Legal
Privacy
Version 1.0 · 27 July 2026
Template — needs completion before launch.
This describes what the site as built actually does. Before launch it must be completed with your legal entity, a named data-protection contact, and a review against Colombia’s Ley 1581 de 2012 (Habeas Data), the UK/EU GDPR if you market to those visitors, and — because you handle health information for medical travel — the heightened rules for sensitive data under all three.
1.What this site collects on its own
Your language, nationality and currency preferences are stored in your browser’s local storage on your device. They are not sent to us, not shared, and not used for advertising. Clearing your browser data removes them.
This site sets no advertising cookies and runs no third-party trackers. Fonts and images are served from this domain, not a CDN, so browsing here does not disclose your visit to a third party.
2.What you give us when you enquire
The booking form collects your name, email, phone number, nationality, travel dates, party size and whatever you write in the notes field. We use it to answer your enquiry, plan and run your trip, and meet Colombian record-keeping obligations for tourism operators.
We share the minimum necessary with the suppliers actually running your trip — a guide gets your name and party size, a hotel gets what it needs to hold a room. We do not sell your data, and we do not add you to a marketing list because you made an enquiry.
3.Health information — treated differently
If you tell us about a medical condition, mobility need, allergy or medication — whether in the booking notes or as part of a medical-travel enquiry — that is sensitive personal data. We handle it under stricter rules:
- Collected only where it is genuinely needed for your safety or your care.
- Shared only with the specific clinician, clinic or guide who needs it, only with your explicit consent, and only for that purpose.
- Never used for marketing, profiling or analytics. Ever.
- Deleted on request at any time, subject to any clinical record-keeping obligation held by a treating provider — which is theirs, not ours.
Please do not send diagnostic reports, imaging or clinical records through the booking form. We will give you a secure channel once a medical-travel enquiry is underway.
4.How long we keep it
Enquiries that do not become bookings: 12 months, then deleted. Booking records: as long as Colombian tax and tourism record-keeping requires. Health information: only as long as needed for the trip it relates to, then deleted.
5.Your rights
You may ask us what we hold about you, correct it, delete it, or object to how we use it. Under Colombia’s Ley 1581 de 2012 you also have the right to revoke consent and to be told to whom your data has been disclosed. Write to hola@corazoncolombia.co and we will respond within 15 working days.
6.Where your data goes
Our team is in Colombia, so your data is processed in Colombia. If you are in the UK or EU, that is a transfer outside your jurisdiction — Colombia does not currently hold a UK or EU adequacy decision, so such transfers rely on your explicit consent or on the transfer being necessary to perform the contract you asked us to enter into.
7.Children
This site is not directed at children and we do not knowingly collect data from anyone under 18. Where a booking includes minors, we collect only what is necessary from the accompanying adult.