Personal Data Processing Policies

Hotel Bora Bora Bar Restaurante, which operates the Grupo Bora Bora and Bora Bora Beach Club brands ("Bora Bora"), adopts this policy in compliance with Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Single Regulatory Decree 1074 of 2015) and any rules that amend or supplement them, in order to guarantee everyone's constitutional right to know, update and correct the information collected about them (article 15 of the Colombian Constitution).

Our contact details are at the end of this page. This policy applies to the personal data collected through this website and the channels offered from it: the booking and payment form, the subscription form and the WhatsApp links.

Definitions

1. Personal data: any information linked or that can be associated with one or more identified or identifiable natural persons.
2. Data subject: the natural person whose personal data is processed.
3. Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
4. Controller: the person who decides on the database and the processing of the data.
5. Processor: the person who processes personal data on behalf of the controller.
6. Authorisation: the data subject's prior, express and informed consent to the processing.
7. Transmission: the communication of personal data to a processor, inside or outside Colombia, so that it processes it on behalf of the controller.

Personal data we collect

When you book a day pass

To create and confirm your booking we ask for: email address, first name, last name, phone number, and type and number of identity document (Colombian ID card, foreigner ID card or passport). Together with them we record the booking details: the day pass, the date, the number of guests, the amount and the reference and status of the transaction.

Your card or bank account details are received and processed directly by the Wompi payment gateway on its own platform. Bora Bora never sees or stores your card number or passwords.

When you subscribe

If you leave your email in the website's subscription form, we receive that email, the language you were browsing in and the date of the subscription.

When you message us on WhatsApp

The website's WhatsApp buttons open a conversation with our team in the WhatsApp app. In that case we process your phone number, your profile name and any information you choose to share in the conversation. The website itself does not receive or store that information.

When you browse the website

Like any website, our hosting provider logs technical data for each visit (IP address, browser and device type, requested page, date and time), which is used exclusively to operate the site, keep it secure and diagnose failures.

We do not collect sensitive data (such as racial origin, health, political or religious views, or biometric data) and will not ask you to provide it.

Purposes of processing

Your personal data is processed for the following purposes:

1. Creating, confirming and managing your booking, and issuing the corresponding voucher.
2. Processing the payment for the booking through the payment gateway and verifying its result.
3. Verifying your identity and that of the guests at boarding and at the entrance to the club.
4. Contacting you about your booking: confirmations, changes, rescheduling or cancellations, including those due to sea conditions or orders from the Port Authority.
5. Handling your requests, enquiries, complaints and claims, and processing requests for changes, withdrawal, refunds or payment reversals.
6. Sending you, if you subscribed, information about our experiences, news and offers. You can unsubscribe at any time.
7. Complying with legal, accounting, tax and tourism obligations, and responding to requests from competent authorities.
8. Preventing fraud and protecting the security of the site and of our customers.

Authorisation

You grant your authorisation for the processing of your data by completing and submitting the booking form and accepting our policies, by submitting your email in the subscription form, or by starting a conversation with us on WhatsApp. We will keep proof of that authorisation.

If you book on behalf of other people, you declare that you have their authorisation to provide us with their data. Bookings must be made by adults; the data of children and adolescents travelling with them will be processed respecting their best interests and fundamental rights, pursuant to article 7 of Law 1581 of 2012.

Who we share your data with

Bora Bora does not sell or assign your personal data. We only share it with third parties that provide services needed for the purposes described, acting as processors and under a duty to protect the information:

1. Grupo Bora Bora's booking system, where bookings are created and managed.
2. Wompi (Bancolombia S.A.), the payment gateway that processes the payment for your booking.
3. Web hosting, cloud infrastructure and email delivery providers, including Vercel Inc. and Resend Inc.
4. WhatsApp (Meta Platforms), when you choose to contact us through that channel.
5. Our website development and technical support provider.

Some of these providers are located, or store information, outside Colombia, mainly in the United States. By accepting this policy you authorise that international transmission of data, which is made to providers offering adequate levels of protection, pursuant to article 26 of Law 1581 of 2012.

We may also disclose your data to public or judicial authorities when they require it in the exercise of their legal functions.

Cookies and storage in your browser

This website does not use its own advertising or analytics cookies. For the site to work we store information in your own browser:

1. The shopping cart (day pass, date and number of guests), so you don't lose it between visits. It contains no personal data.
2. The details you type into the booking form, so you don't have to type them again if the payment fails or you reload the page. They are deleted automatically when you close the tab.

You can delete this information at any time from your browser settings. Wompi and WhatsApp may use their own cookies when you access their platforms, under their respective privacy policies.

Your rights

Under article 8 of Law 1581 of 2012, as the data subject you have the right to:

1. Know, update and correct your personal data, including partial, inaccurate, incomplete, fragmented or misleading data.
2. Request proof of the authorisation granted, except where the law does not require it.
3. Be informed, on request, of the use made of your personal data.
4. File complaints for breaches of the law with the Superintendence of Industry and Commerce, once you have exhausted the enquiry or claim procedure with Bora Bora.
5. Revoke the authorisation and request the deletion of your data where legal principles, rights and guarantees are not respected, provided there is no legal or contractual duty to keep it.
6. Access your processed personal data free of charge.

How to exercise your rights

Send your request to cartagenaborabora@gmail.com stating your full name, your document number, a description of your request, the address or email where you want to receive the answer and, where applicable, any supporting documents. If you are acting on behalf of the data subject, attach proof of your authority to represent them.

Enquiries

We will answer your enquiry within a maximum of ten (10) business days from the date of receipt. If that is not possible, we will tell you the reasons for the delay and the date on which it will be answered, which will in no case exceed five (5) additional business days.

Claims

If you believe your data should be corrected, updated or deleted, or you notice a possible breach of the law, you can file a claim. If the claim is incomplete, we will ask you to complete it within five (5) business days; if two (2) months pass without you doing so, the claim will be deemed withdrawn. We will resolve the claim within a maximum of fifteen (15) business days from the day after we receive it in full. If that is not possible, we will tell you the reasons and the new date, which will not exceed eight (8) additional business days.

Requests for deletion and revocation of the authorisation do not apply where you have a legal or contractual duty to remain in the database, for example while a booking is active or an accounting obligation is pending.

To stop receiving subscription emails, just ask us by replying to any of them or by writing to the address above.

Responsible department

Bora Bora's Customer Service department handles requests, enquiries and claims about personal data, at cartagenaborabora@gmail.com.

Information security

We adopt reasonable technical, human and administrative measures to protect your data against loss, unauthorised or fraudulent consultation, use or access. Among them: the site is served exclusively over an encrypted connection (HTTPS), system access credentials are kept on the server and never in your browser, and access to the information is limited to the people who need it for the purposes described.

Validity

This policy is effective from 28 September 2026. Your personal data will be kept for as long as needed for the purposes described and for the time required by applicable legal, accounting and tax rules. Subscription data will be kept until you request its deletion.

Bora Bora may amend this policy. Any substantial change will be published on this same page before it takes effect, stating the date of the latest update.