Privacy and data processing policy

1. Who is responsible for your data

TIQUETES DE VUELOS.COM S.A.S, tax ID 901.475.146-3, a travel agency based in Medellín, Colombia. National Tourism Registry 159291 and IATA accreditation 76570756. Supervised by the Colombian Superintendency of Industry and Commerce.

For anything to do with personal data, write to us at ventas@tiquetesdevuelos.com or by WhatsApp.

2. What data we keep

Only what it takes to sell you a trip and look after you afterwards.

• From your account: email, first and last names. If you sign in with a password, we keep a mathematical fingerprint of it, never the password.
• From your profile, if you fill it in: phone, date of birth, gender, ID or passport with its expiry date and nationality, and the city you usually fly from.
• From your travel companions: the same data for anyone you save so you do not have to type it on every booking. You save it, and it is on you to have told them.
• From your bookings: flights, hotels and services booked, booking codes, dates and the amount paid.
• From your browsing: recent searches, approximate city from your connection, and the server’s technical logs.

ID documents and passports are stored encrypted, with a key kept separately from the data. We never store card numbers: those go straight to the payment gateway and never pass through our servers.

3. What we use it for

• To search, book and issue your tickets, hotels and other services.
• To charge you and send you the receipt and your travel documents.
• To help you if there is a change, a cancellation or a complaint.
• To run your account, your trips and your Club Tiquetes points.
• To comply with accounting, tax and tourism law.
• To send you deals and news, only if you opt in separately. You can withdraw that permission any time from your account, without losing anything else.

4. Who we share it with

With whoever is needed for your trip to exist, and nobody else. We do not sell your data.

• Airlines and their reservation systems, to issue the ticket in your name.
• Hotels and their booking systems, so your room is in your name.
• The payment gateway, which processes the charge and receives your card details directly.
• Google, only if you choose to sign in with your Google account. See point 5.
• Colombian authorities, when a regulation or a court order requires it.

An international trip means your data leaves the country: the airline, the hotel or the booking system may be anywhere in the world. By booking with us you authorise that transfer, which is the only way the booking can happen.

5. If you sign in with Google

The "Continue with Google" button is optional: you can always use your email and a password. If you use it, Google gives us three things and nothing more: your email, your name and an internal identifier that lets us recognise you next time.

• We neither receive nor can see your Google password.
• We do not access your Gmail, your contacts, your calendar or your files.
• We do not post anything on your behalf.

Since Google already confirmed that email is yours, we treat it as verified and save you that step. You can withdraw Tiquetes de Vuelos’ permission any time from your Google account permissions page. If you do, your account with us still exists: sign in with your email and request a new password.

6. Cookies

We use the minimum needed for the site to work. None of them is there to follow you around the internet.

• Your session: keeps your account signed in while you browse.
• Your bookings: lets you see a booking made without an account and claim it later if you register.
• The Google step: lasts ten minutes and only exists to check that whoever comes back from Google is you.

They all travel encrypted, no other site can read them and the browser does not hand them to any script on the page.

7. How long we keep it

For as long as you have an account with us, and after that for as long as Colombian accounting and tax law requires us to keep the record of a sale. If you delete your account, your profile data, your travel companions and your preferences go with it.

8. How we protect it

• The whole site runs over an encrypted connection.
• Passwords are stored with a method designed so they cannot be turned back into the original.
• We check against public lists that your password is not one already leaked on other sites.
• ID documents are encrypted with a key kept separately.
• Anyone entering the internal panel needs a second factor, and every action is logged.

No system is infallible. If something happened that put your data at risk, we would tell you and report it to the Superintendency of Industry and Commerce, as the law requires.

9. Your rights

Colombian Law 1581 of 2012 gives you these rights over your own data, and you can exercise them free of charge:

• Know what we hold about you and where it came from.
• Ask us to correct it if it is wrong or incomplete.
• Withdraw the permission you gave us, or ask us to delete it, except what the law requires us to keep.
• Have us prove that you authorised us.
• Complain to the Superintendency of Industry and Commerce if you believe we did not comply.

Write to us at ventas@tiquetesdevuelos.com with your name, your ID and what you need. We answer within a maximum of 10 business days for a query and 15 business days for a complaint, as the law requires. Many of these changes you can make yourself, right away, from My account.

10. If this policy changes

We publish the new version here with its date. If the change affects what we use your data for, we email your account before applying it.