Personal Data Processing Notice

1. Purpose of this Notice

This Notice describes, in operational detail, how 125 Ventures LLC processes the personal data of users of the Tiquetes Monserrate website. It supplements, and does not replace, the Privacy Policy available on this Site. In the event of inconsistency between the two documents, the Privacy Policy shall prevail.

2. Identification of the Controller

3. Definitions

For the purposes of this Notice, the following terms have the meanings given below:

• Personal data: any information linked or that can be associated with one or more identified or identifiable natural persons.
• Sensitive data: data that affects the privacy of the Data Subject or whose misuse could lead to discrimination, such as racial origin, political opinions, religious beliefs, or health data.
• Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion.
• Data Subject: the natural person whose personal data is subject to Processing.
• Data Controller: the natural or legal person who decides on the Processing of personal data (in this case, 125 Ventures LLC).
• Data Processor: the natural or legal person who carries out the Processing of personal data on behalf of the Controller.
• Authorization: prior, express, and informed consent of the Data Subject to carry out the Processing of personal data.

4. Processing Principles

The Processing of personal data shall be subject to the following principles:

• Legality: Processing shall be carried out in accordance with applicable law
• Purpose: Processing shall serve a legitimate, previously disclosed purpose
• Freedom: Processing requires prior consent where required by law
• Truthfulness: Information must be truthful, complete, accurate, and up to date
• Transparency: The Data Subject may access information about the Processing of their data
• Security: Information shall be processed with appropriate technical and organizational measures
• Confidentiality: Persons handling the data shall ensure its confidentiality

5. Categories of Data Processed

We process the following categories of personal data:

5.1 Identification data

• Name and surname
• Type and number of identity document or passport

5.2 Contact data

• Email address
• Mobile phone number
• Residential address (where applicable)

5.3 Technical and browsing data

• IP address
• Device and browser information
• Cookies, identifiers, and activity logs on the Site

6. Purposes of Processing

Personal data shall be processed for the following purposes:

6.1 Necessary purposes

• Manage the purchase of tickets and services
• Issue and deliver purchased tickets
• Verify the buyer's identity
• Process payments and issue receipts
• Handle inquiries, petitions, complaints, or claims
• Comply with legal, contractual, and tax obligations

6.2 Purposes subject to consent

• Send commercial and promotional information
• Conduct satisfaction surveys
• Prepare market studies and statistics on an aggregate basis
• Personalize the user experience

7. Recipients and Data Processors

Personal data may be disclosed to the following categories of recipients, only to the extent necessary for the purposes described:

• Payment processors: to process transactions; these processors receive payment information directly under their own security policies.
• Technology service providers: including hosting, email delivery, messaging, analytics, and customer support providers, who act as Processors under our instructions.
• Competent authorities: when required by applicable law, court order, or legitimate request by a public authority.

8. International Transfers

Because 125 Ventures LLC is organized in the United States and works with service providers and partners in various jurisdictions, personal data may be transferred to, stored, and processed in the United States, Colombia, or other countries where we or our Processors have operations. We implement reasonable safeguards to protect the information during such transfers, in accordance with applicable law.

9. Retention Periods

Personal data is retained only for as long as necessary to fulfill the purposes described and to comply with applicable legal obligations. As a reference:

• Transaction data: up to five (5) years, for accounting and tax obligations
• Marketing contact data: until the Data Subject withdraws consent
• Browsing data: up to twelve (12) months

10. Security Measures

We implement reasonable technical, organizational, and administrative measures to protect personal data, including:

• Encryption of data in transit and, where appropriate, at rest
• Access control for databases and systems
• Periodic backups
• Internal information security policies
• Staff training on data protection
• Access monitoring and auditing

11. Rights of the Data Subject and Procedure to Exercise Them

Subject to applicable law, the Data Subject may:

• Know, update, and rectify their personal data
• Request proof of the authorization granted
• Be informed about the use of their personal data
• Withdraw consent and/or request deletion of their data, subject to legal retention obligations
• Access their personal data free of charge
• File complaints with the competent authority of their jurisdiction

To exercise these rights, the Data Subject must:

1. Send a written request to info@visitamonserrate.com
2. Properly identify themselves
3. Clearly describe the right they wish to exercise
4. Attach any supporting documents that may apply

Response times: we will respond to requests within the timeframes provided by applicable law. Without prejudice to stricter statutory deadlines, we generally respond to inquiries within a maximum of ten (10) business days, and to claims within a maximum of fifteen (15) business days, counted from the date the complete request is received.

12. Service Channels

For inquiries, complaints, or to exercise rights related to personal data:

13. Effective Date and Updates

This Notice may be modified at any time. Changes will be communicated through the Site and take effect upon their publication. The date of the last update appears at the beginning of this document.

14. Entry Into Force

This Personal Data Processing Notice takes effect as of May 2026.