Personal Data Processing

1. Data Controller

Esperanza Marín Spa, as the data controller, is committed to protecting and respecting the privacy of personal data of its clients, users and visitors, in accordance with Law 1581 of 2012 and Decree 1377 of 2013.

2. Purpose of Processing

The personal data we collect will be used for the following purposes:

• Manage and process spa and massage service reservations
• Establish communication with clients for confirmations, reminders and follow-up
• Provide information about our services, promotions and news
• Comply with contractual and legal obligations
• Improve the quality of our services and customer experience
• Conduct statistical analysis and internal market studies
• Manage claims, inquiries and requests from clients
• Maintain historical records of services provided
• Send commercial and advertising communications (with prior authorization)

3. Personal Data Collected

We collect the following types of personal data:

• Identification data: Names, surnames, identification number
• Contact data: Email address, phone number, physical address
• Health data: Relevant information about health conditions that may affect treatments (with your explicit consent)
• Preference data: Service preferences, schedules, types of massages
• Transaction data: Reservation history, contracted services, payments made
• Technical data: IP address, browser type, pages visited (when using our website)

4. Data Subject Authorization

By providing your personal data to Esperanza Marín Spa, you expressly and informedly authorize the processing of your personal data for the purposes described in this policy. This authorization may be revoked at any time, except when there is a legal or contractual duty that requires the processing of the data.

Authorization is considered granted when you:

• Complete forms on our website
• Make a reservation or request information
• Communicate with us by any means
• Explicitly accept this policy

5. Data Subject Rights

As the data subject, you have the right to:

• Know: Access free of charge to your personal data that has been processed
• Update: Request the update or rectification of inaccurate or incomplete data
• Rectify: Request the correction of erroneous information
• Delete: Request the deletion of data when you consider that they are not being processed in accordance with constitutional and legal principles, rights and guarantees
• Revoke: Revoke authorization and/or request deletion of data when processing does not respect constitutional and legal principles, rights and guarantees
• Request proof: Request proof of the authorization granted
• File complaints: File complaints with the Superintendency of Industry and Commerce for violations of current regulations

6. Procedure to Exercise Rights

To exercise any of your rights, you can submit a request by:

• Email to: atencion@grupoezma.com
• Written communication addressed to our contact address
• WhatsApp: +57 313 507 9834

The request must contain:

• Identification of the data subject
• Clear description of the data for which you seek to exercise a right
• Right you wish to exercise
• Reasons for the request (when applicable)

We will respond to your request within a maximum period of ten (10) business days from receipt.

7. Security Measures

Esperanza Marín Spa has implemented the necessary technical, human and administrative measures to guarantee the security of personal data and prevent its alteration, loss, consultation, use or unauthorized or fraudulent access. These measures include:

• Access control to information
• Encryption of sensitive data
• Regular backups
• Staff training on data protection
• Internal confidentiality policies
• Computer security systems

8. Data Transfer and Transmission

Esperanza Marín Spa will not transfer personal data to third parties, except in the following cases:

• When the data subject has given express authorization
• When necessary to comply with a legal or contractual obligation
• When it involves data storage or processing services with providers that guarantee adequate levels of protection
• When required by competent authorities in the exercise of their functions

In case of transfer, the data subject will be informed and it will be guaranteed that the receiving third party complies with data protection obligations.

9. Processing Validity

Personal data will be processed for the time necessary to fulfill the purposes for which they were collected, and subsequently during the terms established by law for the retention of information. Once the purposes and legal terms are fulfilled, the data will be deleted from our databases, except when there is a legal obligation to retain them.

10. Policy Modifications

Esperanza Marín Spa reserves the right to modify this personal data processing policy at any time. Modifications will be published on this page and the "Last updated" date will be modified. It is recommended to periodically review this policy to be informed about how we protect your personal data.

11. Contact and Inquiries

For any inquiry, request or exercise of rights related to personal data processing, you can contact us: