Privacy Policy 

• Personal data: Any information concerning or linked to determined or determinable natural persons.

• Data Subject: Natural person whose data is subject to processing.

• Personal database: Organized set of personal data that are subject to processing by a natural or legal person.

• Sensitive data: Personal data that affects the intimacy of the Data Subject and whose incorrect use could generate discrimination. Sensitive data includes, among others, health data, data on sexual orientation, racial and ethnic origin, political opinions, religious, philosophical, or moral convictions.

• Private data: Personal data that, due to its intimate or reserved nature, is relevant to the Data Subject.

• Semi-private data: Personal data known and of interest both to the Data Subject and to a certain sector of people or to society in general, so it is not intimate, reserved, or public.

• Public data: Personal data qualified as such according to the Constitution and the law, and which has not been classified as private or semi-private personal data.

• Data Protection: The right of the Data Subject to demand from the administrators of this data access, inclusion, exclusion, correction, addition, updating, and rectification of the data, as well as the limitation of its disclosure, publication, or transfer.

• Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of personal data.

• Privacy notice: Verbal or written communication addressed to the Data Subjects whose personal data is being processed by the company, informing them about the existence of the personal data processing policies that will be applied to them, the way to access them, and the purposes for which their personal data will be used.

• Data Processor: Natural or legal person, public or private, who by themselves or in association with others, performs the processing of personal data on behalf of the Data Controller.

• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

• Custodian of the databases: Natural person, within the company, who is the custodian of the personal databases.

• Personal data breach: The crime typified in Article 269 of the Penal Code. Which establishes: "Whoever, without being authorized to do so, for their own benefit or that of a third party, obtains, compiles, subtracts, offers, sells, exchanges, sends, buys, intercepts, discloses, modifies, or uses personal codes, personal data contained in files, archives, databases, or similar means, shall incur a prison sentence of forty-eight (48) to ninety-six (96) months and a fine of 100 to 1000 current legal monthly minimum wages."

According to the provisions of Title II of Statutory Law 1581 of 2012, the protection of personal data will be governed by the harmonious and integral application of the following principles:

• Principle of legality in personal data processing: The processing of personal data referred to in Statutory Law 1581 of 2012 is a regulated activity that must be subject to the provisions established therein and in other provisions that develop it.

• Principle of purpose: The processing of personal data must obey a legitimate purpose in accordance with the Constitution and the law, which must be informed to the Data Subject.

• Principle of freedom: The processing of personal data can only be exercised with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.

• Principle of veracity or quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.

• Principle of transparency: In the Processing of personal data, the Data Subject's right to obtain information from the Data Controller or the Data Processor, at any time and without restrictions, regarding the existence of data concerning them must be guaranteed.

• Principle of security: The information subject to processing by the Data Controller or Data Processor referred to in Statutory Law 1581 of 2012 must be handled with the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access.

• Principle of confidentiality: All people involved in the processing of personal data that is not public in nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that comprise the processing, and may only supply or communicate personal data when it corresponds to the development of the activities authorized in Statutory Law 1581 of 2012 and under the terms of the same.

• Principle of restricted access and circulation: The processing is subject to the limits derived from the nature of the personal data, the provisions of Statutory Law 1581 of 2012, and the Constitution. In this sense, processing can only be done by persons authorized by the Data Subject and/or by the persons provided for in the aforementioned law.

• Access the provided data that has been subject to processing free of charge.

• Know, update, and rectify their information regarding partial, inaccurate, incomplete, fragmented data, data that leads to error, or data whose processing is prohibited or has not been authorized.

• Request proof of the authorization granted.

• File complaints with the Superintendency of Industry and Commerce (SIC) for violations of current regulations.

• Revoke the authorization and/or request the deletion of the data, provided there is no legal or contractual duty preventing its elimination.

• Refrain from answering questions about sensitive data. Answers regarding sensitive data or data of children and adolescents are optional.

El Mundo Te Espera Viajes S.A.S. collects, stores, and uses personal data for the following purposes:

• Offer services for travel, tours, experiences, touristic events, and tourism reservations, advising, coaching and resources.

• Offer services for tourism-related business development support, services, equipment, coworking spaces, 

• Offer services for business and corporate events in collaboration with tourism and providers of touristic and cultural tourism products and services.

• Maintain contact with clients, suppliers, and employees for contractual management.

• Carry out market studies, statistical analysis, and satisfaction surveys.

• Send commercial, advertising, or promotional communications related to our services, programs, and projects.

• Comply with legal and contractual obligations.

The consent and authorization from the Data Subject is a constitutional and legal requirement that must be met by those responsible for the processing of personal data. Consent must meet the following requirements:

• Prior: The authorization must be given by the Data Subject prior to any type of personal data Processing.

• Express: The authorization must be granted clearly, unequivocally, and specifically.

• Informed: The Data Subject must clearly understand for what purposes their personal data will be processed and the purposes that may arise from their Processing.

In compliance with personal data protection regulations, El Mundo Te Espera Viajes presents the minimum procedure and requirements for exercising your rights (for the submission and attention of your request, we ask you to provide the following information):

• Full name and surnames, contact information (physical and/or electronic address and contact telephone numbers),

• Means to receive a response to your request, reason(s)/fact(s) that give rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request proof of authorization granted, revoke it, delete, access the information).

• Area of El Mundo Te Espera Viajes to which it is addressed (Customer Service)

• Signature (if applicable) and identification number.

The maximum term provided by law to resolve your claim is fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to address the claim within said term, El Mundo Te Espera Viajes will inform the interested party of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. Once the terms indicated by Law 1581 of 2012 and other regulations that regulate or complement it have been met, the Data Subject whose exercise of the rights of access, updating, rectification, deletion, and revocation is denied, totally or partially, may bring their case to the attention of the Superintendency of Industry and Commerce: Delegate for the Protection of Personal Data.

This Personal Data Data Policy is effective from November 9, 2025.

The databases in which personal data will be registered will have an effectiveness equal to the time the information is maintained and used for the purposes described in this policy.

Once these purpose(s) are met and provided there is no legal or contractual duty to keep your information, your data will be eliminated from our databases.