Personal Data Protection Policy

Framework, controller and definitions

1. Purpose and legal framework

This Personal Data Protection Policy (the “Policy”) sets out the guidelines, principles and procedures that Exploria applies to the processing of the personal data it collects in the course of its activity as a platform that intermediates between travelers and verified local operators.

It is issued in compliance with article 15 of the Political Constitution, Statutory Law 1581 of 2012, Decree 1377 of 2013 and other rules that regulate, amend or replace them (compiled in Decree 1074 of 2015). Its purpose is to guarantee the right of data subjects to know, update, correct and delete their information, and to know the use made of their data.

2. Data controller

The data controller is Exploria, the trade name of the commercial establishment EXPLORIIA, a travel and tourism agency listed in the National Tourism Registry (RNT) under No. 288420, identified with NIT 1012457141-7, domiciled in Bogotá D.C., Colombia.

The team responsible for handling petitions, inquiries and complaints about personal data (habeas data) can be contacted as follows:

• Email: reservas@exploriia.com
• WhatsApp: +57 320 403 1707
• Hours: Sunday to Saturday, from 6:00 AM to 9:00 PM

3. Definitions

In accordance with Law 1581 of 2012 and Decree 1377 of 2013:

• Authorization: the data subject’s prior, express and informed consent to process their personal data.
• Privacy notice: a communication made available to the data subject to inform them about the processing of their data and how to access this Policy.
• Database: an organized set of personal data subject to processing.
• Personal data: information linked to, or that can be associated with, one or more specific or identifiable natural persons.
• Public, private, semi-private and sensitive data: categories of data according to their degree of confidentiality; sensitive data affects privacy or may lead to discrimination.
• Data processor: whoever processes data on behalf of the controller.
• Data controller: whoever decides on the database and its processing (Exploria).
• Data subject: the natural person whose data is being processed.
• Transmission: the processing of data by a processor on behalf of the controller.
• Transfer: the sending of data to a recipient that is itself a controller, inside or outside the country.
• Processing: any operation on data: collection, storage, use, circulation or deletion.

4. Scope

This Policy applies to all the personal data recorded in the databases for which Exploria is the controller, and involves those who interact with the platform, mainly:

• Travelers and visitors to the website and the official channels.
• Partner operators who provide the experiences.
• Suppliers, business partners and contacts in general.

5. Processing principles

All data processing at Exploria is governed by the principles of Law 1581 of 2012:

• Legality: processing is subject to the law.
• Purpose: it serves a legitimate purpose, communicated to the data subject.
• Freedom: it requires the data subject’s prior, express and informed consent.
• Truthfulness or quality: the information is truthful, complete, accurate and up to date.
• Transparency: the data subject can obtain information about their data.
• Restricted access and circulation: processing is limited to the authorized purposes.
• Security: measures are applied to protect the data.
• Confidentiality: those involved in the processing keep the information confidential.

The data and its processing

6. Data we process and data subjects

Depending on the relationship with each data subject, Exploria may process:

• For travelers: identification and contact data, booking data, data needed to pay the deposit and browsing data.
• For partner operators: identification, contact details, information about the activity and data needed to settle payments.
• For visitors: browsing data collected through cookies and similar technologies (see the Cookie policy).

The details of the data and its origin are described in our Privacy policy.

7. Purposes of processing

As a platform that connects travelers with verified operators, Exploria acts as an intermediary and processes data to:

• Manage bookings and confirmations, and coordinate the provision of the experience with the partner operators.
• Process the payment of the deposit through the gateway and handle refunds where applicable.
• Share with the partner operator the data strictly necessary for them to provide the booked service.
• Provide assistance and support and process PQRS.
• Send information about the booking and, with your authorization, news and promotions.
• Improve the platform and the user experience.
• Prevent fraud and guarantee the security of transactions and of the platform.
• Comply with legal, accounting, tax and tourism-activity obligations, and respond to requests from the authorities.

We do not use analytics tools. Only with your authorization, which is given in the site’s cookie notice, do we share with Meta (Facebook and Instagram) the information about your visit and your purchase described in the Privacy policy, to measure our ads and show you Exploria ads; you can withdraw it whenever you want in “Cookie preferences”.

8. Data subject’s authorization

Processing requires the data subject’s prior, express and informed authorization, which Exploria obtains by physical or electronic means: by ticking acceptance boxes, continuing with a booking, creating an account, subscribing to communications or writing through our channels. The authorization is recorded as evidence.

Authorization is not required in the cases exempted by law (for example, data of a public nature, medical or health emergencies, requests from a public or administrative entity in the exercise of its functions, or a court order).

The data subject may revoke the authorization and/or request the deletion of their data when there is no legal or contractual duty that prevents it.

9. Privacy notice

When it is not possible to make this Policy available to the data subject at the time of collection, Exploria will use a privacy notice that, at a minimum, will state: the identity and contact details of the controller, the purposes of the processing, the rights of the data subject and the means to access this Policy. Accepting the notice or continuing to use the platform will be understood as authorization for the processing in accordance with the stated purposes.

10. Sensitive data and data of minors

The processing of sensitive data is prohibited, except in the cases authorized by law and always with the data subject’s explicit authorization; they are not obliged to provide such data. As a general rule, Exploria does not request sensitive data; if a specific experience required some health data relevant to the safety of the activity, this will be communicated and it will only be processed with express authorization and for that purpose.

The data of children and adolescents is processed in their best interest and with respect for their fundamental rights. We do not collect data from minors without the consent of their parents or legal guardians.

Duties, processors and security

11. Exploria’s duties as controller

As the controller, Exploria assumes, among others, the duties set out in article 17 of Law 1581 of 2012:

• To guarantee the data subject the full exercise of their rights.
• To request and keep proof of the authorization given.
• To report the use made of the data when the data subject requests it.
• To keep the information under security conditions that prevent tampering, loss, or unauthorized or fraudulent consultation, use or access.
• To update, correct or delete the information when appropriate, and to process inquiries and complaints within the legal terms.
• To require data processors to respect the conditions of security and confidentiality.
• To inform the authority when there are breaches of the security codes and risks in the management of the information.

12. Processors, transmission and third parties

To operate the platform, Exploria relies on data processors that process data on its behalf and under its instructions, such as the payment gateway and the hosting, email, messaging and support providers. The data transmission agreements required by law are signed with them, with duties of security and confidentiality.

Likewise, as an intermediary, Exploria shares with the partner operator who will provide the experience the data strictly necessary to carry out the booking. We do not sell personal data. It is only given to third parties when necessary for the stated purpose or when required by a rule or an authority.

13. International transfer and transmission

Some data processors (for example, technology providers) may process data outside Colombia. When an international transfer or transmission requires it, Exploria adopts the measures required by law to guarantee adequate levels of protection, in accordance with the standards of the Superintendence of Industry and Commerce.

14. Information security

Exploria applies reasonable technical, human and administrative measures to protect data against unauthorized access, loss, alteration or misuse. Card payments are processed through a PCI DSS certified gateway with SSL encryption, and Exploria does not store your full card details. No system is completely infallible, but we work constantly to keep your information protected.

Your rights, retention and validity

15. Data subject’s rights

Law 1581 of 2012 recognizes your right, as a data subject, to:

• Know, update and correct your data.
• Request proof of the authorization given, except where the law does not require it.
• Be informed about the use made of your data.
• File complaints with the Superintendence of Industry and Commerce (SIC).
• Revoke the authorization and/or request deletion where appropriate.
• Access your personal data free of charge.

16. Procedure for inquiries and complaints

To exercise your rights, send your request to reservas@exploriia.com or via WhatsApp to +57 320 403 1707, stating your name, a contact detail, a description of your request and any documents you wish to rely on.

• Inquiries: they are answered within a maximum of ten (10) business days of receipt. If that is not possible, the data subject will be told the reasons and the date of the reply, which will not exceed the following five (5) business days.
• Complaints: they are answered within a maximum of fifteen (15) business days from the day after they are received. If that is not possible, the data subject will be told the reasons and the date of the reply, which will not exceed the following eight (8) business days. If the complaint is incomplete, within the five (5) days following its receipt the data subject will be asked to complete it; if two (2) months pass without them doing so, they will be deemed to have withdrawn the complaint.

The data subject may turn to the Superintendence of Industry and Commerce (SIC) once the procedure with Exploria has been exhausted, in accordance with the law.

17. Database validity and retention

Data is kept for as long as necessary to fulfill the purposes of the processing and the applicable legal periods (for example, accounting, tax and tourism-activity obligations). When it is no longer needed and there is no duty to keep it, it is deleted or anonymized securely. The databases will remain in force for as long as Exploria carries out its business purpose and those purposes are fulfilled.

18. Database registration

The Superintendence of Industry and Commerce manages the National Database Registry (RNBD). Exploria fulfills the registration and reporting obligations that apply to it according to its nature and current regulations, without prejudice to full compliance with Law 1581 of 2012 for all of its databases.

19. Validity and changes

This Policy is effective from its publication and may be updated to reflect legal or operational changes. The current version will always be the one published on this page, with the date of its last update at the top. Substantial changes that affect the purposes of the processing will be communicated through the usual channels before they apply.

20. Contact and acceptance

For any matter related to the processing of your personal data, contact the team in charge at Exploria:

• Email: reservas@exploriia.com
• WhatsApp: +57 320 403 1707

By providing your personal data and accepting this Policy, you authorize Exploria to process it in accordance with the purposes described here.