PRIVACY AND PERSONAL DATA PROTECTION POLICY

CITYSCOUT Mobile Application for Discovering Places and Tourist Routes

Version 1.0 Effective Date: April 1, 2026

1. INTRODUCTION AND COMPETENT AUTHORITY

CityScout ("the Application") is a mobile platform developed to make it easier to discover places, routes and tourist recommendations in Colombia.

Data Controller (Responsible for the Processing of Personal Data):

• Entity: CityScout
• Address: Popayán, Cauca, Colombia
• Contact phone: Available in the application
• Contact email: soporte@cityscout.com
• Data Protection Officer (DPO): [To be completed as applicable]

This Privacy Policy has been prepared in accordance with:

• Law 1581 of 2012: Colombian Personal Data Protection Law
• Decree 1377 of 2013: Regulations of Law 1581
• POLITICAL CONSTITUTION OF COLOMBIA (Article 15): Fundamental Right to Habeas Data
• International best practices in data protection (GDPR as a reference)

2. KEY DEFINITIONS

• Personal Data: Any information linked or linkable to an identified or identifiable natural person.
• Data Subject: The natural person whose personal data is processed.
• Data Controller: Whoever decides on the processing of personal data.
• Data Processor: Whoever carries out the processing on behalf of the controller.
• Data Processing: Any operation performed on personal data: collection, storage, use, circulation, modification, deletion.
• Consent: Free, prior and informed authorization by the data subject for the processing of their data.
• Habeas Data: Constitutional right of every person to know, update and rectify the information held about them.

3. PERSONAL DATA WE COLLECT

3.1 During Registration and Authentication

When you create a CityScout account, we collect:

• Full name (first and last names)
• Email address
• Phone number (optional)
• Password (encrypted)
• Profile information (profile photo - optional)
• Account creation date

3.2 While Browsing and Using the Application

• Geographic location: GPS coordinates (latitude, longitude) when you search for nearby places
• Search history: Search terms and filters used
• Preferences: Categories of interest, saved/favorite places
• Activity: Places visited, reviews written, ratings given

3.3 If You Own a Place (OWNER)

• Place information: name, description, address, coordinates
• Contact details of the establishment: phone, email, website
• Images of the place
• Opening hours
• Services offered and prices
• Tax status (if applicable under the regulations)

3.4 If You Write Reviews and Comments

• Review text
• Rating given (1-5 stars)
• Publication date
• Attached images (if you upload them)

3.5 Automatic Technical Information

• IP address
• Device type and version (brand, model, OS)
• Unique device identifiers (IDFA, AAID)
• Browser/application information
• Access and error records (logs)
• Usage and analytics data (session events)

3.6 Payment Information (if applicable)

If you make payments within the application:

• Billing information
• Last 4 digits of the card (we do not store the full number)
• Type of payment method

4. PURPOSES OF THE PROCESSING

4.1 Primary Purposes (Essential for the Application)

1. Creating and maintaining your account: Authentication, access to services
2. Providing the service: Showing places, routes and recommendations based on location
3. Communication: Notifications about updates, changes to favorite places, replies to reviews
4. Improving the service: Usage analysis, error identification, experience optimization
5. Legal compliance: Tax, regulatory and legal obligations in Colombia

4.2 Secondary Purposes (Additional Consent)

1. Marketing and Promotions: Personalized recommendations, special offers, advertising campaigns
2. Research and Statistics: Aggregated and anonymous analysis of tourism trends
3. Security and Fraud: Detection of fraudulent activities, protection against abuse
4. Cookies and Tracking Technologies: Improving the experience, remembering preferences

5. LEGAL BASIS FOR THE PROCESSING

Your data is processed on the following bases:

5.1 Free, Prior and Informed Consent

• Mandatory for non-essential processing
• You can withdraw it at any time
• It is obtained explicitly (it is not tacit)

5.2 Legal Obligation

• Compliance with tax and regulatory obligations
• Responding to requests from competent authorities
• Fraud prevention and detection

5.3 Legitimate Interest

• Continuous improvement of the service
• Security of the platform and its users
• Usage analysis and statistics

5.4 Performance of Contractual Relationships

• Providing the application's services
• Compliance with the terms and conditions

6. RIGHTS OF DATA SUBJECTS

6.1 Right of Access (Article 15, Law 1581)

You have the right to:

• Know what personal data we have collected about you
• Access a copy of your data in an understandable format
• Request confirmation of whether your data is being processed

How to exercise it: Send a request to soporte@cityscout.com with the subject "Access to Personal Data - [Your Name]" Response time: Maximum 10 business days (under Law 1581) Cost: Free of charge for the query

6.2 Right of Rectification (Article 16, Law 1581)

You have the right to:

• Correct inaccurate or incomplete data
• Update outdated information
• Clarify data you consider incorrect

How to exercise it:

• Directly in the "Profile" section of the application, OR
• Send a request to soporte@cityscout.com describing the data to be rectified

Response time: Maximum 10 business days

6.3 Right to Erasure/Deletion (Right to Be Forgotten)

You have the right to request the deletion of your personal data when:

• It is no longer necessary for the purpose for which it was collected
• You have withdrawn your consent
• You object to the processing
• It has been processed unlawfully
• The law requires it

Exceptions: We cannot delete data that we must keep due to:

• Legal obligations (tax retention, evidence of fraud)
• Requests from competent authorities
• Platform security needs

How to exercise it: Send a request to soporte@cityscout.com with the subject "Data Deletion Request - [Your Name]" Response time: Maximum 10 business days

6.4 Right to Object (Article 20, Law 1581)

You have the right to:

• Object to the processing of your data at any time
• Opt out of receiving marketing communications
• Refuse behavioral analysis or profiling

How to exercise it: In the app's privacy settings or by sending a request to soporte@cityscout.com

6.5 Right to Restriction

You can request that we:

• Limit the processing of your data (except storage)
• Pause the processing while we verify your request
• Restrict data you are disputing

6.6 Habeas Data (Constitutional Right - Article 15, Political Constitution of Colombia)

Every data subject has the right to:

• Know the information recorded about them
• Demand corrections, updates or exclusions
• Challenge automated decisions based on their data

Procedure: You can file a Habeas Data claim before the civil courts, without any formalities, if you believe your data protection rights have been violated.

6.7 Right to Data Portability

You have the right to:

• Receive your data in a structured, readable and machine-readable format (e.g. JSON, CSV)
• Transfer your data to other services

How to exercise it: Send a request to [privacy email] with the subject "Data Portability - [Your Name]"

7. DATA SHARING (THIRD PARTIES AND PROCESSORS)

7.1 Who We Share Your Data With

A. Within the Application

• Place Owners (OWNERS): Your name and email if you leave a review
• Administrators: To handle reports, fraud and legal compliance
• Other Users: Your name and public profile information (photo, reviews)

B. Service Providers (Data Processors)

Acting as data processors under confidentiality agreements:

1. Cloud/Hosting Provider: Secure data storage

• Compliance with GDPR and security standards
• They cannot use your data for their own purposes

1. Maps and Geolocation Service:

• To show nearby places
• Processing of location-based searches
• Example: Google Maps API (as applicable)

1. Analytics Service:

• Aggregated and anonymous usage analysis
• Example: Google Analytics, Mixpanel (configured without identifiable data)

1. Authentication Provider:

• Secure identity verification
• Password recovery system

1. Push Notification Service:

• Sending notifications to your device
• Limited information transmitted

1. Payment Provider (if applicable):

• Transaction processing
• PCI-DSS compliance
• We do not store full card data

C. Authorities and Legal Requirements

• Government Entities: If there is a legal obligation (Attorney General's Office, DIAN, etc.)
• Courts: In legal proceedings, lawsuits or investigations
• Superintendencies: Regulatory oversight (SIC, Financial Superintendence, etc.)

7.2 International Transfers

We do not make international transfers of personal data outside Colombia, except:

• Cloud providers located in jurisdictions with equivalent safeguards
• In compliance with a legal obligation ordered by a competent authority
• Always with equivalent protection measures

Data is stored preferably on servers located in Colombia or in jurisdictions that guarantee equivalent protection.

7.3 Restriction Principle

• We do not sell your personal data to third parties for commercial purposes
• We do not share financial or sensitive data unnecessarily
• We minimize the information shared to what is strictly necessary
• Third parties are contractually bound to protect your data

8. DATA SECURITY AND PROTECTION

8.1 Technical Security Measures

We implement:

1. Encryption in Transit:

• HTTPS/TLS 1.2+ for all communications
• Valid security certificates
• Protection against man-in-the-middle attacks

1. Encryption at Rest:

• Encrypted databases
• Secure storage of credentials
• Password hashing (bcrypt, PBKDF2 or stronger)

1. Authentication and Authorization:

• JWT tokens with expiration (15 minutes for access)
• Refresh tokens with limited validity (7 days)
• Multi-factor authentication (optional, future)
• Role-based access control (RBAC)

1. Protection Against Vulnerabilities:

• Input validation (SQL injection and XSS prevention)
• Rate limiting against brute-force attacks
• Auditing of access and changes
• Monitoring of suspicious activity

8.2 Organizational Security Measures

1. Limited Access:

• Only authorized personnel access personal data
• Under the principle of least privilege
• Access auditing

1. Training:

• Staff trained in data protection
• Compliance with confidentiality instructions
• Contractual liability for breaches

1. Security Incidents:

• Detection and response procedure
• Notification to data subjects in the event of serious breaches
• Report to the Superintendence of Industry and Commerce (SIC) where applicable

1. Regular Audits:

• Periodic security assessments
• Penetration testing
• Reviews of compliance with this policy

8.3 Your Responsibility for Security

• Keep your password confidential and do not share it
• Use strong passwords: At least 8 characters, numbers and symbols
• Log out on shared devices
• Report suspicious activity to our team
• Keep your device up to date with the latest OS versions

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 Types of Cookies Used

1. Essential/Technical Cookies:

• User authentication and session
• Language/theme preferences
• Fraud prevention and security
• Do not require explicit consent

1. Analytics Cookies:

• Measuring usage and behavior
• Identifying popular pages
• Improving the user experience
• Require prior consent

1. Marketing Cookies:

• Personalized ads
• Retargeting
• Campaign analysis
• Require prior consent

9.2 Unique Device Identifiers

The application may use:

• IDFA (iOS): Identifier for Advertisers
• AAID (Android): Google Advertising ID
• UUID: Unique identifier determined by the app

These are used for:

• User sessions
• Behavioral analysis
• Personalized advertising (with prior authorization)

You can disable them in your device settings.

9.3 How to Manage Cookies

On your device:

• Settings > Privacy > Advertising (iOS) → Disable IDFA
• Settings > Google > Manage your Account > Data & privacy (Android) → Disable AAID

In the application:

• Open Settings > Privacy
• Turn cookies on/off according to your preference

10. DATA RETENTION

10.1 Retention Periods by Data Type

10.2 Account Deletion

When you request the deletion of your account:

We will proceed as follows:

1. Immediate anonymization of identifiable personal data
2. Limited retention of essential data for:

• 5 years for tax obligations
• 3 years for dispute resolution
• The time needed for fraud/security purposes

1. Permanent deletion after the retention period

NOTE: The public information you shared (reviews, photos of places) may remain visible, although unlinked from your identity.

11. MINORS

11.1 Age Restriction

• CityScout is intended for users 18 years of age and older
• We do not knowingly collect data from minors under 18
• Minors cannot create registered accounts

11.2 If a Minor Accesses the Application

If we discover that a minor has provided personal data:

• We immediately delete that data
• We notify whoever holds parental authority
• We do not continue the processing without the consent of parents/guardians

11.3 Consent of Legal Representatives

If a minor exceptionally accesses the application under the supervision of a representative:

• We require explicit consent from parents/guardians
• We limit data collection to the minimum
• We provide privacy instructions in understandable language

12. RIGHTS IN SPECIFIC CONTEXTS

12.1 OWNER (Place Owner)

As an OWNER, in addition to the general rights:

• Access to data of visitors/reviewers (limited to public information)
• Request the removal of false or defamatory reviews
• Control over the images of your establishment
• Restriction of customer data if you operate as a controller

12.2 ADMIN (Administrator)

As an ADMIN, we handle data under CityScout's instructions:

• Access to the data needed to manage the platform
• Anonymization of data in reports
• Prohibition of using data for personal purposes
• Liability for misuse of information

13. CHANGES AND UPDATES TO THIS POLICY

13.1 Right to Modify

CityScout reserves the right to update this Privacy Policy:

• To adapt to legal changes
• To improve protection services
• To reflect new practices

13.2 How We Notify You

Before significant changes:

1. Email notification to your registered address
2. Notice in the application (popup or banner)
3. Publication of the updated version here
4. Minimum notice: 30 days to comment before it takes effect (unfavorable changes)

13.3 Your Consent

• Minor changes do NOT require new consent
• Significant changes require your explicit acceptance
• Continued use = acceptance of the new policy

Last updated: April 1, 2026 Next review: April 1, 2027

14. CONTACT: PRIVACY RIGHTS AND HABEAS DATA

14.1 Requests for Access, Rectification and Deletion

Privacy Officer:

• Email: soporte@cityscout.com
• Hours: Monday to Friday, 8 AM - 6 PM (Colombia time)
• Address: Popayán, Cauca, Colombia

14.2 How to Submit a Request

Option 1: Through the Application

• Settings > Privacy > Request Data
• Fill in the form and submit it

Option 2: By Email Send an email to: soporte@cityscout.com

Minimum content:

• Subject: Describe your request (Access / Rectification / Deletion / Habeas Data)
• Body:
• Full name
• National ID (cédula) or identification number
• Email registered in CityScout
• Detailed description of the request
• Identity documents (photos or scans)
• Attachments: Copy of your identity document

Option 3: By Post CityScout address: Popayán, Cauca, Colombia

14.3 Response Time

• Access/rectification/deletion requests: Maximum 10 business days (Law 1581)
• Habeas Data: No formalities, but we respond within 5 business days
• If an investigation is required: Maximum 5 additional days (with notification)

14.4 Cost

• Access requests: FREE (first access each year)
• Additional access requests: Up to the equivalent of one UVT (currently ~$44,000 COP)
• Rectification/Deletion: FREE
• Habeas Data: FREE

14.5 Habeas Data Claim

If you are not satisfied with our response, you can file a Habeas Data Claim before:

• The Municipal Civil Court or the Circuit Civil Court (your jurisdiction)
• No lawyer needed
• No court costs
• It can be filed verbally or in writing

15. REGULATORY COMPLIANCE AND SUPERVISION

15.1 Competent Authorities

Data protection in Colombia is supervised by:

1. Superintendence of Industry and Commerce (SIC)

• Highest authority on data protection
• Complaints email: [SIC contact email]
• You can submit requests for the protection of your rights

1. Civil Courts

• Hear protection actions, tutela actions and Habeas Data claims
• Territorial jurisdiction based on the citizen's place of residence

1. Office of the Attorney General of the Nation (Fiscalía General de la Nación)

• Investigates crimes against data protection and privacy

15.2 Your Right to File a Complaint

You can file complaints with the SIC if:

• You believe we have violated Law 1581
• We do not respond to your access/rectification/deletion requests
• We transfer data without authorization
• We use your data for purposes you did not consent to

SIC contact: www.sic.gov.co

16. LEGAL BASIS AND REGULATIONS

This policy is supported by:

• Law 1581 of 2012: Colombian Personal Data Protection Law
• Decree 1377 of 2013: Technical regulations and procedures
• Law 1266 of 2008: Protection of personal information in financial entities
• Decree 1081 of 2015: Commercial Code (protection of commercial data)
• Law 1273 of 2009: Computer crimes (hacking, electronic fraud)
• SIC Resolution 60812 of 2020: Implementation guide for PQRSF (petitions, complaints, claims, suggestions and compliments)
• SIC Agreement (Resolutions 60212-60414): Administrative procedures
• Constitutional Case Law: C-748/11, C-1011/08, T-729/02 (Habeas Data)

17. ADDITIONAL INFORMATION

17.1 What Is NOT Data Processing?

We do not consider it "data processing" if:

• It is for exclusively personal or household purposes
• It is anonymous information (impossible to identify the data subject)
• It is data about legal entities (companies, not natural persons)
• It is aggregated public data (statistics without identification)

17.2 Sensitive Data

Although the law defines "sensitive data" (racial origin, beliefs, health data), CityScout does NOT knowingly collect sensitive data. If we were to receive it accidentally:

• We delete it immediately
• We notify you
• We take preventive measures

17.3 Additional Contact Details

For privacy inquiries:

• Live chat: Available in the app (Settings > Help)
• Social media: @cityscout.co
• Blog: https://cityscout.com/privacy

18. ANNEXES (IF APPLICABLE)

Annex A: Marketing Consent Form

[Available in the privacy settings within the app]

Annex B: Habeas Data Response Procedure

[Detailed procedure - see section 14.5]

Annex C: Instructions for Complaints before the SIC

[Available at https://www.sic.gov.co/proceso-pqrsf]

19. CONFIRMATION OF ACCEPTANCE

By using CityScout, you acknowledge that:

✓ You have read this Privacy Policy in its entirety ✓ You understand how we process your personal data ✓ You accept the processing under the conditions described ✓ You know your rights and how to exercise them ✓ You accept the transfer of data as described ✓ You authorize storage on cloud servers in accordance with the security described

If you DO NOT accept, you must stop using the application.

20. FREQUENTLY ASKED QUESTIONS (FAQ)

How long do we have to respond to requests?

Maximum 10 business days for access, rectification and deletion (Law 1581).

Can I delete my account?

Yes, at any time from Settings > Privacy > Delete Account.

Do you sell my data to advertising companies?

No. We never sell personal data.

If I change devices, am I still me?

Yes, with your authentication token. Data is linked to your email/account, not to the device.

What happens if I lose access to my email?

Contact our team at privacy@cityscout.com for identity verification.

Does CityScout share data with Google/Meta?

Only with your consent, for analytics. Meta does not access personal data.

What happens if CityScout is hacked?

We investigate immediately and notify those affected, and the SIC if it is serious.

Can I challenge an automated decision?

Yes, through a Habeas Data claim before a civil court.

Last Updated: April 1, 2026 Version: 1.0 Status: In force

This Privacy Policy is a living document and will be updated as our practices or the legislation change.

For inquiries or to report privacy issues: soporte@cityscout.com