Privacy policy
Last updated: September 29, 2026
This policy explains what personal data we handle when you visit verybdn.com, subscribe to our letters or message us to book at Entre Río y Fuego, and what rights you have. It is governed by Colombian Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015). If you visit from the European Economic Area or the United Kingdom, your rights under the General Data Protection Regulation (GDPR) also apply. The Spanish version is the reference text.
1. Data controller
- Name: Honey, who runs verybdn and Entre Río y Fuego
- Location: Minca, Santa Marta, Magdalena, Colombia
- WhatsApp: +57 311 714 7765
2. What data we handle and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You browse the site | IP address, browser, date and page requested (technical logs kept by the hosting provider) | Serving the site and keeping it secure | Legitimate interest in site security |
| You message us on WhatsApp | Name, number, messages, travel dates, number of guests | Answering your question and managing your booking | Your authorization, given by writing to us, and performing the booking you request |
| You stay at Entre Río y Fuego | Name, ID document, nationality, dates of stay and other details the law requires from lodging providers | Completing the Hotel Registration Card and, for foreign guests, the report to Migración Colombia | Legal obligation |
| You pay a deposit | Payer name and payment receipt details | Confirming the booking, processing refunds and meeting accounting duties | Contract and legal obligation |
| You subscribe to the letters | Email address (collected by Substack, not by this site) | Sending you verybdn letters | Your consent, which you can withdraw anytime with the unsubscribe link in every email |
| You accept affiliate cookies | Browser identifiers and clicks on affiliate links | Attributing bookings made through our links | Your consent (see the Cookie policy) |
This site has no forms of its own, uses no analytics tools and installs no advertising pixels. We do not ask for sensitive data. We do not sell or rent personal data, and we do not use it for automated decisions or profiling.
Minors: we only handle data about children when they stay with their legal guardian, with the guardian's authorization and in the child's best interest, as the law requires.
3. Who we share data with
Only with the providers needed for each purpose:
- Hostinger: website hosting.
- WhatsApp (Meta Platforms): messaging with guests.
- Substack: sending the letters. See its privacy policy.
- Travelpayouts: affiliate program, only if you accept cookies.
- Authorities: when the law requires it (for example Migración Colombia or the courts).
Some of these providers store data outside Colombia, including in countries the Colombian data protection authority does not consider to offer an adequate level of protection. These transfers happen because they are necessary to provide the service you ask for, or with your authorization, under article 26 of Law 1581 of 2012. If you book through Airbnb or Booking, those platforms handle your data under their own policies.
4. How long we keep data
- WhatsApp enquiries that do not become a booking: up to 12 months.
- Booking and stay data: for as long as the relationship lasts and then for the period required by tourism, tax and accounting rules.
- Letter subscriptions: until you unsubscribe.
- Server logs: according to the hosting provider's settings.
5. Your rights
Under article 8 of Law 1581 of 2012 you can:
- Know, update and correct your data.
- Ask for proof of the authorization you gave us.
- Be told how we have used your data.
- Withdraw your authorization or ask us to delete your data, unless a legal or contractual duty requires us to keep it.
- Access your data free of charge.
- Complain to Colombia's Superintendence of Industry and Commerce (sic.gov.co) after first raising your request with us.
If you are in the European Economic Area or the United Kingdom you can also ask us to restrict processing, request portability, object to processing based on legitimate interest, and complain to your local data protection authority.
6. How to exercise your rights
Write to us on WhatsApp at +57 311 714 7765 with your name, your request and a way to reach you. We may ask you to confirm your identity.
- Enquiries (what data we hold and how we use it): we answer within 10 business days, extendable by 5 business days if we tell you why.
- Claims (correction, update, deletion or withdrawal): we answer within 15 business days, extendable by 8 business days if we tell you why.
For GDPR requests we answer within one month.
7. Security
We take reasonable measures to protect your data: restricted access to the devices and accounts where it is stored, and keeping only what is needed. No system is infallible; if an incident affects your data, we will tell you and report it to the authority where required.
8. Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If a change affects the purposes you authorized, we will tell you before applying it.