Privacy Policy

1. Data controller

Mar de las Antillas is the controller responsible for the processing of your personal data. Our restaurant is located in the Getsemaní neighbourhood, Cartagena de Indias, Colombia.

Any question about the processing of your data can be sent to contacto@mardelasantillas.com with the subject «Habeas Data».

2. Information we collect

We only collect the information strictly required to provide the service. Depending on how you interact with us, this may include:

• Reservations: full name, email address, phone or WhatsApp number, desired date and time, party size, and optional comments (allergies, table preference, etc.).
• Marca y Marea (prediction contest): name, email address, WhatsApp (optional), your match predictions and any prize codes assigned to you.
• Contact form: name, email address and the message you choose to send us.
• Browsing data: IP address, browser and device type, pages visited and anonymous usage metrics, collected through technical cookies and analytics tools (see Cookies section).

3. Purpose of processing

We use your data exclusively for the following purposes:

• Managing, confirming and, where necessary, modifying or cancelling your reservation.
• Allowing your participation in Marca y Marea: sending you the access code, registering your predictions, calculating points, generating discount codes and verifying them at redemption.
• Replying to questions you send through email, WhatsApp or the contact form.
• Improving our website and service through aggregate, anonymous analytics.
• Complying with legal, tax or regulatory obligations applicable to the restaurant.
• We do not use your data for third-party advertising and we do not sell, rent or transfer it for those purposes.

4. Legal basis and authorisation

Processing relies on your prior, explicit and informed authorisation given when you submit any of our forms or accept the cookie banner, in accordance with article 9 of Law 1581 of 2012.

For the execution of your reservation or your participation in Marca y Marea, processing is also based on the need to perform the service you request. For web analytics, processing is based on your consent through the cookie banner.

5. Data retention

We keep your data only for as long as necessary to fulfil the stated purposes and applicable legal periods:

• Reservations: up to twelve (12) months from your last visit or contact, unless longer accounting or tax obligations apply.
• Marca y Marea: during the tournament and for up to twelve (12) months after it ends, to resolve any prize-related claims.
• Communications (email, WhatsApp, contact form): up to twenty-four (24) months from the last exchange.
• Analytics data: the period defined by the chosen tool (Google Analytics 4 retains data for fourteen (14) months by default).

6. Sharing with third parties

Your data is not sold or shared for advertising purposes. We do, however, rely on technology providers that act as data processors under our instructions:

• Transactional email provider (Resend, United States): to send verification codes and contest notifications.
• Web analytics (Google Analytics 4, United States): to understand site usage in aggregate. Only enabled if you accept the cookie banner.
• Hosting provider (AWS Lightsail with Plesk panel): to host the website and database.
• WhatsApp Business (Meta Platforms, United States): if you choose to contact us through that channel.
• Competent authorities, where there is a legal obligation to provide the information.

7. International transfers

Some of the providers above are located outside Colombia, mainly in the United States and the European Union. These transfers are carried out with contractual safeguards that guarantee a level of protection equivalent to that required by Colombian law, in accordance with article 26 of Law 1581 of 2012.

8. Cookies and similar technologies

We use cookies and local storage for three purposes:

• Technical cookies: required for the site to work (keeping your session, remembering the selected language, saving your cookie banner preference). They do not require consent.
• Analytics cookies: used by Google Analytics 4 to measure traffic in an aggregate and anonymous way. Only enabled if you accept the banner.
• Browser local storage: we use localStorage to remember how often the Marca y Marea promotion is shown to you.
• You can manage or delete cookies from your browser settings. Disabling technical cookies may affect how the site works.

9. Data subject rights (Habeas Data)

Under article 8 of Law 1581 of 2012, as the data subject you have the right to:

• Access, update and rectify your personal data.
• Request proof of the authorisation granted for processing.
• Be informed about the use given to your data.
• File complaints with the Superintendency of Industry and Commerce (SIC) for breaches of data protection rules.
• Revoke the authorisation and request deletion of your data when no legal or contractual duty to retain it exists.
• Access free of charge to the personal data that has been processed.

10. How to exercise your rights

To exercise any of the above rights, write to contacto@mardelasantillas.com with the subject «Habeas Data». Include your full name, ID document number, the data you wish to consult, rectify or delete, and a contact channel for our reply.

We will handle queries within ten (10) business days and complaints within fifteen (15) business days, in line with the timelines set by Law 1581 of 2012. If we need more time we will let you know in advance.

If you feel your request was not properly handled, you may file a complaint with the Superintendency of Industry and Commerce (SIC) of Colombia.

11. Information security

We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration. These include: encrypted HTTPS connections, passwords stored using one-way cryptographic functions, restricted access to authorised personnel and periodic database backups.

Despite these measures, no system is completely fail-proof. We recommend not sharing your Marca y Marea access code with third parties.

12. Minors

Our services are addressed to adults. Participation in Marca y Marea requires you to be at least eighteen (18) years old. We do not knowingly collect data from minors; if a parent or legal guardian detects that a minor has submitted data without authorisation, they can contact us to request its deletion.

13. Changes to this policy

This policy may be updated to reflect changes in the law, in our services or in our providers. The date of the latest version is shown at the top of the document. If the changes substantially affect your rights, we will notify you by email when we have a channel to do so.