Privacy and Personal Data Processing Policy

Relationship between the parties

Sigler is the visible identity of the event. ICM Travel is the agency contracted by Sigler to organize it. MACONDO DMC S.A.S. offers the optional activities directly to attendees and is the data controller for the purchase, booking, payment, operation, and processing of the data collected through this portal. Data obtained through the portal is not shared with Sigler or ICM Travel.

1. Who is responsible for processing your data?

MACONDO DMC S.A.S., registered under Colombian Tax ID (NIT) No. 900486915-4, domiciled in Bogotá, D.C., at Carrera 15 A No. 112-62, Edificio Urban Atenea, email siglertours@macondodmc.com, and Colombian National Tourism Registry (RNT) No. 26194, is the data controller for the processing carried out to book, pay for, and operate the optional activities offered directly to attendees of the Sigler Cartagena 2027 event.

2. Who does this Policy apply to?

This Policy applies to adults acting as purchasers, passengers, companions, or users of the portal. The portal is intended exclusively for adults: it is not directed at minors, and no bookings may be made for persons under 18 years of age. Sigler’s visual identity does not change Macondo’s status as data controller. Data obtained through the portal is not shared with Sigler or ICM Travel.

A purchaser may book and pay for an activity on behalf of another adult. In that case, the purchaser states that they have the authorization of the other person to provide their data for the sole purpose of managing the booking, and Macondo will process that data under this same Policy.

3. Legal framework and applicable law

Processing is carried out in accordance with the Colombian Constitution, Law 1581 of 2012, Decree 1074 of 2015, and their implementing regulations, applying the principles of legality, purpose limitation, freedom, data quality, transparency, restricted circulation, security, and confidentiality.

The services are contracted and provided in Colombia, and the processing of personal data is governed by Colombian law and subject to the supervision of the Superintendency of Industry and Commerce (SIC). If you reside in a country with its own data protection framework, such as the European Union or the United Kingdom, please note that Colombian law grants you equivalent rights of access, correction, updating, deletion, proof of authorization, and revocation of consent, which you may exercise as described in this Policy.

4. What data do we collect?

To manage the purchase and provision of the optional activities, we may collect:

• Identification and contact data, such as first name, last name, email address, and telephone number.
• Booking information, such as the selected activity, date, time, number of passengers, pickup point, and destination, where applicable.
• For certain water-based activities, the full name, date of birth, age, passport number, and passport expiration date of each participant, as required by the Cartagena Port Authorities and the operating supplier.
• Transaction information, such as amount, currency, payment status, and transaction reference.
• Information included in inquiries, change requests, cancellations, or claims.
• Technical data required for the portal to function and information stored locally in the browser, such as the selected tours and, when the payment process is initiated, a record to prevent duplicate purchases that includes the purchaser’s email address.

Full card data is processed directly by the ePayco payment gateway. MACONDO DMC S.A.S. does not store full card data.

5. Sensitive data

MACONDO DMC S.A.S. does not request or process sensitive data through this portal. The forms do not collect information on health conditions, illnesses, allergies, dietary requirements, or any special condition. The forms are limited to the identification, contact, booking, and payment information needed to manage and provide the optional activities.

6. What do we use your data for?

We use the data exclusively to:

• Manage the request, booking, payment, and confirmation.
• Identify adult travelers.
• Create and manage bookings in Tourplan.
• Process payments.
• Reconcile transactions, prevent fraud, and manage refunds.
• Coordinate service delivery with tourism suppliers.
• Send operational information.
• Respond to inquiries and claims.
• Comply with legal and contractual obligations.
• Retain evidence.
• Protect the security of the portal.

The data will not be used to send advertising or promotions.

7. Authorization and privacy notice

Before collecting data, the portal identifies Macondo as the data controller, explains the purposes and your rights, and links to this Policy. Authorization is prior, express, and informed, given by means of a checkbox that is not pre-checked (opt-in). Acceptance of the terms and authorization for data processing are presented separately. Macondo retains evidence of the authorization granted.

8. Who can access your data?

The following may process the information only to the extent necessary: Banana Script, as technology provider and data processor; Tourplan, as the booking management system; ePayco and the participants in the payment process; the tourism suppliers that operate the activities; authorized infrastructure, database, and transactional email providers; and authorities where there is a legal obligation. Banana Script may access the data only when necessary to operate, maintain, or provide technical support for the portal, following Macondo’s instructions and without using the data for its own purposes. Portal data is not shared with Sigler or ICM Travel.

9. International transfers and transmissions

Some of the providers involved in operating the portal, processing payments, and sending transactional email may process or store data on infrastructure located outside Colombia. By authorizing the processing of your data, you authorize these international transfers and transmissions, which may involve countries whose data protection standards differ from those of Colombian law.

In these cases, Macondo and its data processors apply the corresponding contractual and security conditions, including confidentiality obligations, purpose limitation, security measures, and the standards required by the Superintendency of Industry and Commerce for international transfers of personal data.

10. How long do we keep your data?

Data is kept for as long as necessary to manage the booking, provide the service, handle claims, and comply with legal obligations. Booking and identification data is retained for the duration of the event and for the period required to handle any subsequent claim. Transaction, billing, and accounting data is retained for the periods required by Colombian commercial and tax regulations. Once these periods have elapsed, the data is deleted, anonymized, or retained with restricted access, as applicable.

11. What are your rights?

As the data subject, you may:

• Ask MACONDO DMC S.A.S. for information about the personal data it holds about you and how it is used.
• Request that your data be updated or corrected when it is inaccurate, incomplete, or misleading.
• Request proof of the authorization granted, except where the law does not require it.
• Revoke your authorization or request deletion of your data where legally applicable, provided there is no legal or contractual obligation requiring its retention.
• File a complaint with the Superintendency of Industry and Commerce (SIC), after first exhausting the inquiry or claim procedure before Macondo, which is a mandatory prior step under Colombian law.

12. How can you submit an inquiry or claim?

Requests should be sent to siglertours@macondodmc.com, including the data subject’s identification, a description of the request, contact details, and any supporting documentation.

Inquiries are answered within ten (10) business days of receipt. If it is not possible to answer within that period, you will be informed of the reasons and of the date on which your inquiry will be addressed, which will not exceed five (5) business days following the expiry of the first period.

Claims are resolved within fifteen (15) business days of receipt. If it is not possible to resolve the claim within that period, you will be informed of the reasons and of the new date, which will not exceed eight (8) business days following the expiry of the first period.

If a claim is incomplete, Macondo will ask you to correct it within five (5) days of receipt. If you do not provide the required information within two (2) months, the claim will be deemed withdrawn. While the claim is being processed, the corresponding record will be marked with the legend “claim in process” and the reason for it, within two (2) business days of receipt and until the claim is resolved.

13. How do we protect your data?

Macondo and its data processors apply encryption in transit, database encryption at rest, role-based access with least privilege, enhanced authentication for administrative access, audit trails, environment separation, and the use of anonymized or fictitious test data outside production, in accordance with the applicable agreements. Passport data and dates of birth are encrypted and subject to restricted access.

In the event of a security incident affecting personal data, Macondo will report it to the Superintendency of Industry and Commerce within the legally established timeframe and will notify the affected data subjects where the incident may compromise their rights.

14. Payments and financial data

ePayco processes full card data on its own infrastructure. Macondo retains only the reference, status, amount, currency, and other information needed to reconcile the transaction, provide support, and manage refunds.

15. Cookies, local storage, and similar technologies

The public site does not create its own cookies and does not use analytics, advertising, or preference cookies.

The public site uses your browser’s local storage to keep the tours you have selected and, when the payment process is initiated, a record intended to prevent duplicate purchases that includes the purchaser’s email address. This information remains in your browser and is not sent to our servers on its own. You can delete it at any time by clearing your browser’s site data.

The administrative panel, which is used only by authorized staff, uses strictly necessary technical cookies to authenticate users, maintain the session, and manage password recovery. These cookies are not used for advertising or commercial tracking purposes. Staff access uses the Supabase authentication service.

The ePayco payment flow may load technologies of its own, which are governed by that provider’s privacy and cookie policies.

16. White-label arrangement

Sigler’s visual identity identifies the event and does not make Sigler or ICM Travel data controllers or recipients of the portal’s data. The purchase, booking, payment, and management of the activities are carried out directly with Macondo.

17. Protection of children and adolescents

In compliance with Law 679 of 2001 and Law 1336 of 2009, MACONDO DMC S.A.S. warns that the sexual exploitation of children and adolescents is a crime punishable by imprisonment and administrative sanctions under Colombian law. Macondo has adopted a code of conduct against the commercial sexual exploitation of children and adolescents in connection with travel and tourism.

18. Effective date and versions

This Policy is effective as of November 1, 2026. Material changes will be duly communicated. The portal displays the version in force and Macondo retains evidence of previous versions where applicable.

19. How can you contact Macondo?

Data controller: MACONDO DMC S.A.S.

Colombian Tax ID (NIT): 900486915-4

Address: Carrera 15 A No. 112-62, Edificio Urban Atenea

City and country: Bogotá, D.C., Colombia

Email: siglertours@macondodmc.com

Colombian National Tourism Registry (RNT): 26194

Classification: Tour operator travel agency