Privacy Policy

DATA PRIVACY AND INFORMATION MANAGEMENT POLICIES
STATUTE 1581 OF 2012 AND ITS REGULATORY DECREES, STATUTE 1266 OF 2008 AND STATUTE 2573 OF 2026

DATA CONTROLLER
NAME: Distrito Obrador S.A.S
TAX ID / NIT: 902042734-1
ADDRESS: Calle 9 # 43C-41, Barrio Astorga, Medellín, Antioquia, Colombia
E-MAIL: gerencia@obrahotels.com
WEBSITE: https://obrahotels.com/

1. OBJECTIVE
To establish and disseminate the Information Processing and Personal Data Protection Policies implemented by Distrito Obrador S.A.S ., in order to guarantee proper compliance with Statute 1581 of 2012 and its regulatory decrees, which aim to develop the constitutional right of all individuals to know, update, and rectify information collected about them in databases or files, and other constitutional rights, freedoms, and guarantees referred to in Article 15 of the Political Constitution "Habeas Data"; as well as the right to information enshrined in Article 20 thereof.

The company Distrito Obrador S.A.S adopts this internal policies and procedures manual to guarantee compliance with this precept and these regulatory provisions.

2. SCOPE:
This document applies to all personal data registered in any database administered by the company that makes them subject to Processing.

3. DEFINITIONS:

3.1. Authorization: prior, express, and informed consent of the Data Subject to carry out the processing of personal data.

3.2. Database: organized set of personal data that is subject to processing.

3.3. Personal data: any information linked or that can be associated with one or more specific or determinable natural or legal persons.

3.4. Data Processor: natural or legal person, public or private, who by themselves or in association with others, performs the processing of personal data on behalf of the data controller.

3.5. Data Controller: natural or legal person, public or private, who by themselves or in association with others, decides on the database and/or the processing thereof. In this case, it shall be Distrito Obrador S.A.S.

3.6. Data Subject: natural person whose personal data is subject to processing. In this case, the data subjects may be customers, collaborators, contractors, suppliers, or third parties who have a direct or indirect legal, labor, commercial, or contractual relationship with Distrito Obrador S.A.S.

3.7. Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

3.8. Inquiries: request for the personal information of the Data Subject that rests in any database, regarding which Distrito Obrador S.A.S has the obligation to supply to the Data Subject or their successors-in-title all the information contained in the individual record or that is linked to the identification of the Data Subject.

3.9. Claims: request for correction, updating, or deletion of the information contained in a database processed by Distrito Obrador S.A.S . or a request due to alleged non-compliance with any of the duties contained in Statute 1581 of 2012, made by the Data Subject or their successors-in-title.

3.10. Public data: data that is not semi-private, private, or sensitive. Public data includes, among others, data relating to the civil status of persons, their profession or trade, and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public registries, public documents, official gazettes and bulletins, and duly executed judicial rulings that are not subject to confidentiality.

3.11. Sensitive data: personal data that reveals racial or ethnic origin, political opinions, religious or moral convictions, trade union affiliation, information regarding health or sex life, or any other data that may produce, due to its nature or context, any discriminatory treatment toward the data subject. These data are specially protected.

3.12. Habeas data: fundamental right that allows individuals to know, update, and rectify information stored about them in data banks and in files of public and private entities.

3.13. Successor-in-title (Causahabiente): person who has succeeded or subrogated by any title into the rights of another or others.

4. GENERAL GUIDELINES

4.1 The policies set forth in this document are mandatory for Distrito Obrador S.A.S as an information source of data, as well as for the processors who perform personal data processing on behalf of the Company.

4.2 Both the controller and the processors must safeguard the databases containing personal data and maintain confidentiality regarding the processing.

5. REGULATORY BACKGROUND

5.1 Article 15 of the Political Constitution.
"All persons have the right to their personal and family privacy and to their good name, and the State must respect them and make them respected. Similarly, they have the right to know, update, and rectify information collected about them in data banks and in files of public and private entities. In the collection, processing, and circulation of data, freedom and other guarantees enshrined in the Constitution shall be respected."

5.2 Article 20 of the Political Constitution.
"Every person is guaranteed the freedom to express and disseminate their thoughts and opinions, to inform and receive truthful and impartial information, and to establish mass media communications. These are free and have social responsibility. The right to rectification under conditions of equity is guaranteed. There shall be no censorship."

6. Distrito Obrador S.A.S IN THE REGULATION
We are a source of information.

6.1 WHY ARE WE A SOURCE OF INFORMATION?
Inasmuch as Distrito Obrador S.A.S is a company in charge of collecting credit information from users to whom services are offered through payment systems under credit and cash modalities, it constitutes what are called sources of information as referred to in literal (b) of article three of Statute 1266 of 2008. (…)

"It is the person, entity, or organization that receives or knows personal data of the information subjects, by virtue of a commercial or service relationship or of any other nature and that, by virtue of legal authorization or authorization from the subject, supplies those data to an information operator, which in turn will deliver them to the final user. If the source delivers the information directly to the users and not through an operator, it will have the dual status of source and operator and will assume the duties and responsibilities of both. The source of information is responsible for the quality of the data supplied to the operator, which, as it has access to and supplies personal information of third parties, is subject to compliance with the duties and responsibilities provided to guarantee the protection of the rights of the data subject."(…)

6.2 DUTIES OF THE INFORMATION SOURCES ARTICLE 8, STATUTE 1266 OF 2008:
Information sources shall comply with the following obligations, without prejudice to compliance with other provisions provided in this statute and others governing their activity:
a. Guarantee that the information supplied to the operators of the data banks or to the users is truthful, complete, accurate, updated, and verifiable.
b. Report periodically and opportunely to the operator all novelties regarding the data previously supplied to it and adopt other necessary measures so that the information supplied to it remains updated.
c. Rectify information when it is incorrect and inform the operators accordingly.
d. Design and implement effective mechanisms to opportunely report information to the operator.
e. Request, when applicable, and retain a copy or evidence of the respective authorization granted by the information subjects, and ensure not to supply to the operators any data whose supply is not previously authorized, when such authorization is necessary, in accordance with the provisions of this statute.
f. Certify semi-annually to the operator that the information supplied has the authorization in accordance with the provisions of this statute.
g. Resolve the claims and petitions of the subject in the manner regulated in this statute.
h. Inform the operator that certain information is under discussion by its subject, when the request for rectification or updating thereof has been submitted, so that the operator includes a mention in that sense in the data bank until said process is finalized.
i. Comply with the instructions issued by the control authority regarding compliance with this statute.
j. Others derived from the Constitution or this statute.

6.3. PROCEDURE IN CASE OF IDENTITY THEFT OR FRAUD
In accordance with Statute 2573 of 2026 and other regulations that modify, complement, or substitute it, Distrito Obrador S.A.S. is committed to protecting the information of data subjects and preventing fraudulent behavior.

If a data subject considers that a reservation, service, or transaction made in their name was carried out without their authorization or as a result of a possible identity theft or fraud, they may file a claim through the service channels provided by Distrito Obrador S.A.S.

Once the request is received, within the following ten (10) business days, Distrito Obrador S.A.S. will review the information and support materials related to the questioned operation, such as identification documents, authorizations granted by the subject, reservation records, proof of payment, electronic communications, and other available evidence, in order to verify the reported facts.

While the review is being carried out, and when applicable according to current regulations, Distrito Obrador S.A.S. will inform the information operators that the data subject to the claim are under discussion by their data subject.

If, as a result of the review, it is determined that identity theft or fraud occurred under the terms of Article 3 of Statute 2573 of 2026, Distrito Obrador S.A.S. will adopt the necessary measures to correct, update, or delete the corresponding information and will opportunely inform said situation to the information operators when necessary.

Distrito Obrador S.A.S. will retain the supports and evidence of operations carried out by data subjects in order to guarantee information security, address claims, and comply with applicable legal obligations.

7. PROCESSING OF PERSONAL DATA

7.1 Principles for the processing of personal data.
The following principles will be taken into account by Distrito Obrador S.A.S in the personal data administration process.

7.1.1 Legality in data processing matter.
Data processing must adhere to the provisions contained in Statute 1581 of 2012 and in any rule that develops or regulates such provision.

7.1.2 Purpose and treatment.
The personal data collected by Distrito Obrador S.A.S. may be used for the development of its corporate purpose and, in particular, to manage reservations, registration processes, and identity verification (check-in and check-out), accommodation, customer service, provision of hotel, tourism, and complementary services, payment administration, billing, collection, portfolio management, as well as for consultation and reporting to information operators when applicable in accordance with current regulations.

Likewise, personal data may be processed to prevent, detect, investigate, and report conduct that may constitute illegal or fraudulent activities, including fraud, identity theft, money laundering, terrorist financing, human trafficking, sexual exploitation, commercial sexual exploitation of children and adolescents (ESCNNA), sex tourism, child pornography, and any other conduct that may endanger the integrity, security, or rights of guests, visitors, collaborators, or third parties.

Personal data may also be used to address petitions, complaints, and claims; comply with legal, regulatory, contractual, and tax obligations; respond to requirements from administrative, judicial, police, immigration, or any other competent authorities; comply with obligations related to immigration control, citizen security, and guest registration; and, in general, fulfill any obligation applicable to hotel and tourism service providers.

Similarly, the information may be used for the management of facility security, access control, protection of people and goods found within them, as well as for handling security incidents and developing internal investigations when necessary.

On the other hand, personal data may be processed for the administration of loyalty programs, sending commercial communications, marketing and advertising activities, promotions, conducting satisfaction surveys, preparing statistics and reports, customer knowledge, commercial profiling, improving guest experience, and developing new products, services, or benefits.

The Data Subject expressly authorizes Distrito Obrador S.A.S. to carry out the national and international transmission and/or transfer of their personal data to commercial allies, linked companies, contractors, and, in general, to any processor or controller who requires access to the information for the development of the purposes described herein or for the fulfillment of legal or contractual obligations. Such transmissions or transfers may be made to countries other than Colombia, including jurisdictions that may or may not have adequate levels of data protection, in which case Distrito Obrador S.A.S. will adopt reasonable measures to guarantee the protection, confidentiality, and security of the information.

Finally, the website of Distrito Obrador S.A.S. may use cookies, analytics tools, tracking technologies, online identifiers, and similar mechanisms for technical, functional, statistical, analytical, security, personalization, marketing, and advertising purposes. These technologies allow, among other aspects, guaranteeing the proper functioning of the website, remembering browsing preferences, analyzing user behavior, measuring the performance of advertising campaigns, and improving the browsing experience. The processing of information collected through such technologies will be carried out in accordance with the Cookie Policy of Distrito Obrador S.A.S., available for consultation at https://obrahotels.com/.

7.1.3 Truthfulness or quality.
The information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fractioned, or misleading data is prohibited.

7.1.4 Transparency.
In processing, the right of the Data Subject to obtain from Distrito Obrador S.A.S or the designated data processor, at any time and without restrictions, information about the existence of data concerning them must be guaranteed.

7.1.5 Restricted access and circulation.
Processing is subject to the limits derived from the nature of the personal data, the provisions of Statute 1581 of 2012, and the Constitution. In this sense, processing may only be done by persons authorized by the Data Subject and/or by the persons provided in the Statute.

Personal data, except public information, may not be available on the Internet or other mass media or communication channels, unless access is technically controllable to provide restricted knowledge only to the Data Subjects or third parties authorized pursuant to the Statute.

7.1.6 Security
The information subject to processing by the controller or processor must be handled taking technical, human, and administrative measures that are reasonable to grant security to the records, seeking to avoid their alteration, loss, consultation, unauthorized or fraudulent use or access.

7.1.7 Confidentiality.
All persons who intervene in the processing of personal data that do not have a public nature are obliged to guarantee the secrecy of the information, even after the end of their relationship with any of the tasks comprising said procedure, being only allowed to perform supply or communication of personal data when it corresponds to the development of activities authorized in the Statute and under the terms thereof.

7.2 Special categories of data.

7.2.1 Sensitive data.
In accordance with Statute 1581 of 2012 and Decree 1377 of 2013, Distrito Obrador S.A.S. informs the Data Subject that supplying sensitive data is optional and they are not obligated to authorize its processing.

In particular, Distrito Obrador S.A.S. may collect and process biometric data such as facial images, facial recognition, fingerprints, voice recordings, or other authentication or identification mechanisms, when used for registration processes, identity validation, access control, fraud prevention, asset protection, facility security, or responding to requirements from competent authorities.

In general, Distrito Obrador S.A.S. may process sensitive personal data when it is necessary for the provision of its services, the protection of guests, visitors, and collaborators, or compliance with legal or regulatory obligations.

Distrito Obrador S.A.S. will adopt the technical, human, and administrative measures necessary to protect sensitive data under its custody and guarantee its confidentiality, integrity, and security, in accordance with applicable personal data protection regulations.

7.2.1.2. Video Surveillance
Distrito Obrador S.A.S. may use video surveillance systems and other monitoring mechanisms in its facilities in order to guarantee the security of guests, visitors, collaborators, contractors, and third parties, protect the assets and facilities of the Company, control access to restricted areas, prevent illegal behavior, handle security incidents, and comply with requirements from competent authorities.

The images, photographs, video recordings, and other records obtained through these systems may be stored, consulted, and used for the purposes described herein, as well as supplied to administrative, judicial, or police authorities when a legal obligation or requirement from a competent authority exists.

Distrito Obrador S.A.S. will adopt reasonable security measures to protect information obtained through video surveillance systems and limit access to it solely to authorized personnel or third parties legitimized according to law.

7.2.1.2 Distrito Obrador S.A.S. will only process sensitive personal data when it has the prior, express, and informed authorization of the Data Subject or when said processing is permitted by one of the exceptions provided in Statute 1581 of 2012 and other rules that modify, complement, or substitute it.

7.2.2 Rights of children and adolescents.
In processing, respect for the prevailing rights of children and adolescents shall be ensured. The processing of personal data of children and adolescents is prohibited, except for data that is public in nature.

7.2.3 Rights of the Data Subjects:

7.2.3.1 To know, update, and rectify their personal data before Distrito Obrador S.A.S , or before the designated data processor. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, or misleading data, or those whose processing is expressly prohibited or has not been authorized.

7.2.3.2 To request proof of the authorization granted to Distrito Obrador S.A.S except when expressly exempted as a requirement for processing, in accordance with the provisions of Article 10 of Statute 1581 of 2012.

7.2.3.3 To be informed by Distrito Obrador S.A.S , or by the designated data processor, upon request, regarding the use given to their personal data.

7.2.3.4 To submit complaints before the Superintendence of Industry and Commerce for infractions of the provisions of Statute 1581 of 2012 and other rules that modify, add to, or complement it.

7.2.3.5 To revoke the authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in processing, Distrito Obrador S.A.S or the designated processor have engaged in conduct contrary to Statute 1581 of 2012 and the Constitution.

7.2.3.6 To access free of charge under the conditions defined in this document their personal data that have been subject to processing.

8. CONDITIONS FOR DATA PROCESSING

8.1 Authorization
In development of the principles of purpose and freedom, the collection of data carried out by Distrito Obrador S.A.S must be limited to those personal data that are relevant and adequate for the purpose for which they are collected or required according to current regulations, except in cases expressly provided by Law.

8.2 Authorization of the Data Subject
For Distrito Obrador S.A.S to carry out any personal data processing action, the prior and informed authorization of the Data Subject is required, which must be obtained by any means that can be subject to subsequent consultation. These mechanisms may be predetermined through technical means that facilitate the Data Subject's automated manifestation or can be in writing or orally. Authorizations by Data Subjects will be registered as follows:

Distrito Obrador S.A.S requests authorization for information processing from all its data subjects, provided that such collection implies the carrying out of information processing by Distrito Obrador S.A.S , or third parties (with prior authorization). This request for authorization is made at the time of generating commercial relationships with customers (Credit and Cash Sales), purchasing products and services with suppliers, and hiring personnel for the performance of tasks inherent to the organization. Distrito Obrador S.A.S adopts procedures to request, at the latest at the time of data collection, the authorization of the Data Subject for the processing thereof and will inform which personal data will be collected as well as all specific purposes of said processing for which consent is obtained.

Personal data found in publicly accessible sources, regardless of the medium through which access is had—understood as data or databases available to the public—may be processed by Distrito Obrador S.A.S , provided that, by their nature, they are public data.

In case of making substantial changes to the content of the Processing Policies, regarding the identification of the Controller and the Purpose of the processing of personal data, which may affect the content of the authorization, Distrito Obrador S.A.S will communicate these changes to the Data Subjects at least 3 days before the entry into force of the new policy, and will also obtain a new authorization from the Data Subject when the change refers to the Purpose of the Processing. For the communication of changes and authorization.

8.2.1 Cases where authorization is not necessary
a. Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
b. Data of a public nature.
c. Cases of medical or sanitary urgency.
d. Processing of information authorized by law for historical, statistical, or scientific purposes.
e. Data related to the Civil Registry of persons.

8.3 Supply of information The information requested by the Data Subject will be supplied by Distrito Obrador S.A.S , and may be supplied by any means, including electronic ones, as required by the Data Subject. The information must be easy to read, without technical barriers preventing access, and must correspond in its entirety to what rests in the database.

8.4 Duty to inform the Data Subject Distrito Obrador S.A.S , at the moment of requesting authorization from the Data Subject, must clearly and expressly inform them of the following: The processing to which their personal data will be submitted and the purpose thereof. The optional nature of the answer to questions asked, when they deal with sensitive data or data of children and adolescents. The rights that assist them as a Data Subject. The identification, physical or electronic address, and telephone number of the data controller.

8.5 Persons to whom information may be supplied: Information regarding personal data that have been subject to Processing by Distrito Obrador S.A.S ., may be supplied to the following persons: To the Data Subjects, their successors-in-title, or their legal representatives. To public or administrative entities in the exercise of their legal functions or by judicial order. To third parties authorized by the Data Subject or by law.

9. RIGHTS OF THE DATA SUBJECT

9.1 Revocation of authorization and/or deletion of data:
Data Subjects may at any time request from Distrito Obrador S.A.S the deletion of their personal data and/or revoke the authorization granted for the processing thereof, through the presentation of a claim, in accordance with the provisions of Article 15 of Statute 1581 of 2012. The request for deletion of information and revocation of authorization SHALL NOT PROCEED WHEN THE DATA SUBJECT HAS A LEGAL OR CONTRACTUAL DUTY TO REMAIN IN THE DATABASE OF Distrito Obrador S.A.S The procedure will be the one established in this document for submitting claims.

9.2 Inquiries and claims:
The Data Subject or their successors-in-title have the right to submit inquiries and/or claims before Distrito Obrador S.A.S , after validation of their identity, through any of the customer service mechanisms provided by the Company nationwide. Distrito Obrador S.A.S will respond to the inquiry and/or claim by the same medium through which it was formulated.

9.2.1 Inquiry:
Data Subjects or their successors-in-title may consult the personal information of the Data Subject resting in the database of the controller. Distrito Obrador S.A.S will supply the applicant with all information contained in the individual record or linked to the identification of the Data Subject.

The Data Subject may consult their personal data free of charge:
At least once (1) each calendar month. Each time substantial modifications to the Information Processing Policies exist that motivate new inquiries. For inquiries whose periodicity is greater than once (1) per calendar month, Distrito Obrador S.A.S will only charge for shipping, reproduction, and, where applicable, certification of documents. Reproduction costs may not be greater than the recovery costs of the corresponding material.

Response to inquiries
For the purposes of responding to inquiries, Distrito Obrador S.A.S has a term of ten (10) business days counted from the date of receipt thereof. When it is not possible to attend to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their inquiry will be attended to, which in no case may exceed five (5) business days following the expiration of the first term.

Claims
The Data Subject or their successors-in-title who consider that the information contained in a database should be subject to correction, updating, or deletion, or when they notice the alleged non-compliance with any of the duties contained in Statute 1581 of 2012, may file a claim before Distrito Obrador S.A.S , which will be processed under the following rules and formulated through a request addressed to Distrito Obrador S.A.S , with at least the following information:
Name of the Data Controller or Processor.
Name of the petitioner.
Identification number of the petitioner.
Facts on which the request is based.
Object of the petition.
Correspondence address.
Provide the documents intended to be asserted.

If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to remedy the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that they have abandoned the claim. In case the person who receives the claim is not competent to resolve it, they will transfer it to whom corresponds within a maximum term of two (2) business days and inform the interested party of the situation. Once the complete claim is received, a legend saying "claim in process" and the reason thereof will be included in the database within a term not exceeding two (2) business days. Said legend must be maintained until the claim is resolved. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be attended to, which in no case may exceed eight (8) business days following the expiration of the first term.

9.2.3 Procedural requirement: The Data Subject or successor-in-title may only raise a complaint before the Superintendence of Industry and Commerce once they have exhausted the inquiry or claim process before the data controller or processor.

9.2.4 Procedure for inquiries and claims.
In compliance with the above, Distrito Obrador S.A.S will respond to the inquiry and/or claim by the same medium through which it was formulated.

The procedure established by Distrito Obrador S.A.S to file claims, make inquiries, and/or exercise their rights as data subjects of the collected information is as follows.

9.2.4.1 Receipt of the claim or inquiry in any of the complexes—these can be identified on the Websites https://obrahotels.com/ ; they may also address a written statement directly to the Administrative Offices at Calle 9 # 43C-41, Barrio Astorga, Medellín, Antioquia, Colombia9.

9.2.4.2 Claims or inquiries may also be sent via email: gerencia@obrahotels.com

9.2.4.3 For petitions or inquiries, there are 10 business days from receipt; if necessary, the response can be extended for 5 more business days.

9.2.4.4 For claims, there are 15 business days to resolve them, pursuant to Number 3 of Article 16 of Statute 1266 of 2008.

9.2.4.5 Exceptionally, there are 8 additional business days to the first 15 to give a response to the right of petition, provided that the person making the petition is notified.

9.2.4.6 Distrito Obrador S.A.S., within 2 business days following the receipt of the claim, will place a record or legend in the operator's database stating that a "claim is in process".

9.2.4.7 In case of not being competent, there are 2 business days to transfer the information to the competent entity.

9.2.4.8 Once the response to the inquiry or claim raised by the subject is available, it will be sent to the address provided in the request and/or to the medium through which the inquiry was made.

9.2.4.9 In case of doubts or concerns about the procedure to file claims, make inquiries, and/or exercise rights as data subjects of data collected by Distrito Obrador S.A.S general information may be requested through the Customer Service department via email at gerencia@obrahotels.com.

10. DUTIES OF Distrito Obrador S.A.S IN DATA PROCESSING
a. Guarantee to the Data Subject, at all times, the full and effective exercise of the right to habeas data.
b. Request and retain, under the conditions provided by Law, a copy of the respective authorization granted by the Data Subject.
c. Properly inform the Data Subject about the purpose of the collection and the rights assisting them by virtue of the authorization granted.
d. Take measures aimed at preserving information under security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
e. Strive to ensure that the information supplied to the data processor is truthful, complete, accurate, updated, verifiable, and understandable.
f. Update information, communicating in an opportune manner to the data processor all novelties regarding data previously supplied to it and adopt other necessary measures so that the information supplied to it remains updated.
g. Rectify information when it is incorrect and communicate the pertinent information to the data processor.
h. Supply to the data processor, as applicable, only data whose processing is previously authorized in accordance with the provisions of the Law.
i. Require from the data processor at all times respect for the security and privacy conditions of the Data Subject's information.
j. Process inquiries and claims formulated under the terms indicated by law.
k. Adopt an internal policies and procedures manual to guarantee proper compliance with this law and, especially, for handling inquiries and claims.
l. Inform the data processor when certain information is under discussion by the Data Subject, once the claim has been submitted and the respective process has not concluded.
m. Inform at the request of the Data Subject about the use given to their data.
n. Inform the data protection authority when violations of security codes occur and risks exist in the administration of Data Subjects' information.
o. Comply with instructions and requirements issued by the Superintendence of Industry and Commerce.

10.1 Duties of the data processor:
Data processors must comply with the following duties, without prejudice to other provisions provided by Law and others governing their activity:
a. Guarantee to the Data Subject, at all times, the full and effective exercise of the right to habeas data.
b. Take measures to preserve information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
c. Perform opportunely the updating, rectification, or deletion of data under the terms of this law.
d. Update the information reported by data controllers within five (5) business days counted from its receipt.
e. Process inquiries and claims formulated by Data Subjects under the terms indicated by Law.
f. Adopt a document that guarantees proper compliance with the Law and, especially, for handling inquiries and claims by Data Subjects.
g. Register in the database the legend "claim in process" in the manner regulated by Law.
h. Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of personal data.
i. Abstain from circulating information that is being contested by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.
j. Allow access to information only to persons who can have access to it.
k. Inform the Superintendence of Industry and Commerce when violations of security codes occur and risks exist in the administration of Data Subjects' information.
l. Comply with instructions and requirements issued by the Superintendence of Industry and Commerce.
m. Safeguard the databases containing personal data.
n. Maintain confidentiality regarding the Processing of personal data.

11. SECURITY MEASURES
Distrito Obrador S.A.S takes all reasonable precautions and technical, administrative, and organizational measures conducive to guaranteeing the security of Data Subjects' personal data, mainly those destined to prevent its alteration, loss, and unauthorized processing or access. Security measures apply both to files and processing. The application of security measures aims to ensure preservation, confidentiality, integrity, and availability of data.

12. AMENDMENTS
Distrito Obrador S.A.S reserves the right to modify these Information Processing Policies, in whole or in part. In case of substantial changes in the Processing Policies regarding the identification of Distrito Obrador S.A.S and the purpose of personal data Processing, which may affect the content of the authorization, Distrito Obrador S.A.S will communicate these changes to the data subject at the latest at the moment of implementing the new policies.