Personal Data Protection Policy

This English version is provided for convenience only. The legally binding text is the Spanish version, governed by Colombian Law 1581 of 2012 and related regulations.

1. Data Controller

Green Trails S.A.S. (“Green Trails”), a Colombian tour operator registered under RNT 63720 with offices at AC 100 # 17A-36, Bogotá D.C., Colombia, acts as Data Controller for the personal data collected through greentrails.co, contact forms, phone, email, WhatsApp, social media and any other enabled channel.

• Privacy contact: bookings@greentrails.co
• Phone: +57 300 383 2854
• Address: AC 100 # 17A-36, Bogotá D.C., Colombia

2. Legal framework

This Policy complies with Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015 and related regulations governing the general personal-data protection regime, as well as guidance issued by the Superintendence of Industry and Commerce (SIC).

3. Definitions

• Personal data: any information linked or that can be linked to one or several identified or identifiable natural persons.
• Data subject: the natural person whose data is processed.
• Processing: any operation on personal data (collection, storage, use, circulation, deletion).
• Controller: Green Trails, who decides on the database and processing purposes.
• Processor: a third party that processes data on Green Trails’ behalf.
• Sensitive data: data affecting privacy or whose misuse may cause discrimination (health, biometrics, sexual orientation, beliefs, etc.).

4. Personal data collected

Depending on the service requested, we may collect:

• Identification & contact: name, ID/passport number, nationality, date of birth, email, phone, country of residence.
• Booking data: destinations, dates, traveller count, hotel and activity preferences, special requirements.
• Payment data: information needed to process payments via certified gateways; Green Trails does not store full card numbers.
• Sensitive data (exceptional): allergies, dietary restrictions, medical or mobility conditions voluntarily reported for safety and service quality.
• Browsing data: IP address, device identifiers, pages visited, usage metrics and cookies.
• Corporate data (B2B): requester name and contact, company name, position, tax ID and billing data.

5. Purposes

• Handle quotes, reservations and the delivery of tourism services.
• Process payments, invoicing, and accounting/tax obligations.
• Send logistical, itinerary-change and safety communications.
• Commercial and loyalty actions (newsletters, offers, content) with prior consent.
• Manage requests, complaints and suggestions.
• Comply with legal, accounting, tax and AML/CFT obligations.
• Run statistical analysis and improvements to the site and services.
• Share information with suppliers strictly required to deliver the service (hotels, carriers, guides, airlines, booking platforms, payment gateways, marketing tools).

6. Sensitive data and minors

Providing sensitive data is optional. When voluntarily provided (e.g. medical conditions, dietary restrictions), Green Trails will process such data exclusively to ensure traveller safety, health and service quality, retaining it only for the time strictly necessary.

Processing of children’s and adolescents’ data is performed with their best interest in mind and with prior authorisation from their parents or legal representatives, in accordance with Law 1581 of 2012 and Decree 1377 of 2013.

7. Rights of the data subject

Under article 8 of Law 1581 of 2012, the data subject has the right to:

• Know, update and rectify their personal data.
• Request proof of the authorisation granted.
• Be informed, upon request, of the use given to their data.
• File complaints before the SIC for data-protection violations.
• Withdraw authorisation and/or request deletion when applicable.
• Access free of charge to their personal data that has been processed.

8. Procedure to exercise rights

Requests may be sent to bookings@greentrails.co with subject “Habeas Data”, or in writing to our physical address. The request must contain: (i) the subject’s full name and ID; (ii) a clear description of the right being exercised; (iii) contact details; (iv) supporting documents where applicable.

• Queries: answered within ten (10) business days, extendable by five (5).
• Claims: answered within fifteen (15) business days, extendable by eight (8).

9. Data transfers and transmissions

For service delivery, Green Trails may transfer or transmit data to:

• Domestic and international tourism suppliers (hotels, carriers, airlines, cruise lines, guides, local operators, restaurants).
• Technology processors such as cloud infrastructure (Supabase, Google Cloud), email services, payment gateways, booking platforms (including Bokun), analytics (Google Analytics), CRM (HubSpot) and automation services (Zapier).
• Competent authorities when legally required.

Some international transfers may go to countries that the SIC does not deem to provide an adequate level of protection. In such cases, Green Trails adopts the necessary contractual safeguards in line with Decree 1377 of 2013.

10. Security measures

We adopt reasonable technical, human and administrative measures to protect personal data from loss, alteration, unauthorised access or misuse, including HTTPS encryption in transit, user authentication, role-based access control, backups, anti-bot protection and periodic security reviews.

11. Data retention

Personal data is retained for the time required to fulfil the described purposes and applicable legal, accounting and tax obligations. Once that term expires, data is securely deleted or anonymised.

12. Cookies

The site uses first- and third-party cookies for functionality, analytics, personalisation and marketing. Users may configure their browser to reject or delete cookies; doing so may affect the browsing experience.

13. Supervisory authority

Data subjects may file complaints with the Colombian Superintendence of Industry and Commerce (SIC), the data-protection authority, after exhausting the procedure with Green Trails.

14. Validity and changes

This Policy is effective from its publication date and remains in force while Green Trails processes personal data. Substantive changes will be announced on the website at least ten (10) days before they take effect.