PRELIMINARY ASPECTS
ANDES DOMESTIQUE, mindful of the importance that personal data has for its owners and of the responsibility it assumes in handling such data as a consequence of its information‑processing activities in furtherance of its corporate purpose, makes this Personal Data Processing Policy available to interested parties in compliance with Article 13 of Decree 1377 of 2013.
1. CONTACT INFORMATION
Further to Section 7, ANDES DOMESTIQUE S.A.S., for all legal purposes, acts as the DATA CONTROLLER of the personal information that comprises the ANDES DOMESTIQUE DATABASE. The company is domiciled in Medellín, Colombia, with its principal place of business at Calle 5 #76A 201, Apartment 1601. Telephone: +57 (604) 322 05 89. Email: colombia@andesdomestique.com.
2. PURPOSE
This document regulates the activities related to the processing of personal data contained in the ANDES DOMESTIQUE DATABASE, primarily with respect to its purposes, the rights of DATA SUBJECTS, the commitments assumed by ANDES DOMESTIQUE as Data Controller, and the mechanisms adopted so that DATA SUBJECTS can properly exercise their rights.
3. LEGAL FRAMEWORK
For situations not regulated by this POLICY FOR THE PROCESSING OF INFORMATION – ANDES DOMESTIQUE DATABASE, the provisions of Laws 1581 of 2012 and 1266 of 2008 and Regulatory Decrees 1377 of 2013 and 1727 of 2009 shall apply as relevant.
4. DEFINITIONS
Authorization: Prior, express, and informed consent issued by the Data Subject or their legal representative to subject their data to processing activities.
Database: The organized set of personal data subject to processing.
Personal Data: Any information linked or that may be associated with one or more identified or identifiable persons that comprises the ANDES DOMESTIQUE DATABASE.
Private Data: Data that, by its intimate or reserved nature, is only relevant to the Data Subject.
Public Data: Data that is not semi‑private, private, or sensitive. Public data includes, among others, information relating to civil status, profession or trade, and status as a merchant or public servant.
Semi‑private Data: Data that is neither intimate nor public and whose knowledge or disclosure may be of interest not only to its Data Subject but also to a certain sector or group of people.
Sensitive Data: Data that affects the personal privacy of the Data Subject or whose improper use may lead to discrimination.
Processor: A natural or legal person who, after entering into a contract with ANDES DOMESTIQUE, performs personal data processing activities on its behalf.
Controller: For all legal purposes, ANDES DOMESTIQUE is the Data Controller as a result of its decision‑making power over the database and the processing carried out on the data it comprises.
Data Subject: A natural or legal person whose data, being subject to processing, forms part of the ANDES DOMESTIQUE DATABASE.
Processing: Any operation or set of operations that ANDES DOMESTIQUE performs on the personal data that make up the ANDES DOMESTIQUE DATABASE, such as collection, storage, use, circulation, or deletion.
5. PRINCIPLES GOVERNING INFORMATION PROCESSING
Principle of Legality: Throughout all stages and activities of information processing by ANDES DOMESTIQUE or any appointed PROCESSOR, the provisions of this Policy and the rules described in Section 3, as amended or supplemented, shall apply.
Principle of Purpose: Only activities related to the purposes set out in Section 9 shall be performed when processing personal data in the ANDES DOMESTIQUE DATABASE.
Principle of Freedom: Processing activities will be carried out only when the Data Subject has issued prior and/or express authorization for such purpose, except for cases where, under Article 10 of Law 1581 of 2012, authorization is not required. This does not prevent the Data Subject from requesting deletion at any time, as provided in Section 16(f).
Principle of Veracity or Quality: ANDES DOMESTIQUE undertakes to ensure that the information in its database is truthful, complete, exact, up‑to‑date, verifiable, and understandable; accordingly, it will refrain from processing partial, incomplete, fragmented, or misleading data. To this end, mechanisms are provided in Sections 17, 18, and 19 for correction, updating, or deletion at any time.
Principle of Transparency: ANDES DOMESTIQUE has adopted appropriate mechanisms to guarantee that the DATA SUBJECT may obtain, at any time and without restrictions, information regarding the existence of data concerning them.
Principle of Restricted Access and Circulation: Access to the ANDES DOMESTIQUE DATABASE is restricted to specialized personnel previously trained to handle this type of information. ANDES DOMESTIQUE does not publish personal data on the internet or other mass media.
Principle of Security: ANDES DOMESTIQUE has adopted technical, human, and administrative measures, consistent with the nature of the data processed, to prevent alteration, loss, consultation, use, or access by unauthorized persons.
Principle of Confidentiality: ANDES DOMESTIQUE has adopted a protocol that guarantees Data Subjects that those involved in processing their personal data will maintain confidentiality over such information, even after the processing activity or their contractual relationship with the company has ended.
DATA PROCESSING
6. AUTHORIZATION
Processing activities regulated by this Policy will be carried out exclusively on personal data for which the Data Subjects have issued their prior, express, and informed authorization.
Notwithstanding the foregoing, ANDES DOMESTIQUE reserves the right to process information for which no authorization is required under applicable law, in which case the commitments set out in this Policy remain in force.
By expressly accepting this Policy in advance, DATA SUBJECTS AUTHORIZE the processing of their personal data by ANDES DOMESTIQUE in accordance with the purposes, processing activities, and other conditions set forth herein and in line with current regulations.
If the Data Subject is a minor, the authorization and provision of information must be given by the minor’s parents, guardians, or legal representatives.
Data collected by ANDES DOMESTIQUE: ANDES DOMESTIQUE keeps copies of the authorizations issued by the Data Subject and of the communications sent under Article 10 of Decree 1377 of 2013 with respect to the data it collected.
Data provided by third parties: In addition to personal data collected directly from the DATA SUBJECT, ANDES DOMESTIQUE frequently obtains personal data from databases supplied by third parties who have previously obtained authorization from the DATA SUBJECTS.
7. LEVEL OF INTERVENTION
For all legal purposes related to personal data processing and pursuant to Section 13 of this Policy and Articles 17 and 18 of Law 1581 of 2012, ANDES DOMESTIQUE is deemed the Data Controller of personal information, with all legal consequences. That is, ANDES DOMESTIQUE S.A.S. is the sole party that decides on the processing to which personal data in the ANDES DOMESTIQUE DATABASE will be subjected and is the party that carries out the processing activities without third‑party intervention.
Notwithstanding the foregoing, ANDES DOMESTIQUE reserves the right to delegate certain processing activities to a third party to be performed on its behalf, in which case such third party shall observe the commitments set out in Section 15 of this Policy.
8. ANDES DOMESTIQUE DATABASE
The ANDES DOMESTIQUE DATABASE refers to the set of personal data stored systematically in accordance with the purposes described in Section 9 and the processing activities carried out thereon as provided in Section 10.
The ANDES DOMESTIQUE DATABASE is composed mainly of identification document number, first and last name, email, telephone, country, region, postal code, and address, all of which are pertinent and adequate for the purposes of processing.
9. PURPOSE OF PROCESSING
ANDES DOMESTIQUE is a company professionally engaged, among others, in the operation of tourism plans and travel agency activities. For the development of its corporate purpose, ANDES DOMESTIQUE collects certain personal data from (i) clients, (ii) prospective clients, (iii) suppliers, (iv) prospective suppliers, (v) employees or contact persons of its clients, (vi) employees or contact persons of its suppliers, and (vii) employees or contact persons of its prospective suppliers. It also needs to collect and process data of (viii) employees; (ix) prospective employees; (x) shareholders and/or (xi) prospective shareholders or investors.
For the effective development of such activities, ANDES DOMESTIQUE requires collecting, storing, using, and in general performing activities related to the processing of personal data that allow it to interact with the Data Subjects, meet its contractual obligations, verify the performance of obligations in its favor, and properly conduct activities related to its corporate purpose. Consequently, the purposes of processing the personal data in the ANDES DOMESTIQUE DATABASE are as follows:
General purposes of processing activities:
Establish communication channels with Data Subjects related to the activities described above.
Send newsletters and corporate information that ANDES DOMESTIQUE deems of interest to the DATA SUBJECT.
Evaluate the quality of services provided.
Evaluate the quality of services and products received.
Fulfill obligations related to the execution of ANDES DOMESTIQUE’s corporate purpose, within and outside the national territory.
Monitor compliance with obligations by CLIENTS.
Create “users” when necessary for the operation of applications or similar tools.
Carry out marketing and advertising activities related to ANDES DOMESTIQUE’s corporate purpose.
Purposes for processing financial, credit, commercial, and service‑related data:
As an element of analysis to establish and/or maintain contractual relationships.
As an element of analysis to evaluate risks arising from current contractual relationships.
As an element of analysis for market studies or commercial or statistical research.
Specific purposes according to the nature of the relationship with the DATA SUBJECT:
Users and clients:
Offer and provide our products and services.
Provide support in resolving issues or correcting any failure in our service.
Carry out archiving, updating, storage, and processing of information by ourselves or through third parties contracted for that purpose.
Offer loyalty programs.
Inform you of the existence of new products and services, our own and those of third parties.
Define, analyze, and optimize current and future products and services, our own and those of third parties.
Manage information on credit risks and the control and prevention of money laundering.
Conduct statistical analysis of data collected to optimize service performance.
Guarantee the effectiveness and security of transactions carried out through ANDES DOMESTIQUE’s Website or Web Application.
Fully perform contracts or transactions entered into with subscribers, clients, and users, in accordance with their purposes to offer ANDES DOMESTIQUE’s products and/or services.
Supplement information and, in general, undertake the activities necessary to manage requests, complaints, and claims submitted by users and third parties and route them to the areas responsible for issuing the relevant responses.
Send information and commercial offers regarding ANDES DOMESTIQUE’s services, as well as carry out marketing and/or commercialization of products and/or services that it provides or may provide or offer.
Prepare market studies, statistics, surveys, analysis of market trends, and satisfaction surveys regarding ANDES DOMESTIQUE’s products or services.
Transmit personal data to third parties with whom agreements have been executed in order to perform and fulfill the product and/or service offered through ANDES DOMESTIQUE for commercial, administrative, and/or operational purposes.
Manage all information necessary to comply with tax obligations and commercial, corporate, and accounting records.
Identify users when they access our Websites.
Proceed with billing and collection for the product and/or service.
Share Personal Data with service companies or outsourcing providers that help improve or facilitate operations through ANDES DOMESTIQUE, including payment methods, insurance or payment‑processing intermediaries, transportation and courier companies, advertising agencies, among others.
Carry out the transmission or transfer of data to third‑party legal or natural persons.
Investigate, prevent, or act in cases of illegal activities, suspected fraud, situations involving the physical safety of any person, violations of our Terms of Service, or any other case required by law.
Perform contracts executed with contractors, principals, or third parties.
Contact for commercial purposes or for collection management by telephone calls, emails, and visits within the hours and frequency authorized by the applicable regulations.
Suppliers:
Perform executed contracts.
Carry out selection, hiring, and other commercial activities necessary to develop the relationship with the supplier.
Carry out collection management through telephone calls, emails, and visits within the hours and frequency authorized by law.
Report to credit bureaus and perform searches in control lists.
Share Personal Data with service companies or outsourcing providers that help improve or facilitate operations through ANDES DOMESTIQUE, including payment methods, insurance or payment‑processing intermediaries, transportation and courier companies, advertising agencies, among others.
Employees:
Perform executed contracts.
Carry out personnel selection processes, hiring, and other human resources activities of the company.
Shareholders:
Carry out the administrative, financial, accounting, legal, and other actions required in their capacity as shareholders.
10. PROCESSING ACTIVITIES
ANDES DOMESTIQUE collects, stores, uses, transmits, and, in general, performs activities related to the processing of personal data within the framework of contracting processes, execution, and verification of the fulfillment of various contractual obligations, and the other purposes described in the previous section.
11. PROCESSING OF SENSITIVE PERSONAL DATA
Given the purposes of data processing described in Section 9, ANDES DOMESTIQUE recognizes that the data processed are not of a sensitive nature; that is, they do not affect the personal privacy of the Data Subject or give rise to prejudicial attitudes.
12. PROCESSING OF MINORS’ DATA
Our products and services are intended primarily for adults; however, there may be brand activities or events in which minors participate. Therefore, whenever personal data of minors are to be processed, such data must be provided through their parents, guardians, or legal representatives, as must the express authorization for its processing.
COMMITMENTS TO DATA SUBJECTS
13. COMMITMENTS
Guarantee the Data Subject, at all times, the full and effective exercise of habeas data rights.
Request authorization from the Data Subject in cases where, under a legal provision, such authorization is required.
Retain a copy of the authorization issued by the Data Subject when necessary.
Duly inform the Data Subject about the purpose of data collection.
Duly inform the Data Subject of the rights to which they are entitled by virtue of their status as such.
Maintain the information under the necessary security conditions to prevent alteration, loss, consultation, use, or unauthorized or fraudulent access.
Ensure that the information subject to processing is truthful, complete, exact, up‑to‑date, verifiable, and understandable.
Rectify information when it is incorrect or biased.
Process inquiries and claims submitted by Data Subjects within the time limits set by law.
Allow access to personal information only to persons who, according to legal provisions, may have access to it.
Adopt an internal procedures manual to ensure the proper processing of personal data.
Inform the Data Subject, upon request, about the use given to their data.
Inform the Delegate Superintendent for Personal Data Protection, or its successor, when security code violations occur and there are risks in the administration of Data Subjects’ information.
14. SPECIAL COMMITMENTS
In the case of information subject to dispute before an administrative or judicial authority, or that is the subject of a claim by the Data Subject, or whose blocking has been ordered by the competent authority, ANDES DOMESTIQUE undertakes to take all pertinent measures to prevent such information from continuing to be processed—except for storage—until a final decision is made.
15. THIRD‑PARTY COMMITMENTS
Guarantee the Data Subject the full and effective exercise of habeas data rights.
Maintain the information under the necessary security conditions to prevent alteration, loss, consultation, use, or unauthorized or fraudulent access.
Timely carry out the updating, rectification, or deletion of data when required by ANDES DOMESTIQUE or directly by the Data Subject.
Process requests submitted by Data Subjects aimed at obtaining the proper processing of their personal data.
In cases of information under dispute before an administrative or judicial authority, or subject to a claim by the Data Subject, or whose blocking has been ordered by the competent authority, take all pertinent measures to prevent such information from continuing to be processed—except for storage—until a final decision is made.
Allow access to information only to those persons who may have access to it.
Inform the Delegate Superintendent for Personal Data Protection, or its successor, when security code violations occur and there are risks in the administration of Data Subjects’ information.
RIGHTS OF DATA SUBJECTS
16. RIGHTS OF DATA SUBJECTS
Access: The Data Subject may request, at any time and free of charge, information about the data that is being handled by ANDES DOMESTIQUE and the use given to such data.
Rectification: The Data Subject may request, at any time, the correction of inaccurate information contained in the ANDES DOMESTIQUE DATABASE.
Updating: The Data Subject may request that, for reasons other than data correction, the information contained in the ANDES DOMESTIQUE DATABASE be complete and up‑to‑date; accordingly, they may request the inclusion or deletion of any information they consider pertinent.
Copy of Authorization: When authorization from the Data Subject is required for processing under Section 6 and Article 10 of Law 1581 of 2012, the Data Subject may request, at any time and free of charge, a copy of the authorization issued.
Revocation: When authorization is required under Section 6 and Article 10 of Law 1581 of 2012, the Data Subject may revoke, at any time, the authorization granted.
Deletion: The Data Subject may request at any time the deletion of data contained in the ANDES DOMESTIQUE DATABASE, provided there is no legal or contractual duty requiring retention.
PROCEDURES FOR THE EFFECTIVE EXERCISE OF RIGHTS
17. GENERAL ASPECTS
ANDES DOMESTIQUE has adopted internal procedures for the proper processing of personal information and for the exercise of the rights of DATA SUBJECTS recognized in Section 16. These procedures vary depending on the right exercised by the Data Subject, as set out in Sections 18 and 19 below.
18. INQUIRIES
For the exercise of the rights of access, knowledge, and obtaining a copy of the authorization set forth in Section 16(a) and 16(d), DATA SUBJECTS or persons with standing under Section 20 may submit inquiries to the responsible area indicated in Section 21, observing the following rules:
Mechanisms: Inquiries must be submitted in writing to the ANDES DOMESTIQUE DATA PROTECTION DEPARTMENT via email at colombia@andesdomestique.com or by mail to Calle 5 #76A 201, Apartment 1601, by persons with standing as per Section 20. The request must briefly describe the information to which access is sought, include a correspondence address and identification details, and attach documents proving standing when the requester is not the Data Subject.
Processing: Upon receipt, the responsible area will respond, where possible, within ten (10) business days counted from the date of receipt. If it is not possible to respond within this period, the requester will be informed of the reasons for the delay and the date on which the request will be resolved, which in no case shall exceed five (5) additional business days.
Response: The area responsible for personal data processing matters will reply in writing to the physical or electronic address provided by the requester. If both a physical and an electronic address are provided, or more than one of either is provided, ANDES DOMESTIQUE may, at its sole discretion, choose the address to which the response will be sent.
19. REQUESTS (PETITIONS)
For the exercise of the rights of rectification, updating, revocation of authorization, and deletion of information set forth in Sections 16(b), (c), (e), and (f), DATA SUBJECTS or persons with standing under Section 20 may submit requests to the responsible area indicated in Section 21, observing the following rules:
Mechanisms: Requests must be submitted in writing to the ANDES DOMESTIQUE DATA PROTECTION DEPARTMENT via email at colombia@andesdomestique.com or by mail to Calle 5 #76A 201, Apartment 1601, by persons with standing as per Section 20. The request must briefly describe the facts giving rise to the petition, include a correspondence address and identification details, and attach supporting documents and evidence of standing when the requester is not the Data Subject.
Processing
Incomplete request
If ANDES DOMESTIQUE considers that the request submitted by the Data Subject or a person with standing under Section 20 is incomplete for failing to meet the requirements set out above, within five (5) business days following receipt, the interested party will be asked to correct the deficiencies.
If two (2) months elapse from the date of the request for correction without the interested party submitting the required information, it will be understood that the claim has been withdrawn, without prejudice to filing a new request on the same matter, in which case the terms will be counted from the new submission.
Complete request
Once a complete claim is received or the deficiencies have been corrected within the term indicated above, a note will be added to the ANDES DOMESTIQUE DATABASE stating “claim in process” and the reason for it, within a period not exceeding two (2) business days. This note will remain until the claim is decided.
Without prejudice to the foregoing, the responsible area will resolve the request, where possible, within fifteen (15) business days from the date of receipt.
If it is not possible to address the request within the indicated period, the Data Subject will be informed of the reasons for the delay and the date on which the request will be resolved, which in no case shall exceed eight (8) additional business days.
Decision
The ANDES DOMESTIQUE PERSONAL DATA PROTECTION DEPARTMENT will respond to requests within the periods established above, in writing to the physical or electronic address provided by the requester. If both a physical and an electronic address are provided, or more than one of either is provided, ANDES DOMESTIQUE may, at its discretion, choose the address to which the response will be sent.
20. STANDING
The rights established in Section 16 and other rights recognized by law may be exercised by the Data Subject, their successors, and persons authorized by any of them. In the latter two cases, the capacity for which recognition is sought must be evidenced through appropriate means.
21. COMPETENT AREA
For all matters related to personal data processing activities, handling of inquiries, and requests, ANDES DOMESTIQUE has designated the DATA PROTECTION DEPARTMENT as the competent area, adopting technical, human, and administrative measures that ensure the confidentiality and security of information.
FINAL PROVISIONS
22. TERM OF EFFECTIVENESS
This Policy is effective as of June 15, 2014, and will remain in force for as long as ANDES DOMESTIQUE carries out the activities described in Section 10 and such activities remain aligned with the purposes that inspired this Policy.
Material changes to the Processing Policy that may affect the content of the authorization—primarily those related to the identification of ANDES DOMESTIQUE and/or the purpose of processing personal data—will be communicated to Data Subjects in an efficient manner prior to implementing the new policies.
Personal Data that is stored, used, or transmitted will remain in the ANDES DOMESTIQUE DATABASE for the time necessary to fulfill the purposes mentioned in this Policy for which it was collected. Accordingly, the term of effectiveness of the database is closely related to the purposes for which personal data was collected, unless rules require retention for additional periods.
23. NATIONAL DATA PROTECTION AUTHORITY
Protecting the personal data of DATA SUBJECTS whose information forms part of the ANDES DOMESTIQUE DATABASE, ANDES DOMESTIQUE makes available to the general public information regarding the Delegation for Personal Data Protection of the Superintendence of Industry and Commerce, the competent national authority that oversees processing activities carried out in Colombia, which can be consulted at: http://www.sic.gov.co/proteccion-de-datos-personales