Personal data protection policy

1. Who is responsible

The data controller is REALTOR CARIBE S.A.S., a Colombian company with tax ID (NIT) 901.242.527-6, registered at Carrera 7 # 116A-41, local 139, Centro Comercial Zazue Plaza, barrio Bello Horizonte, Santa Marta, Magdalena, Colombia.

• Email for data protection matters: digital@realtorcaribe.com
• Phone: +57 301 398 1672
• WhatsApp: +57 317 319 0385

2. What data we collect

We only collect what is needed to handle your request. Nothing is gathered covertly: either you type it, or it is technical information your browser sends when loading the page.

We do not request or process sensitive data (health, ethnic origin, political opinions, beliefs, biometric data, sexual orientation). If you send any in a free-text message, we delete it.

The site's AI assistant is built so that it never receives your name, phone or email: when you ask to speak to an advisor, those details travel through the form, not through the conversation.

3. What we use it for

• Answering your enquiry and guiding you through buying, selling, renting or booking a property.
• Assigning you an advisor and letting them contact you through the channel you gave us.
• Managing the commercial relationship and recording it in our real estate management system.
• Sending you information about properties that match what you are looking for, when you asked for it.
• Understanding how the site is used and improving it, always with aggregated data.
• Measuring how well our advertising works, if you accepted advertising cookies.
• Meeting legal, accounting and tax obligations.

We do not sell, rent or hand over your data to third parties so they can offer you their own products.

4. On what basis

Processing is based on your prior, express and informed authorisation. You give it by ticking the acceptance box before submitting a form — it never comes pre-ticked — and, for analytics and advertising cookies, by choosing in the cookie notice.

We keep proof of that authorisation: the date, the version of the text you accepted and an irreversible fingerprint of your IP address. That lets us show what you accepted and when, without keeping your IP.

We also process data when it is necessary to perform a contract with you or to comply with a legal obligation.

5. Your rights

As the data subject, the law grants you these rights:

• To access, update and correct your data.
• To request proof of the authorisation you gave us.
• To be told how your data has been used.
• To complain to the Colombian Superintendence of Industry and Commerce about breaches of the law.
• To withdraw your authorisation or ask for your data to be deleted, where no legal or contractual duty requires us to keep it.
• To access your data free of charge.

6. How to exercise them

Write to digital@realtorcaribe.com with your name, the specific data or request, and a way to reach you. You can also write to us at our registered address.

We meet the deadlines set by law:

• Queries: answered within ten (10) working days. If that is not possible, we tell you why and answer within the following five (5) working days.
• Complaints: answered within fifteen (15) working days. If that is not possible, we tell you why and when, no later than eight (8) working days after that.
• If a complaint arrives incomplete, we ask you to complete it within five (5) days. If two months pass without a reply, we take it as withdrawn.

While a complaint is open, the disputed record is flagged as "claim in progress" in our systems.

7. Who else handles your data

The site relies on providers acting as data processors. Each one receives only what it needs and cannot use it for its own purposes:

Several of these providers are outside Colombia, so your data is transferred to and stored abroad, mainly in the United States. By accepting this policy you authorise that international transfer. All of them provide adequate security levels and are contractually bound to protect it.

We may also disclose data to authorities when a law or court order requires it.

8. How long we keep it

• Contact details and enquiries: for as long as the commercial relationship lasts and afterwards for as long as needed to meet legal obligations or handle possible claims.
• Assistant conversations that did not lead to a contact: deleted automatically after twelve (12) months.
• Cookie consent proof: while the accepted version remains current.
• Analytics data: according to the retention periods of each platform.

You can ask for deletion before those periods where no legal or contractual duty requires us to keep the data.

9. Security

We apply reasonable technical and organisational measures: the whole site is encrypted in transit (HTTPS), admin access is restricted to named accounts with hashed passwords, IP addresses are stored only as an irreversible fingerprint, and access is logged. No system is infallible, but we work to make an incident unlikely and, should one happen, detectable.

10. Minors

This site is not aimed at minors and we do not knowingly collect their data. If we find we have received data from a minor without their guardians' authorisation, we delete it.

11. Cookies

Details of which cookies we use, what for and how long they last are in the Cookie Policy, which forms part of this policy.

12. Changes

We may update this policy. When a change affects what you accepted, the cookie notice will ask you again and the date above will change. This version applies from its update date, and our databases remain valid for as long as the purpose they were collected for lasts.