Personal Data Processing Policy
1. Data controller
Espontáneos Travel SAS · NIT 902.056.513 · National Tourism Registry 91795 · Armenia, Quindío, Colombia.
Email: info@espontaneostravel.com · WhatsApp: +57 318 720 0023.
2. Data we process
- Contact and identification: name, email, phone or WhatsApp and, to confirm bookings, the passengers' identity documents.
- Trip details: experiences of interest, dates, number of people, accommodation or area, preferred language.
- Preferences you choose to share: dietary restrictions or accessibility needs. Some of this data may be sensitive: providing it is optional and we only use it to adapt the service.
- Partner agencies (DMC): contact details of the agency and of its portal users (name, email, company, NIT or tax ID).
- Image: photos and videos in which you appear, taken during the experiences. We only publish them if you authorise it (see Terms, section 8).
- Browsing: the site stores in your own browser the language, the light/dark theme and, until 7 days after your trip, the link to your latest itinerary (you can delete it by clearing the site data in your browser). We do not use advertising cookies or analytics tools.
3. Purposes
- Answering your enquiries, preparing quotes, and managing and confirming bookings.
- Communicating with you via WhatsApp, phone or email before and during the trip, and providing you with the concierge service (itinerary, reminders and recommendations).
- Coordinating with the providers involved in your experience (guides, transport providers, hosts and accommodations), sharing only the necessary information.
- Complying with legal and accounting obligations.
- Compiling internal statistics (for example, which channel or partner a request came from).
- Sending you information about experiences and promotions, only if you expressly authorise it.
- Publishing photos and videos in which you appear on our site, social media and promotional material, only if you authorise it; you can withdraw that authorisation at any time.
4. Data processors and data transfers
To provide the service we use technology providers that may store data outside Colombia, such as Meta (WhatsApp), Google (email, spreadsheets and the Firebase / Google Cloud database, where we store requests, customers and bookings) and form-submission services. We require them to process the data only for the purposes described here.
To work, the site also loads third-party resources that receive technical data about your connection (IP address and browser), without your contact details: Google Fonts (only one typeface in the agency portal; the rest of the site uses its own fonts), the unpkg and jsDelivr content delivery networks (libraries for the map and the QR reader), OpenStreetMap (map images), Open-Meteo (weather forecast: it receives the area and date of the trip, not your name), FormSubmit (it sends to our email what you write in the contact form, the details you give Jenny, our assistant, when you accept this policy, and requests for access to the agency portal) and Google Maps if you open a route. QR codes are generated in your browser, without being sent to third parties.
The partner agencies and operators (DMC) that use our private portal may record data about their own travellers to manage bookings; each agency only sees its own customers' information and is responsible for obtaining their authorisation.
5. Your rights as data subject
- To know, update and rectify your data.
- To request proof of the authorisation granted.
- To be informed about how we use it.
- To revoke the authorisation and request the deletion of your data when there is no legal or contractual duty to keep it.
- To access your data free of charge.
- To file complaints with the Superintendence of Industry and Commerce (SIC).
6. Enquiries and claims
Write to us at info@espontaneostravel.com stating your name, your request and a means of contact. We answer enquiries within a maximum of 10 business days and claims within a maximum of 15 business days, extendable under the terms of Law 1581 of 2012 (Articles 14 and 15).
7. Children and adolescents
We only process data of minors with the authorisation of their legal representative, when it is necessary for the trip and respecting their best interests.
🛡️ Espontáneos Travel rejects the sexual exploitation and abuse of children and adolescents (ESCNNA). Law 679 of 2001 and Law 1336 of 2009.
8. Security and retention
We apply reasonable measures to protect your data and keep it for as long as it is necessary for the purposes described and to comply with legal obligations.
9. Validity and changes
This policy is effective from its publication. If we change it, we will publish the new version on this page.