Personal Data Processing and Protection Policy International Tourism Group S.A.S.
Introduction
INTERNATIONAL TOURISM GROUP S.A.S., in the course of its tourism activities under the brands Citysightseeing Cartagena and Local Expert Cartagena, collects, uses, stores, and protects personal data of its clients, employees, suppliers, and third parties in Colombia. This personal data processing and protection policy complies with Law 1581 of 2012 and Decree 1377 of 2013, which regulate personal data protection in Colombia. It ensures the proper handling of such information, including sensitive data such as credit card details.
Purpose
The purpose of this policy is to guarantee the protection and proper management of personal data collected by the company, providing transparency regarding the purposes of processing, the security measures implemented, and the rights of data subjects.
Scope
This policy applies to all personal and financial information collected, used, stored, or processed by INTERNATIONAL TOURISM GROUP S.A.S., in any city in Colombia, within the framework of its tourism activities through the brands Citysightseeing Cartagena and Local Expert Cartagena.
Definitions
a) Personal Data: Information that identifies or can identify a natural person.
b) Sensitive Data: Information that affects the privacy of the data subject, or whose misuse may cause discrimination.
c) Financial Data: Information related to bank accounts, credit cards, or any other means of payment.
d) Processing: Any operation carried out on personal data, such as collection, storage, use, or deletion.
Principles of Data Processing
The processing of personal data by INTERNATIONAL TOURISM GROUP S.A.S. will be carried out under the following principles:
a) Purpose: Data will only be used for the specific purposes previously communicated to the data subject.
b) Freedom: Data collection is carried out with the prior, express, and informed consent of the data subject.
c) Security: Data will be protected with technical, physical, and administrative measures that guarantee its security and confidentiality.
d) Confidentiality: Access to the data is restricted to authorized personnel, and the information will not be shared without the consent of the data subject, unless legally required.
Purposes of Data Processing
Personal data will be processed for the following purposes:
Provide the contracted tourism services.
Manage reservations, payments, and invoicing, including handling credit card data through secure payment gateways.
Offer additional products and services, promotions, and satisfaction surveys.
Comply with legal and contractual obligations.
Processing of Credit Card Data
Clients’ credit card data will be collected and processed exclusively through certified payment gateways, in accordance with PCI DSS (Payment Card Industry Data Security Standard). The Company will not store credit card information once the payment process has been completed.
Rights of Data Subjects
According to Law 1581 of 2012, data subjects have the following rights:
a) To know, update, and rectify their personal data.
b) To revoke authorization for the processing of their personal data.
c) To request the deletion of their personal data, when there is no legal obligation to retain it.
d) To file complaints before the Superintendence of Industry and Commerce for breaches of data protection regulations.
Procedures for Exercising Rights
Data subjects may exercise their rights by sending a request to the following emails: customer.care@citysightseeing.com.co or info@localexpertcartagena.com. The Company will respond to requests within the timeframes established by law, not exceeding 10 business days.
Security Measures
INTERNATIONAL TOURISM GROUP S.A.S. implements the necessary technical and organizational measures to ensure the security of personal and financial data, including the use of encryption technologies and restricted access procedures.
Validity of the Policy
This policy is effective from the date of its publication and will remain in force for as long as the databases managed by the Company exist.
