1. Identification of the Data Controller (Responsable del Tratamiento)
In compliance with Colombian Statutory Law 1581 of 2012 and Decree 1377 of 2013 (incorporated into Decree 1074 of 2015), the Data Controller responsible for the collection, storage, use, circulation, and suppression of your personal data is:
OceanViewFlats — Manuel Enrique Herrera
RNT #268781 & RNT #270413 (1707 & 1606)
Calle 26 # 2-80, Playa Salguero, Santa Marta, Magdalena, Colombia
2. Applicable Legal & Regulatory Framework
Personal data processing at OceanViewFlats is governed by the following Colombian statutes:
- Statutory Law 1581 of 2012 & Decree 1377 of 2013 (Decree 1074 of 2015): General regime for the protection of personal data and prior, express, and informed authorization.
- Law 1558 of 2012, Law 2068 of 2020 & Decree 2590 of 2009: Mandatory hospitality guest registration (Tarjeta de Registro de Alojamiento - TRA / SIRE) and building security identification.
- Law 679 of 2001 & Law 1336 of 2009: Prevention of sexual exploitation and commercial abuse of children and adolescents (ESCNNA) in tourism and hospitality.
3. Purposes of Personal Data Processing
Your personal data is collected and processed strictly for the following authorized purposes:
Inquiries & Guest Communication
Responding to availability inquiries, quotes, pre-arrival coordination, and customer support requests submitted via our Contact channel.
Direct Reservations & Financial Settlement
Processing direct bookings, payment transactions, refunds, and maintaining accounting and tax records required under Colombian law.
Mandatory Hospitality Guest Registry
Recording identification, ages, nationalities, and contact details of the Primary Guest and accompanying Guests prior to check-in per Colombian tourism regulations.
Condominium Clearance & Smart-Lock Access
Registering authorized occupants and vehicles with Edificio Salguero Sunset front-desk security and issuing temporary random smart-lock entry PINs.
4. Special Protection of Children and Adolescents (Minors Under 18)
Pursuant to Article 7 of Law 1581 of 2012 and Law 679 of 2001, the processing of personal data of children and adolescents is strictly limited to statutory hospitality registration and building safety, always respecting their prevailing fundamental rights.
Whenever a minor under 18 (or holder of a Tarjeta de Identidad or Registro Civil) is included in the Guest Registry, the Primary Guest must explicitly attest to holding parental authority (patria potestad) or written legal representation from the minor's parents.
5. Third-Party Transmissions & Recipients
OceanViewFlats never sells or rents personal data. Data is transmitted exclusively to the following operational and statutory recipients:
Mercado Pago Colombia (Payment Gateway)
Processes credit/debit card, PSE bank transfer, and Efecty cash voucher payments during Direct Reservation checkout under PCI-DSS security standards.
Condominium Administration Portal (Edificio Salguero Sunset / Huésped Manager)
Receives occupant identification and vehicle plate details strictly to issue front-desk building clearance, wristbands, and parking authorization.
Colombian Statutory Authorities
Ministry of Commerce, Industry and Tourism (MinCIT), Migración Colombia, and DIAN when required by applicable hospitality and tax mandates.
6. Habeas Data (ARCO) Rights, Consultations & Claims Procedure
As the Data Subject (Titular), you have the constitutional right to Know, Update, Rectify, and Suppress your personal data, request proof of authorization, and revoke consent whenever no legal or contractual duty requires retention.
You may exercise your rights free of charge at any time by submitting a written request to rentals@oceanviewflats.com including your full name, identification number, contact details, and description of your request.
Consultations (Consultas — Art. 14 Law 1581)
Maximum response time: 10 business days (10 días hábiles) (10)
Requests to inspect or obtain a copy of the personal data held by OceanViewFlats are answered within ten (10) business days from receipt. If an extension is required, we will notify you before expiration and respond within five (5) additional business days.
Claims (Reclamos — Correction, Update, or Suppression — Art. 15 Law 1581)
Maximum response time: 15 business days (15 días hábiles) (15)
Requests to correct, update, or suppress personal data (or report an alleged breach) are resolved within fifteen (15) business days from the day following receipt. Incomplete claims will be notified within five (5) business days, and if an extension is required, it will not exceed eight (8) additional business days.
7. Information Security, Cryptographic Protection & Retention Window
Guest Registry occupant payloads are encrypted at rest using authenticated symmetric cryptography (XSalsa20-Poly1305), and identification numbers are masked across secondary logs and email notifications.
Smart-lock door codes are generated using cryptographically random digits and never encode personal identification numbers.
In accordance with the Principle of Temporality (Decree 1377 Art. 11), personal identification and guest registry records of concluded stays are automatically redacted 90 days after check-out (or immediately upon an approved ARCO suppression claim), while preserving anonymized financial and occupancy aggregates required for tax compliance.