LEGAL INFORMATION

Responsible management of your data under the operation of Grupo Heroica

For Grupo Heroica, it is important to ensure that the processing of personal data complies with applicable regulations, for the established purposes, and with appropriate security and confidentiality. In all cases, data collection will be carried out with the data subject’s authorization, and the processing of their data will be subject to the provisions of the law and these policies.

01 What data do we collect?

The data provided will be subject to authorized processing, granted in advance, expressly, and with full knowledge by the data subject. Grupo Heroica will request the data subject’s authorization to collect and process their data, specifying the purpose and use for which the collected data and information will be used.

Visiting, accessing, or using the following websites constitutes prior, express, and informed authorization for the storage, collection, and processing of the information provided, in accordance with this data processing policy.

grupoheroica.com
cccartagena.com
valledelpacifico.co
mareacartagena.com
coworkcartagena.com

Grupo Heroica will also collect your personal data when you visit its facilities or use any of our services, whether in coworking areas, when connecting to our Wi-Fi, when accessing the website coworkcartagena.com, when downloading an application, when making a reservation or requesting a quote, when entering into a contract, or when purchasing a product or service. This collection will always be carried out with your express authorization, which will be understood to be granted when you visit our website or enter your personal information through the available functions, regardless of the specific purpose.

Furthermore, the use of the Wi-Fi network in convention centers, restaurants, or coworking areas, as well as access to our facilities, constitutes prior, express, and informed authorization for the storage, collection, and processing of information related to such use.

In the entrance areas of facilities operated by Grupo Heroica, which are monitored by video surveillance, visitors are informed through distinctive signs. Entry to these areas is considered authorization for the collection and processing of data derived from said monitoring. In cases where audio recordings are made, the data subjects will also be duly informed.

At all times, data collection will be limited solely to personal data relevant and appropriate for the intended purpose. Authorization may be given through technical means that facilitate automated authorization by the data subject, when expressed in writing, orally, or through the data subject’s unambiguous conduct that reasonably allows the conclusion that authorization was granted. Silence cannot be considered unambiguous conduct, in accordance with the provisions of Article 7 of Decree 1377 of 2013.

02 What do we use your data for?

At Grupo Heroica, we use the information you provide to carry out our activities and maintain business relationships, always in accordance with this policy. This allows us to establish direct and effective communication with you and other clients, exhibitors, visitors, or users, facilitating reservations, quotes, contracts, and agreements, as well as the provision of services related to events, venues, food, beverages, or any other service we offer.

The specific purposes for using your information include:

Reservation and contract management: We process, complete, and execute reservations, quotes, agreements, and contracts to provide you with our services efficiently.
Personalized attention: We resolve your requests, queries or needs and keep you informed through invitations, promotions and offers from our portfolio of services.
Compliance with legal obligations: We use your data to comply with tax, fiscal, legal and any other requirements imposed by the government at the national, district or municipal level.
Security: Images and audio recordings are used to preserve the safety of our employees, customers, visitors, users, suppliers and contractors, and to protect the facilities and assets of Grupo Heroica.

By providing us with your information, you expressly authorize its sharing, processing, transmission, transfer, updating, or deletion as established in this policy. We assume that the data you provide is true, accurate, and complete; however, you may withdraw it at any time if you believe it may affect your interests or those of third parties.

When you access our websites (grupoheroica.com, cccartagena.com, valledelpacifico.co, mareacartagena.com, or coworkcartagena.com), the information collected may come from both you and the device you use. To optimize your online experience, we use cookies and similar technologies (such as web beacons) to identify your preferences and provide you with personalized content. It is important to note that, although information such as your IP address is collected, it is not associated with or linked to your name or other personal data.

This authorization and the use of your data are always carried out to offer you a quality service, complying with current regulations and ensuring the protection of your information.

03 How do we protect your data?

Under no circumstances will sensitive data be processed or information of that nature collected. Regarding information from children and adolescents, data collection and the corresponding authorization will be carried out solely through their legal representative, ensuring that the minor’s opinion is heard when relevant.

The processing of your data will always respect the best interests of children and adolescents and their fundamental rights. If any inquiry could lead to the inclusion of sensitive data or information from minors, answering that question will be optional.

We commit to complying fully and transparently with the following, without prejudice to other legal provisions:

Guarantee your right to habeas data: We ensure that you can exercise your right to access, rectify, cancel and oppose the processing of your personal data at any time.
Keep your authorization: Request and keep, under the conditions established by law, a copy of the authorization granted by the holder.
Inform you: Provide clear information about the purpose of data collection and about the rights you have based on the authorization given.
Protecting information: Storing and preserving data under appropriate security measures to prevent its alteration, loss, unauthorized or fraudulent access, use or disclosure.
Ensure the accuracy of the data: Guarantee that the information provided is truthful, complete, accurate, up-to-date, verifiable, and understandable.
Keep information up to date: Promptly notify any new information or changes to the data previously provided, taking the necessary measures to keep it updated.
Correct incorrect information: Correct and communicate any erroneous or outdated data.
Provide only authorized data: Provide only information whose processing has been previously authorized in accordance with the law.
Demand compliance with security conditions: Respect at all times the security and privacy measures of your information.
Handling inquiries and complaints: Managing all your requests, inquiries, and complaints in a timely manner and in accordance with the law.
Reporting information disputes: Communicate when there is a dispute about certain data, until the corresponding claim is resolved.
Provide information on data usage: Respond to your requests regarding the use of your personal data.
Report security breaches: Notify the data protection authority about any incident or breach of security codes that poses a risk to information management.
Comply with official instructions: Follow the guidelines and requirements issued by the Superintendency of Industry and Commerce.

This series of obligations aims to ensure that the processing of personal data is carried out in a secure, transparent manner and in strict compliance with current regulations.

04 Security

We operate in an environment of absolute confidentiality to ensure that the collected data is handled securely. This means that your information will not be shared or transferred to unauthorized individuals. Should we contract an external entity specializing in database management, we will formalize a specific data transfer agreement in accordance with Article 25 of Decree 1377 of 2013.

05 Your rights regarding information

Once you give your consent for the processing of your data, you will have the following rights:

Know, update and rectify: You can access your data, correct or update it if you consider that it is partial, inaccurate, incomplete or if its processing is prohibited or was not authorized.
Request proof of authorization: You have the right to request evidence that you have given your consent, except in those cases where the law exempts this requirement.
Information about the use of your data: You can request information from us about the use that has been made of your personal information.
Filing complaints: If you believe your rights have been violated, you can file a complaint with the Superintendency of Industry and Commerce.
Revoke your authorization and/or request the deletion of your data: If the processing of your data does not respect legal principles, rights, and guarantees, you may revoke your consent or request the deletion of your data. This revocation will be granted when the Superintendency of Industry and Commerce determines that the processing involves conduct contrary to the law or the Constitution.
Request deletion by claim: At any time, you can request the deletion of your data and/or revoke your authorization, except when there is a legal or contractual obligation that prevents deletion.
Free access to your data: You have the right to consult your personal data free of charge, at most, once a month or whenever substantial changes are made to the Data Processing Policy. If you make requests more frequently, shipping, reproduction, and, where applicable, document certification costs may apply.

In addition to you, the following people can also exercise your rights:

Your successors: Who must demonstrate their corresponding status.
Your representative or agent: Upon prior accreditation that they have the necessary representation or power of attorney.
The person designated to exercise the right in favor of another: As stipulated.
In the case of children or adolescents: The rights will be exercised by the persons authorized to represent them, after accreditation of the authority of representation.

How to exercise your rights and manage inquiries, requests, and complaints.
The Marketing and Sales department is responsible for handling and responding to your requests related to the processing of your personal data. You can exercise your rights—access, updating, rectification, deletion, and revocation of authorization—and manage any inquiry or complaint by following this procedure:

Submit your request: You must submit your request in writing, either via email to protecciondedatos@grupoheroica.com, or in person at our offices in Cartagena de Indias, Calle 24 No 8ª – 344, Barrio Getsemaní, or Yumbo, Valle del Cauca, Calle 15 N° 26 – 120, Autopista Cali.

In your writing, please include the following:

Full name.
Identity document.
Physical address and email address.
Contact phone number.
A brief description of the information or data to which the request refers, clearly indicating the scope and purpose (for example, to exercise the right to know, update, rectify, delete or revoke the authorization).
The documents you consider necessary to support your request, including proof of the capacity in which you are acting (for example, legal representative, successor, etc.).

Application registration: Once you submit your application, it will be registered in our system, where the status “claim in process” will be noted along with a description of the reasons presented.

You will receive a response within a maximum of 10 business days. If the response is incorrect, you will be required to correct the deficiency within five (5) business days of receiving it.

If the claim needs to be transferred to another area or authority, you will be informed within a maximum of two (2) business days.

The maximum period for the complete resolution of the claim will be fifteen (15) business days counted from the day after its receipt, which may be extended for no more than eight (8) additional business days in exceptional cases, duly justified.

What can you request from us?

Check your personal data.
Request updates, corrections, or rectifications.
Request the deletion of your data or revoke the consent given, provided that there is no legal or contractual obligation that requires its retention.
Request proof of the authorization granted or information about the use that has been made of your data.

This procedure is designed to ensure that your rights are respected in a timely manner and in accordance with current regulations, ensuring transparency and efficiency in the processing of your information.

06 Dissemination and validity

Our personal data processing policy is permanently available to anyone interested. You can consult it at the following links:

• https://cccartagena.com/politica-de-tratamiento-de-datos-personales/
• https://valledelpacifico.co/politica-de-tratamiento-de-datos/
• https://grupoheroica.com/politica-de-tratamiento-de-datos/

When we request your authorization to process your data, we will inform you about the specific purposes for which your consent will be obtained, present this policy to you, and detail your rights. If for any reason we are unable to provide you with this information, a privacy notice will be published and made available for later review, both by you and by the Superintendency of Industry and Commerce.

Regarding the retention period, your data will be kept only for the time necessary to fulfill the purposes of the processing or to satisfy legal or contractual obligations. Once these objectives have been achieved, your data will be permanently deleted. The current version of this policy came into effect on March 31, 2025, after being notified and communicated through our websites.
Each modification to this policy will be communicated promptly on this same website, in advance of the new conditions taking effect.