Personal data processing policy
Papagayos Tours La Sierra S.A.S. · NIT (tax ID) 901.160.700-1 · Version 1.0, effective September 6, 2026.
Reference translation. The Spanish version is the legally binding one.
In short: we use your data to quote, book and deliver your trip. Marketing communications and the use of your image require separate authorizations. You can access, correct or ask us to delete your data at any time.
1. Identification of the data controller
PAPAGAYOS TOURS LA SIERRA S.A.S., NIT 901.160.700-1, domiciled in Santa Marta, Magdalena, Colombia, hereinafter PAPAGAYOS TOURS, is responsible for processing the personal data it collects, stores, uses, shares, updates or deletes in the course of its activities as a tour operator, lodging provider and provider or coordinator of tourism services.
2. Purpose
This Policy sets out the criteria and rules for processing the personal data of clients, guests, travelers, companions, suppliers, employees, contractors and other data subjects whose data is processed by PAPAGAYOS TOURS, in accordance with applicable Colombian law.
3. Scope
It applies to the physical and digital databases managed by PAPAGAYOS TOURS, including those related to bookings, lodging, excursions, tourist transportation, meals, invoicing, suppliers, customer service, safety and communications.
4. Legal framework
This Policy is adopted mainly under Statutory Law 1581 of 2012, Decree 1074 of 2015 and the other rules, regulations, circulars and provisions applicable to personal data protection in Colombia.
5. Main definitions
For the purposes of this Policy, the legal definitions of data subject, personal data, sensitive data, processing, controller, processor, authorization, database, transfer and transmission apply, among others, in accordance with current Colombian regulations.
6. Principles
PAPAGAYOS TOURS will observe the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality, as well as the other principles established by data protection regulations.
7. Data we may collect
Depending on the service booked and when necessary, we may process data such as first and last names; ID or passport; nationality; date of birth; phone, WhatsApp and email; address; booking, itinerary and companion details; arrival and departure dates; lodging information; billing and payment data; dietary restrictions, allergies, mobility or information needed for safety and emergency care; emergency contact; photos, videos and testimonials when the corresponding authorization exists; and data of suppliers or contractors.
8. International clients
PAPAGAYOS TOURS may serve international clients and process passport, nationality, country of residence, itinerary, booking and other information needed to provide the contracted services and meet legal obligations. Being a foreign national does not remove the data subject's rights under Colombian law. When additional foreign legislation applies due to the circumstances of the processing, PAPAGAYOS TOURS will assess and adopt the appropriate measures.
9. Purposes of processing
Data may be processed to: manage quotes and bookings; provide and coordinate tour packages, lodging, excursions, experiences, transportation and meals; handle changes, cancellations and refunds; invoice and meet accounting, tax and legal obligations; manage insurance and assistance; handle emergencies and safety matters; respond to petitions, complaints and claims; manage suppliers and partners; prevent fraud and protect facilities, people and property; and send marketing communications only when there is authorization or a legal basis to do so.
10. Sensitive data
Sensitive data, including data on health, allergies, mobility, special diets or biometric information where applicable, will only be processed when there is a legal basis and it is necessary for a legitimate purpose, especially safety, proper service delivery or emergency care. Enhanced security and confidentiality measures will apply.
11. Children and adolescents
Data of children and adolescents will be processed respecting their best interests, their fundamental rights and the special rules established by law. Where applicable, the authorization of their legal representative will be requested and collection will be limited to strictly necessary data.
12. Data subject's authorization
When legally required, PAPAGAYOS TOURS will request prior, express and informed authorization to process data. Authorization may be obtained through physical or electronic forms, contracts, bookings, checkboxes or other mechanisms that allow it to be demonstrated. Accepting the Terms and Conditions does not automatically replace the specific authorization for purposes that require separate consent. Authorizations for marketing and for the promotional use of photos or videos are handled independently.
13. Data subjects' rights
Data subjects may access, update and correct their data; request proof of authorization when applicable; know how their data has been used; submit inquiries and claims; request deletion when appropriate; revoke authorization when legally applicable; access their data free of charge under the law; and exercise the other rights recognized by applicable regulations.
14. Inquiries and claims
Data subjects may submit inquiries or claims through the contact channels enabled by PAPAGAYOS TOURS. The request must identify the data subject, clearly describe the request and provide the information needed to process it. PAPAGAYOS TOURS will verify identity when necessary and respond within the legal time frames. Once the process has been completed, the data subject may go to the Superintendence of Industry and Commerce (SIC) when legally applicable.
15. Sharing with third parties
Data may be shared, to the extent strictly necessary, with hotels, guides, transportation companies, partner operators, insurers, booking platforms, technology providers, payment companies, accountants, advisors and competent authorities, when there is a legal or contractual basis or applicable authorization. Third parties acting as processors must meet security, confidentiality and processing obligations under the regulations and the corresponding agreements.
16. International transfers and transmissions
When tourism operations involve booking platforms, technology hosting, email, cloud storage, payments or other providers located outside Colombia, PAPAGAYOS TOURS will manage international data transfers or transmissions in accordance with applicable Colombian rules and, where appropriate, the requirements of applicable foreign law.
17. Information security
PAPAGAYOS TOURS will implement reasonable administrative, technical, human and organizational measures to protect data against loss, alteration, unauthorized access, misuse or disclosure. Access will be limited to staff or suppliers who need it for their duties, and confidentiality obligations will apply.
18. Data retention
Data will be kept for as long as necessary to fulfill the stated purposes, perform contracts, handle claims, meet accounting, tax and legal obligations and exercise rights of defense. After the applicable period, data will be deleted, anonymized or retained when there is a legal obligation to do so.
19. Cookies and similar technologies
If PAPAGAYOS TOURS uses a website, apps or platforms with cookies or similar technologies, they may be used for operation, security, measurement, analytics or marketing, as applicable. When a purpose requires consent, it will be requested through appropriate mechanisms.
20. Photos, videos and testimonials
Taking part in a tourism service does not in itself constitute unlimited authorization to use a person's image for advertising. PAPAGAYOS TOURS will request separate authorization when it intends to use photos, videos or testimonials for promotional or commercial purposes, especially when the use clearly identifies the data subject.
21. Emergency contacts
When an emergency contact is requested, the traveler should make sure they are entitled to provide that person's details. PAPAGAYOS TOURS will use this information mainly for emergencies, safety or service delivery, and not for unauthorized commercial purposes.
22. Data processors
Suppliers that process data on behalf of PAPAGAYOS TOURS may act as data processors. Where applicable, contractual obligations will be established regarding purpose, confidentiality, security, restricted access, retention and handling of incidents and data subject requests.
23. Demonstrated accountability
PAPAGAYOS TOURS will promote measures to demonstrate compliance with its data protection obligations, including internal procedures, access control, training, incident management, supplier review and updating this Policy when necessary.
24. National Database Registry
PAPAGAYOS TOURS will assess and maintain, when legally required, the National Database Registry (RNBD) and the other registration, update or reporting obligations required by the competent authority.
25. Validity and updates
This Policy is effective from its adoption date and will remain in force while PAPAGAYOS TOURS processes personal data. It may be amended when there are legal, technological or operational changes or changes in the purposes of processing. Relevant changes will be communicated through the available channels.
26. Availability
This Policy must be available to data subjects through appropriate physical or electronic means, especially during the quoting, booking, contracting and service delivery processes.
27. Approval
This Policy was adopted by PAPAGAYOS TOURS LA SIERRA S.A.S. in Santa Marta, Magdalena, on September 6, 2026.
28. Contact details to exercise your rights
Email: papagayos@papagayostours.com. Phone / WhatsApp: +57 321 315 3340. Address: Calle 8 # 7-53, Taganga · Santa Marta, Magdalena. Responsible party: Legal Representative of Papagayos Tours La Sierra S.A.S..