Personal Data Processing Policy

1. GENERAL DATA OF BESPOKE COLOMBIA SAS AS THE CONTROLLER OF INFORMATION PROCESSING.

Name: Bespoke Colombia SAS

NIT: 806.015.606-2

Address: Carrera 7 Second Badillo Street #36-125 Cartagena de Indias.

Email: info@bespokecolombia.com

Phone: 660-1344



2. GENERALITIES.

For BESPOKE COLOMBIA SAS, it is important to ensure that the processing of personal data provided to it, or collected from its customers, suppliers, and collaborators, through the various marketing channels for our products and services (such as the website, email, phone calls, third-party distribution channels), is carried out in accordance with applicable regulations, for the established purposes and objectives, with adequate security and confidentiality. In all cases, data collection will be carried out with the owner's authorization, and the processing of their data will be subject to the law and these policies.



3. REGULATORY FRAMEWORK.

Data and information will be processed within the applicable regulatory framework, adhering at all times to the provisions of the Colombian Political Constitution, Law 1581 of 2012, Decree 1377 of 2013, and other applicable regulations and rules.



4. GENERAL PRINCIPLES.

In order to guarantee the collection and use of personal data, as well as its use, processing, sharing, transfer, and transmission, it will always be guided by the principles of legality, freedom, truthfulness, transparency, security, confidentiality, and the principle of access and restricted circulation.



5. LEGAL DEFINITIONS.

In accordance with Law 1581 of 2012 and Decree 1377 of 2013, the following definitions shall govern the policies for the processing of personal information:


Authorization: Prior, express, and informed consent of the data subject to carry out the processing of personal data.


Database: Organized set of personal data that is the object of processing.


Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons.


Data Processor: A data processor is a natural or legal person, public or private, who, either alone or in association with others, processes personal data on behalf of the data controller.


Data Controller: The data controller is the natural or legal person, public or private, who, either alone or in association with others, decides on the database and/or the processing of data.


Sensitive data: Sensitive data is understood to mean data that affects the privacy of the data subject or whose improper use may lead to discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations, or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.


Public data: Data that is not semi-private, private, or sensitive. Public data includes, among others, data relating to a person's marital status, their profession or occupation, and their status as a merchant or public servant. By its nature, public data may be contained in, among other things, public registries, public documents, official gazettes and bulletins, and duly enforceable court rulings that are not subject to confidentiality.


Data subject: Natural person whose personal data is being processed.


Transfer: Data transfer occurs when the controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient, who is in turn the controller and is located within or outside the country.

Transmission: Processing of personal data that involves communicating the same within or outside the territory of the Republic of Colombia when the purpose is to carry out processing by the data processor on behalf of the controller.


Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.


6. AUTHORIZATION OF THE HOLDER.

The data provided will be subject to authorized processing, which must be granted in advance, expressly, and with prior notice by the data subject. BESPOKE COLOMBIA SAS will request authorization from the data and information subject to collect and process the data, indicating the purpose and intended use of the data and information collected.


The visit, entry or use of the various marketing channels for our products and services (such as website, email, phone calls, third-party distribution channels, website) constitutes in itself prior, express and informed authorization for the storage, collection and processing of the information provided, in accordance with this data processing policy.


Data collection will be limited in all cases to personal data that is relevant and appropriate for the purpose pursued.


Authorization may be given through technical means that facilitate automated authorization by the holder, when expressed in writing, orally, or through unequivocal conduct by the holder that allows a reasonable conclusion to be drawn that authorization was granted, without silence being equated with unequivocal conduct, in accordance with the provisions of Article 7 of Decree 1377 of 2013.




7. INFORMATION PROCESSING.

The information collected is used to confirm, fulfill and provide the services acquired, directly and/or with the participation of third-party service providers, as well as to promote and advertise our activities, products and services, carry out transactions, make reports to the different national or international administrative control and surveillance authorities, police authorities or judicial authorities, banking entities and/or insurance companies, for internal administrative and/or commercial purposes such as market research, audits, accounting reports, statistical analysis, billing, and offering and/or recognition of benefits inherent to our loyalty programs.


By accepting this Privacy and Data Processing Policy, our clients, collaborators, suppliers and guests, in their capacity as owners of the data collected, authorize BESPOKE COLOMBIA SAS to process such data, in whole or in part, including the collection, storage, recording, use, circulation, processing, deletion, for the execution of activities related to the services acquired, such as making reservations, modifications, cancellations and changes to the same, refunds, attention to queries, complaints and claims, payment of compensation and indemnities, accounting records, correspondence, processing and verification of credit cards, debit cards and other payment instruments, identification of fraud and prevention of money laundering and other criminal activities and/or for the operation of loyalty programs and other purposes indicated in this document.


The foregoing is without prejudice to any other purposes that may have been disclosed in this document and in the terms and conditions of each of the services we offer.


We advise that third-party providers (such as reservation system providers, travel agencies, call centers, banks, and insurance companies) may be involved in these activities.


7.1. Data collected.

Data collection for the development of the Processing and the purposes pursued will be based on the personal data received and stored on the occasion of or in the development of the different relationships with our clients, suppliers and collaborators, and will include all the information supplied or provided through the various marketing channels of our products and services (such as website, email, phone calls, third-party distribution channels).

Without prejudice to the fact that in some cases this may involve public data, the information collected and processed will be as follows:


  • First and last names.
  • Type and identification number.
  • Nationality and country of residence.
  • Date of birth and gender.
  • Marital status and/or relationship with minors or disabled persons requesting our services.
  • Landline and cell phone contact numbers (personal and/or work).
  • Postal and electronic addresses (personal and/or work).
  • Profession or trade
  • Company where you work.
  • Origin and destination
  • Reason for your trip
  • Credit card information (number, bank, expiration date).
  • Cardholder's personal data (first and last names, type and identification number).
  • Information about the address where the cardholder receives their bank statements.



7.2. Processing to which the data will be subjected and its purpose.

The data and information obtained will be used by BESPOKE COLOMBIA SAS for the normal development of its activities and commercial relations solely for the purposes established in these information processing policies, to maintain direct and effective communication with its clients, suppliers and collaborators, which allows the execution and development of existing commercial relations and legal ties.



7.3. Sensitive data and data corresponding to children and adolescents.

BESPOKE COLOMBIA SAS will ensure the appropriate use of the personal data of minors, guaranteeing that their best interests and fundamental rights are respected in the processing of their data, and, to the extent possible, taking into account their opinions as the owners of their personal data.

The processing of images of children and/or adolescents must observe the following rules:

  • Obtain the authorization of the minors' parents or legal guardians and their acquiescence, taking into account their maturity, autonomy, and ability to understand the matter.
  • Inform parents or legal guardians about the purpose and processing of minors' personal data, as well as their rights.
  • Limit the collection and other processing of images to what is proportional and appropriate in consideration of the previously reported purpose.
  • Ensure the security and confidentiality of minors' personal data.
  • Restrict access to and circulation of images, in accordance with the law.



7.4. Facility security (videos and biometric data)

The purpose is to accurately determine the identity of the people who enter the premises of the commercial establishments of BESPOKE COLOMBIA SAS, for security reasons of the different people, suppliers and employees who enter the commercial establishments of BESPOKE COLOMBIA SAS.



People entering BESPOKE COLOMBIA SAS commercial establishments, whether through the main door or the garage, will be informed at the entrance by placing the legend "For security purposes, the activities carried out in the common areas within the establishment, you are being recorded and monitored by closed-circuit television. In accordance with current Habeas Data regulations, by entering the establishment you authorize BESPOKE COLOMBIA SAS to store the data collected. Our data processing policy is published on the website www.bespokecolombia.com."



7.5. Duties of the data controller.

Without prejudice to other provisions set forth in the law, decrees or other applicable regulations, BESPOKE COLOMBIA SAS as the party responsible for the information undertakes to:


  1. Guarantee the holder, at all times, the full and effective exercise of the right to habeas data.
  2. Request and retain, under the conditions provided for in Law 1581 of 2012, a copy of the respective authorization granted by the owner.
  3. Properly inform the owner about the purpose of the collection and the rights they have by virtue of the authorization granted.
  4. Maintain information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
  5. Other duties of data controllers according to Law 1581 of 2012. Data processors must comply with the following duties.
  6. Promptly update, rectify, or delete data in accordance with Law 1581 of 2012.
  7. Process queries and complaints made by the owners in the specified terms.
  8. Allow access to information only to people who can access it.
  9. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
  10. Other duties of data controllers under Law 1581 of 2012.



8. RIGHTS AND POWERS OF THE HOLDER.

8.1. Rights of the owner.

Once the Data Subject has granted authorization for the corresponding processing, he or she has the right to:

  1. Know, update and rectify your personal data before BESPOKE COLOMBIA SAS This right may be exercised, among others, against partial, inaccurate, incomplete, fractional data that lead to error, or those whose processing is expressly prohibited or has not been authorized;
  2. Request proof of the authorization granted to BESPOKE COLOMBIA SAS, except when expressly excepted as a requirement for the Treatment, in accordance with the provisions of article 10 of Law 1581 of 2012;
  3. Be informed by BESPOKE COLOMBIA SAS, upon request, regarding the use that has been given to your personal data;
  4. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of the law;
  5. Revoke authorization and/or request data deletion when the processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that the processing has involved conduct contrary to this law and the Constitution;
  6. You may request, at any time, that BESPOKE COLOMBIA SAS delete your personal data and/or revoke the authorization granted for the processing of said data by filing a complaint. This will not be done when the Data Subject has a legal or contractual obligation to remain in the database.
  7. Access free of charge your personal data that has been subject to Processing: (i) at least once every calendar month, and (ii) every time there are substantial modifications to the Information Processing Policies that motivate new consultations.


In the case of requests with a frequency greater than one per calendar month, the controller and/or processor may charge the Owner the costs of shipping, reproduction, and, where applicable, certification of documents.




8.2. Legitimacy for the exercise of the rights of the owner.

The following persons are also entitled to exercise the rights granted to the data subject:

  1. The owner himself, who must prove his identity sufficiently by the means made available to him by the responsible party;
  2. Their successors in title, who must prove such status;
  3. The representative and/or attorney of the Owner, upon prior accreditation of the representation or power of attorney;
  4. By stipulation in favor of another or for another;
  5. The rights of children and adolescents shall be exercised by persons authorized to represent them, subject to accreditation of their authority to represent them.



8.3. Area responsible for the care and support of the owner.

The Data Subject's queries, requests, and complaints regarding any aspect of the processing will be handled by Management. Data Subjects who wish to know, update, rectify, request proof of the authorization granted; be informed of the use of their personal data; revoke authorization and/or request the deletion of data; and/or access their personal data that has been processed free of charge must do so in writing directly to the email address info@bespokecolombia.com or send the communication to Carrera 7 Calle Segunda de Badillo #36-125 in Cartagena de Indias. In either case, the following must be indicated:

  1. full name;
  2. identity document;
  3. physical address and email;
  4. contact telephone number;
  5. A brief description of the information and data to which it refers, expressly indicating the scope and content of the request; and
  6. accompany the documents that you consider support your request.



8.4. Procedure for exercising the rights to access, update, rectify, or delete information and to revoke authorization.

The procedures for accessing, updating, deleting and rectifying personal data, and revoking authorization, may be carried out through queries or complaints, addressed to info@bespokecolombia.com or by sending the communication to Carrera 7 Calle Segunda de Badillo #36-125 in Cartagena de Indias, depending on the purpose they pursue, establishing at least the legitimacy that one has to make the request and clearly and specifically stating what is intended.

All requests, suggestions and recommendations related to the processing of information must be sent to the email info@bespokecolombia.com and will be responded to no later than ten (10) business days after receipt.

The owner of the information or the authorized person must accompany their written document with proof of the capacity in which they act, and must provide the necessary data and documents to verify their identity and capacity.

The reason or purpose of the communication must be specified in the email or other communication. It will be sufficient to state in the text that the user is exercising the right to know, update, rectify, delete, or revoke the authorization granted.




8.5. Procedure for correcting, updating, or deleting data and for submitting complaints and claims.

Anyone authorized by law who believes that the information contained herein should be corrected, updated, or deleted, or who believes that the processing of personal data violates legal regulations, may, in accordance with Article 15 of Law 1581 of 2012, file complaints by emailing info@bespokecolombia.com or sending a communication to Carrera 7 Calle Segunda de Badillo #36-125 in Cartagena de Indias.


Complaints and claims will be processed under the following rules:

  • The claim shall be submitted by means of a request addressed to the Data Controller or the Data Processor, including the Data Subject's identification, a description of the facts giving rise to the claim, and the address, along with any documents to be asserted. If the claim is incomplete, the interested party shall be required to rectify the deficiencies within five (5) business days following receipt of the claim. If the applicant fails to submit the required information within two (2) months from the date of the request, the claim shall be deemed withdrawn.


In the event that the person receiving the claim is not competent to resolve it, it will be forwarded to the appropriate person within a maximum period of two (2) business days and the interested party will be informed of the situation.


  • Once the complete claim has been received, a legend stating "claim in process" and the reason for the claim will be added to the database within a period of no more than two (2) business days. This legend must remain in effect until the claim is decided.


  • The maximum period for addressing the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within this period, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.



8.6. Consultation and access to information.

Personal data inquiries will be addressed through a written request sent to info@bespokecolombia.com.

Queries will be answered within a maximum of ten (10) business days from the date of receipt. When it is not possible to answer the query within this period, the interested party will be informed before the expiration of ten (10) business days, stating the reasons for the delay and indicating the date on which the query will be answered, which in no case may exceed five (5) business days following the expiration of the first term.




9. SECURITY.

9.1. Security in information management.

The data collected will always be treated confidentially, and therefore will not be provided, transferred, or handed over to anyone other than those responsible for or in charge of the processing.




9.2. Data transfer and transmission.

In the event that a contract is signed with a third party who is professional and experienced in the management and use of databases, the data controller will sign the personal data transmission contract referred to in Article 25 of Decree 1377 of 2013.




10. DISSEMINATION AND VALIDITY.

10.1. Means of disseminating information processing policies and the privacy notice.

This document, which establishes the information processing policies for personal data collected, will be permanently published on our website www.bespokecolombia.com

When requesting the Data Subject's express authorization for data processing, the Data Subject will be informed of the specific purposes for which consent is being obtained, as well as the Data Processing Policy and the rights to which they are entitled as Data Subject.

In the event that BESPOKE COLOMBIA SAS cannot make this information processing policy available to the data and information owner, it will publish the privacy notice attached to this document, the text of which will be retained for future reference by the data owner and/or the Superintendency of Industry and Commerce.




10.2. Entry into force of information processing policies.

The collection, storage, use, and circulation of personal data, in accordance with the considerations set forth herein, will be carried out and maintained as long as the established and proposed needs and purposes of the Processing remain in force, and for as long as is reasonable and necessary. The data and information will be retained as long as necessary for the fulfillment, execution, and development of legal or contractual obligations. If the purpose cannot be achieved through the Processing of personal data, they will be permanently deleted from the database.

This document comes into force as of November five (05), 2016.




10.3. Procedure for policy modification events.

In the event that changes are made to the personal data processing policies established herein, they will be notified and communicated through our website prior to their entry into force.




10.4. Responsible for the information.

BESPOKE COLOMBIA SAS, with NIT: 806.015.606-2, is responsible for and in charge of processing personal data.

Any communications can be directed to Carrera 7 Calle Segunda de Badillo #36-125 in Cartagena de Indias or to the email address info@bespokecolombia.com.