Through this Policy, Promotora Las Américas Golden Tower S.A., headquartered in Panama City, Republic of Panama, with Taxpayer Registry No. 990445-1-534073, and operator of the Las Américas Golden Tower commercial establishment, aims to provide necessary and relevant information to employees, clients, suppliers, and any interested third parties. It also seeks to communicate the guidelines for the implementation of personal data protection measures that comply with the requirements for safeguarding personal data of children and adolescents, ensuring its preservation and guaranteeing its responsible and secure use. This is in alignment with the provisions of Law 81 of 2019 and Executive Decree 285 of 2021, particularly with the procedures enabling every individual to know, update, and rectify their information contained in our databases or files.

This statement applies to Promotora Las Américas Golden Tower S.A., with Taxpayer Registry No. 990445-1-534073, headquartered in Panama City, Republic of Panama.

This policy applies to all databases containing personal data subject to processing by Promotora Las Américas Golden Tower S.A. as the data controller. It is directed to the general public to inform them about the different data processing purposes and uses according to their data category, as well as the rights that data subjects can exercise before Promotora Las Américas Golden Tower S.A. as the data controller.

DATABASE: An organized set of data of any nature, regardless of the form or modality of its creation, organization, or storage, allowing data to be related to each other and enabling any type of processing or transmission by its custodian.

PERSONAL DATA: Any information concerning natural persons that identifies or makes them identifiable.

CONFIDENTIAL DATA: Data that, by nature, should not be publicly accessible or disclosed to unauthorized third parties, including data protected by law, confidentiality agreements, or non-disclosure agreements, to safeguard such information. In the case of Public Administration, these are data whose processing is limited to administrative purposes or requires explicit consent from the data subject, without prejudice to special laws or regulations that may apply. Confidential data is always subject to restricted access.

ANONYMOUS DATA: Data whose identity cannot be reasonably established or the link between this data and the natural person it refers to.

SENSITIVE DATA: Data related to the intimate sphere of the data subject or data whose improper use could lead to discrimination or pose a serious risk to the data subject. Sensitive data includes, but is not limited to, personal data that may reveal aspects such as racial or ethnic origin; religious, philosophical, or moral beliefs; union affiliation; political opinions; health-related information; life; sexual preference or orientation; genetic data; or biometric data aimed at uniquely identifying a natural person.

BIOMETRIC DATA: Personal data obtained through specific technical processing related to a person’s physical, physiological, or behavioral characteristics that allow or confirm their unique identification.

ACCESSIBLE SOURCE: Databases that are not restricted in access or have no confidentiality for consultations, or that are publicly accessible, such as official state publications, media outlets,

AUTHORIZATION: The manifestation of the data subject's will, through which the processing of their data is permitted.

DATA CONTROLLER: A natural or legal person, whether public or private, profit-oriented or not, responsible for decisions related to the processing of personal data, including determining the purposes, means, and scope of the data processing.

DATA SUBJECT: The natural person to whom the data pertains.

DATA PROCESSING: Any operation or set of operations or technical procedures, whether automated or not, that enables the collection, storage, recording, organization, selection, extraction, comparison, interconnection, association, dissociation, communication, transfer, transmission, cancellation, or use of data in any form.

DATA TRANSFER: The act of disclosing, sharing, communicating, exchanging, and/or transmitting data in any manner and by any means, from one point to another, either within the same country or across borders, to natural or legal persons other than the data subject, whether determined or undetermined.

ARCO RIGHTS: The inalienable fundamental rights of data subjects, identified as the rights of access, rectification, cancellation, and opposition.

The personal data held by the company is stored, protected, and managed in full compliance with Law 81 of 2019. To guarantee data privacy and security, the company adheres to all applicable data protection regulations issued by the national government, as well as its internal data processing policies in effect from the time the data is collected, as previously disclosed to you. Additionally, the company ensures compliance with any added, modified, repealed, or revoked policies or laws following their announcement. In line with Promotora Las Américas Golden Tower S.A.'s corporate purpose, personal data collected will be processed according to the category and purpose of each data processing activity.

PROMOTORA LAS AMÉRICAS GOLDEN TOWER SA may transfer the personal data collected to

The personal information stored in the databases owned by the company Promotora Las

Promotora Las Américas Golden Tower S.A. ensures compliance with ARCO rights (Access, Rectification, Cancellation, and Opposition) for all data subjects throughout the personal data processing stages. These rights can be exercised through mechanisms such as consultations or written claims, enabling individuals to access, rectify, cancel, oppose, update, revoke authorization, or request the deletion of their personal data stored in our databases and records.

Revoking consent for the processing of personal data is always permissible unless Promotora Las Américas Golden Tower S.A. has a legal or contractual obligation to retain the personal data.

To stop receiving communications (e.g., newsletters, promotions) from Hotel Las Américas Golden Tower automatically, click the “UNSUBSCRIBE / REMOVE SUBSCRIPTION” link at the bottom of each email, or contact us via email at datospersonales@lasamericashg.com to rectify data or cancel communications.

This data processing policy will take effect on [specific date] January 2024. Databases subject to processing will remain active for the duration of the company’s existence or as required by law. Any changes to this policy will be communicated via the company website: https://lasamericasgoldentower.com.

The personal data processing policy described above will be effective as of January xxx.