Personal Data Processing Policy

1. SCOPE

This Personal Data Processing Policy will apply to all databases and/or files containing personal data that are subject to processing by SPOT DIVING (hereinafter referred to as “SPOT DIVING”).

2. IDENTIFICATION OF THE RESPONSIBLE PARTY FOR PERSONAL DATA PROCESSING.

SPOT DIVING is a business establishment located in Cartagena, COLOMBIA, at the address barrio Cabrero, Edificio Napoli, Avenida Soledad Roman 42-102, Cartagena (Bolívar), legally constituted, registered with the number 09-484593-02 in the Chamber of Commerce of Cartagena, which can be contacted through the email: info@spotdiving.com; and/or by phone at 311 8323051.

3. For the development of this policy, the following definitions contained in Law 1581 of 2012 and Decree 1074 of 2015 are adopted. Words that begin with uppercase letters will have the meaning assigned herein. All other words, or those whose initial letters are not capitalized, will have their common meaning.

• Authorization: Prior, express, and informed consent from the Data Subject to carry out the Personal Data Processing.
• Privacy Notice: Verbal or written communication generated by the Responsible Party, addressed to the Data Subject regarding the processing of their Personal Data, informing them about the existence of the Information Processing Policies that will apply, how to access them, and the purposes for which their data will be processed.
• Database: An organized set of Personal Data that is subject to Processing.
• Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, information related to the civil status of individuals, their profession or occupation, and their status as a merchant or public servant. By nature, public data can be found in public records, gazettes, official bulletins, and judicial rulings that are not under reserve.
• Personal Data: Any information linked or that can be associated with one or more determined or determinable natural persons.
• Data Processor: A natural or legal person, public or private, who processes Personal Data on behalf of the Responsible Party.
• Responsible Party for Processing: A natural or legal person, public or private, who decides on the Database and/or the processing of the data.
• Terms and Conditions: The general framework that establishes the conditions for participants in promotional or related activities.
• Data Subject: The natural person whose Personal Data is subject to Processing.
• Processing: Any operation or set of operations performed on Personal Data, such as collection, storage, use, circulation, or deletion.
• Transfer: The transfer of data takes place when the Responsible Party and/or the Data Processor, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the processing and is located either inside or outside the country.
• Transmission: Personal Data Processing that involves the communication of data inside or outside the territory of the Republic of Colombia, intended for processing by the Processor on behalf of the Responsible Party.

4. PROCESSING AND PURPOSE.

SPOT DIVING, acting as the Responsible Party for the Processing of Personal Data, carries out the following types of Processing and Purposes related to the Personal Data of its Data Subjects, who have a commercial or contractual relationship with SPOT DIVING. The processing purposes listed below must be authorized by the Data Subjects in advance, expressly, and informedly:

• Establish and maintain a commercial relationship.
• Provide feedback on the service provided to ensure effective customer service.
• Collection of accounts payable for services rendered.
• Sending of commercial or advertising notices about SPOT DIVING services.
• Contacting clients, employees, contractors, or suppliers to send information related to the contractual, commercial, and obligational relationship.
• Collecting data to fulfill SPOT DIVING’s duties as a data controller.
• For security or fraud prevention purposes.
• To send any financial, commercial, credit, or service-related information for statistical, control, or supervisory purposes that must be processed, reported, kept, consulted, provided, or updated with authorized information centers or databases.
• Any other purpose arising from the development of the contract or commercial relationship between the Data Subject and SPOT DIVING.

• The Data Subject expressly recognizes that the commercial information collected will be used for commercial purposes, including the sending of commercial and advertising information related to the services offered by SPOT DIVING. This can be exercised via (i) emails, (ii) text messages (SMS), and/or (iii) phone calls (cell phones or landlines). In accordance with Law 2300 of 2022, the Data Subject agrees to receive such advertisements with the frequency and through the channels used by SPOT DIVING. If the Data Subject does not wish to continue receiving commercial information, they can contact the email provided in the second section of this document.

Moreover, the Data Subject acknowledges that their personal data may be made available to personnel within SPOT DIVING, including being transferred to external processors, consultants, advisors, and offices as needed to fulfill the above purposes.

5. RIGHTS OF DATA SUBJECTS.

Data Subjects whose Personal Data is processed by SPOT DIVING have the following rights, which they can exercise at any time:

• To know the Personal Data that SPOT DIVING is processing.
• To request proof of authorization granted to SPOT DIVING for the Processing of their Personal Data.
• To be informed, upon request, about the use of their Personal Data.
• To file complaints with the Superintendency of Industry and Commerce for violations of Law 1581 of 2012 and other regulations that modify, add to, or complement it.
• To revoke authorization and/or request the deletion of their Personal Data by submitting a claim, according to the procedure established in this Policy. However, the request for deletion and revocation of authorization will not proceed when the Data Subject has a legal or contractual obligation with SPOT DIVING.
• To access their Personal Data that has been processed, free of charge.
• To revoke or modify the channels and frequency through which SPOT DIVING can send advertisements or information related to collections.

6. RESPONSIBLE AREA FOR IMPLEMENTATION AND ENFORCEMENT OF THIS POLICY
   SPOT DIVING is responsible for the development, implementation, training, and enforcement of this policy, as well as for handling requests, inquiries, complaints, and claims through which the Data Subject may exercise their rights to know, update, rectify, delete their data, and revoke the authorization.
7. THIRD-PARTY SERVICES WITH WHICH WE SHARE THE DATA SUBJECT’S INFORMATION

Statistics and Ads:

• Google Analytics
• Facebook Analytics
• X Analytics
• Facebook Ads

• Registration and Authentication:
• Registration is done through the reservation process on the website https://spotdiving.com/en/home/
• The service reservation request is completed with the client’s electronic signature.

• Payment Processing:
• BOLD payment link, which includes:
  • PSE button
  • Bancolombia button
  • Debit/Credit card
  • Direct Bancolombia bank transfer
  • PayPal payment
• Diving Operation:

• The personal data of third parties participating in the services offered, such as diving level, equipment sizes, age, and gender, will be shared exclusively with the diving operators. This data transfer will be carried out with the purpose of ensuring the proper development of the activities, ensuring the provision of the necessary instruments and equipment that meet the specific needs of the clients for each activity.

8. Authorization:

SPOT DIVING must request prior, express, and informed authorization from the Data Subjects whose Personal Data is required for processing. The authorization must be:

• Previa: It means that consent must be given by the Data Subject, at the latest, at the moment the Personal Data is collected.
• Expresa: It means that the Data Subject’s consent must be explicit and specific. Open-ended and non-specific authorizations are not valid. The Data Subject must express their will to authorize SPOT DIVING to process their Personal Data. This consent can be given through various mechanisms provided by SPOT DIVING, such as:
• By accepting the Terms and Conditions outlined on the company website: https://spotdiving.com/en/terms-and-conditions/
• In writing, including authorization clauses in contracts or filling out an authorization form provided by SPOT DIVING.
• Verbally, for example, in a phone call or video conference.
• Implicitly, through clear behaviors indicating consent, such as accepting the Terms and Conditions of one or all of the services provided by the company that require authorization for processing Personal Data.

In no case will SPOT DIVING interpret the Data Subject’s silence as consent for the processing of Personal Data. Regardless of the mechanism used, the company must keep proof of the authorization for future reference.

• Informada: It means that, at the time of requesting consent, the Data Subject must be clearly informed about the following:
• The Personal Data that will be collected.
• The identification and contact details of the Data Controller and the Data Processor.
• The specific purposes of the processing to be carried out, i.e., how and for what the data collection, use, and circulation will be done.
• The rights the Data Subject has concerning their Personal Data.
• The optional nature of answering questions related to Sensitive Data or the Personal Data of children and adolescents.

9. SPECIAL PROVISIONS FOR THE PROCESSING OF SENSITIVE PERSONAL DATA

According to Law 1581 of 2012, Sensitive Personal Data refers to data that affects privacy or whose improper use could lead to discrimination. This includes data related to racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations, or political parties, health status, sexual life, biometric data (such as fingerprints, signature, or photograph). The processing of Sensitive Personal Data is prohibited by law, unless there is explicit, prior, and informed consent from the Data Subject, among other exceptions stipulated in Article 6 of Law 1581 of 2012.

In the event that SPOT DIVING requests Sensitive Data, in addition to fulfilling the established authorization requirements, the company must:

• Inform the Data Subject that they are not obligated to consent to the processing of Sensitive Data.
• Inform the Data Subject about which data will be processed and the purpose of this processing.

Ensure that no activity or service provided by SPOT DIVING will be conditioned on the Data Subject providing Sensitive Personal Data.

10. SPECIAL PROVISIONS FOR THE PROCESSING OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS

According to Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, SPOT DIVING will only carry out the processing of Personal Data of children and adolescents, including collection, storage, use, circulation, and/or deletion, as long as this processing responds to and respects the best interests of the children and adolescents, ensuring the respect for their fundamental rights.

Once the above requirements are met, SPOT DIVING must obtain the authorization of the legal representative of the child or adolescent, after exercising the minor’s right to be heard. The opinion of the minor will be considered based on their maturity, autonomy, and capacity to understand the matter, in accordance with the legal powers granted by law for entering into contracts and their capacity to commit.

11. PROCEDURE FOR ADDRESSING AND RESPONDING TO REQUESTS, INQUIRIES, COMPLAINTS, AND CLAIMS FROM PERSONAL DATA SUBJECTS

Data subjects whose personal data is being collected, stored, used, or circulated by SPOT DIVING have the right to exercise at any time their rights to access, update, rectify, delete information, and revoke their authorization. The following procedure will be followed in accordance with the Personal Data Protection Law:

The data subject or their legal heirs may request from SPOT DIVING, through the indicated means, the following:

• Information regarding the personal data of the data subject that is being processed;
• Proof of the authorization granted to the company for the processing of their personal data;
• Information about how the company has used the data subject’s personal data.

12. Means enabled for the submission of queries and complaints:

SPOT DIVING has made the following methods available for receiving and addressing queries and complaints:

• Physical: Communication addressed to SPOT DIVING, located at the following address: Barrio Cabrero, Edificio Napoli, Avenida Soledad Roman 42-102, Cartagena (Bolívar).
• Virtual: Request sent to the email address info@spotdiving.com.

13. Attention and Response by SPOT DIVING:

• Consultations: These will be addressed within a maximum term of ten (10) business days from the date of receipt. If it is not possible to address the consultation within this term, the interested party will be informed, explaining the reasons for the delay and indicating the date by which the consultation will be addressed, which in no case may exceed five (5) business days after the expiration of the original term.
• Complaints: A data subject or their legal heir who believes that the information contained in a SPOT DIVING database should be corrected, updated, or deleted, or if they observe the possible non-compliance of any duties established in Law 1581 of 2012, may file a complaint with the Data Controller under the following rules:
  • The complaint must be made by submitting a request to SPOT DIVING as the Data Controller, identifying the data subject, describing the facts leading to the complaint, providing contact details, and attaching any documents that support the claim.
  • If the complaint is incomplete, the interested party will be asked within five (5) business days from receipt to provide the necessary information. If the requested information is not presented within two (2) months, it will be understood that the complaint has been withdrawn.
  • If the person receiving the complaint is not competent to resolve it, they will forward it to the appropriate party within a maximum of two (2) business days and inform the interested party of the transfer.
  • Once the complete complaint is received, a legend stating “Complaint in Process” and the reason for the complaint will be included in the database within no more than two (2) business days. This legend will remain until the complaint is resolved.
  • The maximum term for addressing the complaint will be fifteen (15) business days from the day after receipt. If the complaint cannot be addressed within this period, the interested party will be informed of the reasons for the delay and the date by which their complaint will be addressed, which may not exceed eight (8) business days after the expiration of the original term.

14. SECURITY OF PERSONAL DATA:

SPOT DIVING, in strict adherence to the Principle of Security in Personal Data Processing, will provide the necessary technical, human, and administrative measures to ensure the security of records, preventing their alteration, loss, unauthorized access, use, or fraudulent access. SPOT DIVING’s obligation and responsibility are limited to providing the appropriate means for this purpose. SPOT DIVING does not guarantee the total security of your information nor is it responsible for any consequences resulting from technical failures or unauthorized access by third parties to the database or archive where the Personal Data subject to Processing by SPOT DIVING is stored.

15. TRANSFER, TRANSMISSION, AND DISCLOSURE OF PERSONAL DATA:

SPOT DIVING may disclose Personal Data to its affiliated companies for processing and use in accordance with this Personal Data Protection Policy. Similarly, SPOT DIVING may share Personal Data with third parties not affiliated with the company under the following circumstances:

• When dealing with contractors executing contracts related to the development of SPOT DIVING’s activities.
• For transfer to any business line related to the information.
• In any case, contracts for the transmission of Personal Data entered into between SPOT DIVING and the Data Processors will require that the information be processed in accordance with this Personal Data Protection Policy. The following obligations will be included in such agreements with the Data Processor:
  • To process the Personal Data on behalf of SPOT DIVING, in accordance with the principles that protect the data.
  • To safeguard the security of the databases containing Personal Data.
  • To maintain confidentiality regarding the processing of Personal Data.

16. VALIDITY AND APPLICABLE LEGISLATION:

This Personal Data Processing Policy, the Privacy Notice, and the Authorization are governed by the provisions of the current legislation on Personal Data protection, namely Law 1581 of 2012, Decree 1377 of 2013, Decree 1727 of 2009, and Law 2300 of 2023.

SPOT DIVING reserves the right to modify this policy at any time, with prior electronic communication directed to the Data Subject in cases where required by law. However, we invite you to regularly or periodically check our website https://spotdiving.com/en/personal-data-protection-and-processing-policy/ through which the latest version of this Policy will be made available to you.

This Data Processing Policy comes into effect as of November 25, 2024.