletion (“right to be forgotten”)

  • Cancel data

  • Revoke consent

  • Data portability

IX. CONTACT CHANNELS

Guests:
operaciones@btphotel.com
gerencia@btphotel.com

Employees/Candidates:
Phone: +57 601 7424758 Ext. 104
Email: talentohumano@btphotel.com

Suppliers:
compras@btphotel.com

Address: Avenida Calle 24 No. 43A-21, Bogotá, Colombia

X. PROCEDURES TO EXERCISE RIGHTS

Requests must include:

  • Full name and ID

  • Description of the request

  • Supporting documents

  • Contact information

  • Signature (if applicable)

Only verified data subjects or authorized representatives will be attended.

XI. DATA CONTROLLER INFORMATION

CJM INVERSIONES SAS
NIT: 900504404-0
Address: Avenida Calle 24 No. 43A-21, Bogotá, Colombia
Phone: +57 601 7424758

XII. VALIDITY AND AMENDMENTS

Effective as of September 26, 2025.
BLACK TOWER HOTEL may update this Policy at any time.