Privacy and personal data policy

This policy is adopted in compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013 (now compiled in Single Regulatory Decree 1074 of 2015) and the other rules governing personal data protection in the Republic of Colombia.

It applies to all personal data that La Maima collects and manages as controller, whether through this website, WhatsApp, the telephone, email, the guest register at the property or any other channel.

By sending a booking request, registering as a guest or contacting us through any of those channels, the data subject declares that they are aware of this policy and authorises the processing of their personal data on the terms described here.

We only ask for the data needed to handle the booking and provide the accommodation service. Specifically:

• Identification and contact data: first and last name, identity document number, phone or WhatsApp number and email address.
• Booking data: the house chosen, check-in and check-out dates, number of guests, total amount, payment status and the channel the booking came through (website, WhatsApp, or other external booking platforms).
• Invoicing data: whatever tax regulations require when an electronic invoice is requested.
• Payment data: online payments are processed entirely on the platform of Wompi, Bancolombia's payment gateway. La Maima does not store full card numbers or PINs; it only keeps the transaction reference and its status.
• Technical browsing data: the site only uses cookies that are strictly necessary for it to work —including the one that remembers the language you chose in the switch— and, where applicable, tools that measure site usage in aggregate. No individual profiles are built from that information.

We do not request sensitive data (racial or ethnic origin, religious or philosophical beliefs, political or union affiliation, health data, biometric data or data about sexual life). If a guest chooses to tell us voluntarily about a health condition, an allergy or an accessibility requirement so that we can serve them better, that information is handled confidentially, only for that purpose, and providing it is entirely optional.

Where a booking includes children or adolescents, their data will be provided by the responsible adult, limited to what is strictly necessary and processed in the best interests of the child, in accordance with article 7 of Law 1581 of 2012.

Personal data is processed in order to:

• Manage the booking: check availability, confirm dates and rates, process payment, issue the confirmation and block the calendar for that house.
• Provide the service: register check-in and check-out, handle requests during the stay and coordinate the experiences booked.
• Service communications: send the confirmation, reminders, directions and any relevant notice about the booking by email or WhatsApp.
• Handle requests, complaints and claims and keep a record of how they were dealt with.
• Comply with legal obligations: invoicing, accounting, tax obligations, the guest register required by tourism regulations and responding to requests from competent authorities.
• Send commercial information about offers, seasons or news from La Maima, only where the data subject expressly authorises it and with the option to unsubscribe at any time.

Data is not used for purposes other than those listed, and it is never sold to third parties.

Authorisation is obtained before the data is processed, by means that leave evidence of it: express acceptance of this policy when sending a booking request from the website, the signature on the registration card on arrival, or the written conversation on WhatsApp or by email in which the data subject provides their details in order to book.

Providing the data marked as necessary is voluntary, but without it a booking cannot be formalised or confirmed. Authorisation to receive commercial information is always optional and separate.

Under article 8 of Law 1581 of 2012, the data subject has the right to:

• Know, free of charge, what personal data La Maima processes about them.
• Update and rectify data that is partial, inaccurate, incomplete, fragmented or misleading.
• Request deletion of their data where processing does not respect the legal principles, rights and guarantees, or where the data is no longer needed for the authorised purpose.
• Withdraw the authorisation given for processing.
• Request evidence of the authorisation granted, except where the law does not require it.
• Be informed, on request, of the use made of their personal data.
• File complaints with the Colombian Superintendence of Industry and Commerce for breaches of data protection rules, once the query or claim procedure with La Maima has been exhausted.

Deletion and withdrawal do not apply where a legal or contractual duty requires the information to be kept, such as tax and accounting retention periods.

The data subject, their heirs or their representative may exercise their rights through any of these channels:

• Email: [To be confirmed with La Maima: official contact email address]
• WhatsApp or telephone: +57 311 308 2813
• Postal address: Km 12 Vía a Dapa, Yumbo, Valle del Cauca, Colombia

The request must state the data subject's full name, a contact detail for the reply, a description of the facts and what is being asked for. The response deadlines are those set by law:

• Queries: answered within a maximum of ten (10) business days, extendable by up to five (5) further business days, stating the reasons for the extension.
• Claims: answered within a maximum of fifteen (15) business days, extendable by up to eight (8) further business days. If a claim is incomplete, the person will be asked to complete it within the following five (5) days; after two (2) months with no reply, it is deemed withdrawn.

To deliver the service, La Maima relies on suppliers acting as data processors, who may only use the data following our instructions:

• Website hosting and database providers (cloud infrastructure).
• The payment gateway (Wompi, by Bancolombia), which processes the transaction and keeps the financial data under its own security standards.
• The transactional email provider, which delivers booking confirmations.
• The external booking platforms where a booking originates with them; in that case each platform is responsible for the data it collects and applies its own privacy policy.
• Accounting and tax advisers, for compliance with legal obligations.

Some of these suppliers operate servers outside Colombia. In those cases, the international transmission of data takes place under article 26 of Law 1581 of 2012 and the authorisation given by the data subject, requiring adequate levels of security and confidentiality from each supplier.

Beyond these cases, data is not shared with third parties, except at the request of a competent judicial or administrative authority.

La Maima applies reasonable technical, human and administrative measures to protect personal data against tampering, loss, unauthorised consultation, use or access: an encrypted connection (HTTPS) across the whole site, access to the admin panel restricted by username and password, and a strict separation between the public content of the site and booking data, which is never exposed publicly. The availability calendar publishes only occupied dates, with no guest information whatsoever.

Data is kept for as long as the relationship with the guest lasts and, afterwards, for the periods required by applicable legal, accounting and tax obligations. Once those periods are over, it is deleted or anonymised.

This site uses cookies and local storage that are strictly necessary for it to work —for example, to keep the admin panel session open, or to remember whether you prefer to see the site in Spanish or in English— and, where applicable, analytics tools that measure site usage in aggregate.

You can configure your browser to block or delete cookies. Doing so does not prevent you from browsing the site, although it may affect how some sections work.

This policy is in force from its publication and remains in force for as long as La Maima carries on its activity. Databases will be kept for as long as needed to fulfil the purposes described and the legal retention duties.

Any substantial change will be announced through this website before it takes effect and will be reflected in the last-updated date shown at the top of the document.