Privacy and personal data processing policy

Who we are and what data we collect

1. Data controller

The controller of your personal data is Exploria, the trade name of the commercial establishment EXPLORIIA, a travel and tourism agency listed in the National Tourism Registry (RNT) under No. 288420, identified with NIT 1012457141-7, domiciled in Bogotá D.C., Colombia.

• Email: reservas@exploriia.com
• WhatsApp: +57 320 403 1707
• Website: exploriia.com

2. Scope and acceptance

This policy applies to the processing of the personal data that Exploria collects from travelers, website visitors, operators and other people who interact with the platform and its official channels. It is governed by Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and other Colombian data protection rules.

By using the platform, booking an experience or giving us your data through any channel, you declare that you are aware of and accept this policy. If you do not agree, please do not provide your data.

3. Definitions

• Personal data: any information linked to, or that can be associated with, a specific or identifiable natural person.
• Sensitive data: data that affects privacy or whose misuse may lead to discrimination (health, origin, biometric data, etc.).
• Data subject: the natural person to whom the personal data refers.
• Data controller: Exploria, which decides on the processing of the data.
• Data processor: whoever processes the data on behalf of the controller (for example, the payment gateway or the hosting provider).
• Processing: any operation on the data: collection, storage, use, circulation or deletion.
• Authorization: the prior, express and informed consent of the data subject to process their data.

4. Data we collect

Depending on how you interact with us, we may process:

• Identification and contact data: name, identity document, nationality, date of birth (optional), email address and WhatsApp number.
• Companions’ data: the name and, if you enter it, the identity document of the people traveling with you, to register the departure with the operator.
• Booking data: the experience chosen, date, time, number of people and any notes you decide to leave us (for example, your hotel or an allergy) to provide the service.
• Payment data: what is needed to process the deposit. Payment is made through the certified gateway Wompi (Bancolombia); Exploria does not store your full card details.
• Browsing data: IP address, type of device and browser, pages visited and information collected through cookies and similar technologies.
• Wishlists: if you log in and save experiences, the name of each list, what you saved in it, your notes and the date and number of people for the trip. If you share a list, anyone with the link sees its name, your first name and its experiences, never your notes.
• Communications: the content of your messages via WhatsApp, email or forms, and your reviews or opinions. If you publish a review, your first name, the city you enter, your rating, your text and the date (or, if you rated at exploriia.com/en/calificar, the month of your trip with the label “Traveled with Exploria”) are shown publicly; you can ask us to remove it.
• Review verification: if you rate at exploriia.com/en/calificar, your name and your mobile number, only to confirm that you traveled with Exploria before publishing your review. Your mobile number is never published, and we delete it as soon as we verify your review, whether or not it is approved; of your name, we keep only your first name, which is the one we publish.

5. How we collect it

• Directly from you, when you log in with your email, book, update your details in your account or write to us on WhatsApp or by email. If you book via WhatsApp, by phone or in person, your travel planner records the booking on the platform with the details you give them (name, WhatsApp and, if you share them, your email and your identity document) to manage your trip, include you on the operator’s passenger list and, after the tour, invite you to rate it. If you later log in with that same email, the booking appears in your account.
• Automatically, through cookies and similar technologies when you browse the site (see the Cookie policy).
• From third parties, such as the payment gateway or social networks, when you interact with us through them.

What we use your data for

6. Purposes of processing

We process your data for the following purposes:

• To manage and confirm your bookings and provide the service purchased.
• To process payments and deposits, and to handle refunds where applicable.
• To coordinate the provision of the experience with the partner operator (including sharing the strictly necessary data).
• To give you assistance, support and answers to your PQRS.
• To verify that the reviews we receive at exploriia.com/en/calificar come from people who traveled with Exploria, before publishing them.
• To send you information about your booking and, if you authorize it, news, promotions and recommendations.
• To remember the experiences you viewed and recommend similar plans to you on the site (you can pause or delete this whenever you want).
• Only if you authorize it in the cookie notice: to measure the results of our ads on Facebook and Instagram and show you Exploria ads on those networks, with Meta (see sections 9, 10 and 11).
• To improve the platform, its security and the user experience.
• To comply with legal, accounting and tax obligations, and to respond to requests from the authorities.

7. Data subject’s authorization

The processing of your data requires your prior, express and informed authorization, which you can give by physical or electronic means (for example, by ticking the corresponding box, continuing with a booking or writing to us through our channels). Authorization is not required in the cases exempted by law, such as compliance with legal obligations or requests from the authorities.

You can revoke your authorization at any time, provided there is no legal or contractual duty that prevents it.

8. Sensitive data and data of minors

As a general rule, Exploria does not request sensitive data. If a specific experience required processing some health data (for example, a condition relevant to a water or adventure activity), we will tell you and will only process it with your express authorization; you are not obliged to provide it.

We do not collect data from minors without the consent of their parents or legal guardians. The data of minors is processed in their best interest and with respect for their fundamental rights.

9. Cookies and similar technologies

We use our own cookies: necessary ones (your account session, your booking cart and your choice in the cookie notice) and preference ones (currency, language and region, and the translation of reviews), which are only saved when you choose them. We also use your browser’s storage to remember the experiences you viewed, to instantly show your wishlists while you are logged in (they are saved in your account), and so that you don’t lose what you are choosing or writing. If you log in, what you viewed is also saved in your account so that you can see it on your other devices; you can pause or delete it at any time. Only if you accept them in the cookie notice do we also use Meta’s advertising cookies (Facebook and Instagram): the Meta Pixel, from your browser, and our server, through Meta’s Conversions API, notify Meta that you opened a page, viewed an experience, started a booking, paid the deposit (with its amount) or tapped a link to message us on WhatsApp, along with the page address, Meta’s cookies, your IP address, your browser and, if you are logged in or have paid, your email, your mobile number and your name, hashed (SHA-256). This is how we measure our ads, and Meta can show you Exploria ads. If you don’t accept them, we send nothing to Meta. You can withdraw your authorization whenever you want in “Cookie preferences”, at the bottom of any page, or in Your account › Privacy and recommendations. We do not use analytics tools. Full details are in our Cookie policy.

Who it is shared with and how it is protected

10. Who we share your data with

We do not sell your personal data. We may only share it with those who are needed to provide the service and, if you authorize it, with Meta:

• Partner operators: the data strictly necessary for the operator to provide the experience you booked.
• Payment gateway (Wompi, by Bancolombia): to process the deposit securely.
• Meta Platforms, Inc. (Facebook and Instagram), only if you accept advertising cookies: the information about your visit and your purchase described in section 9, to measure our ads and show you Exploria ads. Meta processes it as a controller for its own purposes, in accordance with its data policy.
• Technology providers: hosting for the site and the database, email delivery (access codes and confirmations), messaging and support tools, which act as data processors under duties of confidentiality and security.
• Authorities: when a rule or a legal requirement demands it.

We require our data processors to process your data only in accordance with our instructions and with appropriate security measures.

11. International transfer

Some of our technology providers may be located outside Colombia. When this involves an international transfer or transmission of data, we adopt the measures required by law to guarantee adequate levels of protection. This is the case with Meta, in the United States, with which we share information only if you accept advertising cookies; by accepting them, you also authorize that transfer.

12. Data retention

We keep your data for as long as necessary to fulfill the purposes described and the applicable legal periods (for example, accounting and tax obligations). When it is no longer needed and there is no duty to keep it, we delete or anonymize it securely. We delete the mobile number you leave when rating at exploriia.com/en/calificar as soon as we verify your review.

13. Information security

We apply reasonable technical, human and administrative measures to protect your data against unauthorized access, loss, alteration or misuse. Card payments are processed through a PCI DSS certified gateway with SSL encryption, the site always runs over an encrypted connection (HTTPS), and access codes and sessions are stored encrypted, never in plain text. No system is completely infallible, but we work to keep your information protected.

Your rights, changes and contact

14. Data subject’s rights

Law 1581 of 2012 recognizes your right, as the data subject, to:

• Know, update and correct your personal data.
• Request proof of the authorization given, except where the law does not require it.
• Be informed about the use made of your data.
• File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the law.
• Revoke the authorization and/or request the deletion of your data where appropriate.
• Access your personal data free of charge.

15. How to exercise your rights

To exercise any of your rights, write to us at reservas@exploriia.com or on WhatsApp at +57 320 403 1707, stating your request and a contact detail.

• Inquiries: we will answer them within a maximum of ten (10) business days; if that is not possible, we will tell you the reasons and the date of the reply, which will not exceed the following five (5) business days.
• Complaints: we will answer them within a maximum of fifteen (15) business days counted from the day after they are received; if that is not possible, we will tell you the reasons and the date of the reply, which will not exceed the following eight (8) business days.

You can also raise your concerns with the Superintendence of Industry and Commerce (SIC), the data protection authority in Colombia.

The full formal procedure, with the legal deadlines for inquiries and complaints, is in our Personal Data Protection Policy.

16. Changes to this policy

We may update this policy to reflect legal or operational changes. The current version will always be the one published on this page, with the date of its last update at the top. We recommend reviewing it periodically.

17. Contact

For any matter related to the processing of your personal data, contact the team in charge at Exploria:

• Email: reservas@exploriia.com
• WhatsApp: +57 320 403 1707
• Hours: Sunday to Saturday, from 6:00 AM to 9:00 PM