Personal data policy

Version 1 · Effective October 17, 2026

This is an English translation for reference. If there is any difference, the Spanish version prevails.

This policy explains how Herradura House collects, uses and protects the personal data of people who request quotes, book or contact us, in compliance with Colombian Law 1581 of 2012 and Decree 1074 of 2015 (which incorporates Decree 1377 of 2013).

1. Data controller

2. Data we collect

Name, ID document, email, phone or WhatsApp number, city and country of origin, reason for the trip, dates of stay, number of guests, whether minors or pets are traveling, and any comments you leave us. For guests staying in the house we also collect the data required by law for the lodging register, and we keep a copy of each guest's ID (national ID, passport or, for minors, birth certificate and travel authorizations) to confirm that each registered person is the one staying and, for minors, their family relationship or authorization.

The house also has two security cameras that record images at the main entrance and in the back patio. Images of people captured by these cameras are also personal data and are handled under this policy.

We do not request sensitive data. Data about minors is only collected when the law requires it for guest registration, and always through their legal representative.

3. How we use your data

• To prepare and send you the quote you requested, or to answer your request to use The Garden.
• To contact you by email, phone or WhatsApp to follow up on your quote, confirm availability and manage your booking.
• To provide the lodging service and attend to your requests during your stay.
• To verify each guest's identity and check minors' documents, as the law requires to prevent the sexual exploitation of children and adolescents.
• To meet legal obligations, such as the Lodging Registration Card (TRA), reporting foreign guests to Migración Colombia (SIRE), invoicing and tax obligations.
• To keep internal statistics about our quotes and bookings.
• To protect the safety of guests, visitors and the property through video surveillance in outdoor areas.
• Only if you authorize it separately: to send you marketing information, offers and news from Herradura House by email or WhatsApp.

4. Your rights

As the owner of the data you can:

• Know, update and correct your data.
• Ask for proof of the authorization you gave us.
• Know how we have used your data.
• Revoke the authorization or ask us to delete your data, when there is no legal or contractual obligation to keep it.
• Stop receiving marketing messages at any time.
• File complaints with the Superintendence of Industry and Commerce (SIC) after making your request to us.
• Access your data free of charge.

5. How to exercise your rights

Write to [email protected] with your name, your request and a contact detail.

• Inquiries: we reply within 10 business days at the most. If that is not possible, we tell you why and reply within the following 5 business days.
• Claims (correction, update, deletion or revocation): we reply within 15 business days at the most. If that is not possible, we tell you why and reply within the following 8 business days.

6. Video surveillance

• There are two cameras: one at the main entrance and one in the back patio. Both are marked with "video surveillance area" signs.
• There are no cameras inside the house, in the bedrooms or in the bathrooms.
• Images are used only for the safety of people and the property, and to deal with incidents.
• Recordings are kept for a maximum of 30 days, unless they are needed to deal with an incident, a claim or a request from a competent authority.
• Only the data controller has access to the recordings, and they are only given to authorities when the law requires it.

7. Where your data is stored

We receive and store information in WhatsApp and in Google tools (email and spreadsheets), whose servers may be outside Colombia. These providers act as storage processors and apply their own security measures. Only the Herradura House team has access to your data, and we do not sell it or share it with third parties for marketing purposes. The only exception is when, in a request for The Garden, you ask for a catering quote: in that case, and only with your express authorization, we share your name, your contact details and the gathering details with Gastrología (gastrologiacali.com), our catering partner, so they can send you a quote. We only give data to authorities when the law requires it.

8. How long we keep it

For as long as it is needed for the purposes described and for the time required by legal, accounting and tax rules:

• Guest register and copies of ID documents: 5 years from departure. After that, they are deleted.
• Invoices and accounting records: 10 years, as required by commercial law.
• Quotes that do not become bookings: 2 years at the most, unless you ask us to delete them sooner.
• Camera recordings: 30 days at the most, as explained in section 6.

Copies of documents are kept in a private digital folder that only the data controller can access, and they are not shared through open chats or emails.

9. Changes to this policy

If we change this policy we will publish the new version on this page, with its effective date. If the change affects the purposes, we will ask you for a new authorization.