EspañolBook

Personal data protection

Privacy policy.

Last updated:

At Termales Tierra Viva we take care of the information you share with us. This policy explains which personal data we process, what we use it for and how you can exercise your rights as a data subject under Article 15 of the Colombian Constitution, Statutory Law 1581 of 2012 and Decree 1377 of 2013, compiled in Decree 1074 of 2015.

It applies to data we receive from hotel guests, day-pass visitors, restaurant and spa customers, event organisers, suppliers and users of this website, through any channel: front desk, phone, WhatsApp, email, social media, the booking engine and forms.

This is a translation for convenience. In case of any discrepancy, the Spanish version prevails.

01Data controller

The company has appointed a Personal Data Protection Officer, who handles data subjects’ queries and claims and oversees compliance with this policy.

02Definitions

  • Data subject: the individual whose personal data is processed.
  • Personal data: any information linked or linkable to an identified or identifiable individual.
  • Sensitive data: data that affects the data subject’s privacy or whose misuse may lead to discrimination, such as health or biometric data.
  • Authorisation: the data subject’s prior, express and informed consent to the processing.
  • Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
  • Controller: whoever decides on the database and the processing. Processor: whoever processes data on the controller’s behalf.
  • Transfer: sending data to another controller, in or outside Colombia. Transmission: sharing data with a processor so it can process it on the controller’s behalf.

03Principles

We process personal data in accordance with the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality set out in Article 4 of Law 1581 of 2012.

04Data we collect

  • Identification: name, ID type and number, nationality and date of birth.
  • Contact: phone, email, address and city of residence.
  • Bookings and stays: dates, companions, room, preferences, purchases and special requests.
  • Events: company, type of event, tentative date, number of guests and services of interest.
  • Payment and invoicing: the data needed to charge you and issue the electronic invoice. Card payments are processed by financial institutions and payment gateways; we do not store full card details.
  • Images: CCTV recordings in signposted areas.
  • Health (sensitive and optional): allergies or conditions you choose to tell us about so we can provide the restaurant, hot-spring and spa services safely.
  • Browsing: technical data such as your IP address and browser type, logged by the website’s servers and by the third-party services embedded in it.

05Purposes of processing

We use personal data to:

  • Manage bookings, check-in and check-out, and provide our lodging, hot-spring day pass, restaurant, spa and event services.
  • Comply with legal obligations, including guest registration with the Ministry of Commerce, Industry and Tourism (hotel registration card), reporting foreign guests to Migración Colombia, electronic invoicing and accounting and tax obligations, and respond to requests from the authorities.
  • Answer requests, quotes, complaints, claims and suggestions received through any of our channels.
  • Process payments, invoice and manage collections.
  • Protect guests, visitors, staff and facilities through CCTV and access control.
  • Measure satisfaction and improve the quality of our services.
  • Send you information about offers, seasons, events and news, only if you agree. You can ask us to stop at any time.
  • Publish photos or videos in which you appear only with your express consent.
  • Manage our relationship with suppliers, contractors, staff and job applicants.

06Sensitive data

You are not required to provide sensitive data or to answer questions about it. If you choose to tell us, for example, about a food allergy or a health condition relevant to using the thermal pools or the spa, we will use it only to provide the service safely, with your explicit consent and with the reinforced security measures required by law.

07Children and teenagers

Processing of minors’ data respects their best interests and fundamental rights. We only process the data strictly necessary, such as that required for hotel registration or to apply children’s rates, and always with the consent of their parent or legal guardian.

08Your rights

As a data subject, under Article 8 of Law 1581 of 2012, you may:

  • Access, update and correct your personal data.
  • Request proof of the authorisation you gave us, except where the law does not require it.
  • Be informed, on request, of how your data has been used.
  • File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the law, once you have completed the query or claim process with us.
  • Withdraw your authorisation or request deletion of your data, where there is no legal or contractual duty to keep it.
  • Access your personal data free of charge.

These rights may be exercised by the data subject, their successors, their representative or attorney, or a person acting under a stipulation in favour of another.

09Authorisation

We request your authorisation in a prior, express and informed manner, in writing, electronically (for example, by ticking a box on a form) or through unequivocal conduct showing that you gave it. We keep proof of it.

Authorisation is not required when the information is requested by a public authority in the exercise of its duties or by court order, for public data, in medical or health emergencies, for historical, statistical or scientific purposes authorised by law, or for civil registry data.

10Queries and claims

The official channel to exercise your rights is termalestierraviva@politicadeprivacidad.co. Please include your full name, ID number, contact details, an address for our reply, a description of the facts, the right you wish to exercise and any supporting documents.

  • Queries are answered within ten (10) business days of receipt. If that is not possible, we will tell you why and when you will receive an answer, which will be no more than five (5) additional business days.
  • Claims (correction, update, deletion or non-compliance) are answered within fifteen (15) business days from the day after receipt, extendable by up to eight (8) business days, in which case we will tell you why.
  • If a claim is incomplete, we will ask you to complete it within five (5) business days. If two (2) months pass without a reply, the claim will be considered withdrawn.
  • Within two (2) business days of receiving a complete claim, we will flag the data as “claim in progress” until it is resolved.

11Transmission and transfer

We may share data with processors that provide services to us, such as the hotel software and booking engine, website hosting, messaging, email, payment methods and electronic invoicing, always under contracts that require them to use the data only for the authorised purposes and with security measures. Some of these providers may store information outside Colombia; in those cases the conditions of Article 26 of Law 1581 of 2012 are met. We also disclose data to the authorities when required by law.

We do not sell or rent your personal data.

12This website, cookies and third-party services

This website does not use its own analytics or advertising cookies. It does, however, embed third-party services that have their own policies:

  • Google Maps: the map on the home page may set cookies and receive your IP address.
  • WhatsApp: quote forms do not store data on our site; they build a message that you choose to send from WhatsApp.
  • Booking engine (LobbyPMS): online bookings are completed on the provider’s platform.
  • Instagram and Facebook: links to our social media take you to sites governed by Meta’s policies.

You can block or delete cookies in your browser settings.

13Security and retention

We apply technical, human and administrative measures to protect data against loss, unauthorised or fraudulent access, use or consultation. We keep data for as long as needed to fulfil the purposes described and the applicable legal, accounting and tax obligations, after which we delete or anonymise it.

14Effective date and changes

The personal data policy of Hotel Termales Tierra Viva S.A.S. has been in force since 18 March 2026; the full version (in Spanish) is available at politicadeprivacidad.co. Any substantial change will be published on this website and through our usual channels before it applies.