• Constitución Política, artículo 15. 
• Ley 1266 de 2008 
• Ley 1581 de 2012 
• Decretos Reglamentarios 1727 de 2009 y 2952 de 2010
• Decreto Reglamentario parcial 1377 de 2013

Authorization: Prior, explicit, and informed consent from the data subject to carry out the processing of personal data.

Privacy Notice: A verbal or written communication generated by the data controller and directed to the data subject for the processing of their personal data. It informs the data subject about the existence of the applicable data processing policies, how to access them, and the purposes for which personal data is to be processed.

Database: An organized collection of personal data subject to processing.

Successor: A person who has succeeded another due to the latter’s death (heir).

Personal Data: Any piece of information linked to one or more identified or identifiable individuals or that can be associated with a natural or legal person.

Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, information related to a person’s marital status, profession, occupation, or status as a merchant or public servant. By nature, public data may be contained in public records, public documents, gazettes, official bulletins, and judicial rulings that are duly enforceable and not subject to confidentiality.

Sensitive Data: Data that affects the privacy of the data subject or whose misuse may lead to discrimination. Examples include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in unions, social or human rights organizations, or data concerning the health, sexual life, and biometric data of the individual.

Essential Data: Personal data that is indispensable for KNT to carry out its nature tourism, photography expedition, and wildlife-observation activities — including booking, guiding, and traveler-safety management. Essential data must be provided by the data subjects or those authorized to exercise these rights.

Optional Data: Data that KNT requests to offer additional services related to its economic activity (e.g. dietary preferences, photography-equipment specifics, or newsletter subscription).

Data Processor: A natural or legal person, public or private, who, alone or in association with others, processes personal data on behalf of the Data Controller.

Data Protection Law: Refers to Law 1581 of 2012 and its regulatory decrees, or any rules that modify, supplement, or replace them.

Habeas Data: The right of any person to know, update, and rectify the information collected about them in the databases and records of public and private entities.

Data Controller: A natural or legal person, public or private, who, alone or in association with others, determines the database and/or the processing of the data.

Data Subject: A natural person whose personal data is subject to processing.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

Transfer: The transfer of data occurs when the Data Controller and/or Data Processor located in Colombia sends the information or personal data to a recipient, who in turn is responsible for processing it, either inside or outside the country.

Transmission: The processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia for the purpose of processing by the Data Processor on behalf of the Data Controller.

In the development, interpretation, and application of Law 1581 of 2012, which establishes general provisions for the protection of personal data, as well as the rules that complement, modify, or add to it, the following guiding principles shall be applied in a harmonious and integral manner:

a) Principle of Legality: Data processing is a regulated activity that must adhere to the provisions established in the law and other applicable regulations.

b) Principle of Purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the Law, which must be communicated to the data subject.

In terms of the collection of personal data, KEEPING NATURE will limit itself to collecting data that is relevant and appropriate for the purpose for which it was gathered or required by the company’s administrative or operational areas. The data subject must be informed of the reason for requesting the information and the specific use that will be made of it.

c) Principle of Freedom: Processing can only take place with the prior, explicit, and informed consent of the data subject. Personal data cannot be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that overrides the need for consent.

d) Principle of Truthfulness or Quality: Information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fractional data, or data that may lead to errors is prohibited.

e) Principle of Transparency: Data subjects must be guaranteed the right to obtain information from the data controller or processor at any time, without restrictions, regarding the existence of data concerning them.

f) Principle of Access and Restricted Circulation: Processing is subject to the limits imposed by the nature of personal data, legal provisions, and the Constitution. In this regard, processing can only be carried out by individuals authorized by the data subject and/or those stipulated by law. Personal data, except for public information, cannot be made available on the internet or other mass dissemination or communication media unless access is technically controlled to ensure restricted knowledge only to the data subject or third parties authorized under the law.

g) Principle of Security: Information subject to processing by KEEPING NATURE must be handled with the necessary technical, human, and administrative measures to ensure the security of the records, preventing their alteration, loss, unauthorized consultation, use, or fraudulent access.

h) Principle of Confidentiality: KEEPING NATURE is obliged to ensure the confidentiality of information, even after its relationship with any activities involving data processing has ended. Personal data can only be disclosed or communicated as part of the activities authorized by law.

The holder of the personal data will have the following rights:

• (a) To know, update and rectify their personal data against KEEPING NATURE, in its capacity as data controller. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
• b) Request proof of the authorization granted to KEEPING NATURE, except when expressly excepted as a requirement for the processing (cases in which the authorization is not necessary).
• c) Be informed by KEEPING NATURE, upon request, regarding the use it has given to its personal data.
• d) File before the Superintendence of Industry and Commerce complaints for infringements to the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
• e) To revoke the authorization and/or request the deletion of the data when the processing does not respect the principles, rights and constitutional and legal guarantees.
• f) Access free of charge to their personal data that have been subject to processing.

The processing shall ensure respect for the prevailing rights of children and adolescents.

The processing of personal data of children and adolescents is prohibited, except for data of a public nature.

It is the task of the State and educational entities of all kinds to provide information and train legal representatives and guardians on the possible risks faced by children and adolescents regarding the improper processing of their personal data, and to provide knowledge about the responsible and safe use by children and adolescents of their personal data, their right to privacy and protection of their personal information and that of others.

• a) Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.
• b) To request and keep a copy of the respective authorization granted by the holder.
• c) Duly inform the holder about the purpose of the collection and the rights he/she is entitled to by virtue of the authorization granted.
• d) Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
• e) Guarantee that the information is truthful, complete, exact, updated, verifiable and understandable.
• f) To update the information, thus attending to all new developments with respect to the holder’s data. Additionally, all necessary measures must be implemented to keep the information updated.
• g) Rectify the information when it is incorrect and communicate the pertinent.
• h) Respect the security and privacy conditions of the holder’s information.
• i) To process the consultations and claims formulated in the terms indicated by law.
• j) Identify when certain information is under discussion by the owner.
• k) Inform at the request of the owner about the use given to his data.
• l) Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the holder’s information.
• m) Comply with the requirements and instructions given by the Superintendence of Industry and Commerce on the particular subject.
• n) Use only data whose treatment is previously authorized in accordance with the provisions of Law 1581 of 2012.
• o) KEEPING NATURE, will use the holder’s personal data only for those purposes for which it is duly authorized and respecting in any case the current regulations on personal data protection.

KNT informs holders that they may exercise their rights regarding the processing of personal data through the email info@keepingnaturetours.com or WhatsApp +57 316 664 68 36.

The authorization of the owner of the information will not be necessary in the following cases:

a) Information required by a public or administrative entity in the exercise of its legal functions or by court order.

b) Data of a public nature.

c) Cases of medical or health emergency.

d) Processing of information authorized by law for historical, statistical or scientific purposes. Data related to the Civil Registry of persons.

The rights of the owners established in the Law may be exercised by the following persons:

a) By the holder, who must prove his identity sufficiently by the different means that KEEPING NATURE TOURS makes available to him.

b) By the assignees of the holder, who must prove such capacity.

c) By the representative and/or attorney-in-fact of the holder, prior accreditation of the representation or power of attorney.

d) By stipulation in favor of another person or for another person. The rights of children and adolescents shall be exercised by the persons authorized to represent them.

The treatment for the indispensable personal data of clients, suppliers, workers and/or contractors, will be framed in the legal order and by virtue of the condition of KEEPING NATURE and will be all those necessary for the fulfillment of the mission.

In the case of sensitive personal data, it may be used and treated when:

a) The Data Subject has given his explicit authorization to such Processing, except in cases where the granting of such authorization is not required by law.

b) The Processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.

c) The Processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided that they refer exclusively to its members or to persons who maintain regular contacts by reason of their purpose. In these events, the data may not be provided to third parties without the authorization of the Data Controller.

d) The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a legal proceeding.

e) The processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted.

The processing of personal data of children and adolescents is prohibited, except in the case of data of a public nature, and when such processing complies with the following parameters and/or requirements:

a) That they respond to and respect the best interests of children and adolescents.

b) That it ensures respect for their fundamental rights.

Once the above requirements are met, the legal representative of the children or adolescents will grant the authorization, after the minor has exercised his or her right to be heard, an opinion that will be assessed taking into account the maturity, autonomy and capacity to understand the matter.

KEEPING NATURE will watch over the adequate use of the treatment of the personal data of the children or adolescents.

Information that meets the conditions set forth in the law may be provided to the following persons:

a) To the data subjects, their successors (in their absence), or their legal representatives.

b) To public or administrative entities in the exercise of their legal functions or by court order.

c) To third parties authorized by the data subject or by law.

KNT has designated its management, through the contact channel below, as responsible for ensuring compliance with this policy. Requests, inquiries, and complaints from holders, as well as any update, rectification, or deletion of personal data, are handled through:

Email: info@keepingnaturetours.com
WhatsApp: +57 316 664 68 36

a) Inquiries: Data subjects or their successors may inquire about their personal information held by KNT, which will provide all information contained in the individual record or linked to the identification of the data subject. The inquiry should be made via info@keepingnaturetours.com. It will be addressed within a maximum of ten (10) business days from receipt. If it cannot be resolved within this time frame, the interested party will be informed of the reasons for the delay and given a new resolution date, which in no case may exceed five (5) additional business days.

b) Claims: A data subject or their successors who believe the information in a database should be corrected, updated, or deleted, or who become aware of an alleged breach of any duty under the law, may file a claim with KNT via info@keepingnaturetours.com, including identification of the data subject, a description of the facts, an address for notification, and any supporting documents. If the claim is incomplete, the complainant will be required to correct the deficiencies within five (5) business days of receipt; after two (2) months without the required information, the claim will be deemed withdrawn. If KNT is not the party authorized to resolve it, the matter will be forwarded to the appropriate party within two (2) business days, and the interested party informed. Once a complete claim is received, it will be labeled “claim in process,” with the reason, within no more than two (2) business days; this label remains until resolution. The maximum time to address the claim is fifteen (15) business days from the day following receipt. If it cannot be resolved within this period, the complainant will be informed of the reasons for the delay and given a new resolution date, which in no case may exceed eight (8) additional business days.

c) Request for Data Update, Correction, and Deletion: KNT will correct and update, at the holder’s request, any incomplete or inaccurate information following the procedures and deadlines above. The holder should send the request to info@keepingnaturetours.com, specifying the update, correction, or deletion requested, with supporting documentation.

d) Revocation of Authorization and/or Deletion of Data: Holders may revoke their consent for the processing of their personal data at any time, provided this is not prevented by a legal or contractual provision, by writing to info@keepingnaturetours.com. If, after the relevant legal period, KNT has not deleted the personal data, the holder may request the Superintendence of Industry and Commerce to order the revocation of the authorization and/or deletion of the data, under the procedure of Article 22 of Law 1581 of 2012.

e) Disclosure of Information: By accepting this policy, the data subject acknowledges that KNT may share their information with allied service providers directly involved in delivering the booked Experience — including its medical-assistance and civil-liability insurance providers — as well as with judicial or administrative authorities that request it in the exercise of their functions, subject in all cases to the confidentiality of the information.

In compliance with the legislation, and given its occasional commercial and financial links with international guests, suppliers, and payment providers, KNT may transfer and transmit personal data of holders internationally. For such transfers, KNT will take reasonable measures so that the receiving third parties commit to observe this Policy, understanding that the personal information received may only be used for matters directly related to the Experience contracted with KNT, for no longer than necessary, and may not be used for a different purpose. International transfers will observe Article 26 of Law 1581 of 2012.

This General Privacy Policy is effective as of the date of its publication in June 2017.