Introduction

At RapiTRA, we are committed to protecting the privacy of our users and the guests whose data is processed through our platform. This policy describes how we collect, use, and protect personal information.

Data We Collect

We collect the following types of information:

• Account data: Name, email address when registering and, if the user chooses to provide it, a WhatsApp number used only for technical support and to notify them of failed SIRE or TRA transmissions.
• Property data: Tourist accommodation information (name, address, RNT, NIT).
• Guest data: Name, ID document, nationality, stay dates, and other data required by Colombian regulations (TRA and SIRE).
• Usage data: Information about how you interact with our platform.

Use of Data

We use the collected information to:

• Facilitate compliance with legal obligations to Migration Colombia (SIRE) and the Ministry of Commerce (TRA).
• Manage guest reservations and stays.
• Send service-related notifications.
• Improve and personalize user experience.
• Comply with legal and regulatory requirements.

Data Sharing

We share information only in the following cases:

• Government authorities: We transmit guest data to Migration Colombia (SIRE) and the TRA system as required by Colombian law.
• Service providers: We use third-party services (hosting, database) that process data under strict confidentiality agreements.
• Measurement and monitoring tools: Google Analytics (visits to public pages, with cookies only if you accept them), a cookie-free visit counter and a technical error tracker. See the Cookies section.
• Legal requirements: When required by law or legal process.

Data Security

We implement technical and organizational security measures to protect information, including data encryption in transit and at rest, role-based access control, and continuous security monitoring.

Data Retention

Identity document images are deleted 30 calendar days after check-out. Guest identifying data —names, document number, date of birth, email and phone— is anonymised 6 months after check-out. Both processes run automatically every day: they do not depend on the data subject requesting them. Records of transmissions to the authorities are retained dissociated from the data subject identity, so they cease to constitute personal data. Account data is kept while the user has an active account and can be deleted on request. Deletion is carried out on production systems; backups are overwritten according to their own rotation cycle.

User Rights

Users have the right to:

• Access their personal data.
• Rectify incorrect data.
• Request deletion of their data (when legally possible).
• Object to the processing of their data.
• Receive a copy of their data in a portable format.

Children

Our service is intended for businesses and professionals. We do not intentionally collect information from individuals under 18 years of age as platform users.

Changes to this Policy

We may update this policy periodically. We will notify significant changes through the platform or by email.

Contact

For questions about this policy or to exercise your rights, contact us at: