Privacy Policy

PERSONAL DATA PROCESSING POLICY

ELENATOURS · Guatapé, Antioquia, Colombia

Fecha de vigencia: 24 de agosto de 2026

  1. OBJETO

ELENATOURS, operated by Doris Elena Rincón Franco, in her capacity as the controller of personal data, adopts this Personal Data Processing Policy in compliance with Law 1581 of 2012, Decree 1377 of 2013, as consolidated by Decree 1074 of 2015, and any other regulations that modify, supplement, or replace them.

The purpose of this policy is to inform data subjects about how ELENATOURS collects, uses, stores, retains, protects, and, when applicable, shares their personal data, as well as about their rights and the mechanisms available to exercise those rights.

This policy applies to the personal data that ELENATOURS processes in the course of its activities as a tour operator, through its various customer service and communication channels.

  1. DATA CONTROLLER

Responsable: Doris Elena Rincón Franco

Nombre comercial: ELENATOURS

RNT: 255510

Ciudad: Guatapé, Antioquia, Colombia

Email address for matters related to data protection: elenatoursguatape@gmail.com

Sitio web: elenatoursguatape.com

For the purposes of this policy, Doris Elena Rincón Franco will be referred to as ELENATOURS or the Data Controller.

  1. SCOPE OF APPLICATION

This policy applies to all individuals whose personal data is collected, stored, used, accessed, updated, or processed by ELENATOURS in the course of its business activities.

It includes, among other things, data on:

  • Customers and potential customers.
  • Individuals who request quotes or information.
  • Individuals who make reservations or purchase tourism services.
  • Individuals who contact ELENATOURS through its digital channels.
  • Individuals who participate in experiences or activities offered by ELENATOURS.
  • Suppliers, partners, and other individuals with whom ELENATOURS has a business or contractual relationship.
  1. PERSONAL DATA THAT MAY BE COLLECTED

Depending on the service requested and the channel used, ELENATOURS may collect the following personal data:

  • First and last names.
  • Email address.
  • Phone number or WhatsApp number.
  • City or place of origin, when necessary to manage the service.
  • Information related to the request, quote, or reservation.
  • Number of people participating in an experience.
  • Approximate or scheduled date of the service.
  • Preferences or information necessary to organize the requested tourism experience.
  • Information related to payments, billing, or receipts when necessary for the provision of the service
  • Communications, requests, questions, comments, inquiries, complaints, or claims made by the data subject.
  • Information that the data subject voluntarily provides through ELENATOURS’ contact channels.

ELENATOURS will endeavor to collect only data that is relevant, appropriate, and necessary for the stated purposes.

ELENATOURS will not request sensitive personal data unless there is a legitimate and legal need to do so and the conditions established by applicable regulations are met.

  1. CHANNELS THROUGH WHICH DATA IS COLLECTED

Personal data may be provided directly by the data subject through:

  • Website contact or quote request form.
  • Email address.
  • WhatsApp.
  • Phone calls.
  • ELENATOURS' social media.
  • In-person communication.
  • Other contact channels that ELENATOURS may enable in the future.

When data is voluntarily provided by the data subject through these channels, it will be processed in accordance with the purposes established in this policy and with the corresponding authorization when required.

  1. PURPOSES OF PROCESSING

ELENATOURS may process personal data for the following purposes:

  1. Attend to and respond to requests for information, inquiries, quotes, and requirements made by data subjects.
  2. Manage bookings and requests for tourism services.
  3. Coordinate, organize, and provide the contracted tourism services and experiences.
  4. Communicate with the data subject by email, phone, WhatsApp, or other authorized channels to manage the request or provide the service.
  5. Confirm, modify, or cancel bookings when necessary.
  6. Coordinate logistical aspects related to tourism experiences.
  7. Manage payments, invoicing, receipts, and other administrative aspects related to contracted services.
  8. Maintain records of clients, requests, quotes, and bookings.
  9. Attend to petitions, complaints, claims, inquiries, and requests related to the services provided.
  10. Comply with legal, tax, accounting, administrative, or contractual obligations applicable to ELENATOURS.
  11. Prevent, detect, and manage situations that may affect the safety of people, activities, or service delivery.
  12. Improve customer service and the quality of services offered.
  13. Manage relationships with suppliers, partners, and service providers linked to the tourism operation, when necessary to provide the requested service.
  14. Attend to requirements from administrative or judicial authorities when there is a legal obligation to do so.
  15. Send commercial information, promotions, news, offers, and content related to ELENATOURS only when the data subject has voluntarily and separately granted authorization for this purpose.

Authorization to receive commercial communications will not be a condition for attending to a request, quote, booking, or service delivery.

  1. PRINCIPLES APPLICABLE TO PROCESSING

ELENATOURS will process personal data in accordance with the principles established in Law 1581 of 2012, especially the principles of:

  • Legality
  • Purpose
  • Freedom
  • Truthfulness or quality.
  • Transparency.
  • Restricted access and circulation.
  • Security
  • Confidentiality.

ELENATOURS will strive to ensure that the data processed is adequate, relevant, up to date, and necessary for the informed purposes.

  1. RIGHTS OF DATA SUBJECTS

In accordance with Law 1581 of 2012, data subjects have the right to:

  1. Know, update, and correct their personal data.
  2. Request proof of the authorization granted, when necessary.
  3. Be informed about the use given to their personal data.
  4. Submit inquiries and complaints related to the processing of their data.
  5. Request the deletion of their personal data when applicable.
  6. Revoke the authorization granted for the processing of their data, when applicable.
  7. Access their personal data free of charge.
  8. File complaints with the Superintendency of Industry and Commerce when they believe applicable personal data protection provisions have been violated.

The exercise of these rights will be subject to the exceptions and limitations established by law, including cases where there is a legal or contractual duty to retain certain information.

  1. AUTHORIZATION OF THE DATA SUBJECT

ELENATOURS will request the data subject's prior, express, and informed authorization for the processing of their personal data when required by applicable regulations.

ELENATOURS' digital forms will include independent mechanisms for:

  1. Authorization for the processing of personal data

The data subject must state that they have read and accept the Personal Data Processing Policy and authorize the processing of their data for the purposes described therein.

  1. Authorization for commercial communications

The data subject may, freely and voluntarily, authorize ELENATOURS to send promotions, offers, news, and commercial information.

This second authorization is independent of the first and is not mandatory in order to request information, obtain a quote, or contract a service.

ELENATOURS will keep, when applicable, evidence of the authorization granted by the data subject.

  1. PROCESSING OF DATA OF CHILDREN AND ADOLESCENTS

ELENATOURS recognizes the special protection that Colombian law provides for the personal data of children and adolescents.

Due to the nature of tourism activity, minors may take part in experiences contracted by their parents or legal guardians.

When it is necessary to process personal data of minors, ELENATOURS will strive to ensure respect for their fundamental rights, their best interests, and the conditions established by applicable law.

Information about minors must be provided by their parents, legal guardians, or whoever has the corresponding legitimacy, when necessary.

ELENATOURS will avoid requesting information about minors that is not necessary for the provision of the service.

  1. SENSITIVE DATA

ELENATOURS will avoid collecting sensitive data that is not necessary for the provision of its services.

When it is exceptionally necessary to process information that may be of a sensitive nature, the data subject will be informed of its nature and of the optional character of providing it, and the corresponding authorization will be requested when required.

ELENATOURS will not make the provision of a service conditional upon the supply of sensitive data that is not necessary for its performance.

  1. TRANSFER AND TRANSMISSION OF DATA TO THIRD PARTIES

ELENATOURS does not sell or rent the personal data of its clients or users.

Personal data may be shared with or made available to suppliers, contractors, partners, or third parties involved in the operation of the requested services, only when necessary to fulfill the purposes established in this policy or when there is a legal obligation to do so.

These third parties may include providers related to:

  • Website hosting and operation services.
  • Email address.
  • Messaging and communication.
  • Form management.
  • Technology systems necessary for operations.
  • Payment processing.
  • Bookings and service management.
  • Administrative, accounting, or billing services.
  • Providers or partners directly linked to a contracted tourism experience.

When applicable, ELENATOURS will strive to ensure that these third parties adopt adequate measures to protect personal information and use the data only for authorized or legally permitted purposes.

Where an international transfer or transmission of personal data occurs, ELENATOURS will observe the conditions and requirements established by applicable Colombian law.

  1. COOKIES AND SIMILAR TECHNOLOGIES

ELENATOURS currently uses only cookies and similar technologies that are necessary for the basic and proper functioning of the website.

At this stage, no analytics, behavioral advertising, or user-tracking tools requiring additional processing of personal information are deliberately incorporated.

If in the future ELENATOURS incorporates tools such as analytics, advertising, measurement, tracking services, or similar technologies involving the use of non-essential cookies, this policy will be reviewed and updated to inform about such tools and, when applicable, to request the required authorization.

  1. INFORMATION SECURITY

ELENATOURS will adopt reasonable technical, human, and administrative measures, in accordance with the nature of the data processed and its operational capabilities, to protect personal information against:

  • Loss
  • Alteration.
  • Unauthorized access.
  • Misuse.
  • Unauthorized disclosure.
  • Unauthorized destruction or processing.

Access to personal information will be limited to persons or providers who need to know it in order to fulfill authorized purposes or corresponding legal obligations.

ELENATOURS will promote the confidential and responsible handling of personal information.

  1. RETENTION OF PERSONAL DATA

ELENATOURS will retain personal data for as long as necessary to fulfill the purposes for which it was collected.

The information may be retained for the additional time necessary to comply with legal, contractual, accounting, tax, or administrative obligations, or to address possible liabilities arising from the relationship with the data subject.

Once the corresponding purposes and obligations have been fulfilled, ELENATOURS will delete, anonymize, or retain the information in accordance with applicable legal provisions and its legitimate retention needs.

  1. PROCEDURE FOR INQUIRIES AND COMPLAINTS

Data subjects, their successors, legal representatives, or duly authorized persons may exercise their rights by sending a request to the following email address:

elenatoursguatape@gmail.com

The request must include, at a minimum:

  • Full name of the data subject.
  • The right they wish to exercise.
  • A clear description of the request.
  • Contact information to receive a response.

When necessary, ELENATOURS may request additional information to verify the requester's identity and ensure that the information is delivered only to those entitled to receive it.

16.1 Inquiries

Inquiries will be addressed within a maximum term of ten (10) business days from the date of receipt.

When it is not possible to address the inquiry within that term, the data subject will be informed before the initial deadline expires, indicating the reasons for the delay and the date on which it will be addressed. The response may not exceed five (5) additional business days.

16.2 Complaints

Complaints related to the correction, updating, or deletion of data, revocation of authorization, or alleged non-compliance with applicable regulations will be addressed within a maximum term of fifteen (15) business days, counted from the day following receipt.

When it is not possible to address the complaint within that term, the data subject will be informed of the reasons for the delay and the date on which it will be addressed. The term may be extended by a maximum of eight (8) additional business days.

  1. NATIONAL DATABASE REGISTRY — RNBD

ELENATOURS is operated by an individual, Doris Elena Rincón Franco.

In accordance with Decree 090 of 2018, individuals are excluded from the obligation to register their databases with the National Database Registry (RNBD) administered by the Superintendency of Industry and Commerce.

This exclusion refers specifically to the registration obligation and does not exempt compliance with the other obligations established in Law 1581 of 2012 and its regulatory provisions.

Should ELENATOURS' legal nature or the conditions determining the registration obligation change, the applicability of this obligation will be reviewed.

  1. MODIFICATIONS AND UPDATES TO THE POLICY

ELENATOURS may modify or update this Personal Data Processing Policy when necessary to reflect changes in:

  • Applicable legislation.
  • ELENATOURS' activities.
  • Data collection channels.
  • Processing purposes.
  • Technologies used.
  • Services offered.
  • Security measures or internal procedures.

Modifications will be published on ELENATOURS' website, indicating the date of the last update.

  1. VALIDITY

This Personal Data Processing Policy takes effect on August 24, 2026, and will remain in force for as long as ELENATOURS processes personal data.

Last updated: August 24, 2026.