Personal data processing policy
Draft pending approval by the company.
Controller: Agencia de viajes Holidays in Colombia by MICROIDEAS SAS · Colombian tax ID (NIT) 900872208-0 · National Tourism Registry (RNT) 74577 · Cartagena de Indias, Bolívar, Colombia · gerencia.microideas@gmail.com · +57 312 450 6024
Effective from: 16 October 2026 · Version: 2026-10-16.1
1. Who is responsible for your data
The controller of your personal data is Agencia de viajes Holidays in Colombia by MICROIDEAS SAS (“Holidays in Colombia”, “we” or “us”), a travel agency with Colombian tax ID (NIT) 900872208-0, registered in the National Tourism Registry under number 74577.
- Domicile: Cartagena de Indias, Bolívar, Colombia.
- Email for personal data matters: gerencia.microideas@gmail.com
- Telephone and WhatsApp: +57 312 450 6024
2. What this policy is for and who it applies to
This policy explains which personal data we collect, what we use it for, who we share it with, how long we keep it and how you can exercise your rights. It applies to the data we process about customers, travellers and their companions, people who request a quote, website visitors, subscribers, suppliers and partners, through any channel: website, WhatsApp, email, social media, telephone or in person.
We adopt it in compliance with Colombian Statutory Law 1581 of 2012 and its implementing regulations, in particular Decree 1377 of 2013, now compiled in Single Regulatory Decree 1074 of 2015. Where it applies to you, we also take into account the European Union General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), as explained in section 15.
3. Definitions
- Data subject: the person the data relates to.
- Personal data: any information that identifies you or can identify you, such as your name, email or passport number.
- Sensitive data: data that affects your privacy or whose misuse may lead to discrimination, such as health data, ethnic origin or sexual orientation.
- Authorisation: your prior, express and informed consent for us to process your data.
- Processing: any operation on personal data, such as collecting, storing, using, sharing or deleting it.
- Processor: anyone who processes data on our behalf, following our instructions.
- Transmission: disclosure of data to a processor, inside or outside Colombia.
- Transfer: sending data to another controller, inside or outside Colombia.
4. Principles we apply
We process your data in accordance with the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality set out in Article 4 of Law 1581 of 2012. In practice: we only ask for what we need, we tell you why, we do not use your data for other purposes without your permission and we protect it.
5. What data we collect and how
5.1 Website quote form
When you request a quote on our website we ask for: destination of interest, arrival date, number of travellers, name, email address, telephone or WhatsApp number, the tours or products you are interested in and, if you wish, a free-text message.
When you submit the form:
- Your data is saved in our request database, a spreadsheet in a cloud service that only our team can access.
- A WhatsApp conversation with us opens with your travel information already written, so you can send it to us and we can help you faster.
To submit the form you must tick the data processing authorisation box. Receiving offers and news is optional and is authorised in a separate box.
5.2 WhatsApp, email, social media and telephone
If you contact us through these channels, we process your name, number or username and the information you share about your trip. WhatsApp and Instagram belong to Meta Platforms, and email is managed with Google (Gmail); those companies process messages under their own terms.
5.3 Bookings and service delivery
When you book a tour, trip or boat, we may ask you and your companions for: full name, type and number of identity document or passport, nationality, date of birth, contact details, flight and accommodation information, emergency contact and service preferences.
5.4 Sensitive data
For some services it may help to know about dietary restrictions, health conditions, allergies or mobility needs, in order to keep you safe and adapt the experience. Providing this data is optional: you do not have to answer and no service depends on it, unless the information is essential for your safety in a specific activity, in which case we will explain why. We only process it with your explicit authorisation and only share it with the supplier providing that activity.
5.5 Payments and invoicing
Payments are made through Bold payment links. Your card or account details are processed directly by Bold; we do not receive or store them. To issue the electronic invoice we process the billing details you give us (name or company name, ID number, address and email), which are recorded in the Siigo invoicing software and reported to the DIAN (Colombian tax authority), as required by law.
5.6 Browsing the website
Our use of cookies and similar technologies is explained in our Cookie policy.
6. What we use your data for
With your authorisation, we use your data to:
- Answer your enquiries and prepare and send you quotes.
- Manage your bookings, coordinate services with suppliers and assist you before, during and after your trip.
- Contact you about changes, incidents or emergencies related to your trip.
- Manage payments, invoicing, accounting and tax obligations.
- Handle requests, complaints, claims and warranty requests.
- Comply with legal obligations and requests from competent authorities.
- Measure service quality, for example through satisfaction surveys.
- Only if you authorise it separately: send you offers, news and travel content by email or WhatsApp. You can unsubscribe at any time.
We do not sell your data or use it for purposes other than those stated without asking for a new authorisation.
7. Children and adolescents
We only process data of people under 18 when it is needed to provide a tourism service in which they take part, with the authorisation of their parent or legal representative, and respecting their best interests and fundamental rights, in accordance with Article 7 of Law 1581 of 2012. The representative provides the data and exercises the rights on their behalf.
Holidays in Colombia rejects the sexual exploitation and abuse of children and adolescents in tourism and complies with Law 679 of 2001 and Law 1336 of 2009. We will report any case we become aware of to the authorities.
8. How we obtain your authorisation
We ask for your authorisation before processing your data, using means that allow us to keep evidence of it: the box on the website form, a written WhatsApp or email message, a signed document, or unequivocal conduct showing that you gave it, such as voluntarily sending us your data after receiving the privacy notice.
Authorisation is not required in the cases listed in Article 10 of Law 1581 of 2012, for example when an authority requests the data in the exercise of its functions, in medical or health emergencies, or for data of a public nature.
9. How we protect your data
We apply reasonable technical, human and administrative measures to protect your data against loss, consultation, use or unauthorised access: access restricted to the team members who need it, accounts protected with passwords and two-step verification where the service allows it, and confidentiality commitments from those who process data on our behalf.
10. Who we share your data with
We only share the data needed for the relevant purpose with:
| Recipient | Purpose |
|---|---|
| Tourism suppliers: hotels, local operators, guides, transport companies, boats and airlines | Providing the services you booked |
| Meta Platforms (WhatsApp, Instagram, Facebook) | Communicating with you through those channels |
| Google (email and cloud storage) | Managing emails and the request database |
| Bold | Processing payments you make through its links |
| Siigo and our accountant | Electronic invoicing and accounting |
| Competent authorities | Where required by law or court order |
Those who process data on our behalf do so as processors, following our instructions and this policy.
11. International transfers and transmissions
Some of the recipients above, such as Meta or Google, may store or process data on servers outside Colombia, for example in the United States. In addition, if your trip includes services provided by companies in other countries, your data will be disclosed to those companies to deliver what you booked.
These transfers and transmissions are made in accordance with Article 26 of Law 1581 of 2012: with your express authorisation, where necessary to perform the contract with you, or with suppliers that offer adequate levels of protection or are contractually bound to protect your data.
12. Your rights
As a data subject you have the right to:
- Access, update and correct your data.
- Request evidence of the authorisation you gave us.
- Be informed of how we have used your data.
- File complaints with the Superintendencia de Industria y Comercio (SIC), Colombia’s data protection authority, for breaches of the law, after first submitting your enquiry or claim to us.
- Withdraw your authorisation or request deletion of your data where legal principles, rights and guarantees are not respected. Withdrawal or deletion does not apply where we must keep the data because of a legal or contractual obligation.
- Access your personal data free of charge.
These rights may be exercised by the data subject, their successors, their representative or attorney, or anyone acting under a stipulation in favour of another.
13. How to exercise your rights
The area responsible for handling your enquiries and claims is the Management of Holidays in Colombia. Write to gerencia.microideas@gmail.com stating your name, identity document, a description of your request, the address or email where you want to receive the answer and, if you act on behalf of someone else, the document proving it.
- Enquiries (finding out what data we hold or how we use it): we answer within a maximum of 10 business days of receipt. If we cannot do so within that period, we will explain why and answer within a maximum of 5 additional business days.
- Claims (correcting, updating or deleting data, withdrawing authorisation or reporting a breach): we answer within a maximum of 15 business days from the day after receipt. If we cannot do so within that period, we will explain why and answer within a maximum of 8 additional business days. If the claim is incomplete, we will ask you to complete it within 5 days; if 2 months pass without you doing so, we will consider it withdrawn.
These are the time limits set by Articles 14 and 15 of Law 1581 of 2012. To unsubscribe from marketing communications, just ask through the same channel where you receive them.
14. How long we keep your data
We keep your data only for as long as needed for the purpose for which we collected it and to meet legal obligations:
| Data | Period |
|---|---|
| Quote requests that do not become a booking | 24 months from the last communication |
| Customer and booking data | For the duration of the business relationship and up to 10 years afterwards, for accounting, tax and commercial obligations |
| Invoices and accounting records | 10 years, under commercial law |
| Data for marketing communications | Until you withdraw your authorisation |
| Sensitive data for a trip | Until the service ends, unless a claim is pending |
When the period ends, we delete the data or anonymise it so that it no longer identifies you.
15. If the General Data Protection Regulation (GDPR) applies to you
If you are in the European Economic Area and we offer you our services, the GDPR may apply to the processing of your data. In that case:
- Legal bases: we process your data to perform the contract or take pre-contractual steps you request, such as a quote (Article 6(1)(b)); to comply with legal obligations (Article 6(1)(c)); with your consent for marketing communications and health data (Articles 6(1)(a) and 9(2)(a)); and for our legitimate interest in improving the service and protecting it against fraud (Article 6(1)(f)).
- Additional rights: in addition to those in section 12, you may request restriction of processing, object to it and request data portability. You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
- Transfers: your data is processed in Colombia, which does not have a European Commission adequacy decision, and by the providers listed in section 10. Where needed, we rely on the necessity of performing the contract you requested (Article 49(1)(b)) or on the safeguards each provider offers.
- Complaints: you may lodge a complaint with the data protection authority in your country of residence.
16. Cookies
Our use of cookies and similar technologies on the website is explained in the Cookie policy, which forms part of this policy.
17. Validity and changes
This policy is effective from 16 October 2026. Our databases will remain in force for as long as the purposes described are maintained. If we make substantial changes, in particular regarding the controller, the purposes or the recipients, we will tell you before applying them through the website or the contact channels we have with you and, where the law requires it, we will ask for a new authorisation.