Privacy and Personal Data Protection Policy

  1. Relevant information related to the products and services marketed by Price Res S.A.S.

    Copa Vacations sells its products through Price Res S.A.S., a company incorporated under the laws of Colombia, which offers its technology infrastructure to AEROREPÚBLICA S.A. and COMPAÑÍA PANAMEÑA DE AVIACIÓN S.A. customers in Colombia. Price Res S.A.S. is responsible for the sale of the travel packages and services, such as tickets, hotels, cars, insurance, cruises, and supplemental tours and activities, which are offered on this platform. Consequently, by accepting this Privacy and Personal Data Protection Policy, users expressly and irrevocably represent that they are aware and accept that via this platform, they are purchasing products and services directly from Price Res S.A.S., the company that will be liable for any actual or consequential damages that may arise from the purchase of the aforementioned products and services.

  2. Information about Price Res S.A.S.

    Price Res S.A.S. is a Colombian company that provides tourism services in its capacity as a travel agency. Price Res S.A.S. has extensive experience in the tourism industry. Thus, pursuant to the current laws, rules, and regulations, Price Res S.A.S. adheres to and respects Colombian laws, rules, and regulations on the protection of personal data, which are set forth in Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013, and other supplemental laws, rules, and regulations, as well as the laws, rules, and regulations implementing, amending, or replacing them.

    Price Res S.A.S. therefore implements this Privacy and Personal Data Protection Policy, which seeks to ensure that the databases containing personal or socially significant information about our customers are protected and stored according to strict parameters of security, transparency, and confidentiality. Making purchases online involves great trust on the part of our customers. Price Res S.A.S. is committed to honoring this trust and protecting our customers’ information.

  3. Important definitions to be kept in mind by our customers and hence by the Data Subjects

    • Privacy Notice: A printed document, electronic document, or document in any other format, created by the Controller of the Data Processing, which is available to the Data Subject regarding the Processing of his or her Personal Data, and which informs Data Subjects about the existence of the data processing policies followed by the Controller, how to access such policies, and the features of the Processing that is intended to be performed on the personal data.
    • Personal Data: Personal data are considered to be only the data of one or more identified or identifiable natural persons.
    • Sensitive Data: Sensitive data are data that affect the privacy of the Data Subject, or data which, if used improperly, could lead to discrimination against the Data Subject, such as data revealing his or her race or ethnicity; political opinions; religious or philosophical beliefs; membership in trade unions, social or human rights organizations, organizations promoting the interests of any political party, or organizations ensuring the rights of opposition political parties; data about health and sexuality; and biometric data. Price Res S.A.S. will not ask its customers for any sensitive data via this website or by any other means.
    • Authorization: The prior, express and informed consent by the Data Subject for the Processing of Personal Data.
    • Database: An organized set of personal data subject to Processing.
    • Controller of the Data Processing: A natural person or legal entity, either public or private, which, individually or in association with others, makes decisions regarding the database and/or the Processing of the data. For this purpose, the Controller of the Data Processing will be AEROREPÚBLICA S.A.
    • Processor: A natural person or legal entity, either public or private, which, individually or in association with others, carries out the Processing of personal data on behalf of the Controller of the Data Processing. For this purpose, the Data Processor will be Price Res S.A.S.
    • Subject: The natural person whose personal data are subject to Processing. For this purpose, the Data Subjects will be the users who acquire tourism products and services via various Price Res S.A.S. sales channels.
    • Processing of Personal Data: Any operation or set of operations performed on Personal Data, such as collection, storage, use, circulation, or deletion.
  4. Information collected

    In the course of its business activities, and specifically in order to market various types of tourism products and services, Price Res S.A.S. asks its customers and users for various personal data which are necessary to sell the aforementioned products and services properly by electronic means. For this purpose, Price Res S.A.S. may request and process data including but not limited to the following, in accordance with this Privacy and Personal Data Protection Policy:

    • (i) Date of birth
    • (ii) Identity document number
    • (iii) Nationality
    • (iv) Telephone number
    • (v) Email address
    • (vi) Home address
  5. Processing performed on data and purpose of such processing

    The data provided may be processed in one or more of the ways described below:

    Processing, completing, updating, changing, canceling, or printing the services that have been engaged through Copa Vacations by any means: electronically, by telephone, or in person. Complying in general with the obligations assumed vis-à-vis the Data Subject.

    Sending notifications by email regarding changes or events related to your trip itinerary: confirmation of the services you have purchased, changes, cancelations, balances, and invitations to evaluate or give your opinion about the services you have purchased and the service you have received from Price Res S.A.S. and its employees or representatives.

    Making telephone calls to confirm actions or transactions completed online, by telephone, or in person, if Price Res S.A.S. or its representatives deem it necessary.

    Making telephone calls to request information or documents establishing the identity of the customer or credit card holder, if Price Res S.A.S. deems it necessary./p>

    Sending travel offers by email, if you agree to sign up for the newsletter in order to be notified about offers electronically, by telephone, in writing, or by any other means. Each email includes a link to unsubscribe from the newsletter if you wish to do so.

    Sending technical, operational, or commercial information about Copa Vacations or our vendors, marketing or promotional information about products and/or services, or promotions intended to prompt, invite, guide, run, inform, and in general carry out commercial or marketing campaigns or promotions.

    Maintaining and updating, on an ongoing basis, databases that generate statistics enabling us to improve the services our customers receive

    Sharing, including the transfer and transmission of personal data to third parties for purposes related to the performance and provision of services and products acquired through Copa Vacations.

    Performing any supplemental or related activity necessary for the proper marketing of the aforementioned tourism products and services.

    Conducting internal research about compliance with trade relations and market research at all levels.

    Complying with legal requirements established by administrative and judicial authorities.

    All personal data sent or provided to us may be handled at any time via the www.copavacations.com.co website, by our reservations agents, by telephone, or by email, when requested by any trip advisor.

    The information we request will be that which is strictly necessary to complete your purchases, and the collection of such information implies prior authorization by the Data Subject.

    Only Copa Vacations has access to the information collected when users sign up for our program to receive promotions, offers, or services by email. Promotional messages or notices are sent only to users who have agreed to sign up, and you may remove your email address from the mailing list at any time by clicking on the link included for this purpose in each message we send. Our emails may also include third-party offers from our business partners.

    If you provide us with personal data about someone other than yourself, such as your spouse, children, etc., we understand that you are authorized by that person to provide his or her data to us.

  6. Quality and transparency in the handling of personal data

    Price Res S.A.S. is committed to processing in an accurate, complete, verifiable, transparent, secure, accurate, and confidential manner all information you provide to us. Processing of partial, incomplete, fragmented, or misleading data is prohibited.

  7. Information Security

    We have implemented a sophisticated security system to protect our customers’ information from unauthorized access. Our systems are configured with data encryption and encoding technologies that meet the highest standards in the industry. All data transmissions from Price Res S.A.S. sites are encoded before sending using SSL-3 technology.

    Thus, Price Res S.A.S. has implemented the necessary technical security, personnel, and administrative safeguards available to it in order to maintain confidentiality and prevent the unauthorized or fraudulent manipulation, loss, viewing, and use of, or access to, the data that have been collected and will be processed in accordance with this Privacy and Personal Data Protection Policy.

  8. Authorizations

    Price Res S.A.S. requires the prior, free, express and informed consent of the Data Subject. Therefore, PRICE TRAVEL, in its capacity as the Personal Data Processor, has arranged for the mechanisms necessary to obtain authorization from Data Subjects, ensuring in every case that it is possible to confirm that such authorization has been granted.

    Price Res S.A.S. will obtain authorization by various means, including via electronic document, printed document, data message, Internet, websites, or any other format which, in every case, makes it possible to obtain consent through unambiguous behavior, showing that, had such authorization not been given by the Data Subject or the person authorized by the Data Subject for that purpose, the data would not have been stored or entered in the database.

    Authorization will be requested prior to the processing of the personal data. Consequently, Price Res S.A.S. customers agree to the processing of their personal data in accordance with the terms of this Privacy and Personal Data Protection Policy, whenever they provide their personal data to Price Res S.A.S. via its electronic platform and in general via any means of communication, unless they expressly indicate otherwise in writing.

  9. Transfer and Transmission of data

    Some of the personal data you provide when booking are shared with our vendors, affiliates, partners, or related companies, in all cases exclusively for the same travel agency purposes, to process and provide the services you purchase. Moreover, Price Res S.A.S. receives personal data from its related, partner, or vendor companies, for purposes of travel agency services, and Price Res S.A.S. in all cases processes such personal data strictly as indicated in this policy. In all cases, the purpose of the processing is identical or analogous to, or compatible with, the purpose for which the personal data were collected initially, and for compliance with our obligations to customers in providing travel agency services.

    Personal data will not be transferred to parties or companies other than Price Res S.A.S. The Privacy and Personal Data Protection Policy is implemented according to Law 1581 of 2012, Decree 1377 of 2013, and other laws, rules, and regulations amending, implementing, or replacing them. The data shared depend on the service booked:

    • Hotel, transfers, tours, and bus tickets: Your first and last names are the only personal data transferred to the vendor.
    • Flights without a layover or final destination in the United States: Your first and last names are transferred to the airline. For flights with a layover or final destination in the United States, your full name, date of birth, and sex are transferred to the United States Transportation Security Administration.
    • For car rentals, your first and last names and address are transferred.

    Price Res S.A.S. reserves the right to disclose personal data provided by telephone or online in the following cases

    • In response to requests from government authorities, when necessary or appropriate in order to investigate illegal or fraudulent activity.
    • To assert or defend the rights of Price Res S.A.S. in response to frauds or lawsuits, or in compliance with law.
    • If Price Res S.A.S. deems it necessary to investigate or respond to reports of fraudulent or illegal activity on this site.
  10. How to exercise your rights to know, update, correct, and delete your data and revoke your authorization

    Law 1581 of 2012 establishes certain rights that Data Subjects are entitled to exercise at any time in regard to their personal data. These rights are: to access your personal data in order to learn the details of the processing of such data; to update your data; to correct your data if they are inexact, incorrect, or out of date; and to cancel or delete your data if you believe they are not required for any of the purposes indicated in this privacy policy, they are being used for purposes to which you have not consented, or the contractual or service relationship has ended.

    In addition, Data Subjects have the right to be informed of substantial changes to this Privacy and Personal Data Protection Policy, including but not limited to: changes in the identity of the Controller of the Data Processing, and changes in the purpose of the Processing of Subjects’ personal data. Consequently, Data Subjects will receive a new request for authorization for Data Processing when changes made by Price Res S.A.S. to this Privacy Policy alter the purpose of the Data Processing stated herein.

    If you need to access the personal data you provided, or to exercise any of the rights of Data Subjects or their representatives established by law, call 01-800-952-0663 toll-free within Colombia, email contact@copavacations.com.co, or mail your request to the following address: Calle 92 No. 15-48 oficina 401, Bogota. In your request, include:

    • Your full name and telephone number or address.
    • A copy of your official photo ID or other ID confirming that you are the subject of the data you wish to access, or the legal representative of the data subject.
    • Specify what you wish to be done with your personal data.
    • Locator number. With this information, we can find your data quickly.
    • Any other documentation you wish to be considered.

    If Price Res S.A.S. requires additional information from the Data Subject in order to evaluate the request, it will notify the Subject of this fact within five (5) days of receipt of the Subject’s request or claims. If the claimant does not provide the requested information within two (2) months of the date of the request, he or she will be understood to have withdrawn the claim.

    The deadline for responding to the claim will be fifteen (15) business days from the day after receipt of the claim. In the event that it is not possible to respond to the claim by that deadline, the interested party will be notified prior to the deadline of the reasons for the delay and the date when the claim will be responded to, which may not under any circumstances be more than eight (8) business days after the first deadline.

  11. Non-personal information and security

    We automatically collect and store non-personal information each time the customer accesses any Price Res S.A.S. platform—e.g., the destination the customer selects or how the customer uses the site. This information is collected through cookies and enables us to make continuous improvements.

    Cookies are text files that your browser stores on your computer’s hard drive. When you access Price Res S.A.S., we may save information about your session and assign one or more cookies to you. Cookies enable us to know whether this is your first visit to Price Res S.A.S., for example. Our cookies do not collect or store personal information.

    How to change the way your browser handles cookies

    Cookies can be handled in two basic ways.

    • You can change your browser’s settings to either allow or block cookies. The process may vary slightly depending on your browser. If you are interested in this option, you can do a search on Google (or the search engine of your choice) using the phrase "How to manage cookies in (name of your browser)." For example, How to manage cookies in Internet Explorer.
    • You can delete all of the cookies that are already stored on your computer.
  12. Other important aspects related to privacy

    To familiarize yourself with the specific terms and conditions of use for the Copa Vacations platform, you can review the terms and conditions of use at the following web address Terms and conditions

    Although the Price Res S.A.S. content is suitable for the general public, the user must be at least 18 years old to book any product or service on the platform. It is recommended that users younger than 18 years old obtain the consent of their parents or guardians to use Copa Vacations.

    For services intended for minors which may involve the collection of Personal Data, Price Res S.A.S. will request the express authorization of the minor’s parents or representatives, so that minors may access their Personal Data, and so that manual and/or automated processing may be performed on such Personal Data, as provided in this policy notice.

    In the event that Price Res S.A.S. must transfer Personal Data to third parties located abroad for purposes of provision of the services and/or products, Price Res S.A.S. warrants that the Personal Data will be kept confidential and processed securely during the international transmissions that may occur for the purpose of such transfers.

    If you do not express any objection to the transfer of your personal data, you will be understood to have given your consent. You may indicate your objection to the transfer of your personal data by emailing contact@copavacations.com.co

  13. Changes and updates to this policy

    Price Res S.A.S. reserves the right to amend or change this policy if necessary or because of changes in laws, rules, and regulations. Changes take effect when they are published. By using this site and Price Res S.A.S. booking services (by any means), you accept this privacy policy. If you have questions about this policy, contact us with a detailed description of your situation, and we will attempt to resolve it. Price Res S.A.S.

  14. Entry into force of the Privacy and Personal Data Protection Policy.

    This Privacy and Personal Data Protection Policy enters into force on the day it is published, i.e., on July 23, 2015.

    The information supplied by you will be stored for a period of ten (10) years, counted from the date of publication of this Privacy and Personal Data Protection Policy. This is to comply with the relevant laws, rules, and regulations on administrative, accounting, fiscal, and legal matters applicable to the Controller of the Data Processing and the Data Processor.

    Last updated July 2015