Privacy and confidentiality policy
Authorization for the Processing of Personal Data
By providing and voluntarily registering their personal data through the channels enabled on the On Vacation website or via text message, the owner of the personal data authorizes TOUR VACATION HOTELES AZUL SAS BIC, as the data controller, to collect, register, store, use, circulate, manage, update, and delete their data for the following purposes and depending on the registration module:
Receive more promotions , We'll call you, Chat, registration via text message and social networks : Administrative management, reservation management, internal statistics management, marketing, commercial prospecting, conducting studies on consumption habits, preference and purchase interest, customer loyalty, opinion surveys, data update campaigns and information on changes in the processing of personal data, sales and handling of information inquiries.
Reservations : Administrative management, reservation management, customer loyalty, internal statistics management, collection management, billing management, economic and accounting management, marketing, commercial prospecting, studies on consumption habits, preference and purchase interest, opinion surveys, analysis for the control and prevention of fraud and money laundering, including but not limited to the consultation of reports in restricted lists, data update campaigns and information on changes in the processing of personal data, transmission of data within the framework of the contractual relationship to allied companies.
Work with us : Administrative management, personnel management, promotion and selection of personnel, verification of data and references, carrying out pre-employment or entry medical examinations, data update campaigns and information on changes in the processing of personal data, marketing and commercial prospecting.
Support and Complaints, Claims, Suggestions, and Requests (PQRSD), Online Appointments : Handling requests, complaints, claims, suggestions or compliments within the framework of statutory laws 1755 of 2015 and 1581 of 2012, as well as the consumer statute regulated through Law 1480 of 2011, reservation management, data update campaigns and information on changes in the processing of personal data, marketing and commercial prospecting.
Promotional or special campaign forms : Reservation management, customer loyalty, internal statistics management, marketing, commercial prospecting, studies on consumption habits, preference and purchase interest, opinion surveys, data update campaigns and information on changes in the processing of personal data, participation in special benefits to be effective in accommodation plans or complete packages (accommodation, tickets, food) in accordance with the terms and conditions of the campaign through which the registration of personal data is carried out.
Internet access form for hotel facilities : Administrative management, enabling permissions for internet access in hotel facilities, keeping a connection record for security purposes, information systems administration, user administration, internal statistics management, marketing, commercial prospecting, customer loyalty, opinion surveys, data update campaigns and information on changes in the processing of personal data, sales and handling of information inquiries.
Rights of Data Subjects : Data subjects may exercise the following rights through the website https://servicioalcliente.onvacation.com/ :
Access free of charge to the data provided that has been processed.
Request updating and rectification of your information in the face of partial, inaccurate, incomplete, fragmented data, data that induces error, or data whose processing is prohibited or has not been authorized.
Request proof of the authorization granted.
To file complaints with the Superintendency of Industry and Commerce (SIC) for violations of the provisions of current regulations, once the consultation or claim process before the data controller has been exhausted.
Revoke authorization and/or request the deletion of the data, unless there is a legal or contractual duty that makes it imperative to retain the information.
Answering questions about sensitive data or data about girls, boys and adolescents is optional.
The video surveillance policy and information processing policy, as well as any substantial changes to them, can be consulted through the website https://www.onvacation.com/
Provisions
TOUR VACATION HOTELES AZUL SAS BIC with address in the city of BOGOTÁ at Calle 100 # 7 A -81 Floor 6 Telephone: 601 3908484 who for the purposes of these policies will be called the company and its website https://www.onvacation.com/ which from this moment on will be called “the portal” makes known the policies of use, privacy, processing and confidentiality of personal data, which apply to all users, clients and natural persons who have provided their personal data, who are the owners of personal data that has been acquired by the company by virtue of commercial agreements, conventions, cooperations and/or alliances, who use the portal in any way, who acquire any product or service with the company through any existing channel, in which the rights that users and/or clients have to know, update and rectify the information that iscopIlen about them in databases or files and the right to information.
The company and its portal may request personal data and any information linked to or that may be associated with users and/or clients from users and/or clients, always referring to it as personal data, but sensitive data is not requested, nor is any data of that nature included in the records.
Taking into account the Privacy policies, by using, accessing, or registering in any other way and by continuing to browse the portal or by providing their Data and information, users and/or clients express their authorization and express consent for the company to carry out the processing of the personal data and information provided.
Information processing
The information and data provided by reservation holders is primarily intended to provide tourist services, as well as to offer products and services, send promotions, and for general processing related to this, and also for the following purposes:
To establish fluid, current, and repeated communication regarding services, products, promotions, programming, and everything related to the company's purpose. To carry out marketing, promotional, and/or advertising activities, whether for ourselves or third parties, on a recurring basis; sales; invoicing; collection management; payment processing; scheduling; market research; service improvement; verifications and inquiries; monitoring; customer behavior and habits; enabling payment methods; fraud prevention; and any other activity related to current and future products and services, for the fulfillment of contractual obligations and the company's purpose. Users and/or clients expressly authorize these communications to be sent through any means of communication, including virtual platforms, social media, email, voice, SMS, and any other method developed for the mass or personalized distribution of information.
To evaluate the quality of products and services, and to conduct studies on consumption habits, preferences, purchase intent, product testing, concept testing, service evaluation, satisfaction, and other aspects related to services and products. To take all necessary steps to fulfill the obligations inherent to the services and products contracted with the company. To comply with the obligations undertaken with clients, users, suppliers, partners, subsidiaries, distributors, subcontractors, outsourcing providers, and other public and/or private third parties directly or indirectly related to the company's business purpose.
To inform you about changes to products and services related to the company's ordinary course of business. The data provided by the reservation holder may be processed, collected, stored, used, circulated, deleted, shared, updated, and transmitted, in accordance with the terms and conditions of the Privacy Policies mentioned above, as applicable, primarily to enable the provision of its services, for reporting to regulatory and supervisory authorities, and also for administrative, commercial, advertising, and contact purposes with the data subjects.
The data subject, once he has granted the corresponding express and prior authorization, empowers TOUR VACATION HOTELES AZUL SAS BIC, or whoever represents his rights, to consult, request, supply, report, process and disclose all information that refers to his credit, financial, commercial, and service behavior to the different risk centers or financial behavior consultation mechanisms in Colombia or in a different country.
TOUR VACATION HOTELES AZUL SAS BIC may provide the personal contact details of reservation holders to the airlines, so that the air transport operators can contact them to notify them of any changes, updates or adjustments to flight itineraries.
TOUR VACATION HOTELES AZUL SAS BIC may transfer or share the personal contact data of the owners with allied companies, in order to send them commercial information of all types of products and services through emails, data messages and telephone calls.
On this website, as a fundamental security principle, the privacy of data and information is paramount. Therefore, this information will only be used to provide better service to our clients, tailored to their interests and needs. For this reason, physical, electronic, and administrative security measures have been designed and implemented to protect the information that is shared.copIn accordance with the Privacy Policy, these security measures are frequently reviewed to protect against unauthorized access, viewing, or use, alteration, loss, disclosure, and misuse of your information, and to maintain the accuracy and integrity of that information.
Payment information is used to request payment authorization from the relevant entities. Therefore, information provided on the portal by users and/or clients, such as personal data, card numbers, and expiration dates, is never stored or recorded. Confidentiality agreements are signed for any transfer of this type of information to a third party or authorized entity, and users and/or clients authorize this processing.
Due to the security measures applicable to the portal, no information related to credit and/or debit cards, or any other electronic means of payment, will ever be stored or saved. Therefore, the user and/or client is obligated to enter all the data relating to the card or means of payment that they will use, each time they make a transaction on the portal.
The information provided by the user and/or client to access and use the portal will not be disclosed in any way by the portal or the company. However, the user and/or client expressly authorizes the company to carry out any legal processing, commercial use, development, communication, as well as to share, assign, and transfer the information and personal data with any third-party entity or company that is in charge of or responsible for processing data and information, extending to them the express authorization granted by the data subject to carry out the processing of personal data.
Personal Data Protection Officer
It is the natural person who assumes the function of coordinating the implementation of the legal framework in the protection of personal data, who supervises the processing of requests from the Holders, for the exercise of the rights referred to in Law 1581 of 2012 designated by the Habeas Data Committee of the company.
Area in charge of Requests, Inquiries and Claims of Personal Data
The area responsible for handling requests, inquiries and complaints from reservation holders to exercise their rights to know, update, rectify and delete their data and revoke their authorization is the Customer Service (SAC).
Means to Exercise the Rights of Access, Withdrawal and Rectification of Personal Data
The client and/or user has the right at any time to revoke the authorization for the processing of data and/or request the deletion, updating, rectification and access to their data authorized for processing, by contacting us through the website https://servicioalcliente.onvacation.com/ . Tour Vacation Hoteles Azul SASBIC will respond to the request within the period stipulated by Law 1581 of 2012. When it is not possible to address the inquiry within said period, the client will be notified promptly, stating the reasons for the delay and indicating the date on which it will be addressed.
Please note that a request for removal or deletion will not be processed when there is a contractual or legal obligation to maintain the information in our database, as is the case with outstanding receivables.
The client and/or user has the right to authorize the communication channel through which they wish to be contacted, in accordance with the provisions of Law 2300 of 2023.
Procedure to Exercise Your Rights as a Data Subject
The law has defined two ways to exercise rights; the first being consultations and the second being claims.
Inquiries will be answered within a maximum of ten (10) business days from the date of receipt of this.
When it is not possible to address the query within said term, the interested party will be informed of the reasons, indicating the new date on which their query will be resolved, which will not be more than five (5) business days following the expiration of the first term.
Claims will be addressed within a maximum of fifteen (15) business days, starting from the day after the date of receipt. Tour Vacation Hoteles Azul SAS BIC may extend the response time in special cases by notifying the interested party. This new period will not exceed eight (8) business days.
If it is not possible to address the inquiry within that period, you will be notified in due course, stating the reasons for the delay and indicating the date on which it will be addressed.
Please note that a request for removal or deletion will not be processed when there is a contractual or legal obligation to maintain the information in our database, as is the case with outstanding receivables.
All of the above channels have trained personnel to perform their functions, as well as the necessary control systems so that the updates to personal information requested by users are documented and can be verified.
However, it should be noted that Tour Vacation Hoteles Azul SAS BIC will only send personal data for the purpose of the inquiry or complaint to the following persons:
To the data subject, their successors or their legal representatives, provided that they prove this status as mentioned in the definitions section of this document.
To persons authorized by the data subject.
To persons authorized by court or legal order.
In this last case, one must consider what the Constitutional Court said in ruling C-748 of 2011 regarding requests for information from public or administrative entities:
The public or administrative entity must justify its request by indicating the link between the need to obtain the data and the fulfillment of its constitutional or legal functions.
Secondly, with the delivery of the information, the public or administrative entity will be informed that it has the duty to comply with the obligations and requirements imposed on it by Law 1581 of 2012, as the data controller, or in charge in certain cases.
The receiving administrative entity must comply with all legal mandates that exist on the subject at the time of receipt of the information, especially the principles of – purpose – legitimate use – restricted circulation – confidentiality and – security.
Following established channels is the way to a prompt response.
Data subjects may access, update, and correct their personal information held in the databases of Tour Vacation Hoteles Azul SAS BIC
The procedures for exercising the rights of data subjects are established in each of the processing policies that are embedded in the Comprehensive Data Management Program; however, it is noted that the terms for their response will begin to count from the moment Tour Vacation Hoteles Azul SAS BIC has effective knowledge of the data subject's request, if the request was received through the established channels.
Requirements for Inquiries and Claims Regarding Personal Data
Regardless of the channel the holder chooses to submit their request, it must be addressed to Tour Vacation Hoteles Azul SAS BIC and include at least the following items:
Contain the identification of the Holder (name and identification document).
Include a description of the events that gave rise to the inquiry or complaint.
The object of the request.
Specify the Holder's notification address, either physical or electronic (e-mail).
Attach the documents you wish to use as evidence. (Especially for claims)
In the event that the inquiry or complaint is submitted in person, the holder must put their request or complaint in writing without any formality other than the requirements demanded in the previous point.
If the holder considers that the response does not satisfy their needs, they have a period of fifteen (15) business days from the receipt of this to request that it be re-evaluated in cases where it has been unfavorable to their interests.
Third Party Authorizations
The data subject must provide Tour Vacation Hoteles Azul SAS BIC, either physically or via a previously registered email address, with the necessary authorization to allow a third party to consult, update, or correct their information. This requirement is solely for the purpose of protecting and restricting access to the information by unauthorized third parties.
This authorization must contain at least the following:
Identification of the authorizing holder
Copia of the holder's national identity card
Name and identification details of the authorized person.
Time period for which you can consult, update or correct the information (only once, for one year, for the duration of the legal relationship, or until further notice, etc.).
Voluntary and free nature of the authorization.
Authorization Confirmation
In accordance with the foregoing and having the authorization granted by the client and/or user for the processing of data and information, this authorization empowers the company to use the information received and entered by the user and/or client for marketing, statistical, survey, and customer service purposes related to its own affiliated or linked products, in order to offer services, offers, and promotions tailored to their profile. This includes sharing the information provided to third parties, suppliers, affiliates, etc., as appropriate for registration purposes. These third parties, suppliers, affiliates, etc., will be subject to confidentiality agreements that prohibit the disclosure or unauthorized use of the information provided. Notwithstanding the foregoing, the authorization granted herein by the client and/or user extends to these third parties, suppliers, affiliates, etc., and may be revoked at any time by providing written notification. We may use the email address(es) included in the database to contact you, reference you, send you offers, advertising, surveys, etc., regarding new services, promotions, suppliers, or to send you electronic communications or messages, unless you inform us that you do not wish to receive them. The user and/or client consents to the portal exchanging, reproducing, obtaining, processing, transferring, disposing of, etc., the data and information of registered users and/or clients with third parties, their establishments, companies, and/or affiliated and/or participating and/or related entities, so that these third parties may offer products and/or services to the users and/or clients.
The treatment provided by the company and its website ensures respect for the prevailing rights of children and adolescents.
Confidentiality of Information
The data provided by the user and/or client is protected by security measures designed to guarantee the confidentiality of the information within the systems, employing the most secure technology possible. This confidentiality will be maintained even after the termination of the relationship that encompasses the processing of the data.
Rights of Users and/or Clients
Data subjects (users and/or clients) have the right to know, update, and rectify their personal data. This right may be exercised, among other things, with respect to data that is partial, inaccurate, incomplete, fragmented, misleading, or whose processing is expressly prohibited or has not been authorized. Data subjects may request proof of the authorization granted to the Data Controller, notwithstanding this authorization in accordance with the acceptance and application of the privacy and confidentiality policies. Data subjects have the right to be informed by the Data Controller regarding the use of their personal data. Data subjects may file complaints related to the handling of personal data with the appropriate entities. Data subjects may revoke their authorization and/or request the deletion of their data when it is being processed. Data subjects have the right to access their personal data that has been processed, free of charge.
The others established in the Law
These rights can be exercised at any of the service points or through the national line or any suitable means of direct communication to the company or through the portal.
Acceptance and Application of the Privacy and Confidentiality Policies
Any user and/or client who accesses or uses the portal's services and/or makes use of any other type of product or service offered by the portal and/or the company through any existing or different channel or mechanism, accepts and is bound by the privacy and confidentiality policies established on the portal. This constitutes a legal agreement between the client and/or user and the company, and it is understood that these terms and conditions are expressly accepted and that the user agrees to them, as their consent is express and informed. Likewise, acceptance implies that the user and/or client authorizes the company and/or the portal to process their personal data.
This privacy and confidentiality policy for personal data came into effect on February 22, 2013 and the database of the company TOUR VACATION HOTELES AZUL SAS BIC will be valid for Ten (10) Years counted from February 22, 2013, a period that will be automatically renewed unless there is a request from the data subject to proceed with its deletion.
Privacy Policy
Tour Vacation Hoteles Azul SAS BIC and its affiliated companies, in compliance with Law 1581 of 2012 and its regulatory decrees, through this Privacy Notice informs the owners of personal data about the conditions and the treatment to which the data stored in our databases will be subjected:
Data Controller: Tour Vacation Hoteles Azul SAS BIC, a company domiciled in the city of Bogotá DC, at Calle 100 # 7 A -81 Floor 6, is responsible for the processing of your personal data.
Treatment and purpose of the collection of personal data: Tour Vacation Hoteles Azul SAS BIC informs users, employees, visitors, suppliers, and clients that the collection, registration, storage, use, circulation, administration, updating, and deletion of data taken by our staff and video surveillance cameras (content stored on specialized recording devices under security measures) is intended to keep a record of entry to the establishment's facilities, in compliance with the company's administrative management and for strictly security reasons, to carry out internal statistics management, marketing, commercial prospecting, conduct studies on consumption habits, purchase preferences and interest, customer loyalty, opinion surveys, sales, and handling information inquiries.
Rights of Data Subjects: Data subjects may exercise the following rights through the website https://servicioalcliente.onvacation.com/ :
Access free of charge to the data provided that has been processed.
Request updating and rectification of your information in the face of partial, inaccurate, incomplete, fragmented data, data that induces error, or data whose processing is prohibited or has not been authorized.
Request proof of the authorization granted.
To file complaints with the Superintendency of Industry and Commerce (SIC) for violations of the provisions of current regulations, once the consultation or claim process before the data controller has been exhausted.
Revoke authorization and/or request the deletion of the data, unless there is a legal or contractual duty that makes it imperative to retain the information.
Answering questions about sensitive data or data about girls, boys and adolescents is optional.
The video surveillance policy and information processing policy, as well as any substantial changes to them, can be consulted through the website https://www.onvacation.com/
On Vacation – Push Notifications: Notice and Authorization for Data Processing
ANNEX / ADDITIONAL CLAUSE – AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA AND TECHNICAL DATA OF THE DEVICE FOR SENDING PUSH NOTIFICATIONS (APP “ON VACATION”)
By downloading, installing, registering, and/or using the “On Vacation” mobile application (the “App”), and especially by enabling notification permissions in the device's operating system, the user (hereinafter the “Data Subject”) declares that they have read and understood this clause and grants their prior, express, and informed authorization to TOUR VACATION HOTELES AZUL SAS BIC (hereinafter, the “Company”), identified as the Data Controller, located in Bogotá DC, Calle 100 # 7 A – 81, Floor 6, telephone 601 3908484, to collect, register, store, use, circulate, transmit, transfer, update, and delete personal data and technical data associated with the use of the App, exclusively for the purposes described in this clause and in accordance with the current Personal Data Processing Policy, available at onvacation.com, in the customer service channel https://servicioalcliente.onvacation.com/
This authorization is granted within the framework of the constitutional right of habeas data and the Colombian personal data protection regime, and is governed by the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security, and confidentiality. The Company undertakes to process the data for legitimate and informed purposes and to implement reasonable measures to protect the information against unauthorized access, loss, alteration, or improper disclosure.
SPECIFIC PURPOSE (PUSH NOTIFICATIONS AND SERVICE-RELATED COMMUNICATIONS). The Data Subject authorizes the Company to use their data to enable and manage the sending of “push” notifications from the App, including: (i) transactional or operational notifications related to reservations, confirmations, reminders, service updates, relevant changes to itineraries or service conditions, customer service and complaint communications, and security or service continuity notices; (ii) informational notifications about App functionalities and commercial or promotional notifications; and (iii) when the Data Subject optionally enables it, commercial or promotional notifications related to the Company's products, services, benefits, or campaigns, in accordance with the preferences selected by the Data Subject.
For the aforementioned purposes, the Data Subject understands and accepts that the Company may process, as personal data or data associated with an identifiable person, the following categories: (a) notification or messaging identifiers (“notification tokens”) necessary to route and deliver push notifications to the device; (b) technical data of the device and the App (for example: operating system and version, device model, language, time zone, App version, notification permission status, and technical logs of events/errors related to sending or receiving notifications); (c) usage metadata associated with messaging (date and time of generation, sending, or technical delivery confirmation, and technical diagnostic parameters); and (d) when the Data Subject registers or has an account, identification data and
The Company will not use contact information provided by the User (e.g., name, email address, phone number, or other information necessary to associate the device token with their account and send operational notifications related to the service). For the sole purpose of push notifications described in this clause, the Company does not require access to the User's photos, files, contacts, microphone, camera, call logs, or SMS messages. If, in the future, the App requires additional permissions for different functionalities, the Company will inform the User of the specific purpose and request the corresponding permissions or authorizations separately.
TECHNOLOGY PROVIDERS, PROCESSORS, AND INTERNATIONAL PROCESSING. The Data Subject understands that sending push notifications may involve the use of technology providers and messaging platforms (including notification routing and delivery services) acting as Processors or authorized recipients, and that, due to the nature of the technological infrastructure, processing may involve the transmission and/or transfer of data, including internationally, to data centers or servers located outside of Colombia. In such cases, the Company will adopt reasonable contractual and organizational measures to require these third parties to comply with obligations of confidentiality, security, use limited to the authorized purposes, and, where applicable, the legal standards required for international transmissions/transfers, ensuring that the level of protection is no less than that required by Colombian regulations.
DATA SUBJECT CONTROL, CHANNELS, AND PREFERENCES. The Data Subject acknowledges that push notifications depend on (i) acceptance of this agreement and the Data Processing Policy; and (ii) enabling notification permissions in the device's operating system. The Data Subject may disable push notifications at any time through the device settings or the App's options, when available. When the Data Subject enables commercial or promotional notifications, they may modify their preferences and/or revoke their authorization for such communications at any time, without affecting the receipt of notifications strictly necessary for the performance of the contracted service, provided there is an active contractual relationship or a legal obligation to inform. Where relevant and applicable, the Company will respect the Data Subject's choice of authorized contact channels in accordance with current regulations on consumer privacy protection in contact communications.
DATA SUBJECT RIGHTS AND CHANNELS FOR EXERCISING THEM. Data Subjects may exercise their rights to know, access, update, rectify, request proof of authorization, revoke authorization, and/or request the deletion of their data, after first contacting the Company. To do so, Data Subjects may submit requests, inquiries, or complaints through the Customer Service channel (SAC) and the portal https://servicioalcliente.onvacation.com/, or through other channels that the Company makes available and specifies in its Data Processing Policy. The Company will process requests within the applicable legal timeframes and will retain evidence of the process for auditing and compliance purposes.
RETENTION AND DELETION. The Company will retain notification tokens and associated technical data only for as long as necessary to fulfill the purposes described, maintain the notification operation, and comply with legal/contractual obligations or requests from authorities. If the Data Subject disables notifications or revokes their authorization for promotional purposes, the Company will proceed to disassociate, delete, or
Anonymize the token and/or preferences when technically and operationally possible, unless there is a legal or contractual obligation to retain certain information for a specific period.
SECURITY AND LIMITED EXEMPTION FROM THIRD-PARTY FAILURES. The Company will implement reasonable security measures (technical, administrative, and organizational) to protect information. However, the Data Subject understands that the effective and timely delivery of push notifications may be affected by factors beyond the Company's control (for example: operating system restrictions, user settings, connectivity, messaging provider availability, app store policies, or device failures). Consequently, the Company does not guarantee the continuous availability or real-time delivery of all notifications and will not be liable for delays or failures attributable solely to such external factors, without prejudice to any legally non-waivable liabilities.
DATA OF CHILDREN AND ADOLESCENTS AND SENSITIVE DATA. The Data Subject declares that the information provided is truthful and that they have the necessary legal authority to grant authorizations when acting on behalf of third parties. The Company does not request sensitive data for the purpose of push notifications described herein. If, due to the nature of the service, information pertaining to minors is involved, the Company will observe the best interests of the child and applicable legal requirements, including obtaining authorizations from the legal representative when necessary.
CONTRACTUAL INTEGRATION. This clause forms an integral part of the App download/use agreement and shall be interpreted in accordance with the Company's Personal Data Processing Policy. In case of discrepancy, the provision that provides greater protection to the Data Subject shall prevail, without prejudice to applicable legal or contractual obligations.
