Privacy Policy

1 Introduction

La Vega Travel (“we”, “us”, “our”) provides nature‑based travel experiences throughout Colombia for customers worldwide. We are committed to protecting your personal data in accordance with global privacy laws, including GDPR, UK GDPR, CCPA/CPRA, PIPEDA, APPI, PDPA, PIPA, PDPO, and Colombian Law 1581/2012.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information.

2 Data Controllers

Both entities jointly determine the purposes and means of processing personal data.

3 Personal Data We Collect

Identification Data

• Full name
• Nationality
• Date of birth
• Passport number
• Passport scan/photo

Contact Information

• Email
• Phone number
• Emergency contact details

Sensitive Data

• Health or mobility information
• Dietary restrictions

Travel Information

• Flight details
• Accommodation details
• Travel preferences

Payment Information

• Payment details processed through Stripe
• Transaction history

Website & Technical Data

• IP address
• Cookies
• Device identifiers
• Analytics data (Google Analytics)

Communications

• Email
• Messaging apps (WhatsApp, Telegram, Signal, or others used by customers)

User‑Submitted Media

• Photos, videos, testimonials voluntarily provided or submitted via waiver

4 Legal Bases for Processing

We process personal data under the following legal bases:

• Contractual Necessity: To provide travel services, manage bookings, coordinate logistics, and communicate with customers.
• Legal Obligation: For tax, accounting, fraud prevention, and compliance with Colombian and US law.
• Explicit Consent: For sensitive data, passport scans, cookies, marketing, and user‑submitted media.
• Legitimate Interests: For security, fraud prevention, internal analytics, and service improvement.
• Vital Interests: To process emergency contact information and respond to health emergencies.

5 How We Use Your Personal Data

We use your data to:

• Process bookings and deliver travel services
• Coordinate accommodations, flights, and logistics
• Communicate with you before, during, and after your trip
• Ensure safety and respond to emergencies
• Process payments through Stripe
• Improve our website and services
• Comply with legal obligations
• Conduct future marketing (with consent)
• Manage customer service and dispute resolution

6 Sensitive Data Handling

Sensitive data is collected only when necessary and only with explicit consent. This includes:

• Health or mobility information
• Dietary restrictions
• Passport scans
• Photos/videos submitted voluntarily or via waiver

7 International Data Transfers

Your data may be transferred to:

• Colombia (primary storage and processing)
• United States (Stripe payment processing, hosting via GoDaddy)
• Your country of origin (communications and messaging apps)

GDPR Compliance

Transfers from the EU/UK to Colombia or the US use:

• Standard Contractual Clauses (SCCs)
• Data Transfer Impact Assessments (DTIAs)
• Additional safeguards where required

Colombian Compliance

International transfers are disclosed in accordance with Law 1581/2012.

Asian Jurisdictions

Foreign transfers are disclosed as required by APPI, PDPA, PIPA, and PDPO.

8 Third‑Party Processors

We share data only with trusted service providers:

Hosting & Domain

• GoDaddy (US)

Payments

• Stripe (US)

Messaging Platforms

• WhatsApp, Telegram, Signal (independent controllers)

Local Partners

• Hotels
• Drivers
• Guides
• Insurance providers

All processors are bound by confidentiality and data‑protection obligations.

9 Cookies & Tracking Technologies

We use:

• Strictly Necessary Cookies
• Analytics Cookies (Google Analytics)
• Functional Cookies
• Marketing Cookies (future use)

EU/UK Visitors

Analytics and marketing cookies require explicit consent.

California Visitors

Analytics may constitute “sharing” under CPRA; opt‑out is provided.

A full Cookie Policy is included below.

10 Marketing & Future Marketing

We may use your data for:

• Email newsletters
• WhatsApp broadcast lists
• Retargeting ads (Facebook, Instagram, Google)
• Referral programs
• Social media advertising

Marketing is always based on explicit consent or opt‑out rights.

11 Data Retention

See Appendix A for the full retention schedule.

12 Your Rights

You may have rights to:

• Access your data
• Correct your data
• Delete your data
• Object to processing
• Withdraw consent
• Request portability
• Opt‑out of marketing
• Opt‑out of sharing (California)

How to Exercise Your Rights

Email: explore@lavegatravel.com
Response time: 30 days (extendable to 60 days)

Identity Verification

We may request proof of identity before fulfilling requests.

Deletion Exceptions

We cannot delete data required for:

• Tax compliance
• Accounting
• Fraud prevention
• Legal obligations
• Defense of legal claims

13 Security Measures

We implement:

• Encryption
• Access controls
• Secure local database storage
• Processor contracts
• Regular audits
• Data minimization
• Strict retention limits

14 EU Representative

La Vega Travel will appoint an authorized EU representative. Once designated, their contact information will be added to this policy.

15 Changes to This Policy

We may update this Privacy Policy to reflect changes in law or operations.

16 Contact Information

1 What Are Cookies?

Cookies are small text files stored on your device to improve your browsing experience.

2 Types of Cookies We Use

• Strictly Necessary Cookies
• Analytics Cookies (Google Analytics)
• Functional Cookies
• Marketing Cookies (future use)

3 Google Analytics

We use GA4 to analyze website performance. GA4 anonymizes IP addresses and may transfer data to the United States.

4 Consent Requirements

• EU/UK: Explicit consent required
• California: Opt‑out required
• Canada/Asia: Transparency required

5 Managing Cookies

You may manage cookies through your browser settings or our cookie banner.