Privacy policy

Data controller

The controller of your personal data is Expotur Eco, the company that operates the Punta Gallinas Tours brand.

• Office: Cra 5 #3A-02, Riohacha, La Guajira, Colombia
• Phone and WhatsApp: the numbers shown in the site footer and on our contact page
• Queries and claims about your data: through the requests and complaints form (PQRS) or in writing at our office

Scope of this policy

This policy applies to the personal data we receive through puntagallinastours.com, in its Spanish, English and French versions, on WhatsApp, by email and at our office. It covers travelers, people who request a quote or contact us, and people who leave a review.

What data we process

What we use your data for

1. To reply to your messages, quote requests and booking requests.
2. To manage your booking: confirm it, collect the deposit and the balance, issue the invoice and send you the trip emails.
3. To deliver the tour: share the data needed to look after the group with the driver-guide and the lodgings on the route.
4. To handle requests, complaints, claims, changes, cancellations and refunds.
5. To invite you to leave a review after the tour, and to publish it if you send one.
6. To protect the site and the forms against fraud and automated submissions.
7. To meet legal, accounting, tax, tourism and consumer protection obligations, and to respond to requests from the authorities.
8. To measure how the site is used and how our ads perform: with cookies, only if you accept analytics or advertising cookies; without them, through the cookieless signals that Google Analytics and Google Ads receive for aggregate measurement.
9. To send you marketing information, only if you give us separate authorization for it.

What the law calls processing (tratamiento) covers everything we do with your data: collecting, storing and using it, sharing it with the parties named in this policy, and deleting it.

How we ask for your authorization

On the site's forms, you give your authorization by checking a box that is not pre-checked; you must check it to submit the form. We keep the text you accepted, in your language, together with your request.

Sensitive data and data about children and adolescents

You are not required to give us sensitive data, such as health information. If you choose to tell us about a health condition, an allergy or a mobility need so we can prepare the trip, we use it only for that purpose and share it only with the people who look after you on the route.

The La Guajira tours are for travelers over 6 years old and the Ciudad Perdida tours for travelers 13 and older, so a booking may include the names of children or adolescents. That data is provided by the minor's mother, father or legal representative, or by the adult making the booking with that representative's authorization. We use it only for the booking and the trip, respecting the best interests of minors, as required by Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013.

Who we share your data with

We do not sell your data. We share it only with those who need it for the purposes described in this policy:

• Cloudflare, Inc. (United States): hosts the site, the database and the files, protects the site and verifies forms with Cloudflare Turnstile.
• The transactional email provider, which sends the booking emails and the replies to your requests.
• The payment gateways, which process the deposit or the full payment when online payment is active.
• Google (United States): Google Tag Manager loads on every page; Google Analytics and Google Ads receive cookieless signals even if you do not accept cookies (Consent Mode v2, advanced mode) and use cookies only if you accept them; YouTube, when you play a video hosted there.
• Meta Platforms (United States): WhatsApp, when you message us there; and Facebook and Instagram ads, only if campaigns are running and you accept advertising cookies.
• Microsoft (United States): Microsoft Clarity, only if it is enabled and you accept analytics cookies.
• Mux, Inc. (United States): plays the site's videos and measures playback quality only if you accept analytics cookies.
• The driver-guides and the lodgings on the route, with the data they need to provide the service.
• The authorities, when the law requires it.

International transfers and transmissions

Several of these providers process data outside Colombia, mainly in the United States, so your data may be stored or processed in other countries.

When a provider processes data on our behalf, the relationship is governed by a personal data transmission agreement under Articles 24 and 25 of Decree 1377 of 2013. International transfers are made with your authorization or in the other cases allowed by Article 26 of Law 1581 of 2012.

Your rights

As the data subject, you have the right to:

1. Access, update and correct your data.
2. Request proof of the authorization you gave us.
3. Be told, on request, how we have used your data.
4. File complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, SIC) for violations of the law.
5. Revoke your authorization or ask us to delete your data when the principles, rights and guarantees of the law are not respected.
6. Access your data free of charge.

How to exercise your rights

You can send a query or a claim through the requests and complaints form (PQRS) or in writing at our office in Riohacha.

Requests may be made by the data subject, who must prove their identity; by their heirs or successors; by their representative or attorney; and by anyone acting under a stipulation for the benefit of another, as provided in Article 20 of Decree 1377 of 2013.

Queries

To find out what data we hold about you, send a query. We answer within 10 business days of receiving it. If we cannot answer within that time, we will explain why and answer within 5 more business days at most (Article 14 of Law 1581 of 2012).

Claims

To correct, update or delete your data, or if you believe we have breached the law, submit a claim with your identification, a description of the facts, the address where you want to receive the reply and any documents you want to rely on.

If information is missing, we will ask you for it within 5 business days. If 2 months pass without you sending it, we will consider the claim withdrawn. Once the claim is complete, we will mark the data as “claim in progress” within 2 business days at most and reply within 15 business days at most. If we cannot reply within that time, we will explain why and reply within 8 more business days at most (Article 15 of Law 1581 of 2012).

Revocation and deletion

You can ask us at any time to delete your data or revoke your authorization. This does not apply when you have a legal or contractual duty to remain in the database, for example while a booking is active or an accounting obligation is pending (Article 9 of Decree 1377 of 2013).

Complaints to the SIC

You can file a complaint with the Superintendence of Industry and Commerce after you have submitted your query or claim to us (Article 16 of Law 1581 of 2012).

How long we keep your data

We keep your data for as long as we need it for the purpose for which we received it, and for the periods required by accounting, tax and consumer protection rules. After that, we delete or anonymize it.

How we protect your data

The site uses an encrypted connection (HTTPS). Only authorized staff can access the bookings and requests dashboard. The forms have spam protection and submission limits.

If a security incident puts your data at risk, we report it to the Superintendence of Industry and Commerce, as required by Article 17 of Law 1581 of 2012, and to the people affected.

Cookies

The site's analytics and advertising cookies are off until you accept them; even so, Google tags send cookieless signals for aggregate measurement. What each cookie does, how those signals work and how to change your choice are explained in the cookie policy.

Changes to this policy

The date of the last update is shown at the top of this page.

If we make a significant change to this policy, we will announce it on this site before the change takes effect and, where necessary, ask you for a new authorization.

Laws cited

• Law 1581 of 2012, in the Función Pública legal database (in Spanish)
• Decree 1377 of 2013, in the Función Pública legal database (in Spanish)