I. DECLARATION OF EXONERATION OF LIABILITY.

I have made the free and informed decision to participate in one of the circuits that will take place as part of the first 7 Colores Marathon (hereinafter the Race), which will be held in the city of San Andrés Islas on Sunday, November 30, 2025, and is organized and operated by Fundación 7 Colores (hereinafter the Organizer).

I have been duly and fully informed about the location where the Race will take place, and I understand that this involves travel and accommodation expenses for which the Organizer bears no responsibility.

I have also been duly and fully informed about the implications of participating in the physical activities involved in the Race. I expressly acknowledge that the Organizer clearly and explicitly informed me that the circuits of the Race are not designed for individuals with heart conditions, deficiencies, or cardiovascular problems. I have been informed of the importance of using appropriate athletic equipment, the fundamental need for proper hydration during the Race, and the symptoms and consequences of dehydration during intense physical activity and in stressful environmental conditions, all of which may pose risks to my health and physical integrity. I understand that these activities expose me to potential harm, accidents, loss of personal belongings, illness, and physical injuries of various types and severity, including but not limited to: sudden cardiovascular or cardiorespiratory failure, musculoskeletal injuries, and both minor and fatal accidents that may occur at the locations where the Race takes place. This also includes any kind of accidents, falls, or illnesses caused by contact with other people, animals, or objects; weather-related consequences such as temperature and/or humidity; vehicular traffic; and the topographical conditions of the race course. I declare that I fully understand and have carefully evaluated all these risks. Therefore, I consciously and expressly release and hold harmless the Organizer, as well as its associates, partners, contractors, administrators, agents, employees, volunteers, and representatives, and the sponsors, their representatives, and any future entities assuming these roles, from any liability for any type of injury, illness, harm, loss, theft, or damage of any kind, including in the case of death, even if caused by unforeseeable and irresistible events by third parties or as described in Article 64 of the Colombian Civil Code and related jurisprudence, that I may suffer as a result of my participation in the Race.

I declare that, at the time of registration, I am in perfect physical, mental, and general health—in other words, fully fit to participate in the Race. I also confirm that I am currently enrolled in and contributing to the General Health System and have been properly informed about the physical demands and implications of participating in the Race. I understand that optimal physical and mental preparation is required in order to participate, and if my condition changes between now and the date of the Race, I will refrain from participating and release the Organizer from any consequences or harm I may suffer as a result of doing so.

I declare that, at the time of registration, I do not suffer from any illness, injury, disability, or adverse condition that would prevent me from participating in the Race. Should any such condition arise between now and the date of the Race, I will refrain from participating and hereby release the Organizer, its partners, and affiliates from any harm or consequences I may suffer as a result of doing so.

I declare that I am fully aware that if, on the date of the Race, I present any of the following conditions, I will refrain from participating and will not be entitled to a refund of the registration fee: pregnancy; intoxication; being under the influence of psychoactive substances; use of crutches, casts, and/or prosthetics; heart or respiratory illnesses; or any other condition that may prevent me from participating. If I choose to participate in the Race despite any of these conditions, I release the Organizer, its partners, and affiliates from all liability for any consequences that may occur.

I assume all risks associated with participating in the Race, including but not limited to falls, illnesses caused either by direct contact with other participants or by weather conditions, vehicular traffic, and the condition of the course. I fully accept all such risks, which I acknowledge have been disclosed, understood, and evaluated at the time of registration.

Having read this declaration, understanding the risks involved, and accepting them by choosing to participate in the Race, I, on my own behalf and on behalf of anyone acting on my behalf, release the Organizer, volunteers, its partners (including the Colombian Athletics Federation, the Municipal Mayor’s Office, the Governor’s Office, and others), sponsors and/or their representatives—and any future entities assuming such roles—from any and all claims or liability of any kind arising from my participation in the Race.

I accept the terms and conditions set forth in this document, which I have read, understood, and voluntarily agreed to.

 

II. REIMBURSEMENT POLICY.

By interacting with the domain https://staging.fundacion7colores.org, participants are subject to the terms and conditions of this document, as well as the liability waiver and the data processing policy. 

Since the physical items to be used in the Race—namely the race kits—are personal-use items and will be provided as complimentary gifts to participants by the Organizer, they are not subject to the Right of Withdrawal established in Article 47 of Law 1480 of 2011.

No refunds will be issued for registration fees under any circumstances, even if, for any reason or cause—including unforeseeable and irresistible events caused by third parties or as defined in Article 64 of the Colombian Civil Code and related jurisprudence—the participant does not compete in the Race. The Organizer reserves the right to cancel the Race and shall not be held responsible or obligated to refund the registration fee in the event of an unforeseeable and irresistible situation that prevents the event from taking place. Nor shall the Organizer be liable for any travel or accommodation expenses incurred by participants. If, by decision of local authorities or due to other unforeseeable and irresistible circumstances, the Organizer is forced to cancel the event, no liability shall apply, and the Organizer will be authorized to retain the amounts paid for registration. 

If, by decision of the authorities, the Organizer is required to postpone, cancel, or modify any of the circuits of the Race, and/or change the start and/or finish locations, date, or place of service delivery, the Organizer may reschedule the Race. The Organizer shall not be held liable or obligated to refund the registration fee in the event of any modification, alteration, or change to the start or finish location, circuits, or race routes.

 

III. DATA PROCESSING POLICY

Fundación 7 Colores (hereinafter the Foundation), within the framework of the 7 Colores Marathon, hereby issues and discloses this Data Processing Policy to all Data Subjects whose personal data may be processed in any manner by the legal entity. This policy is issued in compliance with Law 1581 of 2012 and Decrees 1377 of 2013, 886 of 2014, and 1074 of 2015, and has been adopted for the execution of its activities.

Article 1 – Purpose The purpose of this policy is to inform all stakeholders who have or will have a contractual relationship with the legal entity about their rights concerning the protection of personal data that is collected, managed, or stored, as well as the procedures and mechanisms established by the legal entity to ensure those rights are upheld. Likewise, this policy aims to explain the scope and purpose of the processing to which personal data will be subjected in the event that the data subject grants their prior, express, and informed authorization, emphasizing that all collected information will be handled with strict confidentiality and care.

Article 2 – Scope This policy applies fully to all operations carried out by the legal entity, and in particular, to all files and databases containing personal data that are subject to processing.

Article 3 – Obligations This policy is mandatory and strictly applicable to the legal entity, its collaborators, all clients, and suppliers. Therefore, all stakeholders who have any relationship with the legal entity and who handle personal data databases are equally required to comply with it.

Article 4 – Definitions For the purposes of this policy and in accordance with current regulations, the following definitions shall apply:

• Authorization: Prior, express, and informed consent granted by the Data Subject for the processing of personal data by the legal entity.

• Privacy Notice: A verbal or written communication issued by the Data Controller to the Data Subject regarding the processing of their personal data. This notice informs the Data Subject about the existence of the applicable data processing policies, how to access them, and the purposes for which their personal data will be processed.

• Database: An organized collection of personal data that is subject to processing.

• Personal Data: Any information linked or that can be associated with one or more identified or identifiable natural persons.
• Personal Data: Any information linked or that can be associated with one or more identified or identifiable natural persons.

• Private Data: Data that, due to its intimate or reserved nature, is only relevant to the data subject. For example, a person’s tastes or preferences are considered private data.

• Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, information related to a person’s marital status, profession or occupation, and their status as a merchant or public servant. By nature, public data may be found in public records, official documents, gazettes, official bulletins, and court rulings that are final and not subject to confidentiality.

• Semi-Private Data: Data that is neither intimate, reserved, nor public in nature, and whose knowledge or disclosure may be of interest not only to the data subject but also to a specific sector of the legal entity or society in general. Examples include financial and credit information related to commercial or service activities.

• Sensitive Data: Sensitive data refers to information that affects the privacy of the Data Subject or that, if misused, could lead to discrimination. This includes data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social or human rights organizations, or organizations that promote the interests of any political party or protect the rights and guarantees of opposition parties. It also includes data related to health, sexual life, and biometric data.

• Data Processor: A natural or legal person, whether public or private, who, by themselves or in association with others, carries out the processing of personal data on behalf of the Data Controller.

• Data Controller: A natural or legal person, whether public or private, who, by themselves or in association with others, determines the purpose and means of the database and/or the processing of personal data.

• Transfer: A data transfer occurs when the Data Controller and/or Data Processor, located in Colombia, sends information or personal data to a recipient who is also a Data Controller and is located either inside or outside the country.

• Data Subject: A natural person whose personal data is subject to processing.

 Tratamiento: Cualquier operación o conjunto de operaciones sobre datos personales, tales
• Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

• Transfer: A transfer of data occurs when the Data Controller and/or Data Processor, located in Colombia, sends personal data or information to a recipient who is also a Data Controller and is located either within or outside the country.

• Transmission: The processing of personal data that involves its communication within or outside the territory of the Republic of Colombia, for the purpose of being processed by the Data Processor on behalf of the Data Controller.

Article 5 – Data Controller The Foundation, a legally constituted non-profit legal entity, identified with NIT 901932044-1, domiciled in Bogotá D.C., located at Cl 89 No. 12 14, Apt. 903 in the same city, and with the designated email address pqr@staging.fundacion7colores.org, shall act as the Data Controller and/or Data Processor of the personal data collected in the course of fulfilling its purpose. This includes collecting, using, storing, circulating, and deleting such data solely for the purposes outlined in this policy.

The legal entity, in accordance with its legal and corporate responsibilities, shall ensure that the information contained in the databases it manages is complete, truthful, up-to-date and updatable, verifiable, and understandable. It shall be handled using physical, technological, human, and administrative measures that safeguard the confidentiality of the information, in strict compliance with the principle of confidentiality in all its actions. Likewise, the entity shall ensure the protection of the right to habeas data, based on the principles of good faith, legality, and transparency established in Law 1581 of 2012, as well as in Law 2300 of 2023.

Article 6 – Processing and Purpose In fulfilling its legal purpose—especially within the framework of the 7 Colores Marathon—the Foundation will use the data collected before and during the activity for the following purposes: i) For statistical purposes only, to develop market analysis; ii) To conduct satisfaction surveys related to the goods and services offered by the Foundation; iii) To contact the data subject via electronic means—such as SMS or chat—to send information related to the Foundation's mission and its activities; iv) To contact the data subject via email to send information related to the Foundation and its activities; v) To comply with national legal regulations; vi) To fulfill and enforce contractual and legal obligations acquired or to be acquired with the Foundation; vii) To process and respond to requests, complaints, inquiries, or claims made by the data subjects; viii) To provide information regarding the Foundation’s products, services, or offers; ix) To transfer or transmit the data subjects' personal data to third parties in Colombia or abroad with whom the Foundation has or enters into data transfer or transmission agreements in accordance with the law; x) To update data through any means of contact, existing or future, in accordance with the guidelines of Law 2300 of 2023; xi) To comply with policies regarding knowledge of the data subjects; xii) To assess the quality of services provided in the execution of the Foundation’s purpose; xiii) To report activities and provide information to oversight authorities; xiv) To manage the Foundation’s human resources in accordance with legal employment regulations applicable to all current and former personnel; xv) To perform checks using restrictive or binding lists, or databases, to adequately understand the profile of the data subject, whether a supplier, employee, or any other individual related to the Foundation; and xvi) Any other activity related to the data subject and the Foundation. Paragraph: For the processing of data that is public in nature, prior authorization from the data subject shall not be required. Nevertheless, the Foundation will adopt the necessary measures to ensure compliance with the principles and obligations set forth in the aforementioned law for the handling of such data.

Article 7 – Processing of Sensitive Data Biometric data, and any other sensitive data as defined by Law 1581 of 2012, shall be processed solely for the purpose of controlling access by Data Subjects to the legal entity’s facilities, and only in the event that such processing becomes necessary.

Article 8 – Rights of Data Subjects As the data subject, you have the right to: i) Access, free of charge, the personal data you have provided and that has been subject to processing; ii) Know, update, and correct your information in the case of partial, inaccurate, incomplete, misleading, or outdated data, or data whose processing is prohibited or unauthorized; iii) Request proof of the authorization granted; iv) File complaints with the Superintendence of Industry and Commerce (SIC) for violations of applicable data protection regulations; v) Revoke authorization and/or request the deletion of your data, provided there is no legal or contractual obligation requiring its retention in the legal entity’s databases; vi) Refrain from answering questions about sensitive data. Responses concerning sensitive data or data related to minors shall be optional in cases where applicable.

Article 9 – Handling of Requests, Inquiries, and Complaints The Foundation’s customer service department is responsible for processing Data Subjects’ requests to exercise their rights. To this end, the Foundation has made available the following communication channels: the email address pqrs@staging.fundacion7colores.org and the website https://staging.fundacion7colores.org.

Article 10 – Procedure for Exercising the Right to Habeas Data In compliance with regulations on personal data protection, the Foundation outlines the procedure and minimum requirements for exercising your rights. To submit and process your request, you must provide the following information: a) Full name and surname; b) Contact details (physical and/or email address and phone numbers); c) Means by which you wish to receive a response to your request; d) Reasons or facts supporting your claim, including a brief description of the right you wish to exercise (e.g., to know, update, correct, request proof of authorization, revoke, delete, or access the information); e) Signature (if applicable); and f) Identification number. Paragraph: The maximum time allowed by law to respond to your request is fifteen (15) business days from the day following receipt of the request. If it is not possible to address the request within that period, the Foundation will inform the requester of the reasons for the delay and the date by which the request will be handled, which in no case may exceed eight (8) additional business days after the expiration of the initial term. Once the deadlines established by Law 1581 of 2012 and other applicable regulations have passed, if the data subject is denied—either partially or completely—the rights of access, correction, updating, deletion, or revocation, they may submit the case to the Superintendence of Industry and Commerce (SIC) – Delegation for the Protection of Personal Data.

Article 11 – Disclosure of Information Personal information may only be disclosed when the request is made by the following individuals: i) the data subject; ii) their heirs; iii) their legal representatives; iv) individuals authorized by the data subject; v) individuals authorized by judicial or legal order. First Paragraph: In accordance with Constitutional Court Decision C-748 of 2011, if a public or administrative entity requests the information, it must justify the request by explaining the link between the need for the data and the fulfillment of its constitutional or legal duties. Additionally, upon disclosure of the information, the requesting public or administrative entity must be informed that it is responsible for complying with the obligations and requirements imposed by Law 1581 of 2012, either as a Data Controller or, in some cases, as a Data Processor. The receiving administrative entity must comply with all legal mandates in effect at the time of receiving the information, especially the principles established by law. Second Paragraph: The databases containing personal data will be retained for as long as the data subject does not request their deletion and provided that there is no legal or contractual obligation requiring their continued storage, unless a pre-existing legal or contractual provision states otherwise.

Article 12 – Authorization of Third Parties When the data subject wishes to submit a request or ask for the updating or correction of their personal data through a third party, they must send the Foundation a proper, voluntary, and freely given authorization that grants the third party the power to exercise the data subject’s rights. Submitting this authorization is a mandatory requirement to ensure the confidentiality of the information against unauthorized third parties. The authorization must include at least the following: i) Identification of the data subject granting the authorization; ii) A copy of the data subject’s national ID card; iii) Full name and identification details of the authorized person; iv) The period during which the person is authorized to consult, update, or correct the information.

Article 13 – Authorization I authorize the Foundation, its representatives, and sponsors to use the registration information, photographs, films, videos, recordings, and any other type of media captured during its activities for any legitimate use and for the purposes they deem appropriate, without any compensation or financial obligation. I also authorize the processing of the personal data provided and those collected during the Foundation’s activities for purposes related to the Foundation, as well as for commercial and advertising purposes, without prejudice to the rights established by law—particularly the right to access, update, correct, and request the deletion of personal data.

Article 14 – Term of Validity This Personal Data Processing Policy is effective as of March 2025. The databases will remain active for the period necessary to fulfill the purposes for which the data was authorized for processing and as established by any applicable special regulations or legal functions assigned to the Organization. Once this period has elapsed, and provided there is no legal or contractual obligation to retain the data, the information will be deleted from the Organization’s databases. Paragraph: The Foundation reserves the right to modify this policy at any time. Any updates will be published on the website https://staging.fundacion7colores.org for public awareness.