Privacy and personal data policy

01 Data controller

• Company: Panel Rock Colombia S.A.S.
• Tax ID (NIT): 830.097.622-9
• Address: Calle 93B #18-69, Bogotá D.C., Colombia
• Email: info@altitude93.com
• Phone / WhatsApp: +57 317 160 7978
• Website: altitude93.com

02 Data we process

• Identification and contact: name, phone or WhatsApp number and email.
• Details of your request or booking: type of stay, dates, apartment of interest, number of guests and anything you tell us in your messages.
• Guest registration: ID type and number, nationality, date of birth and origin, which the law requires us to collect at check-in.
• Billing and payments: billing details. Card data is processed directly by payment providers; we do not store it.
• Proof of your consent: date and time, IP address, browser and device, the page where you accepted and the version of the documents accepted.
• Security: access logs and CCTV footage in the building’s common areas.

We will not ask you for sensitive data. If you choose to share any (for example, an accessibility need), you are not required to, and we will only use it to assist you. We only receive data about children and adolescents from their parents or guardians, respecting their best interests.

03 Purposes

We use your data to:

• Answer your requests and send you availability, rates and quotes.
• Manage your booking, contract, payments, invoicing and service during your stay.
• Comply with legal obligations such as guest registration, reporting foreign guests to Migración Colombia, and accounting and tax obligations.
• Ensure the safety of guests, residents and facilities, and control access to the building.
• Handle requests and complaints, and measure your satisfaction with the service.
• Keep proof of the consents and acceptances you give us.
• Send you marketing information about Altitude 93, only if you expressly authorize it; you can ask us to stop at any time.

We do not sell or rent your personal data.

04 Automated assistance

Our WhatsApp channel may use an automated assistant powered by artificial intelligence to answer questions and calculate informational quotes. These quotes are not a confirmed booking: a Altitude 93 host checks availability and terms before confirming. You can ask to speak with a person at any time.

For this service, messages are processed by Anthropic (United States) and by our automation server provider, acting as data processors.

05 Consent

Before processing your data we ask for your prior, express and informed consent: by ticking the corresponding box in our forms, in writing on WhatsApp or email, or by signing a contract. We keep a record of each consent so we can prove it. Consent is not required in the cases set out in article 10 of Law 1581 of 2012, for example when a public authority requests the data in the exercise of its duties.

06 Your rights

As the data subject you have the right to:

• Access, update and correct your personal data.
• Request proof of the consent you gave us.
• Be informed about how we have used your data.
• Withdraw your consent or request deletion of your data, when there is no legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with the Superintendencia de Industria y Comercio (SIC), after completing the inquiry or claim process with us.

07 How to exercise your rights

Email info@altitude93.com with the subject “Personal data”, stating your name, ID document, your request and how you want to receive the answer. Your heirs, representatives or attorneys may also submit it, proving that capacity. This channel is handled by the Altitude 93 team.

• Inquiries: we reply within ten (10) business days of receipt. If that is not possible, we will tell you why and reply within five (5) further business days.
• Claims (correction, update, deletion or breach): we reply within fifteen (15) business days. If that is not possible, we will tell you why and reply within eight (8) further business days. If a claim is incomplete, we will ask you to complete it within five (5) days; if two (2) months pass without you doing so, we will consider it withdrawn. While it is being resolved, your data will be marked “claim in progress”.

08 Processors and transfers

To provide the service we share data with providers who process it on our behalf and under our instructions, such as website hosting (Vercel Inc., United States), messaging (WhatsApp, by Meta Platforms), automated assistance (Anthropic, United States, and our automation server provider), email, the booking management system, payment providers and, when you book through them, booking platforms. Some are located outside Colombia; in those cases we require appropriate security and confidentiality measures. We also disclose data to authorities when required by law.

09 Security

We apply reasonable technical, human and administrative measures to protect your data against loss and unauthorized access or use. For example, consent records are kept in private storage with restricted access.

10 Retention

We keep your data for as long as needed for the purposes described and for the periods required by law, such as accounting, tax and tourism regulations. Proof of your consent is kept while we process your data and for the additional time needed to handle any claims.

11 Effective date and changes

This policy is effective from October 17, 2026. Our databases will remain in force while the purposes described apply. If we make material changes, we will publish them on this page and, where appropriate, ask for your consent again.