Authorization for the Processing of Personal Data

Terms and Conditions – GEMA TOURS S.A.S. Service Requests

1. Purpose: These terms and conditions govern the use of the contact and service request form provided by GEMA TOURS S.A.S. The purpose of this form is to allow clients, suppliers, and advisors to submit requests, ask for quotations, or manage administrative processes with our company.

2. Accuracy of Information: The user completing this form guarantees that the information provided is truthful, accurate, and complete. GEMA TOURS S.A.S. is not responsible for errors, delays in service provision, or any issues arising from false or inaccurate information provided by the user.

3. Third-Party Information: If the user provides personal data of third parties (e.g., clients, guests, or employees), the user guarantees that they have obtained the prior and express authorization from those individuals to share their information with GEMA TOURS S.A.S. for the purposes described herein.

Appropriate Use of the Channel: This form must be used exclusively for matters related to the agency's tourism brokerage and operational activities.

4. Processing of Requests: Completing this form does not constitute an automatic confirmation of services. GEMA TOURS S.A.S. commits to managing your request within a reasonable timeframe and contacting you through the provided channels to offer the necessary support or send the requested quotation.

5. Use of the Form by Minors: The use of this form by minors must be carried out under the supervision and consent of their legal representative or responsible adult, who assumes full responsibility for the information provided.

6. Modifications to the Terms: GEMA TOURS S.A.S. reserves the right to modify these Terms and Conditions at any time. Any significant changes will be notified through our official website.

7. Governing Law: These terms are governed by the laws of the Republic of Colombia. Any disputes shall be resolved in accordance with applicable regulations.

AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

I declare that I have been informed that GEMA TOURS S.A.S., in the course of its business as a travel agency and tour operator, acts as an authorized intermediary for various airlines, hotels, ground operators, insurance companies, and other national and international providers of tourism services.

By virtue of these commercial and contractual relationships, these providers establish operational, regulatory, and security conditions that oblige GEMA TOURS S.A.S. to transfer or transmit certain personal data of passengers, customers, or beneficiaries in order to manage the reservation, issuance, modification, cancellation, or reimbursement of tourism services, as well as to comply with legal, regulatory, and security requirements specific to the sector. Consequently, I freely, expressly, and knowingly authorize the processing of my personal data (and, where applicable, the data of third parties that I represent or provide) for the following purposes:

Purposes of processing:

a) To manage the sale, reservation, issuance, modification, cancellation, or refund of airline tickets, accommodation, ground transportation, and other contracted tourist services.

b) To process and administer travel insurance, excursions, tourist packages, medical assistance, and other complementary services.

c) To comply with contractual, commercial, and legal obligations arising from relationships with airlines, hotels, operators, insurers, strategic allies, or tourism service providers.

d) Respond to requests from competent authorities in matters of immigration, customs, tax, health, security, or judicial matters, in Colombia and abroad.

e) Execute administrative, accounting, financial, and billing processes related to the contracted services.

f) Comply with the risk management systems SARLAFT, SAGRILAFT, PTEE, and other control schemes required by Colombian regulations or by commercial partners.

g) Conduct satisfaction surveys, data analysis, market segmentation, and send information about services, promotions, or benefits associated with the contractual relationship.

Transfer and processing by third parties:

I authorize GEMA TOURS S.A.S. to, in the course of its activities and for the purposes described herein, transfer or transmit my personal data—and that of any third parties I have provided—to airlines, hotels, insurance companies, tour operators, business partners, affiliates, subsidiaries, parent companies, allied companies, and suppliers, both in Colombia and abroad, under the following conditions:

1. Tourism service providers (airlines, hotels, operators, insurance companies, etc.): I expressly authorize these providers, once they receive my personal data, to process it for the same purposes authorized to GEMA TOURS S.A.S., acting as independent or joint data controllers, in accordance with their own regulatory framework and privacy policies.

2. I declare that I understand that this transfer or transmission is indispensable for the management, control, confirmation, modification, or cancellation of the contracted services, as well as for the fulfillment of their legal and regulatory duties before aeronautical, immigration, customs, or security authorities.

3. Other third parties (business partners, subsidiaries, parent companies, and allies): I authorize the processing of my personal data only to the extent strictly necessary to ensure the proper provision of the contracted services or to comply with legal or contractual obligations arising from said relationship.

4. These third parties will act as data processors, following the instructions of GEMA TOURS S.A.S. and complying with the security, confidentiality, and protection measures required by law.

Sensitive data and data of minors:

I authorize the processing of sensitive personal data, such as health information, medical condition, or special requirements, when necessary for the proper provision of tourism, transportation, or travel assistance services.

Likewise, I authorize the processing of data of children and adolescents, under the representation and consent of the responsible adult, in accordance with the provisions of Law 1581 of 2012 and complementary regulations.

Rights of the data subject and contact channels:

I acknowledge that, as the owner of the personal data, I have the right to:

• Know, update, rectify, or delete my personal data.

• Revoke this authorization at any time.

• Be informed about the use that has been made of my data.

• File complaints with the Superintendency of Industry and Commerce (SIC) for violations of personal data protection regulations.

I may exercise these rights by writing to the following email address: habeasdata@gematours.com, in accordance with the Personal Data Processing Policy available at the link: [Privacy and personal data processing policy].

Acceptance:

By electronically accepting this authorization or signing it physically, I declare that I have read, understood, and accept the processing of my personal data by GEMA TOURS S.A.S. and its suppliers, partners, and affiliated airlines, under the terms and for the purposes described herein.