Personal Data Processing Notice

1. Purpose of this Notice

This Notice describes, in operational detail, how 125 Ventures LLC processes the personal data of users of the Visita Monserrate website. It supplements, and does not replace, the Privacy Policy available on this Site. In the event of inconsistency between the two documents, the Privacy Policy shall prevail.

2. Identification of the Controller

3. Definitions

For the purposes of this Notice, the following terms have the meanings given below:

• Personal data: any information linked or that can be associated with one or more identified or identifiable natural persons.
• Sensitive data: data that affects the privacy of the Data Subject or whose misuse could lead to discrimination, such as racial origin, political opinions, religious beliefs, or health data.
• Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion.
• Data Subject: the natural person whose personal data is subject to Processing.
• Data Controller: the natural or legal person who decides on the Processing of personal data (in this case, 125 Ventures LLC).
• Data Processor: the natural or legal person who carries out the Processing of personal data on behalf of the Controller.
• Authorization: prior, express, and informed consent of the Data Subject to carry out the Processing of personal data.
• Processing: Any operation on personal data, such as collection, storage, use, circulation, or deletion.

4. Processing Principles

The Processing of personal data shall be subject to the following principles:

• Legality: Processing shall be carried out in accordance with applicable law
• Purpose: Processing shall serve a legitimate, previously disclosed purpose
• Freedom: Processing requires prior consent where required by law
• Truthfulness: Information must be truthful, complete, accurate, and up to date
• Transparency: The Data Subject may access information about the Processing of their data
• Security: Information shall be processed with appropriate technical and organizational measures
• Confidentiality: Persons handling the data shall ensure its confidentiality
• Confidentiality: Persons processing data must guarantee its confidentiality

5. Categories of Data Processed

We process the following categories of personal data:

5.1 Identification and contact data

• Name and surname
• Email address

5.2 Technical and browsing data

• Device and browser information
• Cookies, identifiers, and activity logs on the Site

6. Purposes of Processing

Personal data shall be processed for the following purposes:

6.1 Necessary purposes

• Manage the purchase of tickets and services
• Issue and deliver purchased tickets
• Process payments and issue receipts
• Handle inquiries, petitions, complaints, or claims
• Comply with legal, contractual, and tax obligations

6.2 Purposes subject to consent

• Send commercial and promotional information
• Conduct satisfaction surveys
• Prepare market studies and statistics on an aggregate basis
• Personalize the user experience

7. Recipients and Data Processors

Personal data may be disclosed to the following categories of recipients, only to the extent necessary for the purposes described:

• Express acceptance when making a purchase
• Checking a verification box on digital forms
• Written or verbal authorization when required
• Unequivocal conduct by the data subject that implies authorization

Authorization may be revoked at any time by the Data Subject by sending a request to info@visitamonserrate.com.

8. Data Location and Processing

Because 125 Ventures LLC is organized in the United States and works with service providers and partners in various jurisdictions, personal data may be transferred to, stored, and processed in the United States, Colombia, or other countries where we or our Processors have operations. We implement reasonable safeguards to protect the information during such transfers, in accordance with applicable law.

• Know, update, and rectify their personal data
• Request proof of the authorization granted
• Be informed about the use given to their personal data
• File complaints with the Superintendence of Industry and Commerce (SIC)
• Revoke authorization and/or request data deletion
• Access their personal data free of charge

9. Retention Periods

Personal data is retained only for as long as necessary to fulfill the purposes described and to comply with applicable legal obligations. As a reference:

1. Send a written request to info@visitamonserrate.com
2. Provide their complete identification
3. Clearly describe the right they wish to exercise
4. Attach supporting documents (if applicable)

Response times:

• Inquiries: maximum 10 business days
• Claims: maximum 15 business days

10. Security Measures

We implement reasonable technical, organizational, and administrative measures to protect personal data, including:

• Encryption of data in transit and, where appropriate, at rest
• Access control for databases and systems
• Periodic backups

In all cases, we ensure that third parties comply with protection standards equivalent to or higher than those established in this policy.

11. Rights of the Data Subject and Procedure to Exercise Them

Subject to applicable law, the Data Subject may:

• Know, update, and rectify their personal data
• Request proof of the authorization granted
• Be informed about the use of their personal data
• Withdraw consent and/or request deletion of their data, subject to legal retention obligations
• Access their personal data free of charge
• File complaints with the competent authority of their jurisdiction

12. Service Channels

For inquiries, complaints, or to exercise rights related to personal data:

• Transaction data: 5 years (in accordance with tax regulations)
• Marketing contact data: until consent revocation
• Browsing data: 1 year

13. Data Protection Officer

For matters related to the processing of your personal data, you may contact our Data Protection Officer:

You may also file complaints with the Superintendence of Industry and Commerce (SIC).

14. Modifications

This Notice may be modified at any time. Changes will be communicated through the Site and take effect upon their publication. The date of the last update appears at the beginning of this document.

15. Effective Date

This Data Processing Policy takes effect as of May 2026.