Logo
HomeCompaniesTravelsSell with usContact usSubscriptions
Subscriptions

Data processing policy

1. GENERAL ASPECTS

HOLDING CLUB CYBERCARD S.A.S, in order to observe and ensure full compliance with the legal provisions on the processing of personal data established in Law 1581 of 2012, partially regulated by Decree 1377 of 2013, which develop the constitutional right that all individuals have to know, update, and rectify the information collected about them in databases or files, as well as other rights, freedoms, and guarantees referred to in Articles 15 and 20 of the Political Constitution.

2. LEGAL FRAMEWORK

Political Constitution, Articles 15 and 20. Law 1266 of 2008. Law 1581 of 2012. Regulatory Decrees 1727 of 2009 and 2952 of 2010. Partial Regulatory Decree No. 1377 of 2013. Constitutional Court Rulings C–1011 of 2008 and C–748 of 2011.

Returns within 30 days from the date of receipt

You have the right to receive a full refund for products returned in their original condition within 30 days from the date of receipt. You may receive a partial refund or no refund if the returned products are used or damaged. Please read the full return policy.

3. PURPOSE AND PROCESSING OF PERSONAL DATA

The personal data that HOLDING CLUB CYBERCARD S.A.S collects, stores, uses, circulates, deletes, processes, or compiles will be used for the following purposes: to offer services and promotional campaigns; provide value-added services, advertising, and participation in benefit and loyalty programs; consult information centers for commercial and credit service purposes; analyze consumption habits and preferences to design offers, promotions, and services, among others; contact you for market research and satisfaction surveys; manage and handle requests, complaints, claims, and suggestions; and share information with partner companies, associates, branches, affiliates, and subsidiaries for service offerings.

4. DEFINITIONS

The following definitions are established as the framework for the personal data processing policies set forth herein, in order to ensure appropriate application of the regulatory environment, in accordance with the interpretation criteria established by law: Authorization: Prior, express, and informed consent of the Data Subject for the processing of personal data. Database: Organized set of personal data subject to processing. Personal Data: Any information linked or that can be associated with one or more identified or identifiable natural persons. Data Controller: Natural or legal person, public or private, who alone or jointly with others decides on the database and/or the processing of data. Data Processor: Natural or legal person, public or private, who alone or jointly with others carries out the processing of personal data on behalf of the data controller. Data Subject: Natural person whose personal data is subject to processing. Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

5. GUIDING PRINCIPLES

The following legal principles shall be taken into account in the interpretation and application of the established guidelines: Principle of Legality: In the use, collection, and processing of personal data, the applicable and current legal provisions governing data protection and related fundamental rights shall be applied. Principle of Freedom: The use, collection, and processing of personal data can only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal, statutory, or judicial mandate that replaces consent. Principle of Purpose: The use, collection, and processing of personal data accessed and gathered by HOLDING CLUB CYBERCARD S.A.S shall be subject to and serve a legitimate purpose, which must be informed to the respective Data Subject. Principle of Truthfulness or Quality: The information subject to use, collection, and processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited. Principle of Transparency: During the use, collection, and processing of personal data, the Data Subject’s right to obtain information from HOLDING CLUB CYBERCARD S.A.S at any time and without restriction regarding the existence of any personal data of interest must be guaranteed. Principle of Restricted Access and Circulation: Personal data, except for public information, may not be available on the Internet or other mass communication or dissemination media unless access is technically controllable to ensure restricted knowledge only by the Data Subject or authorized third parties. For this purpose, HOLDING CLUB CYBERCARD S.A.S has a duty of means. Principle of Security: Personal data and information used, collected, and processed by HOLDING CLUB CYBERCARD S.A.S shall be protected to the extent permitted by technical resources and minimum standards, through the adoption of technological protection measures, protocols, and all necessary administrative actions to secure electronic records and repositories, preventing their alteration, modification, loss, consultation, or unauthorized use or access. Principle of Confidentiality: All individuals who manage, handle, update, or access information of any kind contained in databases commit to maintain strict confidentiality and not disclose it to third parties. All persons currently working or to be engaged in the future for the management of databases must sign an additional document or annex to their employment or service contract to ensure this commitment. This obligation continues even after their relationship with the company ends.

6. PROCESSING OF SENSITIVE DATA

Sensitive Data: Sensitive data refers to information that affects the Data Subject’s privacy or whose misuse could lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, union membership, membership in social or human rights organizations, or data concerning health, sexual life, or biometric information. The processing of sensitive data shall occur only when: (a) The Data Subject has given explicit authorization for such processing, except in cases where the law does not require it; (b) The processing is necessary to safeguard the Data Subject’s vital interest and the Data Subject is physically or legally incapacitated, in which case legal representatives must provide authorization; (c) The processing is carried out in the course of legitimate activities with appropriate guarantees by a foundation, NGO, association, or any other non-profit organization with political, philosophical, religious, or union purposes, provided it refers exclusively to its members or individuals with regular contact due to its purpose. In these cases, the data may not be provided to third parties without authorization from the Data Subject; (d) The processing is necessary for the recognition, exercise, or defense of a right in judicial proceedings; or (e) The processing has a historical, statistical, or scientific purpose, in which case measures to suppress the Data Subject’s identity must be adopted.

7. Rights of Data Subjects

In accordance with Article 8 of Law 1581 of 2012, the Data Subject shall have the following rights:

  • Know, update, and rectify their personal data against HOLDING CLUB CYBERCARD S.A.S or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or not authorized.
  • Request proof of the authorization granted to HOLDING CLUB CYBERCARD S.A.S, except when expressly exempted as a requirement for Processing, in accordance with Article 10 of Law 1581 of 2012.
  • Be informed by HOLDING CLUB CYBERCARD S.A.S or the Data Processor, upon request, regarding the use that has been made of their personal data.
  • Submit complaints to the Superintendencia de Industria y Comercio for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add, or supplement it.
  • Revoke the authorization and/or request the deletion of the data when the Processing does not respect the principles, rights, and constitutional and legal guarantees. The revocation and/or deletion shall proceed when the Superintendencia de Industria y Comercio has determined that HOLDING CLUB CYBERCARD S.A.S or the Data Processor has engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
  • Access, free of charge, their personal data that have been processed.

8. Duties of HOLDING CLUB CYBERCARD S.A.S

HOLDING CLUB CYBERCARD S.A.S acknowledges the ownership of personal data belonging to individuals and, therefore, they are the only ones who can decide on the use of such information. Accordingly, HOLDING CLUB CYBERCARD S.A.S will use the data collected only for the purposes for which it is authorized and respecting, in all cases, the current regulations on the protection of personal data.

In accordance with Article 17 of Law 1581 of 2012, HOLDING CLUB CYBERCARD S.A.S undertakes to fulfill the following duties in relation to the Processing of Personal Data:

  • Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
  • Request and keep, under the conditions provided by law, a copy of the respective authorization granted by the Data Subject.
  • Properly inform the Data Subject of the purpose of the collection and the rights that assist them by virtue of the authorization granted.
  • Maintain the information under the necessary security conditions to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access.
  • Ensure that the information provided to the Data Processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
  • Update the information, communicating timely to the Data Processor all developments regarding the data previously provided and take other necessary measures to ensure that the information provided to them remains up to date.
  • Rectify information when it is incorrect and communicate the relevant information to the Data Processor.
  • Provide the Data Processor, as appropriate, only data whose Processing is previously authorized in accordance with the provisions of this law.
  • Demand that the Data Processor at all times respect the security and privacy conditions of the Data Subject’s information.
  • Process inquiries and complaints formulated in the terms indicated by law.
  • Adopt an internal manual of policies and procedures to ensure proper compliance with the law and, particularly, to address inquiries and complaints.
  • Inform the Data Processor when certain information is under discussion by the Data Subject, once a claim has been filed and the respective process has not been completed.
  • Inform the Data Subject, upon request, about the use given to their data.
  • Inform the data protection authority when violations of security codes occur and there are risks in the administration of the information of the Data Subjects.
  • Comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio.

9. Authorization and Consent

HOLDING CLUB CYBERCARD S.A.S will obtain the prior, express, and informed authorization of the Data Subjects for the Processing of their personal data, except in the cases expressly exempted by law. This authorization may be obtained in writing, verbally, or through unequivocal behavior that allows it to be reasonably concluded that the authorization was granted.

10. Validity of the Database

The databases under the responsibility of HOLDING CLUB CYBERCARD S.A.S will be valid as long as the purposes for which the data were collected remain in force. However, HOLDING CLUB CYBERCARD S.A.S will proceed with the deletion of personal data when requested by the Data Subject, provided that there is no legal or contractual duty that prevents their deletion.

11. Procedures for the Exercise of Rights

Data Subjects or their successors may exercise their rights to know, update, rectify, and delete information, or revoke the authorization granted for its Processing, by submitting requests to HOLDING CLUB CYBERCARD S.A.S through the means provided for this purpose.

12. Inquiries

HOLDING CLUB CYBERCARD S.A.S will respond to inquiries regarding the personal data of the Data Subject within a maximum term of ten (10) business days from the date of receipt. When it is not possible to respond within this term, the interested party will be informed of the reasons for the delay and the date on which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

13. Claims

The Data Subject or their successors who consider that the information contained in a database should be corrected, updated, or deleted, or when they note alleged non-compliance with any of the duties contained in the law, may file a claim before HOLDING CLUB CYBERCARD S.A.S, which will be processed under the following rules:

  • The claim will be submitted by means of a request addressed to HOLDING CLUB CYBERCARD S.A.S containing the identification of the Data Subject, the description of the facts that give rise to the claim, the address, and accompanying documents to be asserted. If the claim is incomplete, the interested party will be required within five (5) days following receipt to correct the deficiencies. After two (2) months from the date of the request without the applicant presenting the required information, it will be understood that the claim has been withdrawn.
  • If the person receiving the claim is not competent to resolve it, they will transfer it to the appropriate party within a maximum term of two (2) business days and will inform the Data Subject of the situation.
  • Once the complete claim is received, a legend stating “claim in process” and the reason for it will be included in the database within a term no greater than two (2) business days. This legend must remain until the claim is decided.
  • The maximum term to address the claim will be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within this term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

14. Data Protection Officer

HOLDING CLUB CYBERCARD S.A.S has designated a data protection officer who is responsible for ensuring the correct application of this policy and compliance with the rules on personal data protection. Data Subjects may contact the data protection officer to exercise their rights through the communication channels provided by HOLDING CLUB CYBERCARD S.A.S

15. Security Measures

HOLDING CLUB CYBERCARD S.A.S has adopted the technical, human, and administrative measures necessary to ensure the security of personal data, preventing its alteration, loss, unauthorized or fraudulent access, or Processing. The personnel involved in the Processing of personal data are obliged to guarantee the confidentiality of the information even after the termination of their relationship with any of the tasks involving Processing.

16. Transfer and Transmission of Data

HOLDING CLUB CYBERCARD S.A.S may transfer and/or transmit personal data to third countries when authorized by the Data Subject or when permitted by law. In such cases, the necessary contractual clauses will be established to ensure adequate protection of the data.

17. International Data Transfers

When international data transfers occur, HOLDING CLUB CYBERCARD S.A.S will ensure compliance with the provisions of Colombian regulations on the subject and, in particular, that the country of destination provides adequate levels of data protection.

18. Data of Minors

The Processing of personal data of minors by HOLDING CLUB CYBERCARD S.A.S will only take place when it responds to and respects their best interests, and their fundamental rights are ensured. In any case, the prior, express, and informed authorization of their parents or legal guardians will be required.

19. Modifications to the Policy

HOLDING CLUB CYBERCARD S.A.S reserves the right to modify this Policy at any time. Any modification will be communicated timely through the website or other usual means of contact.

20. Entry into Force

This Policy shall take effect from the date of its publication and will remain in force as long as HOLDING CLUB CYBERCARD S.A.S carries out Processing of personal data.

21. Applicable Law and Jurisdiction

This Policy is governed by Colombian law, particularly by Law 1581 of 2012 and its regulatory decrees. Any dispute related to this Policy will be resolved by the competent courts of the Republic of Colombia.

22. Contact Information

For inquiries, requests, complaints, or claims related to personal data, the Data Subject may contact HOLDING CLUB CYBERCARD S.A.S through the following channels: