Legal

Personal Data Processing and Privacy Policy

How Muisca Travel & Events SAS collects, uses, protects, and shares the personal information of clients, guests, partners, and website visitors, in accordance with Ley 1581 de 2012 (Colombia’s data protection statute) and its regulations.

Version 1.0 — in force since 3 September 2026. The Spanish version is the legally governing text.

Privacy notice

The essentials in one minute

Muisca Travel & Events SAS (NIT 901337471-1), domiciled at Calle 70 No. 27-67 Ofc 201, Palermo, Manizales, Caldas, Colombia, is the data controller for your personal data. You can write to info@muiscatravel.com or call +57 320 619 6078.

  • What we collect: your contact and company details, the programme information you describe to us, any documents you choose to attach and, while operating a programme, the guest data required to deliver the service.
  • Why: to answer your request, design and price a proposal, deliver the programme you contract, meet legal and accounting obligations and — only if you agree — stay in commercial contact.
  • Who it is shared with: only the suppliers needed to deliver the service (hotels, airlines, operators, insurers, technology providers), under confidentiality agreements.
  • Your rights: to know, update, rectify, and delete your data, to revoke your authorisation, and to lodge complaints with the Superintendencia de Industria y Comercio (SIC, Colombia’s data protection authority). The channel is info@muiscatravel.com.
  • Sensitive data: you are never obliged to provide it. We ask for it only when it is essential to operate a programme (for example, food allergies or accessibility needs) and with your express authorisation.

The full policy follows and can be consulted at any time at muiscatravel.com.

1. Data controller

  • Company name: Muisca Travel & Events SAS
  • NIT (Colombian tax ID): 901337471-1
  • Registro Nacional de Turismo (RNT, National Tourism Registry): 79106, Agencias de viajes operadoras (travel agency, tour operator category); 259770, Operadores profesionales de congresos, ferias y convenciones (professional congress, trade fair and convention organiser, OPC)
  • Registered address: Calle 70 No. 27-67 Ofc 201, Palermo, Manizales, Caldas, Colombia
  • Email for personal data matters: info@muiscatravel.com
  • Telephone: +57 320 619 6078
  • Website: https://www.muiscatravel.com (versions at /en, /es-co, and /pt-br)
  • Legal representative: James Gallego, Chief Executive Officer

Muisca Travel & Events SAS is a destination management company (DMC) founded in 2019 in Manizales, dedicated to incentive travel, corporate events, meetings, and private journeys in Colombia.

This policy gives effect to the fundamental right of habeas data enshrined in Article 15 of the Colombian Constitution and is governed by Ley 1581 de 2012 (the general data protection statute), Decreto 1377 de 2013 — compiled into Decreto 1074 de 2015 —, Ley 1266 de 2008 (financial and credit data) where applicable, Ley 2300 de 2023 (commercial contact channels and hours), and the instructions of the Superintendencia de Industria y Comercio (SIC) as data protection authority.

3. Short definitions

  • Personal data: any information linked to, or that can be associated with, an identified or identifiable natural person.
  • Sensitive data: data that touches on the data subject’s privacy or whose misuse could lead to discrimination, such as health data, ethnic origin, beliefs, or biometric data.
  • Data subject (titular): the natural person whose data is processed.
  • Processing: any operation on personal data — collection, storage, use, circulation, or deletion.
  • Authorisation: the prior, express, and informed consent of the data subject to the processing of their data.
  • Controller (responsable): the party that decides on the database and the processing; here, Muisca Travel & Events SAS.
  • Processor (encargado): a party that processes data on behalf of the controller, such as a technology provider.

4. Principles we apply

All processing carried out by Muisca™ follows the principles set out in Article 4 of Ley 1581 de 2012:

  • Lawfulness: processing is carried out in accordance with the law.
  • Purpose: data is collected for legitimate purposes made known to the data subject.
  • Freedom: processing takes place only with the data subject’s authorisation, unless the law provides otherwise.
  • Accuracy or quality: information must be truthful, complete, exact, and up to date.
  • Transparency: the data subject may obtain information about their data at any time.
  • Restricted access and circulation: data is handled only by authorised people and is not made openly available.
  • Security: we apply technical, human, and administrative measures to prevent loss, alteration, or unauthorised access.
  • Confidentiality: everyone involved in processing keeps the information confidential, even after the relationship ends.

5. What data we collect and through which channel

The website’s “Request a Proposal” form

When you send us a request we collect your name, email, telephone, company, role, and the details of the programme you describe (event type, dates, number of participants, destinations, indicative budget). You may optionally attach a brief or other documents; please do not include third parties’ sensitive data in them.

Together with the form we capture technical and attribution data: the page you arrived from, campaign UTM parameters, advertising click identifiers (gclid, fbclid), and the URL of the page from which you submitted the form. This tells us which channels work and is not used to profile you individually.

Email, trade shows, and meetings

We collect the data you give us when you write to us, exchange business cards or have your badge scanned at trade shows and roadshows, or meet our team: name, role, company, contact details, and the interests you share with us.

Programme operations

To deliver a contracted programme we process the guest data the client sends us that is necessary to provide the service: rooming lists, passport or ID details for air, hotel, and immigration bookings, flight dates, and travel preferences.

Sensitive data

Operations may require sensitive data such as dietary restrictions, allergies, medical conditions relevant to travel safety, or accessibility needs. We collect it only with the data subject’s express authorisation, use it solely to adapt and run the programme safely, share it only with the supplier that must act on it (for example, the hotel or restaurant), and delete it when the programme closes. No data subject is ever obliged to provide sensitive data, and we do not make the service conditional on it except where it is essential to their own safety.

6. Purposes of processing

  • Handle your request for information or a proposal and maintain pre-contractual communication.
  • Design, price, contract, and deliver incentive travel programmes, events, meetings, and private journeys.
  • Manage bookings, contracts, payments, invoicing, and accounting, tax, and tourism-registry obligations.
  • Coordinate programme logistics with suppliers and respond to emergencies during delivery.
  • Measure the performance of our acquisition channels and improve the website.
  • Send commercial information about our services, only where you have agreed and until you decide otherwise.
  • Comply with requests from competent authorities and exercise or defend rights in legal proceedings.

7. Data of children and adolescents

Our services are aimed at companies and adults. We process minors’ data only when they take part in family or private journeys, always with the authorisation of their parents or legal guardians, in the child’s best interests and with respect for their fundamental rights, as required by Article 7 of Ley 1581 de 2012. In those cases we limit collection to what is strictly necessary for the booking and the safety of the trip.

8. Transfer and transmission to third parties

To deliver the service we share data with third parties acting as processors or as independent controllers, as the case may be:

  • Programme suppliers: hotels, airlines, ground transport, venues, restaurants, guides, partner DMCs in other destinations, and travel or event insurers.
  • Web form processing: Formsubmit, which receives the data from the “Request a Proposal” form and forwards it to our email.
  • Website hosting: Vercel, which serves the site’s pages and may log technical connection data.
  • Professional services: accounting, legal, and audit advisers bound by a duty of confidentiality.
  • Authorities: where there is a legal obligation or a judicial or administrative order.

Some of these third parties are located outside Colombia. International transfers are made to countries that provide an adequate level of protection under the SIC’s criteria or, failing that, under contractual safeguards and the exceptions set out in Article 26 of Ley 1581 de 2012, including the data subject’s authorisation and the need to perform the contract. We do not sell or assign personal data for commercial purposes.

9. Retention period

We keep data for as long as it is needed for the purpose that justified its collection and for the periods required by Colombian accounting, tax, and commercial law. As a guide:

  • Proposal requests that do not become a contract: up to 24 months from the last contact.
  • Contract and invoicing data: the statutory retention period for accounting records.
  • Guests’ sensitive data: deleted at the administrative close of the programme.
  • Commercial contact data: until you revoke your authorisation.

10. Security measures

We store information in cloud services with encryption in transit and at rest, control access through individual accounts and strengthened authentication, restrict access to the team members who need it for their role, sign confidentiality agreements with staff and suppliers, and share guest lists with suppliers through protected channels and only for as long as strictly necessary. No measure removes risk entirely; should an incident affect your data, we will notify the SIC and the affected data subjects as the law requires.

11. Rights of the data subject

Under Article 8 of Ley 1581 de 2012 you have the right to:

  • Know, update, and rectify your personal data.
  • Request proof of the authorisation granted, except where the law does not require it.
  • Be informed about how your data has been used.
  • Revoke your authorisation and request deletion of your data where no legal or contractual duty requires us to keep it.
  • Access your personal data free of charge.
  • Lodge complaints with the Superintendencia de Industria y Comercio for breaches of the law, once the enquiry or claim procedure before Muisca has been exhausted.

These rights may be exercised by the data subject, their successors, their representative or attorney, and anyone authorised by the data subject.

12. Enquiries and claims procedure

The channel for exercising your rights is info@muiscatravel.com. Put “Personal data” in the subject line and include your full name, ID type and number, a description of your request, and a contact address. If you act on behalf of someone else, attach the document that authorises you.

Enquiries

We answer enquiries about your data within a maximum of ten (10) business days from receipt. If we cannot respond within that period, we will tell you why and give a response date no later than five (5) business days after the first period expires (Article 14, Ley 1581 de 2012).

Claims

If you believe your data should be corrected, updated, or deleted, or that the law has been breached, you may file a claim. If it is incomplete, we will ask you to complete it within five (5) days; if we hear nothing within two (2) months, we will treat the claim as withdrawn. Once a complete claim is received, we mark the record “claim in progress” in the database and resolve it within a maximum of fifteen (15) business days, extendable by a further eight (8) business days where we notify you of the reasons (Article 15, Ley 1581 de 2012).

Only after this procedure has been exhausted may you take a complaint to the Superintendencia de Industria y Comercio (www.sic.gov.co).

13. Commercial contact channels and hours

In line with Ley 2300 de 2023 (the Colombian statute limiting commercial contact), Muisca makes commercial contact only Monday to Friday between 8:00 and 18:00 Colombia time (UTC-5), and does not contact data subjects on Colombian public holidays. We use the channels you have authorised — email, telephone, or messaging — and no more than once a week for the same commercial purpose. You may at any time ask us not to contact you for commercial purposes, or restrict a channel, by writing to info@muiscatravel.com; we will act on the request free of charge. This limit does not apply to communications needed to deliver a contracted programme.

14. Cookies and similar technologies

The site muiscatravel.com sets no analytics or advertising cookies unless you explicitly accept them. Without your consent no analytics cookie is set and no request is sent to Google Analytics. The site uses browser storage for three technical purposes:

  • Session storage: remembers, while the tab stays open, the referring page and campaign parameters (UTM, gclid, fbclid) so they can be attached to your proposal request, and prevents the form submission from being recorded twice.
  • Language preference: remembers in browser storage the language version you chose, or the language suggestion you dismissed, so we do not show it to you again.
  • Consent choice: remembers in browser storage (muisca-consent) whether you accepted or declined analytics cookies and when, so the banner is not shown again. It contains no personal data and stays until you clear it or change your choice.

This data never leaves your browser except when you submit the form. You can clear it at any time from your browser settings without affecting how the site works.

Analytics cookies (Google Analytics 4)

On your first visit a cookie banner asks whether you accept analytics cookies. Only if you choose Accept analytics does the site load Google Analytics 4, a measurement service provided by Google. If you choose Decline, or make no choice at all, Google Analytics is not loaded and no analytics cookie is set.

With your consent, Google Analytics sets the cookies _ga and _ga_*, which last up to two years and hold a random identifier that tells your browser apart from others. It collects the pages you view, the time and order of your visits, the page that referred you and any campaign parameters, your approximate location at city or region level, your device, browser and screen type, and interactions such as clicks on contact links and proposal-form submissions. Google Analytics 4 neither logs nor stores IP addresses, and the site additionally requests IP anonymisation. We use this data only to understand how the site is used and to improve it; we do not use it for advertising and we do not combine it with the information you send us in a proposal request.

The data is processed by Google LLC (United States) under its own privacy policy and data-processing terms, which may involve transfers outside Colombia. Google retains user-level and event-level data for no more than 14 months, the longest period a standard Google Analytics 4 property allows; aggregated reports may be kept beyond that.

Withdrawing consent. You can change your choice at any time through the Cookie settings link in the footer of every page. Choosing Decline stops Google Analytics from loading, disables measurement for the rest of your visit and removes its cookies from your browser; you can also delete them from your browser settings.

The site loads its typefaces from Google Fonts. When it does, your browser requests the font files from Google’s servers, which may receive your IP address and technical connection data under Google’s privacy policy.

15. Validity and updates

This policy — version 1.0 — takes effect on 3 September 2026 and applies to the databases of Muisca Travel & Events SAS for as long as the company exists. We may update it to reflect legal, operational, or technological changes; the current version will always be published on this page with its date. Where a substantial change affects the purposes of processing or the identity of the controller, we will inform data subjects through the available contact channels before applying it.

For any question about this policy, write to info@muiscatravel.com.