Personal data protection and Habeas Data policy

SAFE TRAVELS GO S.A.S., a Colombian simplified joint stock company based in Medellín, operates as Data Controller for personal information gathered through online platforms, mobile software, phone communications, and in-person channels.

This policy strictly satisfies Article 15 of the Colombian Constitution, Statutory Law 1581 of 2012 (Habeas Data Framework), Regulatory Decree 1377 of 2013, Decree 1079 of 2015 for the Transport Sector, and international guidelines under GDPR (European Union) and CCPA (United States).

Data handling at Safe Travels Go is anchored in Colombian public policy mandates:

• Colombian Constitution (Article 15): guarantees constitutional rights to access and correct personal records in private or public databases.

• Law 1581 of 2012: defines general rules, governing principles, data subject protections, and duties of data controllers and processors.

• Regulatory Decree 1079 of 2015 (Transport Sector): regulates fleet telematics, GPS satellite monitoring, and driver records.

• Law 2068 of 2020 (Tourism Law, Article 38): regulates digital tourism platforms and cross-border visitor data protections.

• Resolution 6652 of 2019 (Ministry of Transport): technical mandates and mandatory validation of FUEC travel forms with RUNT authorities.

Pursuant to Decree 1079 of 2015, Safe Travels Go maintains bidirectional global positioning (GPS) monitoring across all operational fleet vehicles.

Exclusive purposes: protecting road safety, activating RCC and RCE insurance policies during accidents, auditing mileage and declared routes against FUEC authorizations to prevent uncertified diversions, providing real-time data access to transport authorities and highway police, and optimizing arrival estimations (ETA).

Strict disclosure restrictions: under Article 2.2.2.4.6 of Decree 1079 of 2015, real-time vehicle GPS coordinates are classified as restricted circulation data by law. Safe Travels Go never sells or leases location telemetry to commercial third parties.

4.1. Data collected: full legal names, passport or cédula identification, nationality, contact phone, email address, flight details (airline, flight code, arrival ETA), hotel destinations, and tax billing details for DIAN electronic invoicing under Simplified Tax Regime (RST).

4.2. Absolute in-transit privacy (Zero-Contact Rule): to protect personal privacy and safety, passenger phone numbers and email addresses are never disclosed to allied drivers. Communication is routed exclusively through central dispatch. Drivers receive only the passenger name and route coordinates.

4.3. Operational and statutory purposes: validating official FUEC travel manifests with RUNT, mandatory foreign traveler registration with Migración Colombia (SIRE), civil liability insurance coverage exceeding 100 SMMLV per traveler, and issuing electronic DIAN sales invoices under commercial mandate.

Under Article 2.2.1.3.8.9 of Decree 1079 of 2015, Safe Travels Go operates a verified real-time driver registry. Independent drivers collaborating under the commercial revenue model (75% driver, 20% platform, 5% allied channels) authorize personal data management.

Collected records: recent digital identification photos, national ID numbers, blood type and Rh factor, PILA social security certifications (EPS healthcare, pension, and Risk Level IV or V ARL occupational insurance paid before 00:00 on the day of trip execution), contact numbers, residential address, and vehicle compliance paperwork (plates, SOAT, mechanical inspection RTM, operating cards, and policies).

Purposes: screening criminal records, background checks, and SIMIT traffic penalty validation, issuing electronic DIAN support documents, and satisfying highway police inspections.

Focusing on international incoming tourism and pursuant to Article 38 (Paragraph 3) of Law 2068 of 2020, whenever visitor data is transmitted from third countries to Colombia, Safe Travels Go guarantees full adherence to data privacy standards in the country of origin, including GDPR directives in Europe and CCPA requirements in California.

• Banking-grade encryption: advanced TLS 1.3 / AES-256 protocols protect all sensitive inputs, geolocation records, and payment gateway interactions (Wompi, PayU, Bold). Safe Travels Go never stores credit card details or CVV security codes.

• Protected cloud architecture: cloud infrastructure defended with Cloudflare WAF perimeters, anti-DDoS mitigations, and automated snapshots.

• Restricted administrative access: database access is restricted to verified administrative staff utilizing multi-factor authentication (2FA) and enforceable confidentiality contracts.

Under Colombian Law 1581 of 2012, all individuals enjoy enforceable Access, Rectification, Cancellation (Erasure), and Opposition (Revocation) rights over their personal records.

Contact channels: official privacy email legal@safetravelsgo.com, WhatsApp support (+57) 301 706 3345, or the online PQRS portal.

Statutory response deadlines: Safe Travels Go guarantees formal resolution within ten (10) business days for information inquiries, and fifteen (15) business days for formal complaints or modification requests, as mandated by Law 1581 of 2012.