GENERAL POLICY ON THE PROTECTION OF PERSONAL DATA

ON-VACATION ECUADOR SAS, hereinafter referred to as On Vacation , is a company committed to safeguarding personal data. To keep you informed, we have established a General Personal Data Protection Policy, hereinafter referred to as the Policy , which will guide our interactions and procedures related to the processing of your personal data.

1. IDENTIFICATION AND CONTACT DETAILS OF ON VACATION AS THE CONTROLLER OF PERSONAL DATA

On Vacation is responsible for the processing of personal data; their contact information is as follows:

• Address: GALLERY PLAZA Building, Avenida Seis de Diciembre, between Los Naranjos and Tamayo, Benalcázar Parish, Quito Canton, Pichincha Province

• Telephone number: 593 98 848 8343

• Email: atencionalclienteecuador@onvacation.com

2. SCOPE OF APPLICATION OF THE POLICY

This Policy applies to candidates or applicants for employment, employees, clients, potential clients, suppliers, visitors to the facilities and any other third party that maintains a relationship with On Vacation, who from now on will be known as the data subject individually or collectively, which involves the Processing of Personal Data.

It is mandatory for employees, consultants, associated companies, business partners, suppliers and in general, any related or linked entity acting on behalf of and representing On Vacation to comply with this Policy.

This obligation is public knowledge, as the Policy is available on the On Vacation website, which facilitates its dissemination.

3. TERMS AND DEFINITIONS

Within this Policy, the following definitions are established, which were obtained from the Organic Law on the Protection of Personal Data (LOPDP), its implementing regulations and other relevant regulations:

1. Personal Data Protection Authority (Superintendency of Personal Data Protection): Independent public authority responsible for overseeing the application of this Law, regulations and resolutions issued by it, in order to protect the fundamental rights and freedoms of natural persons, regarding the processing of their personal data.
2. Anonymization: The application of measures aimed at preventing the identification or re-identification of a natural person, without disproportionate efforts.
3. Database: A structured set of data, regardless of its form, method of creation, storage, organization, type of support, treatment, processing, location or access, whether centralized, decentralized or distributed functionally or geographically.
4. Consent: A manifestation of free, specific, informed and unambiguous will by which the owner of the personal data authorizes the controller of the personal data to process the same.
5. Personal data: Data that identifies or makes identifiable a natural person, directly or indirectly.
6. Personal credit information: DData that integrate the economic behavior of natural persons, to analyze their capacity financial
7. Health-related data: personal data relating to a person's physical or mental health, including the provision of health care services, which reveal information about their health status.
8. Sensitive data: Data relating to: ethnicity, gender identity, cultural identity, religion, ideology, political affiliation, criminal record, immigration status, sexual orientation, health, biometric data, genetic data and those whose improper processing may give rise to discrimination, violate or may violate fundamental rights and freedoms.
9. Data protection officer: Natural person responsible for informing the controller or processor about their legal obligations regarding data protection, as well as ensuring or supervising regulatory compliance in this regard, and cooperating with the Personal Data Protection Authority, serving as a point of contact between it and the entity responsible for data processing.
10. destinatario: Natural or legal person who has been informed with personal data.
11. Profiling: All processing of personal data that allows evaluating, analyzing or predicting aspects of a natural person to determine behaviors or standards related to: professional performance, economic situation, health, personal preferences, interests, ability, location, physical movement of a person, among others.
12. Person in charge of processing personal data: Natural or legal person, public or private, public authority, or other body that alone or jointly with others processes personal data on behalf of and for the account of a personal data controller.
13. Data controller responsible for processing personal data: natural or legal person, public or private, public authority, or other body, who alone or jointly with others decides on the purpose and processing of personal data.
14. Owner: Natural person whose data is being processed.
15. Transfer or communication: Any disclosure, declaration, delivery, consultation, interconnection, assignment, transmission, dissemination, disclosure, or any other form of personal data made to a person other than the data subject, controller, or processor. The personal data communicated must be accurate, complete, and up-to-date.
16. Treatment: Any operation or set of operations performed on personal data, whether by automated, partially automated or non-automated technical procedures, such as: collection, recopCollection, obtaining, recording, organization, structuring, preservation, custody, adaptation, modification, elimination, indexing, extraction, consultation, elaboration, use, possession, exploitation, distribution, assignment, communication or transfer, or any other form of enabling access, comparison, interconnection, limitation, suppression, destruction and, in general, any use of personal data.
17. Breach of personal data security: Security incident that affects the confidentiality, availability or integrity of personal data.

4. RIGHTS OF DATA SUBJECTS AND HOW TO EXERCISE THEM

Depending on the circumstances of each case, and in accordance with the Organic Law on the Protection of Personal Data, data subjects have the following rights:

1. Right to information: Data subjects have the right to receive information about the recopcollection and processing of your personal data, including information about On Vacation, the use of your personal data and your rights in relation to the information.
2. Right of access: Data Subjects have the right to know and obtain access to their personal data from the Data Controller.
3. Right of rectification and updating: Data Subjects have the right to obtain from the Data Controller the rectification and updating of their inaccurate or incomplete personal data.
4. Right of deletion: Data subjects have the right to have their personal data erased by the data controller when: a) the processing does not comply with the principles established in the Organic Law on the Protection of Personal Data; b) the processing is not necessary or relevant for the purpose for which the data were collected; c) the purpose for which the data were collected has been fulfilled; d) the retention period for the personal data has been fulfilled; e) the processing of personal data affects fundamental rights or individual freedoms; f) the data subject's consent is revoked; and, g) there is a legal obligation.
5. Right of opposition: Data subjects have the right to object to or refuse the processing of their personal data in the following cases: a) the processing does not affect the fundamental rights and freedoms of third parties, the law permits it, and the data does not involve public information, information of public interest, or information whose processing is mandated by law; b) the processing of personal data is for direct marketing purposes, including profiling; their consent is not required for processing due to a legitimate interest, as provided for in Article 7 of the Spanish Organic Law on the Protection of Personal Data (LOPDP), and it is justified by a specific personal situation of the data subject, provided that no law provides otherwise. On Vacation will cease processing the personal data of data subjects in the aforementioned cases, unless it demonstrates compelling legitimate grounds for the processing that override its interests, the rights and freedoms of the data subjects, or for the establishment, exercise, or defense of legal claims.
6. Portability right: Data Subjects have the right to request and receive from On Vacation their personal data in a compatible, updated, structured, common, interoperable and machine-readable format, preserving its characteristics; or that the same be transferred to another Controller, provided that it is technically possible.
7. Right to suspend treatment: Data subjects shall have the right to suspend the processing of their personal data when any of the following conditions are met: a) when the accuracy of their data is contested; b) when the processing is unlawful and the data subject requests the restriction of its use instead of its erasure; c) when there is no need for the personal data for the purposes of the processing, but it is necessary for the Data Subject for the establishment, exercise or defense of legal claims.
8. Right not to be subject to a decision based solely or partly on automated assessments: Data subjects have the right not to be subject to a decision based solely or partially on assessments resulting from automated processes, including profiling, which produce legal effects concerning them or which infringe their fundamental rights or freedoms.

On Vacation will verify the legitimacy of your request, which may be submitted physically to the address Edificio GALLERY PLAZA, Avenida Seis de Diciembre, between Los Naranjos and Tamayo, Benalcázar Parish, Quito Canton, Pichincha Province, or digitally to the email address: atencionalclienteecuador@onvacation.com. If the information requires clarification or expansion, the Data Subject may be asked, only once and within five (5) days of receiving the request, to clarify or expand upon it. The Data Subject will have ten (10) days to clarify or expand upon the request.

Your request to exercise your rights will be processed within fifteen (15) days of its submission, or any subsequent amendment or clarification thereof. You may not exercise your rights on behalf of third parties without their express written authorization.

If your request is not addressed within the timeframe stipulated by applicable regulations, or if you believe the response you received violates your rights, you have the right to file a complaint directly with the Data Protection Authority. You also have the option to withdraw your consent at any time, easily and free of charge. To withdraw your consent, you can send an email to the address previously provided.

To exercise your rights, you must send your request in writing to the addresses indicated above, and must include at least the following information:

1. Your name and email address to receive the response and notifications;
2. A document that proves your identity as the Holder; and,
3. Your request must include a clear and precise description of the personal data regarding which you seek to exercise any of your rights, your specific request, and your signature.

Notwithstanding the foregoing, On Vacation may refuse the request with due justification. Likewise, it may retain certain information that you request be deleted or erased, in order to serve as evidence in the event of a claim against On Vacation. Such retention will be for the time necessary according to On Vacation's legitimate interest in defending itself against any potential claim that the Data Subject may initiate, or for the periods established by applicable regulations.

If the deletion of personal data is appropriate but cannot be carried out due to technical limitations, this data will be anonymized so that it cannot be used to identify or make the Data Subject identifiable.

5. SECURITY MEASURES

On Vacation adopts the necessary security measures to protect your information as the Data Subject, in order to prevent its alteration, loss, unauthorized processing and/or access, taking into consideration the nature of the information and the risks to which it is exposed according to its processing.

In order to protect the personal data of Data Subjects, On Vacation complies with the provisions of the corresponding regulations, adopting technical, organizational, and legal security measures. In the event of any breach of Personal Data security, On Vacation will make the corresponding notifications in accordance with the Organic Law on the Protection of Personal Data and its implementing regulations.

6. PERSONAL DATA RETENTION PERIOD

Personal data will be stored only for as long as necessary to achieve the processing purposes, respecting the time limits established by applicable regulations and until the statute of limitations for any corresponding legal actions has expired. After this time, the data will be deleted or anonymized according to the procedures and tools implemented by On Vacation.

The data recopImages captured through video surveillance systems will be kept for a period of up to 15 days, although this period may be extended if required by law.

Regarding marketing communications and service promotions, your data will be retained until you withdraw your consent. You are free to withdraw your consent or object to the processing of your data at any time. In situations where data needs to be retained for longer than usual, it will be blocked and accessed only to comply with legal and contractual obligations or at the request of a competent authority.

7. DATA SUBJECT TO PROCESSING

On Vacation processes Personal Data only when it has a legitimate basis for doing so.copWe obtain this data directly from the Data Subjects who provide it voluntarily or through authorized third parties. For example, but not limited to, we obtain Personal Data through our website, social media, telephone calls, recruitment processes for vacancies, in connection with employment or commercial contracts, through video surveillance cameras on our premises, publicly accessible sources, etc.

We handle the following categories and types of Personal Data, by way of example and without limitation:

1. Special categories of personal data: Credit information, health data, disability information, data on minors.
2. Academic information: Education (degrees or certificates obtained), languages ​​spoken.
3. Contact: Telephone, home address, email address.
4. Economic and financial data: Banking information (bank, account number, account type), credit or debit card details, business references.
5. Identification data: They include names, surnames, identity document number, RUC, photograph, driver's license, reservation or client code, and signature.
6. Personal information: Marital status, date and place of birth, gender, age, nationality and personal references.
7. Social and family data: Information about family members, spouse's name, number of dependents, guarantor information.
8. Presence data: Entry and exit times, reason for absences.
9. Professional data: Work experience, position, salary, work references, performance evaluations, employee code, dates of entry and exit from employment.

8. PURPOSES OF PROCESSING THE PERSONAL DATA OF THE DATA SUBJECT OR SUBJECTS

On Vacation processes the aforementioned personal data in order to fulfill its corporate purpose; therefore, the processing of this data is based on compliance with legal obligations, the execution of pre-contractual measures, contractual and post-contractual obligations including commercial prospecting, compliance with orders from competent authorities, the safeguarding of public interest, the protection of the legitimate interests of the company, and the free, specific, informed and unambiguous consent of the Data Subject.

The purposes for which the Personal Data of the Data Subjects is processed are the following:

1. Updating of information: Request periodic updates of the Personal Data provided by the Data Subjects.
2. Information storage: Retain information on On Vacation's media in compliance with applicable regulations.
3. Credit information analysis: Verify Personal Data to perform a credit rating for credit package sales.
4. Statistical, commercial, financial, social and technical analysis, and profiling: Analysis to improve products or services according to the needs and interests of the Owner.
5. User deletion: Limit access to On Vacation's information systems to former employees.
6. Supplier rating: Validate and verify information from potential suppliers.
7. Training: Provide training and updates on topics relevant to the employment relationship with On Vacation employees.
8. Marketing of products and services: Manage the sale, prospecting, promotion and marketing of products and services.
9. Verification and verification of the identity and background of applicants: Verify the information provided by applicants for On Vacation positions, including criminal, disciplinary, financial, and credit records.
10. Communications with applicants: Inform applicants about the status of the selection process.
11. Communications with suppliers: Maintain communication with suppliers on business matters.
12. Communications with employees: Contacting employees about work and company matters.
13. Recruitment: Formalize the employment relationship by signing contracts and creating human resources files.
14. Assist Control: Monitor attendance and pay overtime or supplementary hours of the workers of the business.
15. User creation: Manage access to On Vacation's computer systems for employees.
16. Compliance with tax obligations: Filing tax returns, issuing invoices, withholding taxes, and handling other tax obligations.
17. Development, execution and fulfillment of the contractual relationship: Formalizing relationships with clients, delivering contracted products or services, and handling related requests. This includes sending Personal Data to related companies or business partners for the development, execution, and fulfillment of the relationship.
18. Satisfaction surveys: Evaluate the Holder's experience with the products and services contracted with On Vacation.
19. Equipment delivery: Provide electronic equipment and work tools to the workers.
20. Occupational examinations: Verify the holder's suitability for their job duties.
21. Pre-employment examinations: Evaluate whether the holder is suitable for the job.
22. Management of workplace accidents: Register accidents and manage procedures with relevant public entities.
23. Management of disciplinary actions: Administer sanctions to workers for labor violations listed in the Internal Work Regulations.
24. Management of accounting and collection activities: Handle accounting tasks, refinancing, and collections.
25. Activity management with external audit: Send information to external auditors according to corporate regulations.
26. Social security management: Affiliation with the Ecuadorian Social Security Institute, discounts for contributions and management of contributions to the social security system in order to comply with the relevant regulations.
27. Management of raffles and events: Organize and manage events and raffles.
28. Handling requests, complaints or claims: Attend to requests from Personal Data Holders.
29. Management at the Ministry of Labor: Register the employment relationship in accordance with labor regulations.
30. Corporate management: Comply with the corporate obligations established in the applicable regulations.
31. Payment: Make payments to suppliers for services rendered or goods delivered, as well as payments of salaries, legal benefits and applicable discounts to workers.
32. Payment of legal benefits: Manage employee benefit payments and related procedures.
33. Dividend payment: Comply with dividend payments.
34. Profit payment: Ccomply with the payment of profits according to labor regulations.
35. Requirements of competent authorities: Transfer of information relating to personal data when requested by a competent authority.

9. TRANSFER OF PERSONAL DATA

To carry out the aforementioned treatments, as well as to comply with legal and contractual obligations, ON VACATION may transfer personal data to the following entities:

1. Public sector entities and institutions due to their legitimate powers, such as the Internal Revenue Service, the Financial and Economic Analysis Unit, the Superintendency of Banks, judicial and administrative authorities, among others.
2. External auditors to comply with the contractual and legal obligations applicable to ON VACATION.
3. Service providers and data processors that support the management and compliance of the company's activities, including security service providers, legal services, technology platforms and applications, compliance and cybersecurity tool providers, cloud computing solutions, consultants and other professional services.
4. Associated companies to facilitate and optimize the processing of personal data in accordance with the established purposes, ensuring compliance with the principles of relevance, minimization and proportionality of the processing, quality, accuracy, and others contemplated in the Organic Law on the Protection of Personal Data.

The processing of Personal Data may include international transfers, such as those made to information storage servers. Therefore, when such international transfers of Personal Data are carried out, On Vacation will require compliance with protection, confidentiality, and security standards, especially when the transfers are to jurisdictions that do not offer adequate levels of protection as defined by the relevant regulations and the decisions of the Superintendency of Personal Data Protection, or the equivalent data protection authority.

10. DATA ON CHILDREN, ADOLESCENTS AND PEOPLE WITH DISABILITIES

On Vacation will process Personal Data of children, adolescents and disabled persons when there is consent from their duly accredited legal representative in accordance with the terms indicated in Article 5 of the Regulations of the Organic Law on the Protection of Personal Data, when there is a legitimate basis that allows the processing or when it is necessary to comply with a legal, contractual or judicial obligation.

Notwithstanding the foregoing, On Vacation reserves the right to remove or delete any information related to the aforementioned persons, in the event that a Personal Data Holder has shared information.

11. SECURITY CAMERA RECORDINGS AND IMAGES

On Vacation will process image and video data obtained through video surveillance cameras to ensure the protection of its facilities, its assets and the people who access the company's properties, as well as to verify the traceability of the processes and the aforementioned data is stored in a system that maintains strict physical and logical security conditions, which can only be accessed by authorized personnel.

The processing is based on the fulfillment of a mission of public interest and on the legitimate interest of On Vacation.

The recordings are kept for fifteen (15) days, after which they are deleted, and can only be downloaded for security reasons only.

12. CHANGES TO DATA PROTECTION POLICIES

On Vacation may modify, update, or add changes to this General Personal Data Protection Policy at any time to ensure it complies with any regulatory changes in data protection. Any changes, updates, or additions to this Policy will be notified through On Vacation's official channels, encouraging Data Subjects to review the updated version of this document.