Privacy Policy

Personal Data Treatment · Law 1581 of 2012

1. Data Controller

The entity responsible for processing personal data collected through this website, digital or physical check-in forms, booking engines, or messaging services is MIRADA S.A.S (commercial operator of the brand estar), identified under Tax ID (NIT/Cédula) 902.032.515-0, registered tourist service provider under National Tourism Registry number RNT 276306, located in Sector Palogrande, Manizales, Caldas, Colombia, with the official contact email: [email protected].

2. Data Collection and Purposes

The information we request (such as full name, ID/passport number, email address, phone number, nationality, and payment details) is used for the following essential purposes:

Processing, managing, and confirming your short-term or long-term accommodation bookings.
Handling billing, invoicing, and payment verification.
Complying with Colombian legal obligations before tourism and immigration authorities (such as filling out the mandatory guest registration card).
Sending critical details regarding your arrival, smart access codes, digital home guides, and satisfaction surveys.
With your prior consent, sending updates, seasonal newsletters, and special promotions from estar.

3. Data Subject Rights (Habeas Data)

In compliance with Colombian Law 1581 of 2012 (Habeas Data), you have the right to know, update, correct, or request the deletion of your personal data from our databases at any time. You may also revoke consent for promotional communications.

To exercise these rights, you may submit a formal request to our email: [email protected]. We will respond to your request within ten (10) business days.

4. Data Security

We implement appropriate technical, administrative, and physical security measures (including SSL encryption and secure hosting environments) to safeguard your data against unauthorized access, loss, or alteration.

5. Children and Adolescents Data Protection

In compliance with Article 7 of Law 1581 of 2012, we ensure the respect and protection of the rights of minors. We only collect and process personal data of children and adolescents for the sole purpose of completing the mandatory Guest Registration Card required by the Colombian Ministry of Commerce, Industry, and Tourism, and always under the express authorization and supervision of a parent or legal guardian at check-in. We do not use this data for commercial or marketing purposes.

6. Data Processors and International Data Transfers

To provide its services, MIRADA S.A.S relies on technology providers acting as Data Processors. Some operate servers outside Colombia, so processing may involve an international transfer or transmission of data, always under contractual guarantees of confidentiality and security equivalent to those required by Colombian Law 1581 of 2012 and Decree 1377 of 2013. The main processors are:

OTASync / Kunas — property management system (bookings and guest data).
Wompi and Mercado Pago — payment processing.
Microsoft Azure — automated reading (OCR) of identity documents during check-in.
Google (Firebase, Drive) — administrative authentication and secure document archiving.
Netlify — website hosting and encrypted data storage.
Resend — transactional email delivery (confirmations and notices).
Odoo — customer, quote, and invoicing management.
Anthropic, Twilio, and Meta (WhatsApp) — conversational assistance and communications, when these channels are active.

Additionally, to comply with legal obligations, MIRADA S.A.S transmits data to Colombian authorities: Migración Colombia (SIRE registry), the Ministry of Commerce, Industry and Tourism (National Tourism Registry / TRA), and the DIAN (electronic invoicing).

All processors are contractually bound to process data solely in accordance with our instructions and the purposes described in this policy. The Data Owner may request information about these processors by writing to [email protected].