Personal Data Privacy Policy

1. Data Controller

The Data Controller for personal data collected through the Tragovel platform is:

Legal name: Tragovel S.A.S.

Tax ID (NIT): 902.118.512-1

Contact email for personal data matters: privacy@tragovel.com

In compliance with Article 17 of Law 1581 of 2012, the Company acts as Data Controller when it determines the purposes and means of personal data processing. When the Company acts as a Data Processor under a third party's instruction, such relationship shall be governed by the corresponding contract.

2. Definitions

For the purposes of this Policy, and in accordance with the definitions established in Article 3 of Law 1581 of 2012 and Article 3 of Decree 1377 of 2013, the following terms shall mean:

• Data Subject (Titular): The natural person whose personal data is being processed.
• Personal data: Any information linked or that can be associated with one or more determined or determinable natural persons.
• Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person's civil status, profession or trade, and status as a trader or public servant.
• Semi-private data: Data that is not intimate, reserved or public in nature, and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of people or to society at large.
• Private data: Data that, by its intimate or reserved nature, is only relevant to the data subject.
• Sensitive data: Data that affects the privacy of the data subject or whose improper use may generate discrimination, such as racial or ethnic origin, political orientation, religious beliefs, health data, sexual life, biometric data and data relating to criminal convictions or administrative offences.
• Processing (Tratamiento): Any operation or set of operations on personal data, such as collection, storage, use, circulation, transfer, transmission or deletion.
• Data Controller (Responsable): A natural or legal person, public or private, who alone or in association with others decides on the database and/or the processing of personal data.
• Data Processor (Encargado): A natural or legal person, public or private, who alone or in association with others carries out personal data processing on behalf of the Data Controller.
• Authorization: Prior, express and informed consent of the data subject for personal data processing.
• Database: Organized set of personal data that is subject to processing.
• Transfer (Transferencia): Processing of personal data involving communication thereof within or outside Colombian territory, where the recipient is another Data Controller.
• Transmission (Transmisión): Communication of personal data to a Data Processor within or outside Colombian territory, for the Processor to carry out processing on behalf of the Controller.
• Privacy notice: Verbal or written communication directed to data subjects to inform them of the existence of the personal data privacy policy and how to access it.

3. Scope and acceptance

This Policy applies to all personal data collected by the Company through the Tragovel platform (website, mobile application and any associated digital channel), as well as data obtained by physical or verbal means during the commercial relationship.

All natural persons who, as users, customers, experience providers, visitors or in any other capacity, provide personal data to Tragovel or whose data is collected in the course of providing the services, are subject to this Policy.

By registering on the platform, completing a form or interacting in any other way with Tragovel, the data subject grants authorization for the processing of their personal data in accordance with the terms of this Policy. Where authorization cannot be obtained through unequivocal conduct, the Company will request express consent before initiating processing.

4. Personal data we collect

The Company collects only personal data that is adequate, relevant and necessary for the purposes described in this Policy, in accordance with the data minimization principle. The categories of data that Tragovel may collect include:

• Identification data: full name, identity document number, nationality and date of birth.
• Contact data: email address, phone number, city and country of residence.
• Account data: username, password (stored in encrypted form), profile photo and travel preferences.
• Browsing and usage data: IP address, browser type, operating system, pages visited, session time, device identifiers and precise geolocation data when expressly authorized by the user. An approximate location is also inferred from the IP address; it is used to show nearby events and plans and, for statistical purposes, to keep the country, region and city of each visit to the website or the app (or the profile city, when it cannot be inferred) for at most thirteen (13) months. The IP address and coordinates are not stored.
• Platform activity data: search history and experiences viewed and saved.
• Clicks to third-party sites: Tragovel does not sell tickets, take bookings or process payments, so it does not receive card or payment data. When the user follows a link to a partner's site, the Company records the click together with a pseudonymous device and session identifier, the experience, the city and the platform used, and sends the partner only a random code. If the partner reports that the click led to a purchase, the Company records the conversion and the corresponding commission.
• Communications data: messages sent to the support team, ratings and reviews published on the platform.
• User-created content: trips and itineraries with their activities, the bookings and flight details the user records, packing lists, favorites, photos the user uploads, and the email addresses of the people the user invites to collaborate on a trip.
• Third-party sign-in data: when the user chooses to sign in with an account from an external identity provider, the Company receives from that provider the user's name, email address (which may be a forwarding address generated by the provider) and an account identifier. The Company never receives the password for that account.
• Mobile app technical data: a random installation identifier; the identifier needed to send push notifications, only if the user allows them; and technical information about app errors and performance (device model, operating system and app versions, and the technical log of the failure). If the user allows access to their location, it is used to show their position on the map and, rounded to about one kilometre, to look up events and plans near them; the Company does not store it. When the user has not allowed it, the approximate location inferred from the IP address is used for the same purpose, also without storing it, except for the statistical data described above. The map and third-party sign-in services built into the app may collect, under their own policies, technical and usage data about their own service, such as device identifiers, diagnostic information and interactions with the map or the sign-in screen.

5. Purposes of processing

The Company processes data subjects' personal data for the following purposes, all of which are covered by the data subject's authorization, the performance of a contract or the fulfilment of legal obligations:

• Service delivery: managing registration, authentication and maintenance of the user's account; facilitating the search, comparison and saving of experiences and trip planning through the Tragovel platform.
• Partner links: recording clicks to partner sites and the purchases they report, in order to calculate and reconcile commissions. Partners receive only a random code per click, never data that identifies the user.
• Customer service and support: handling queries, complaints, claims and requests related to the services; resolving technical and operational incidents.
• Marketing communications: sending information about news, promotions, discounts and editorial content related to travel, only when the data subject has given prior and express authorization. The data subject may revoke this authorization at any time.
• Product improvement and analytics: conducting statistical and behavioral analyses in aggregate or pseudonymized form to improve the platform, personalize the user experience, develop new features and optimize service performance.
• Measurement of featured content: recording, in pseudonymized form, how many times providers' featured or sponsored content is shown and opened, in order to produce aggregate reports and invoice those services. Providers receive only aggregate figures, never data that identifies the user.
• Service stability: detecting, diagnosing and fixing technical errors and performance problems on the platform.
• Notifications: sending push notifications with plan recommendations when the user has allowed them on their device. The user can turn them off at any time from the app or from the device settings.
• Security and fraud prevention: detecting, investigating and preventing fraudulent activities, unauthorized access and other conduct that endangers the security of the platform or its users.
• Legal compliance: complying with requirements from judicial, administrative or supervisory authorities; retaining records as required by Colombian law.

6. Processing of sensitive data

Tragovel does not routinely collect sensitive data as defined in Article 5 of Law 1581 of 2012. However, in certain specific contexts — for example, when the user voluntarily discloses a health condition relevant to the safe practice of an adventure experience — the platform may receive this type of data.

The provision of sensitive data is strictly voluntary. No data subject will be required to disclose sensitive data to access Tragovel's general services. Where the processing of sensitive data is necessary, the Company will request an explicit, separate and informed authorization, clearly indicating the sensitive nature of the data and the specific purpose of the processing.

In no case will the Company condition access to essential services on the provision of sensitive data, nor will it process sensitive data without the express and specific authorization of the data subject.

7. Personal data of children and adolescents

Tragovel recognizes that children and adolescents (persons under 18 years of age) are entitled to special protection under Article 7 of Law 1581 of 2012, Law 1098 of 2006 (Code of Childhood and Adolescence) and the Convention on the Rights of the Child.

The Tragovel platform is intended for persons over 18 years of age. The Company does not deliberately collect personal data from minors without the express and verifiable consent of the parent or legal guardian. If the Company becomes aware of having collected personal data from a minor without proper authorization, it will proceed to immediate deletion.

8. Rights of the data subject

In accordance with Article 8 of Law 1581 of 2012, the personal data subject has the following rights, the exercise of which is free of charge:

• Right to access: access their personal data that is being processed by the Company at any time.
• Right to update: request the update of their personal data when it is inaccurate, incomplete or has changed.
• Right to rectification: request the correction of inaccurate or erroneous personal data.
• Right to proof of authorization: request from the Company proof of the authorization granted for data processing, except in cases expressly exempted by law.
• Right to be informed: learn, upon request, for what purposes their personal data has been and is being used.
• Right to complain to the SIC: file complaints with the Superintendencia de Industria y Comercio (SIC) for infringements of Law 1581 of 2012, once the consultation or claim procedure before the Controller has been exhausted.
• Right to revoke authorization: withdraw at any time the consent granted for processing, provided there is no legal or contractual obligation that prevents it. Revocation will not have retroactive effect.
• Right to deletion: request the elimination of personal data when it is no longer necessary for the purposes that justified the processing, when the authorized retention period has expired, or when processing does not comply with the law, provided there is no legal obligation to retain it. The user can also delete their account directly from the account settings, in the mobile app or on the website; deletion is immediate. What is erased, what is kept and for how long is set out at /delete-account.

9. Procedure for queries and claims

The data subject, their heirs or representatives may exercise their rights through the channel provided by the Company:

Email: privacy@tragovel.com

The data subject must fully identify themselves, indicate the type of request (query or claim), describe the facts and attach any documents they deem relevant.

Queries: The Company will respond within a maximum period of ten (10) business days from the date of receipt. If it is not possible to attend to the query within this period, the interested party will be informed of the reasons for the delay and the date on which their query will be addressed, which may in no case exceed five (5) additional business days following the expiry of the first period, pursuant to Article 14 of Law 1581 of 2012.

Claims: If the data subject believes that information should be corrected, updated or deleted, or when they observe presumed non-compliance with any of the Controller's duties, they may file a claim following this procedure: (i) If the claim is incomplete, the Company will notify the interested party within five (5) days of receipt to remedy the deficiencies; if two (2) months elapse without the data subject remedying them, the claim will be deemed withdrawn. (ii) The Company will respond within a maximum period of fifteen (15) business days from the day following the date of receipt of the complete claim. If it is not possible to attend to the claim within this period, the interested party will be informed, and the date for addressing the claim may in no case exceed eight (8) additional business days following the expiry of the first period, pursuant to Article 15 of Law 1581 of 2012.

10. Authorization of the data subject

Pursuant to Article 9 of Law 1581 of 2012, the processing of personal data requires the prior, express and informed authorization of the data subject, except in cases exempted by law (public data, medical or health emergencies, processing authorized by law, Civil Registry data, among others).

Tragovel obtains authorization through the following mechanisms:

• Express acceptance during registration: the user checks a box declaring that they have read and accepted this Policy before creating their account.
• Unequivocal conduct: when the data subject voluntarily provides their data in contact forms or other channels, having been previously informed of the existence and content of this Policy through the corresponding privacy notice.
• Physical format: in the case of in-person collection, by signing the authorization form provided by the Company.

11. Transfer and transmission of data

The Company may share personal data with third parties in the following circumstances:

• Data Processors: technology service providers (cloud hosting, analytics, transactional email) who act on behalf of the Company and are contractually obligated to process data only in accordance with the Controller's instructions and under the same data protection standards required by Law 1581 of 2012. These processors include providers of hosting and file storage, app error and performance monitoring, push notification delivery, authentication, maps and place search, and network and content delivery, some of them with servers outside Colombia.
• Third-party sites: when the user follows a link to a ticketing or partner site, the Company does not transmit the user's personal data to it. That third party processes whatever the user gives it directly, under its own privacy policy.
• Competent authorities: the Company will disclose personal data to judicial, administrative or supervisory authorities when there is a legal obligation or formal request.
• International transfers: when it is necessary to transfer personal data to countries that do not offer adequate levels of protection according to Colombian standards, the Company will adopt the contractual safeguards, data protection clauses or other measures required by the Superintendencia de Industria y Comercio to ensure the effective protection of data subjects' rights.

12. Information security measures

The Company adopts the technical, human and administrative measures necessary to secure records, preventing their alteration, loss, unauthorized or fraudulent consultation, use or access, pursuant to Article 17(d) of Law 1581 of 2012.

Measures in place include: encryption of user passwords using secure hashing algorithms (bcrypt); data transmission using encrypted protocols (HTTPS/TLS); role-based access controls for Company staff; periodic security audits; and confidentiality agreements with all Data Processors.

In the event of a security incident affecting personal data, the Company will notify affected data subjects and the Superintendencia de Industria y Comercio within the terms and timeframes established by applicable regulations.

13. Cookies and similar technologies

Tragovel uses cookies and similar tracking technologies (tracking pixels, browser local storage) to improve the user experience, maintain active sessions, remember preferences and collect analytical information about the use of the platform.

Cookies may be: (i) essential, necessary for the basic functioning of the platform and not requiring additional consent; (ii) analytics or performance cookies, which enable understanding of how users interact with the platform and which require consent; (iii) personalization cookies, which allow content to be adapted to user preferences; and (iv) advertising cookies, used to display relevant commercial content, always with the data subject's consent.

The user may configure their browser to reject all cookies or to receive an alert when a cookie is sent. However, disabling essential cookies may affect platform functionality. To manage cookie preferences, the user may access the settings panel available on the platform or modify their browser settings.

Product analytics: the Company uses a random anonymous identifier (not a device identifier or fingerprint) to measure aggregate use of the platform — searches performed, content viewed and retention. This information is processed in pseudonymized form, contains no contact details, and may be processed by analytics providers located outside Colombia under the contractual safeguards described in the international transfers section. The identifier is reset on logout or when application data is cleared.

14. Policy validity and database retention

This Policy comes into force from the date of its publication and will remain in force for as long as the Company carries out personal data processing.

Personal data will be retained for the time necessary to fulfil the processing purposes described in this Policy, or until the data subject requests deletion, provided there is no legal or contractual obligation to retain it for a longer period. In particular, data related to commercial transactions may be retained for a minimum of five (5) years in accordance with Colombian tax and accounting regulations.

The Company reserves the right to modify this Policy at any time in order to adapt it to regulatory, jurisprudential or business practice changes. Substantial modifications will be communicated to data subjects through the means available to the Company (email, notice on the platform or others), with such advance notice as circumstances allow, and will be published on the platform with an indication of the date of the last update.

15. Supervisory authority and contact information

The personal data protection authority in Colombia is the Superintendencia de Industria y Comercio (SIC), before which data subjects may file complaints, queries and claims related to the processing of their personal data, once the procedure before the Controller has been exhausted. The SIC can be contacted through its official website: www.sic.gov.co, or at its offices in Bogotá D.C., Colombia.

For any query, claim or request related to the processing of your personal data, you may contact the Controller through the following channels:

Email: privacy@tragovel.com

The team responsible for handling personal data requests will respond within the legal terms established in section 9 of this Policy.