PRIVACY POLICY

SECTION 1

1. Purpose and scope

This Privacy Policy describes how Hotel Bellavista SpA, Chilean Tax ID (RUT) No. 78.451.360-2, located at Avenida Vicente Pérez Rosales No. 60, municipality of Puerto Varas (hereinafter, the “Hotel”), collects, uses, stores, protects and, where applicable, discloses the personal data of its guests, in compliance with the duty to provide information and transparency established in Article 14 ter of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719.

The Hotel is the data controller responsible for processing the personal data described in this document, pursuant to Article 2, letter m), of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719. This Policy applies to the personal data of guests, visitors, accompanying persons and, in general, any person whose data is processed by the Hotel in connection with reservations, check-in, stays, use of the video surveillance system, connection to the Wi-Fi network, use of restaurant and event services, and communications addressed to the Hotel through any channel. The processing of employees’ and job applicants’ data is governed by a separate policy.

Action required before publication: this Policy enters into force on 1 December 2026. The approval date must be completed before publication, as required by Article 14 ter, letter a).

SECTION 2

2. Identification of the data controller

Legal note: the law does not require the appointment of a Data Protection Officer. Article 50 of Law No. 19,628 provides that the data controller may appoint one, while Article 49 identifies the Data Protection Officer as the first component of the voluntary infringement prevention model. Article 14 ter, letter b), requires identification of the person responsible for prevention only if one exists.

SECTION 3

3. Personal data collected and its source

The Hotel collects the following personal data directly from the data subject when they make a reservation, check in or use the establishment’s services:

The data described in this section is obtained directly from the data subject, captured by the Hotel’s systems during the provision of services, or provided to the Hotel by travel agencies, booking intermediary platforms, companies or event organisers that make reservations on behalf of the data subject. The Hotel does not obtain personal data from publicly accessible sources or from third parties unrelated to the reservation or provision of services.

SECTION 4

4. Purposes of processing and lawful bases

The Hotel processes guests’ personal data for the following purposes, each based on the corresponding lawful basis under Articles 12 and 13 of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719:

• Managing reservations and performing the accommodation contract (Article 13, letter c).
• Identifying the guest as part of the performance of the accommodation contract (Article 13, letter c), and complying with tax and accounting obligations, including identifying foreign tourists for the purposes of the exemption provided for in Article 12, letter E), No. 17, of Chilean Decree Law No. 825 (Article 13, letter b).
• Protecting guests, employees and the premises through video surveillance (Article 13, letter d) — the legitimate interest of the data controller, consisting of protecting the physical integrity of persons present on the premises, preventing theft and robbery, and establishing facts in the event of incidents or complaints; this processing is disclosed through visible signs at entrances).
• Providing Wi-Fi access to guests as an ancillary service under the accommodation contract (Article 13, letter c), and protecting network security (Article 13, letter d).

The Hotel does not process guests’ personal data for purposes other than those disclosed here, unless there is a new lawful basis under applicable law or the data subject consents to an additional purpose.

Sensitive personal data, particularly health data, is processed only with the data subject’s express consent, pursuant to Article 16 of Law No. 19,628. The data subject may refuse or withdraw that consent at any time without affecting the provision of the other contracted services.

The Hotel does not use guests’ personal data for marketing, advertising or sending commercial communications. If it decides to do so in the future, it will first obtain the data subject’s specific consent for that purpose and update this Policy.

Operational implementation — captive portal: the Wi-Fi connection portal displays a notice stating that, upon connecting, the guest’s name, email address and room number are processed to provide the service, with a link to this Policy. A separate acceptance checkbox is not required because the lawful basis is performance of the accommodation contract (Article 13, letter c), rather than consent — the service is included in the contracted stay.

SECTION 5

5. Disclosure or transfer of data to third parties

The Hotel may disclose guests’ personal data to the following third parties, only to the extent necessary to provide the contracted service:

• Service providers that process data on behalf of the Hotel as data processors pursuant to Article 15 bis of Law No. 19,628: the hotel management system provider, technology and cybersecurity service providers, payment processors, internet service providers, and accounting and auditing service providers. All act on the Hotel’s written instructions and are subject to confidentiality and security obligations.
• Public authorities, where disclosure is required by law or pursuant to a request from a court or other competent authority.
• Travel agencies, booking intermediary platforms and contracting companies, exclusively in relation to the reservation managed by each of them and to the extent necessary for its confirmation and invoicing.

The Hotel does not sell or disclose guests’ personal data for marketing by third parties unrelated to the accommodation relationship.

Action required before publication: a data processing agreement pursuant to Article 15 bis of Law No. 19,628 must be entered into with each of the providers identified above, including instructions, confidentiality obligations and a prohibition on using the data for their own purposes, before 1 December 2026.

SECTION 6

6. Security measures

The Hotel has adopted and continues to implement technical and organisational measures aimed at protecting guests’ personal data, in accordance with the security principle established in Article 3, letter f), and the duty to adopt security measures established in Article 14 quinquies of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719.

• Endpoint protection through centrally managed security software.
• Segmentation of the guest network from the Hotel’s internal administrative systems.
• Periodic backups of systems storing guest data.
• Access control to systems through individual credentials, with privileges assigned according to each employee’s duties.
• Confidentiality or secrecy obligations applicable to all staff and service providers who have access to personal data, pursuant to Article 14 bis of Law No. 19,628.

Data breach reporting: if the Hotel detects a breach of security measures affecting personal data that poses a reasonable risk to the rights and freedoms of data subjects, it will report the breach to the Personal Data Protection Agency by the most expeditious means available and without undue delay, and will notify affected data subjects where required by law, pursuant to Article 14 sexies of Law No. 19,628.

SECTION 7

7. Rights of the data subject

Under Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719, every guest has the right to:

• Access: request confirmation as to whether their data is being processed and obtain access to it (Article 5).
• Rectification: request correction of inaccurate, outdated or incomplete data (Article 6).
• Erasure: request deletion of their data where applicable (Article 7).
• Objection: object to specific processing of their data (Article 8).
• Data portability: receive their data in a structured electronic format where processing is automated and based on their consent (Article 9).
• Blocking: request temporary suspension of any processing operation involving their data in the circumstances established by law (Article 8 ter).
• Withdraw consent previously granted at any time, without retroactive effect (Article 12).

To exercise these rights, the data subject must submit their request to the contact email address specified in Section 2, pursuant to Article 11 of Law No. 19,628. The Hotel will acknowledge receipt and respond within thirty calendar days of receiving the request. This period may be extended once for up to an additional thirty calendar days. To protect the data subject, the Hotel may request information necessary to verify their identity before responding. The exercise of the rights of rectification, erasure and objection is free of charge.

If the Hotel denies the request or fails to respond within the statutory period, the data subject has the right to lodge a complaint with the Personal Data Protection Agency, pursuant to the procedure established in Article 41 of Law No. 19,628. Any denial of a request will state the grounds on which it is based.

SECTION 8

8. International transfers of personal data

Some of the providers used by the Hotel for reservation management, system hosting and payment processing store or process data outside Chile. Such international transfers are carried out in accordance with Title V of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719, on the basis that the destination country provides an adequate level of protection or, failing that, through contractual clauses or other appropriate safeguards pursuant to Article 27. The data subject may request information about the applicable safeguards through the email address specified in Section 2.

SECTION 9

9. Data retention period

In accordance with the principle of proportionality set out in Article 3 of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719, guests’ personal data is retained only for as long as necessary to fulfil the purposes set out in Section 4, after which it is erased or anonymised.

Notwithstanding the above, the Hotel applies the following retention periods: reservation, check-in and stay data is retained for the statutory limitation period applicable to claims arising from the accommodation contract; data contained in tax and accounting documents is retained for the periods required under tax and commercial law; video surveillance footage is retained for a maximum of thirty calendar days, unless it must be kept longer in connection with ongoing judicial, administrative or insurance proceedings; Wi-Fi network connection data is retained only for the period strictly necessary to provide and secure the service; and health data voluntarily disclosed is retained only for the duration of the stay. Once these periods have expired, the data is erased or anonymised.

Action required before publication: management must confirm that the 30-day retention period for CCTV footage matches the actual configuration of the video surveillance system (recording loop). If the equipment records on a different cycle, this retention period must be adjusted to reflect the Hotel’s actual practices.

SECTION 10

10. Automated decision-making and profiling

The Hotel does not use guests’ personal data to make automated decisions that produce legal effects concerning them, nor does it use such data for profiling, within the meaning of Article 8 bis of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719.

SECTION 11

11. Amendments to this Policy

The Hotel may update this Policy whenever necessary to reflect regulatory or operational changes. Every update will be recorded in the version history table, and the current version will remain permanently available to data subjects on the Hotel’s website and in printed form at the establishment’s reception desk, pursuant to Article 14 ter of Law No. 19,628 on the Protection of Personal Data, as amended by Law No. 21,719.

Document governance

Version history

Approval

Traceability — Article 14 ter of Law No. 19,628

The following table shows that this Policy addresses each requirement of the duty to provide information and transparency established in Article 14 ter of Law No. 19,628, as amended by Law No. 21,719.