2. Applicable regulatory framework

This Policy is mainly governed by the following Colombian regulations:

• Political Constitution of Colombia, Article 15.
• Law 1581 of 2012, which establishes general provisions for the protection of personal data.
• Decree 1377 of 2013, regulating Law 1581 of 2012.
• Decree 886 of 2014, related to the National Database Registry.
• Single Regulatory Decree 1074 of 2015, where applicable.
• Any other rules that modify, add to or supplement the Colombian personal data protection regime.

3. Scope of the Policy

This Policy applies to the processing of personal data carried out by Threads Travel with respect to:

• Current and potential clients.
• National and international travelers.
• Persons requesting information, quotations or travel proposals.
• Commercial allies, agencies, operators, guides, hotels, carriers and suppliers.
• Commercial, institutional and marketing contacts.
• Users of the website, digital forms, social media, WhatsApp and other service channels.
• Persons participating in experiences, trips, events, activations or activities organized, coordinated or marketed by Threads Travel.

4. Main definitions

Personal data: any information linked to or that may be associated with a specific or identifiable natural person.

Sensitive data: information that affects the data subject’s privacy or whose improper use may lead to discrimination, such as data relating to health, medical conditions, mobility, health-related dietary restrictions, biometric data, racial or ethnic origin, religious beliefs, political orientation, among others.

Data subject: the natural person whose personal data are subject to processing.

Processing: any operation performed on personal data, such as collection, storage, use, circulation, transmission, transfer, update or deletion.

Data controller: the natural or legal person who decides on the database and/or the processing of personal data.

Data processor: the natural or legal person who processes personal data on behalf of the data controller.

Authorization: the prior, express and informed consent of the data subject to carry out the processing of his or her personal data.

5. Personal data Threads Travel may collect

Threads Travel may collect the following personal data, according to the nature of its relationship with each data subject:

5.1. Identification and contact data

• Travel dates.
• Number of travelers.
• Nacionalidad.
• Country and city of residence.
• Email address.
• Phone or WhatsApp number.
• Emergency contact information, when necessary for travel operations.

5.2. Data related to trips and experiences

• Travel dates.
• Number of travelers.
• Destination, accommodation, transportation, food and experience preferences
• Itinerary information.
• Data necessary for bookings, confirmations and provision of tourism services.
• Passport, visa or other travel document information, when strictly necessary to manage services, bookings or operational requirements.

5.3. Commercial and transactional data

• History of requests, quotations and bookings.
• Payment, billing and accounting support information.
• Commercial and communication preferences.
• Interaction with Threads Travel proposals, campaigns, content or channels.

Threads Travel will not store full credit or debit card details when payments are processed by external payment gateways or financial institutions. In such cases, the processing of financial information will be carried out in accordance with the policies of those platforms or entities.

5.4. Sensitive data

In some cases, to ensure the proper provision of tourism services, Threads Travel may request sensitive information, such as:

• Health conditions relevant to travel safety.
• Allergies.
• Dietary restrictions.
• Mobility conditions.
• Special assistance needs.
• Minimum medical information necessary for emergency care during an experience or trip.

Providing sensitive data shall always be optional. Threads Travel will process this type of data only when it has the explicit authorization of the data subject or when it is necessary to protect his or her life, health or integrity during the provision of the service.

5.5. Images, photographs and audiovisual material

During trips, events, experiences or activities, Threads Travel may capture photographs, videos or testimonials for recordkeeping, memory, communication, promotion or marketing purposes.

When the material clearly identifies a person and is to be used for commercial or promotional purposes, Threads Travel will request the corresponding authorization, unless it involves general records of public events or situations in which the law allows its use.

5.6. Browsing and digital usage data

When the user visits the website or interacts with Threads Travel digital channels, technical data may be collected, such as:

• IP address.
• Device type.
• Browser.
• Operating system.
• Pages visited.
• Browsing time.
• Traffic source.
• Interactions with forms or content.

These data may be used for analytics, security, website improvement, content personalization and campaign measurement.

6. Purposes of processing

Threads Travel may process personal data for the following purposes:

6.1. Commercial and customer service purposes

• Respond to information requests.
• Prepare and send quotations, proposals and itineraries.
• Contact the data subject by email, phone, WhatsApp, social media or other authorized channels.
• Manage commercial relationships with clients, agencies, allies and prospects.
• Follow up on commercial opportunities.
• Send information about products, services, experiences, destinations, content, news or campaigns, provided that authorization exists.

6.2. Operational purposes and provision of tourism services

• Design, coordinate, book and operate travel experiences.
• Manage bookings with hotels, carriers, restaurants, guides, local operators, airlines, insurance companies, booking platforms and other necessary allies.
• Coordinate transfers, activities, access, permits, experiences and services included in itineraries.
• Manage special traveler requirements.
• Handle emergencies, updates, operational changes or situations related to traveler safety.
• Comply with contractual obligations arising from the provision of the service.

6.3. Administrative, accounting and legal purposes

• Manage payments, billing, collections and accounting support.
• Comply with legal, tax, contractual and regulatory obligations.
• Manage complaints, claims, requests, guarantees or disputes.
• Retain supporting documents related to the contractual or commercial relationship.
• Respond to requests from competent authorities.

6.4. Marketing, reputation and customer experience purposes

• Send promotional, informational or commercial communications.
• Conduct satisfaction surveys.
• Measure customer experience.
• Analyze travel preferences and commercial behavior.
• Improve products, services, experiences, content and channels.
• Create audiences, segmentations or internal analyses to improve Threads Travel’s value proposition.
• Develop brand content, testimonials, experience cases and promotional material, with prior authorization when applicable.

7. Authorization for the processing of personal data

Threads Travel will request the prior, express and informed authorization of the data subject for the processing of his or her personal data, except in cases where the law does not require it.

Authorization may be obtained through physical, electronic, digital, telephone, web form, data message, terms acceptance, checkbox, WhatsApp record, email or other mechanisms that make it possible to prove that the data subject knew and accepted the processing of his or her data.

By providing personal data to Threads Travel, the data subject declares that the information supplied is truthful, complete, accurate and up to date.

When Threads Travel requests sensitive data, data of children or adolescents, or authorization for image use, it will inform the data subject or his or her legal representative of the optional nature of providing such information and of the specific purpose of the processing.

8. Processing of sensitive data

Threads Travel recognizes that sensitive data require special protection.

The data subject is not required to provide sensitive data. However, in some cases, not having certain sensitive information could limit the proper provision of tourism services, especially when necessary to protect the traveler’s health, safety or integrity.

Threads Travel will use sensitive data only for the specific purposes for which they were requested, such as adapting an experience to a mobility condition, informing suppliers of dietary restrictions, preventing risks during an activity, handling emergencies or coordinating special assistance.

Threads Travel will not use sensitive data for discriminatory, improper commercial or other purposes different from those authorized by the data subject.

9. Processing of data of children and adolescents

Threads Travel may process personal data of children and adolescents only when necessary for the provision of family, group or similar tourism services, and always with authorization from their parents, legal representatives or guardians.

In all cases, Threads Travel will give precedence to the best interests of the minor, limit the information collected to what is strictly necessary and use the data only for the planning, booking, operation, safety and service of the corresponding tourism experience.

10. Recipients and circulation of personal data

To fulfill the purposes described in this Policy, Threads Travel may share personal data, in a limited and necessary manner, with:

• Hotels, accommodations and tourism operators.
• Guides, carriers, restaurants and local experiences.
• Airlines, insurance companies, booking platforms and payment gateways.
• Commercial allies, travel agencies, wholesalers or retailers.
• Technology providers, CRM, automation, analytics, storage or communication tools.
• Accounting, legal, tax or administrative advisors.
• Public authorities or competent entities, when there is a legal obligation or valid request.

Threads Travel will seek to ensure that third parties receiving personal data adopt appropriate confidentiality, security and information protection measures.

11. International transfer and transmission of data

Given that Threads Travel provides tourism services aimed at international travelers and may interact with allies, agencies, platforms or suppliers located inside and outside Colombia, personal data may be transferred or transmitted internationally when necessary to manage requests, coordinate services, process bookings, payments, communications, digital tools, CRM, cloud storage, automation, analytics or customer service.

The data subject authorizes Threads Travel to transfer or transmit his or her personal data to third parties located in Colombia or abroad when necessary for the planning, quotation, booking, payment, operation, follow-up or service of tourism services. Threads Travel will seek to ensure that such third parties adopt reasonable security, confidentiality and personal data protection measures, in accordance with applicable law.

12. National Database Registry

When Threads Travel is legally required to register its databases with the National Database Registry —RNBD—, it will carry out such registration and corresponding updates in accordance with applicable regulations.

The possible obligation to register will depend on the legal conditions applicable to Threads Travel, including its legal nature and total assets. In any case, Threads Travel will maintain internal procedures for the proper management of the personal databases under its responsibility.

13. Retention of personal data

Threads Travel will retain personal data for the time necessary to fulfill the purposes for which they were collected, address contractual, commercial, accounting, tax, legal or administrative obligations, and resolve possible claims.

Data may be retained during the term of the relationship with the data subject and for the additional time necessary under applicable law.

When the data are no longer necessary and there is no legal or contractual obligation to retain them, Threads Travel will proceed to delete, anonymize or block them, as applicable.

14. Information security

Threads Travel will adopt reasonable technical, administrative and organizational measures to protect personal data against loss, unauthorized access, misuse, alteration, disclosure, destruction or unauthorized processing. Information security

These measures may include, as applicable:

• Restricting access to information.
• Use of passwords and security controls.
• Storage on platforms with protection measures.
• Internal confidentiality protocols.Protocolos internos de confidencialidad.
• Management of access granted to suppliers or collaborators.
• Backup copies.
• Periodic review of databases and collection channels.

Although Threads Travel will implement reasonable security measures, no technological system or internet transmission can guarantee absolute security. In the event of relevant incidents that may affect the rights of data subjects, Threads Travel will act in accordance with applicable law.

15. Rights of data subjects

Personal data subjects have the right to:

• Know, update and rectify their personal data.
• Request proof of the authorization granted.
• Be informed about the use made of their personal data.
• Submit inquiries and claims.
• Request the deletion of their data when applicable.
• Revoke the authorization granted, provided there is no legal or contractual obligation requiring the retention of the information.
• Access their personal data free of charge.
• File complaints with the Superintendence of Industry and Commerce when they consider that their personal data have not been properly processed, after first submitting a direct claim to Threads Travel when required by law.

16. Channels to exercise rights

The data subject may exercise his or her rights by sending a request through the following channels:

The request must include at least:

• Full name of the data subject.
• Type and number of identification document.
• Clear description of the request, inquiry, or claim.
• Contact details to receive a response.
• Supporting documents for the request, when applicable.
• If acting through a representative, a document proving such representation.

Threads Travel may request additional information to verify the identity of the data subject and ensure the security of personal data.

17. Procedure for inquiries and claims

Inquiries shall be answered within a maximum term of ten (10) business days from the date of receipt. When it is not possible to answer the inquiry within such term, Threads Travel will inform the data subject of the reasons for the delay and the date on which it will respond, which may not exceed five (5) business days following the expiration of the initial term.

Claims shall be answered within a maximum term of fifteen (15) business days counted from the day following their receipt. When it is not possible to respond to the claim within such term, Threads Travel will inform the data subject of the reasons for the delay and the date on which it will respond, which may not exceed eight (8) business days following the expiration of the initial term.

When a claim is incomplete, Threads Travel may require the data subject within five (5) business days following receipt of the claim to correct the deficiencies. If two (2) months have elapsed from the date of the request and the data subject has not submitted the required information, the claim shall be deemed withdrawn.

18. Use of cookies and similar technologies

The Threads Travel website may use cookies, pixels, tags, analytics tools or other similar technologies to improve the browsing experience, remember user preferences, measure traffic and behavior on the website, analyze campaign performance, personalize content or communications and strengthen website security.

The user may configure his or her browser to accept, reject or delete cookies. However, some website functionalities may be affected if certain cookies are disabled.

Threads Travel may use third-party tools, such as analytics, advertising, CRM, automation or social media platforms, subject to their own privacy policies.

19. Links to third-party sites

The Threads Travel website, communications or digital channels may contain links to third-party websites, platforms, social media, payment gateways, forms or services.

Threads Travel is not responsible for the privacy, security or data processing practices of such third parties. Users are encouraged to review each platform’s privacy policies before providing personal information.

20. Amendments to this Policy

Threads Travel may update, modify or adjust this Policy when necessary due to legal, regulatory, operational, commercial, technological or service-related changes.

The current version will be available through Threads Travel’s official channels. When changes are substantial, Threads Travel will seek to inform data subjects through the means it deems appropriate.

Term

This Policy shall be effective as of its publication and shall remain in force while Threads Travel carries out personal data processing in the course of its commercial, operational, tourism, administrative and legal activity.