Privacy and Personal Data Processing Policy

This policy explains how Finkeros S.A.S. processes the personal data of the people who use finkeros.com: owners who list their finca (a Colombian country house, usually rented whole), travelers and buyers looking for one, and anyone who writes to us. It complies with the Ley Estatutaria 1581 de 2012 (Colombia's statutory data protection law), the Decreto 1377 de 2013 (now part of the Decreto Único 1074 de 2015) and the other Colombian personal data protection rules.

1. Data controller

• Controller: Finkeros S.A.S., NIT 900.583.099-4, a Colombian company.
• Website: www.finkeros.com
• Email for personal data matters: [email protected]
• Who handles your requests: the Finkeros support team, at that same email address.

2. Basic definitions

• Personal data: any information that identifies a person or makes it possible to identify them, such as their name, their email or their cell phone number.
• Data subject: the person the data refers to. If you list a finca or write to us, you are the data subject of your data.
• Processing: any operation with the data: collecting it, storing it, using it, sending it or deleting it.
• Controller: whoever decides what the data is processed for and how. Here, Finkeros S.A.S.
• Processor: whoever processes data on behalf of the controller, for example the provider that supplies our servers.
• Transfer and transmission: sending data to another controller (transfer) or to a processor (transmission), inside or outside Colombia.

3. What data we process

If you list a finca (owners and agencies):

• First names, last names, email, cell phone number and, if you enter it, your company.
• Your account password, which we store encrypted with a one-way algorithm: no one at Finkeros can read it.
• The details and photos of your finca, including the contact phone number and email you publish for interested people.
• The payments you make: service, amount, date and status. If you save a payment method, we only keep the identifier the payment gateway gives us, the brand, the last four digits and the expiration date. We never see or store your full card number.
• Your email preferences and the record of each authorization you give or withdraw.

If you are looking for a finca (travelers and buyers):

• When you ask to see a finca's phone number, we record that contact: the finca, the date and a technical identifier of your visit.
• When you write to the owner, we store your name, email, cell phone number and message, and we send them to the owner.

If you pay through Finkeros: for PSE payments, your document type and number, your name and your cell phone number go directly to the payment gateway to carry out the transaction; we don't store them.

When you visit the site:

• The pages you view, the searches you make (the place and the filters, not who made them), the language, the type of browser and the page you came from.
• An identifier of your visit, calculated irreversibly from your IP address and your browser. We don't store your IP address in our statistics.
• If you arrive from one of our emails or from an ad, which email or campaign you came from. If the ad carries a click identifier from the advertising platform, we store it separately and for a short time (see section 11).
• Technical data about errors and loading speed, to fix what isn't working.

We don't ask for sensitive data (health, racial or ethnic origin, political or religious orientation, biometric data), and we ask you not to include it in your messages or in your finca's description.

4. Purposes of processing

We use the data only for the following:

• To create and manage your account, and to let you sign in to it securely.
• To publish your finca and show it to people who are searching, with the contact details you decided to publish.
• To put travelers and buyers in touch with owners: sending the message you wrote and showing the finca's phone number.
• To charge for the services you buy, activate them, issue receipts and meet our accounting and tax obligations.
• To notify you about your account and your listing: payment confirmations, expirations, renewals and password changes.
• To show you how your finca is doing (visits and contacts) and suggest how to improve it.
• To send you reports about your finca, newsletters, offers of our services and plans for the puentes festivos (Colombia's long holiday weekends), always within the hours the law allows. You can choose which emails you get in "Your emails" or unsubscribe from any email.
• To automatically translate the name and description of fincas into other languages, so that travelers from other countries can find them.
• To measure use of the site, learn which emails and ads work, and improve the service.
• To prevent fraud and abuse: verifying fincas, limiting the number of contacts or attempts per hour, and detecting suspicious listings.
• To handle your inquiries, complaints and requests.
• To comply with the law and respond to requests from competent authorities.

5. Authorization

We ask for your authorization to process your data when you create your account, list a finca or write to an owner, in that same form and with a link to this policy. Submitting the form after reading that notice is the unequivocal conduct by which you authorize the processing (article 7 of the Decreto 1377 de 2013). Emails about your account and your listing are part of the service. You can turn off reports, newsletters and offers whenever you want, one by one, in "Your emails" or from the link included in each email; we keep a record of each change and, when you turn a category on, the date, the channel and the exact text you saw.

We don't need authorization for data of a public nature, to comply with a legal or court order, or in the other cases listed in article 10 of the Ley 1581 de 2012.

6. Your rights

As the data subject, you have the right to:

• Know the data we have about you and how we use it.
• Update and rectify your data when it is incomplete, inaccurate or misleading. You can change much of it yourself in "Your account".
• Request proof of the authorization you gave us.
• Be informed, if you ask, of the use we have made of your data.
• Revoke the authorization and ask us to delete your data, when there is no legal or contractual duty to keep it (for example, the accounting records of a payment).
• Access your personal data free of charge.
• File complaints with the Superintendencia de Industria y Comercio (SIC, Colombia's data protection authority) for violations of the law, after having made your inquiry or complaint to us.

7. Procedure for inquiries and complaints

Write to us at [email protected] from your account's email address, or from another address explaining who you are, with your name, how to contact you and what you need. Your successors in title, your representative or your attorney-in-fact may also do so, providing proof of that status.

Inquiries (to learn what data we have or how we use it): we answer within a maximum of ten (10) business days from the day after we receive it. If we can't answer within that time, we explain why and answer no later than five (5) business days after the first deadline.

Complaints (to correct, update or delete your data, revoke the authorization or report a violation):

• Include your identification, a description of what you are asking for, an address or email where we can reply, and any documents you want to rely on.
• If the complaint is missing information, we ask you for it within the following five (5) business days. If two (2) months go by without you sending it, we will understand that you have withdrawn the complaint.
• While it is being resolved, we mark your data as "complaint in progress" within no more than two (2) business days.
• We resolve it within a maximum of fifteen (15) business days from the day after we receive it complete. If that isn't possible, we explain why and resolve it no later than eight (8) business days after the first deadline.

If you want to close your account or have us delete your data, write to us and we will do it within those same deadlines. We will keep only what the law requires us to keep, such as the records of payments.

8. Who we share data with

• With the owner of the finca you contact: your name, email, cell phone number and message, so they can reply to you.
• With the people who visit the site: your finca's details and the contact details you publish on it.
• With our providers, who process the data on our behalf and only to provide their service to us (list in section 9).
• With authorities, when a law or an order requires it.

We don't sell personal data or hand over databases of users or fincas to third parties.

9. Providers and international transfers

Several of our providers have their servers outside Colombia, mainly in the United States. By accepting this policy you authorize your data to be transmitted to them, only for the purposes in section 4. We choose providers with recognized security and data protection measures.

10. Cookies and similar technologies

A cookie is a small file the site stores in your browser. We use these first-party cookies:

In addition, Google Analytics, Google AdSense and reCAPTCHA set their own cookies, in accordance with Google's privacy policy at policies.google.com/privacy. You can block or delete cookies in your browser settings; if you block ours, you won't be able to stay signed in to your account. To avoid being measured by Google Analytics you can use Google's official add-on: tools.google.com/dlpage/gaoptout.

We don't use the Meta pixel or its cookies.

11. How long we keep data

12. Security

We protect data with reasonable technical, human and administrative measures: an encrypted connection (HTTPS) across the whole site, passwords stored with a one-way encryption algorithm, access to information restricted to the team members who need it, protected sessions that are closed when you change your password, attempt limits to prevent abuse, backups and error logging. No system is infallible; if we detect an incident that affects your data, we will notify you and report it to the Superintendencia de Industria y Comercio as the law requires.

13. Minors

Finkeros is for people over 18 years of age, as our terms and conditions state. We don't knowingly collect data from minors. If you are the parent or representative of a minor and believe they gave us their data, write to us and we will delete it.

14. Finkeros in ChatGPT

If you use Finkeros from ChatGPT, ChatGPT sends us your search (the place, the number of people and the filters you asked for), your account's language and an anonymous identifier assigned by OpenAI. We don't receive your name, your email or your conversation.

With the anonymous identifier, which we store only in an irreversibly transformed form, we set usage limits and count how many people use Finkeros in ChatGPT. From your search we only store the type (for example, "municipality, rental") and which finca you looked at in detail, not the text you wrote. In ChatGPT we never show the owners' phone number, email or name.

Some of the features below may be switched off at times. When you use them, this is how we handle your data:

Your list, your settings and the links you share: if you save fincas to your list or change the Finkeros settings in ChatGPT (language, region, rental or sale, approximate prices in dollars), we store them linked to OpenAI's anonymous identifier, irreversibly transformed with a key of our own, so we don't know who you are. If you share your list, we create a public link that shows those fincas and doesn't say who shared it; it expires after 90 days. Lists that go unused for 180 days are deleted.

If you write to an owner from ChatGPT: you fill in a form with your name, email, mobile number (optional) and message, and you expressly agree that we send it to the owner of that finca. We store that contact just as we do when you write from the finca's page, together with the exact text of the authorization you accepted and the date. You fill in the form yourself: ChatGPT doesn't send it for you.

Alerts: if you ask ChatGPT to let you know when a finca matching your search appears or when a finca's price drops, we store the search or the finca, the address ChatGPT asks us to send the alert to, and a signing key ChatGPT gives us, which we store encrypted. Alerts only carry the finca's public data. The subscription expires after 7 days if ChatGPT doesn't renew it (30 days at most) and is deleted 7 days after it expires.

Owners who connect their account: if you connect your Finkeros account in ChatGPT, ChatGPT receives an access permission, not your password. With it, ChatGPT can see your fincas, how they are doing (in relative figures), how many contacts you received and what to improve, and, if you allow it, change basic details of your fincas, always with your confirmation. It never receives the data of the people who contact you. We store the permissions only in irreversible form. The access permission expires after one hour and the renewal permission after 30 days; they are cancelled if you change your password, and you can revoke them whenever you like on the Aplicaciones conectadas (connected apps) page.

If you open a finca from ChatGPT, the link carries a marker so we know you came that way, and from that moment on what this policy explains for any visit to the site applies. The processing carried out by OpenAI is governed by its own privacy policy.

15. Changes to this policy

If we change this policy, we will publish the new version on this same page with its date. If the change affects the purposes of processing, we will notify you beforehand by email or on the site and, when the law requires it, we will ask you for a new authorization.

16. Effective date

This policy is effective as of October 1, 2026. The databases will remain in effect for as long as Finkeros provides its services and for the retention periods in section 11.

17. Contact

For any question about your personal data or about this policy, write to us at [email protected]. We will answer you within the deadlines in section 7.