Privacy and Personal Data Processing Policy

1. Who we are

The AI Reservations Agent service is operated by Contler AG and its Colombian branch. Both act under this policy and are referred to as "Contler".

2. Purpose, scope and applicable law

This policy explains how Contler collects, uses, stores and protects the personal data processed by its AI reservations agent, over voice and chat.

It applies to:

• Guests and prospective guests who call or message the agent of a hotel or hotel group that is a Contler client.
• Contact persons at the hotels and groups that hire the service.
• Any other person whose data reaches Contler through the agent.

Applicable law:

• Colombia: Political Constitution (art. 15), Law 1581 of 2012, Decree 1074 of 2015 (which compiles Decree 1377 of 2013) and the guidance of the Superintendence of Industry and Commerce (SIC).
• Switzerland: Federal Act on Data Protection (FADP), in force since September 1, 2023.
• European Union: General Data Protection Regulation (GDPR), when the service is provided to hotels established in the EU or to guests located there.
• Any other local data protection law of the country where the client hotel operates.

Where two laws govern the same matter, Contler applies the one that gives the individual greater protection.

3. Roles in processing

For guest data, the hotel or hotel group is the Controller and Contler is the Processor.

As a result:

• Each client hotel is responsible for having its own privacy policy and a valid legal basis to process its guests' data.
• Contler processes guest data only to provide the service hired by the hotel, under the contract and, where applicable, the data processing agreement signed between the parties.
• Contler does not sell, rent or trade guests' personal data, nor use it for its own marketing.

4. Definitions

• AI Agent: Contler's virtual assistant that answers by voice (calls) and chat (web, WhatsApp or other enabled channels) and handles reservations for a hotel.
• Data subject: the individual whose personal data is processed, for example the guest who calls or writes.
• Personal data: any information linked or that can be linked to an identified or identifiable individual.
• Sensitive data: data that affects the individual's privacy or whose misuse could lead to discrimination, such as health or biometric data.
• Processing: any operation on personal data, such as collection, storage, use, disclosure or deletion.
• Controller: the party that decides on the database and the processing. For guest data, the hotel.
• Processor: the party that processes data on behalf of the Controller. For guest data, Contler.
• Booking engine: the hotel's or group's system (IBE, CRS, PMS or channel manager) where the reservation is created and paid.
• International transfer: sending personal data to a recipient located in another country.

5. Personal data we process

The agent only asks for the data needed to quote, create the reservation and send its confirmation.

Contler does not request payment card or bank data (see section 7).

6. Purposes of processing

Guest data is processed only to handle the guest's enquiry or reservation with the hotel. The purposes are:

1. Answer questions about the hotel, its rooms, rates, availability and services.
2. Check real-time availability and rates in the hotel's or group's booking engine.
3. Create, modify or cancel reservations directly in the hotel's booking engine, at the guest's request.
4. Send the guest the confirmation link and, where applicable, the payment link of the hotel's booking engine, by SMS, WhatsApp or email.
5. Transfer the call or case to hotel staff when the agent cannot resolve it or the guest asks.
6. Provide the hotel with the conversation record and request summary.
7. Monitor service quality, review errors and handle complaints.
8. Protect the security of the service and prevent fraud or abuse.
9. Produce aggregated or anonymized statistics and reports for the hotel and to improve Contler's service.
10. Comply with legal and contractual obligations and requests from competent authorities.

Any new and different purpose will require informing the data subject and, where the law requires it, obtaining new consent.

Where the GDPR or FADP applies, the legal bases are performance of a contract or pre-contractual steps at the guest's request (purposes 1–6), the legitimate interests of the hotel and Contler (purposes 7–9) and compliance with legal obligations (purpose 10).

7. Payments: Contler does not process payments

• Reservations are always paid in the hotel's or group's booking engine or payment gateway, through the link the guest receives.
• The AI agent is instructed never to ask, by voice or chat, for card numbers, security codes (CVV), expiry dates, passwords or bank details.
• If a guest tries to say or type payment data, the agent will ask them not to share it and to complete payment on the hotel's secure link.
• If the guest shares such data anyway, Contler will take steps to mask or delete it from recordings and transcripts as soon as it is detected, and will not use it for any purpose.
• Payment security, including PCI DSS compliance, is the responsibility of the hotel and its booking engine or payment gateway provider.

Contler will never call or write to ask for payment data. If you receive such a message in the name of Contler or its agent, do not reply and notify the hotel or Contler.

8. Artificial intelligence and conversation storage

All conversations with the agent, voice and chat, are recorded or logged and stored securely and encrypted.

AI transparency

At the start of every call or chat, the agent states that the person is speaking with an artificial intelligence assistant and that the conversation will be recorded. The person may ask to speak with a member of hotel staff at any time.

What is stored

The audio recording (voice), the transcript or messages (chat), the request summary and the technical data of the interaction.

Use of voice

Voice is processed only to convert it into text and understand the request. Contler does not use voice to identify or authenticate people, and does not create voice profiles or biometric voiceprints.

Automated decisions

The agent does not on its own make decisions that produce legal effects on the person. Availability, rates and reservation confirmation are determined by the hotel's booking engine.

Model training

Contler does not use guests' personal data to train third-party AI models. To improve its service it uses only anonymized or aggregated information, unless the hotel and, where applicable, the data subject expressly authorize otherwise.

Access to conversations

Only the client hotel (for its own conversations) and authorized Contler staff, for support, quality or security, can access them.

9. Consent and privacy notice

The data subject's consent is obtained at the start of the interaction, through a short notice and an unequivocal action: continuing the call or chat.

Voice notice:

"Hello, I'm [Hotel]'s artificial intelligence virtual assistant. This call will be recorded and your data will be processed to handle your request, in line with our privacy policy. If you'd rather speak with a person, just tell me at any time."

Chat notice:

"You're chatting with [Hotel]'s AI assistant. We keep this conversation and your data to handle your enquiry or reservation. By continuing, you accept our privacy policy."

• If the person does not accept, they can end the interaction or ask for a human. The agent will then not request any further data.
• Contler keeps proof of consent through the recording or chat log.
• The client hotel must mention its use of Contler's AI agent in its own privacy policy and ensure the notice is active on its channels.

10. Sensitive data and minors

The agent does not request sensitive data and the person is not required to provide it.

• If a guest voluntarily shares sensitive data for a special request (for example, an accessibility need or a health-related dietary restriction), it will be used only to fulfil that request and shared only with the hotel.
• Reservations must be made by adults. Data about children travelling (for example, the number or age of minors) is processed only for the reservation, respecting their best interests and fundamental rights, under article 7 of Colombian Law 1581 of 2012.

11. Data sharing and international transfers

Contler shares data only with those who need it to provide the service, always under contracts with confidentiality and security obligations.

Current technology providers (sub-processors)

Contler will update this list when it adds or changes providers.

International transfers

Some of these providers are located outside Colombia and Switzerland. Contler only transfers data to countries with an adequate level of protection, or under data transfer agreements or standard contractual clauses that guarantee an equivalent level, in line with article 26 of Law 1581 of 2012, the Swiss FADP and, where applicable, the GDPR.

Contler AG and its Colombian branch may share data with each other, as they are the same legal entity, to operate and support the service.

12. Security measures

Contler protects data with technical, organizational and administrative measures in line with industry standards.

• Encryption of data in transit (TLS) and at rest.
• Infrastructure on cloud providers with recognized security certifications (for example, ISO 27001 or SOC 2).
• Role-based access control with secure authentication and least privilege. Each hotel only accesses its own conversations.
• Logging and monitoring of access and activity on the platform.
• Secure management of credentials and API keys, with periodic rotation.
• Confidentiality agreements with employees, contractors and providers.
• Backups and recovery procedures.
• Incident management procedure. If an incident affects personal data, Contler will notify the affected hotel without undue delay and, where the law requires it, the competent authority (in Colombia, the SIC) and the data subjects.

No system is infallible. Contler reviews and updates these measures periodically.

13. Retention and deletion

Contler keeps data only as long as needed for the purpose and as required by law or the contract with the hotel.

When a hotel's contract ends, Contler will return or delete its guests' data, at the hotel's choice, unless the law requires it to be kept. Anonymized data may be kept for statistics, as it no longer identifies anyone.

14. Your rights

Under article 8 of Colombian Law 1581 of 2012, and the FADP and GDPR where applicable, you may:

• Access, update and correct your personal data.
• Request proof of the consent given.
• Be informed about how your data has been used.
• Withdraw consent and request deletion of your data, where there is no legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with Colombia's Superintendence of Industry and Commerce (SIC), after first contacting the Controller or Processor.
• Where the GDPR or FADP applies: object to processing, request restriction, request data portability and lodge a complaint with the competent data protection authority (in Switzerland, the FDPIC).

Because hotels are the Controllers of their guests' data, you can exercise these rights directly with the hotel. If you write to Contler, Contler will handle the request or forward it to the hotel and support its response.

15. Requests and complaints

Send requests to atencionalcliente@contler.com with the subject "Data protection", or call +57 315 765 0150. Requests are handled by Contler's Administration department.

Please include: your name, ID document, preferred reply channel, the hotel you interacted with, the approximate date of the conversation, a description of your request and any supporting documents.

• If a complaint is incomplete, Contler will ask you to complete it within 5 business days. If 2 months pass without a reply, the complaint will be considered withdrawn.
• While it is being resolved, the record will be flagged "complaint in progress".
• If Contler is not competent to resolve the request, it will forward it to the Controller hotel within 2 business days and inform you.

Time limits under articles 14 and 15 of Colombian Law 1581 of 2012. Where the GDPR applies, Contler will respond within one month of receipt, extendable as permitted by the GDPR.

16. Effective date and changes

This policy is effective from September 1, 2026 and will remain in force while Contler provides the AI reservations agent service.

• Contler publishes this policy on contler.com and links to it from the agent's voice and chat notices.
• Any material change will be published on this site and communicated to client hotels before it takes effect, stating the update date.
• Databases will be kept while the stated purposes apply and no valid deletion request exists.

Version 1.0 — Contler AG / Contler AG Colombia, NIT 901.487.841-6. In case of discrepancy, the Spanish version prevails for processing governed by Colombian law.