Policies

Cancellation and Modification Policy:

You may cancel or modify your reservation(s) according to the terms of the rate or plan purchased. If you do not use your reservation and have not canceled or modified it within the established timeframe, a penalty equal to the cost of the first night’s accommodation plus taxes and additional reserved services will be charged. This does not apply to non-refundable rates.

Child Policy

Children aged 0 to 10 years old incur an extra charge starting at $80,000. Accommodation for children over 11 years old is charged at the adult rate. At check-in, identification documents will be requested, and any additional charges will be applied if the age limit is exceeded.

GENERAL CONSIDERATIONS

Aware of the importance of protecting and properly managing the personal information provided by the data subjects, AVIA SOLUCIONES HOTELERAS, - hereinafter AVIANET, which acts as the controller of the received information, has designed this policy and procedures that together allow for the proper use of your personal data.

In accordance with Article 15 of the Political Constitution of Colombia, which develops the fundamental right to habeas data, referring to the right of all citizens to know, update, and rectify personal data that exists about them in databases and files, both public and private, which is inexorably related to the handling and processing of information that recipients of personal information must consider. This right has been developed through the issuance of Statutory Law 1581 of 2012 and Regulatory Decree 1377 of 2013, based on which AVIANET, as the CONTROLLER of the personal data it receives, handles, and processes the information and thus issues this personal data processing policy, which is made known to the public so that they are aware of how AVIA handles their information. The provisions of this personal data processing policy are mandatory for AVIANET, its administrators, employees, contractors, and third parties with whom AVIANET establishes relationships of any kind.

OBJECTIVE

The implementation of this policy aims to ensure the confidentiality of information and the security of its processing for all customers, suppliers, employees, and third parties from whom AVIANET has legally obtained information and personal data in accordance with the guidelines established by the regulatory law of the right to Habeas Data. Likewise, through the issuance of this policy, compliance is given to what is provided in subsection K of Article 17 of the aforementioned law.

DEFINITIONS

Authorization: Prior, express, and informed consent of the data subject to carry out the processing. This can be written, verbal, or through unequivocal conduct that reasonably concludes that the data subject granted authorization.

Database: The organized set of Personal Data that is subject to processing, electronic or not, whatever the mode of its formation, storage, organization, and access.

Query: Request by the data subject or by persons authorized by them or by law to know the information held about them in databases or files.

Personal data: Any information linked or that can be associated with one or several determined or determinable natural persons. These data are classified as sensitive, public, private, and semi-private.

Sensitive personal data: Information that affects the privacy of the person or whose improper use can generate discrimination, such as those revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations or promoting the interests of any political party, or guaranteeing the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data (fingerprints, among others).

For the purposes of this policy, AVIANET advises the optional nature of providing such information in cases where it may eventually be requested.

Public personal data: Data that is classified as such according to the mandates of the law or the Political Constitution and all those that are not semi-private or private. Public data includes, among others, data contained in public documents, public registers, official gazettes and bulletins, and duly executed judicial decisions that are not subject to confidentiality, data related to the civil status of persons, their profession or occupation, and their status as a merchant or public servant. Public data also includes personal data existing in the commercial register of the Chambers of Commerce (Article 26 of the C.Co.).

Likewise, public data includes those which, by decision of the data subject or by legal mandate, are found in files of free access and consultation. These data can be obtained and offered without any reservation and regardless of whether they refer to general, private, or personal information.

Private personal data: Data that by its intimate or reserved nature is only relevant to the data subject. Examples include: merchants' books, private documents, information extracted from home inspections.

Semi-private personal data: Data that is not intimate, reserved, or public, and whose knowledge or disclosure may interest not only its data subject but also a certain sector or group of people or society in general, such as data relating to compliance and non-compliance with financial obligations or data relating to relationships with social security entities.

Data Controller: A person who, by themselves or in association with others, decides on the database and/or the processing of the data.

Data Processor: The person who processes data on behalf of the data controller.

Being "Authorized" refers to AVIANET and all persons under its responsibility who, by virtue of authorization and this Policy, have legitimacy to process the data of the data subject. The Authorized includes the broader category of those Enabled.

"Enablement" or being "Enabled" refers to the legitimization granted by AVIANET to third parties, expressly and in writing through a contract or equivalent document, in compliance with applicable law, for the processing of personal data, making such third parties data processors of the personal data provided or made available.

Complaint: Request by the data subject or authorized persons to correct, update, or delete personal data or when there is an alleged violation of the data protection regime, as per Article 15 of Law 1581 of 2012.

Data Subject: The natural person to whom the information refers.

Processing: Any operation or set of operations performed on personal data such as collection, storage, use, circulation, or deletion of such information.

Transmission: The processing of personal data involving their communication within Colombia (national transmission) or outside Colombia (international transmission) for the purpose of processing by the data processor on behalf of the data controller.

Transfer: The transfer of data occurs when the data controller and/or processor, located in Colombia, sends the information or personal data to a recipient, who in turn is a data controller and is located inside or outside the country.

Requirement of Procedural Stage: The data subject or heir can only file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or complaint procedure with the data controller or data processor, according to Article 16 of Law 1581 of 2012.

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

The processing of personal data must respect the general and special rules on the subject and for activities permitted by law. Therefore, for the purposes of this policy, the following principles apply:

Principle of Legality: Data processing is a regulated activity that must comply with the law and other relevant provisions.

Principle of Purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the Law.

Principle of Freedom: Processing can only be carried out with the prior, express, and informed consent of the data subject. Personal data cannot be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that exempts consent.

Principle of Veracity or Quality: Information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, or misleading data is prohibited.

Principle of Transparency: Data subjects must be guaranteed the right to obtain from the data controller, at any time and without restrictions, information about the existence of data concerning them.

Principle of Access and Restricted Circulation: Processing is subject to limits derived from the nature of personal data, legal provisions, and the Constitution. Therefore, processing can only be performed by persons authorized by the data subject and/or by persons provided for by law.

Principle of Security: Information subject to processing must be handled with the necessary technical, human, and administrative measures to ensure security, preventing its adulteration, loss, unauthorized consultation, use, or access.

Principle of Confidentiality: All persons involved in processing personal data that are not public in nature are obliged to ensure the confidentiality of the information, even after their relationship with any of the processing tasks has ended, and may only provide or communicate personal data when it corresponds to the activities authorized by this law and under its terms.

Any new project within the Organization that involves the Processing of Personal Data must be consulted with the Information Security Management, which is responsible for data protection to ensure compliance with the policy and necessary measures to maintain the confidentiality of personal data.

RIGHTS OF DATA SUBJECTS

In accordance with current legal provisions, the following are the rights of personal information holders:

- Right to know, update, rectify, and consult personal data at any time with AVIANET concerning data considered partial, inaccurate, incomplete, fragmented, and those that induce error.

- Right to request proof of the authorization given to AVIANET at any time, except in cases where legally the controller is exempt from having authorization to process the data of the holder.

- Right to be informed by AVIANET, upon request, about the use of their data.

- Right to file complaints with the Superintendency of Industry and Commerce to enforce their Habeas Data rights.

- Right to revoke authorization and/or request the deletion of data when AVIANET has not respected their constitutional rights and guarantees.

- Right to free access to personal data voluntarily shared with AVIANET.

The information and/or personal data we collect from you are as follows:

Type of Person:

Natural: Names and surnames, type of identification, identification number, gender, marital status and date of birth, email, financial data (bank accounts).

Legal:Company name, NIT, address, phone, cell phone, email, country, city, financial data (bank accounts).

Information necessary to facilitate travel or other services, including preferences such as travel class, names and surnames of passengers (type of document, document number, date of birth, first name, last name, gender, email, nationality, passport expiration date), emergency contacts or any other anomaly (names and surnames, phone).**

Cardholder Information: document type, document number, phone number, address, email, names, card number, expiration date, and bank.

Quotation Request: names, surnames, phone numbers, city, and email.

Travel Information: request type, destination, departure date, duration, number of adults, number of children, hotel category, meals, additional services, transportation service, budget per person.

Write to Jean Claude Bessudo: names, surnames, ID number, address, phone number (landline or cell), city, and email.

Online Help Chat: name, email, what is your question?

Evaluate Our Site: your opinion is very important to us for continuously improving our customer service channels: names, surnames, email, phone numbers, and city.

Complaint Request: names, surnames, identification number, address, phone numbers, city, email, and comments.

Technical Problem Report: names, surnames, address, phone numbers, city, email, and comments.

Biometric Data: images, video, audio, fingerprints that identify or make identifiable our clients, users, or any person entering, being in, or transiting any place where AVIANET has implemented devices to capture such information.

This data may be stored and/or processed on servers located in data centers either owned by or contracted with providers located in various countries, which is authorized by our clients/users by accepting this personal data processing and protection policy.

AVIANET reserves the right to improve, update, modify, or delete any type of information, content, domain, or subdomain that may appear on the website, without prior notice, with publication on Aviatur’s websites deemed sufficient. This is for resolving legal or internal requests and for offering or providing new services or products.

PROCESSING, SCOPE, AND PURPOSES

AVIANET informs data subjects that the data collected from our clients, contractors, and suppliers may be used for the following purposes. The processing may be carried out by AVIANET directly or through its contractors, consultants, advisors, and/or third parties responsible for personal data processing, to perform any operation or set of operations such as collection, storage, use, circulation, deletion, classification, transfer, and transmission (the “Processing”) of all or part of their personal data:

- Supporting the contractual relationship established with AVIANET.

- Providing services related to the offered products and services.

- Performing all activities related to the service or product, including adding you to an email list for newsletter distribution.

- Sending information about changes to the conditions of purchased services and products and notifying you about new services or products.

- Managing your requests, clarifications, and investigations.

- Conducting studies and programs necessary to determine consumption habits.

Refinement of Security Filters and Business Rules: refining security filters and business rules in commercial transactions; confirming and processing such transactions with your financial institution, our service providers, and with you.

Periodic Evaluations: performing periodic evaluations of our products and services to improve their quality.

Information Distribution: sending technical, operational, and commercial information about products and services offered by AVIANET, its partners, or providers, both currently and in the future, through traditional and electronic means.

Satisfaction Surveys: requesting satisfaction surveys, which you are not obligated to answer.

Data Transmission and Transfer: transmitting and/or transferring data to other companies, business alliances, or third parties to fulfill acquired obligations. Transmission and transfer may even occur to third countries that may have a different level of protection compared to Colombian standards when necessary to meet our obligations.

Compliance with Obligations: fulfilling obligations undertaken by AVIANET with its clients when acquiring our services and products.

Response to Queries: responding to inquiries, requests, complaints, and claims made by control bodies and other authorities that, by virtue of applicable law, must receive personal data.

Other Activities: performing any other activities similar to those described above that are necessary to develop the corporate purpose of AVIATUR.

Consultations for Fraud Control: conducting consultations in various databases and authorized sources (such as OFAC lists, UN, among others) necessary for the control and prevention of fraud or crimes related to money laundering, according to our prevention and risk management policies - SARLAFT.

Employee Data:

- Compliance with obligations undertaken by AVIANET with employees regarding salary payments, social benefits, and other aspects stipulated in the employment contract and current labor regulations.

- Informing employees of updates during and after the term of their employment contract.

- Evaluating the quality of the services we provide.

- Conducting internal studies on employee habits or requesting personal information for developing management programs or systems.

- Making authorized payroll deductions.

- Managing requests, activity administration, clarifications, and investigations.

- Marketing and selling our products and services.

- Sending technical, operational, and commercial information about products and services offered by associates or providers, both currently and in the future, through traditional and electronic means.

- Conducting studies and programs necessary to determine consumption habits.

- Transmitting and/or transferring data to other companies, business alliances, or third parties to fulfill acquired obligations. Transmission and transfer may even occur to third countries with different protection levels compared to Colombian standards when necessary to meet our obligations.

- Requesting surveys that employees are not obligated to answer.

- Transferring information to judicial and/or administrative entities when necessary to fulfill duties as an employer, including labor, social security, pensions, occupational risks, family compensation funds (Comprehensive Social Security System), and taxes.

- Transferring personal information to third parties legitimately authorized to access such information, including but not limited to companies within the Aviatur Ltda. Group.

- Providing personal information to entities involved in fulfilling the responsibilities of the employer.

- Performing any other activities similar to those described above that are necessary to develop the corporate purpose of AVIATUR and fulfill labor obligations acquired through the employment contract or by law.

Data Processing Authorization: processing personal data will be carried out with prior authorization from the data subject, except in cases where the data is of a public nature. An authorization format for data processing has been implemented, which must be completed by the data subject at the time they provide their personal information. This authorization explains the scope and purposes of personal data processing, references authorization by others, data about minors and sensitive data, and defines the contact channel for data subjects who wish to exercise their rights under data protection laws, and indicates where this policy is located. To ensure data processing, AVIANET employs all activities to maintain the confidentiality of the information.

Authorization: Authorization will be obtained through any means that can be consulted later, such as the website, forms, formats, in-person activities, or social media, etc. Authorization may also be obtained from unequivocal behaviors of the data subject that reasonably allow us to conclude that they have granted permission for the processing of their information.

Third-Party Information: If you provide us with personal information about someone other than yourself, such as your spouse or a colleague, we assume that you have obtained that person's authorization to provide us with their data; we do not verify, nor assume the obligation to verify the identity of the user/client, nor the accuracy, validity, sufficiency, and authenticity of the data they provide. Therefore, we do not assume responsibility for damages or prejudices of any kind that may arise from the lack of accuracy, homonymy, or impersonation of identity information.

Data Sharing: Since AVIANET belongs to the Aviatur Business Group, your personal information may be shared through transfer or transmission with group companies, business partners, and/or third-party providers involved (such as flight, hotel, car booking systems, transaction security validators, banks, financial networks, tourist services). These processes may be carried out in different locations from where the tourism service or product is contracted, for the same purposes indicated for the collection of personal data. These entities are obligated to comply with the confidentiality agreements, transmission, or transfer requirements.

Data Processing: Personal data collected will be subject to manual or automated processing and incorporated into the relevant files or databases (hereinafter, the "File"), either as a data processor or as responsible for data protection. The term of data processing will consider applicable regulations for each purpose and the administrative, accounting, fiscal, legal, and historical aspects of the information.

Minors and Disabled Individuals: When the data subject is accompanied by minors or individuals considered disabled, and their personal data is collected, AVIANET will always request authorization from the legal representative of the minor. However, if personal information is provided about this population without being the legal representative, you declare that you have the authorization from the respective legal representative, assuming direct responsibility for it. AVIANET will ensure that the rights and best interests of such individuals are respected at all times. The representative must ensure the right to be heard and consider the opinion of the minor regarding the processing, taking into account their maturity, autonomy, and capacity. Representatives are informed that responding to questions about minor data is optional. Data about minors, which are in a special protection category, will be processed according to applicable legislation and our personal data policy.

Security Measures: The companies within the Aviatur Business Group have adopted the legally required levels of data protection security and have implemented all available technical measures to prevent loss, misuse, alteration, unauthorized access, and illegal removal of personal data provided to AVIANET. However, data subjects should be aware that internet security measures are not infallible.

Data Deletion: If you choose to delete your information, to the extent permitted by law, we will retain certain personal information in our files to account for transactions, prevent fraud, resolve disputes, investigate conflicts or incidents, enforce our terms and conditions, and comply with legal requirements.

Revocation of Authorization: If you decide to revoke your authorization, the information stored will not be used for the purposes outlined here, except as strictly necessary and defined in the previous paragraph.

Security Risks in Online Transactions: 

- Users may be deceived by phishing emails or DNS spoofing to visit a fake site that mimics the original, where card details are captured by a fraudulent system. It is important to develop a culture where users perform transactions directly through known domains to reduce risks.

  - The computer used for transactions might unknowingly have spyware or malicious software that captures keystrokes or input device information, which could be sent to a network or host online. Therefore, it is recommended to conduct transactions on a home or office computer.

- There may be identity theft where the data subject denies having sent or received a transaction, which could be used by a third party.

- It is recommended that the device used for electronic transactions has up-to-date and active antivirus software to mitigate fraud risks.

Historical Data Collection: If personal information was collected or provided before July 30, 2013, and you did not express opposition to the transfer of your personal data, it will be understood that you have granted your consent. If you wish to reaffirm your consent or express your refusal, you may do so via email at privacidad@aviasolucioneshoteleras.com.

Cookies and Device Fingerprinting: Like other websites, AVIANET uses certain technologies, such as cookies and device fingerprinting, to make your visit to our site easier and more efficient by providing personalized service and recognizing you when you return. For this Privacy Notice, "cookies" are identified as text files of information that a website transfers to the user's computer hard drive to store certain records and preferences.

Third-Party Cookies and Tracking: Websites may allow third-party advertising or functions that send cookies to users' computers.

Cookies are associated only with an anonymous user and their computer and do not provide the user's name and surname. In many cases, you can browse AVIANET's websites anonymously. When you access any AVIANET website, your IP address (the Internet address of your computer) is recorded to give us an idea of which parts of the website you visit and how long you spend in each section. We do not link your IP address to any personal information unless you have registered with us and logged into the system using your profile.

User Recognition: Therefore, in some AVIANET applications, users may be recognized after their initial registration without needing to log in each time to access areas and services or products reserved exclusively for them.

Access Keys and Digital Certificates: In other services, certain access keys or even a digital certificate may be required, depending on the specified features.

Cookies Security: The cookies used cannot read cookies created by other providers. AVIANET encrypts user identification data for added security.

Cookie Installation: To use the AVIANET website, it is not necessary for the user to allow the installation of cookies sent by AVIANET, although in such a case, the user will need to register for each service that requires prior registration.

National or International Transfer of Personal Data: 

AVIANET may transfer data to other data controllers when authorized by the data subject, by law, or by an administrative or judicial mandate.

International and National Data Transmission to Data Processors:

AVIANET may send or transmit data to one or more data processors located inside or outside the Republic of Colombia in the following cases: a) When there is authorization from the data subject, and b) When, without authorization, there is a data transmission contract between the controller and the processor.

Duties of the Data Controller:

- Ensure the data subject's full and effective exercise of the right to habeas data at all times.

- Request and retain, under the conditions set out in this law, a copy of the authorization granted by the data subject.

- Properly inform the data subject about the purpose of data collection and the rights they have under the granted authorization.

- Keep the information under necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use, or access.

- Handle inquiries and complaints in accordance with the terms outlined in this law.

- Adopt an internal manual of policies and procedures to ensure compliance with this law, especially for handling inquiries and complaints.

- Inform the data subject upon request about the use of their data.

- Inform the data protection authority when security code violations occur and there are risks in managing the data subject’s information.

- Comply with the instructions and requirements of the Superintendence of Industry and Commerce.

Duties of Data Processors:

- Ensure the data subject's full and effective exercise of the right to habeas data at all times.

- Keep the information under necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use, or access.

- Timely update, correct, or delete data in accordance with this law.

- Update information reported by data controllers within five (5) business days from receipt.

- Handle inquiries and complaints from data subjects in accordance with the terms of this law.

- Adopt an internal manual of policies and procedures to ensure compliance with this law and, in particular, for handling inquiries and complaints from data subjects.

- Refrain from circulating information that is disputed by the data subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.

- Allow access to the information only to authorized individuals.

- Inform the Superintendence of Industry and Commerce when security code violations occur and there are risks in managing the data subject’s information.

- Comply with the instructions and requirements of the Superintendence of Industry and Commerce.

Requests, Complaints, and Claims:

For receiving requests, complaints, and inquiries related to the handling and processing of personal data, AVIANET has designated the email address privacidad@aviasolucioneshoteleras.com to channel, study, and respond to them. Therefore, you may send your requests to this address, which will be handled in accordance with Law 1581.

Inquiries: Data subjects or their legal heirs may inquire about their personal information stored in our database. AVIANET will provide them with all the information contained in the individual record or related to the identification of the data subject. The inquiry will be addressed within a maximum term of ten (10) business days from the date of receipt. If it is not possible to respond within this term, the data subject will be informed, and the date when their inquiry will be addressed will be indicated, which in no case may exceed five (5) business days following the expiration of the initial term.

Complaints: Data subjects or their legal heirs who believe that the information contained in a database should be corrected, updated, or deleted, or who notice a potential breach of any duties under the law, may file a complaint with AVIANET, which will be processed under the following rules:

- The complaint must be submitted via a request addressed to AVIANET, including the data subject’s identification, a description of the facts leading to the complaint, the address, and any supporting documents. If the complaint is incomplete, AVIANET will request the missing information from the data subject within five (5) days of receipt. If the data subject does not provide the requested information within two (2) months from the request date, it will be understood that they have withdrawn their complaint.

- Once the complete complaint is received, a note saying “complaint in process” and the reason for it will be added to the database within no more than two (2) business days. This note must remain until the complaint is resolved.

- The maximum term to address the complaint is fifteen (15) business days from the day following its receipt. If it is not possible to address the complaint within this term, the data subject will be informed and a date when the complaint will be addressed will be indicated, which in no case may exceed eight (8) business days following the expiration of the initial term.

- In any case, the data subject or their legal heir may only file a complaint with the Superintendence of Industry and Commerce after exhausting the inquiry or complaint process with AVIANET.

- The department responsible for receiving and processing complaints is the Information Security Management.

- Requests for data deletion and revocation of authorization will not be processed if the data subject has a legal or contractual obligation to remain in the database.

DATA CONTROLLER INFORMATION

- Corporate Name: Operadora de Hoteles Avia SAS

- Address: Centro de Negocios Andino, Carrera 11 # 82-01 Piso 4, Bogotá DC - Colombia

-Email: privacidad@aviasolucioneshoteleras.com

-Phone: (+57 1) 3817111

- Website: www.aviasolucioneshoteleras.com 

QUESTIONS OR SUGGESTIONS

If you have any questions or inquiries about the process of collecting, processing, or transferring your personal information, or believe that the information in a database should be corrected, updated, or deleted, please send us a message to: privacidad@aviasolucioneshoteleras.com.

For more information about AVIATUR, including its identity, address, and contact details, you can visit www.aviasolucioneshoteleras.com. This website includes the terms and conditions applicable to the services and products published, which can be consulted at any time for more information.

VALIDITY

AVIANET reserves the right to modify this policy to adapt it to legislative or jurisprudential updates, as well as to good practices in the tourism sector and other sectors of the economy that are part of the business group. In such cases, AVIANET will announce the changes on this page with reasonable advance notice before they take effect.