This is an English translation of the Política de Tratamiento de Datos Personales, provided for convenience. If the translation and the Spanish original differ, the Spanish version governs. Quotations from Colombian laws and regulations are our own translations; only their Spanish text is official.
Personal Data Processing Policy
El Arte de Nicolás · In force since September 18, 2026 · Updated on October 6, 2026: the data of partner planners and what it is processed for (sections 2.2, 2.5 and 3). Updated on September 29, 2026: the address of the Controller’s domicile (section 1), and the person booking is also asked for their identity document and home address, which appear on the billing statement (section 2.1). Reviewed on September 28, 2026: drafting notes were removed, without changing the processing of the data.
1. Identification of the Data Controller
Required by Art. 2.2.2.25.3.1, numeral 1, of Decree 1074 of 2015 and by Art. 12, letter d), of Law 1581 of 2012.
- Controller: Ubaldo Nicolás Herrera de Ávila, a natural person, identified with Colombian citizenship card (cédula de ciudadanía) no. 73.111.757.
- Domicile: Barrio Torices, Cl. 41, Ed. Gaviotas del Lago, apto. 201, Cartagena de Indias, Bolívar, Colombia.
- Email for personal data matters: datos@elartedenicolas.com
- Phone: +57 324 661 7899
- Website: https://elartedenicolas.com
Person responsible for handling requests, inquiries and claims: the Controller, through the email indicated.
Art. 2.2.2.25.4.4 of Decree 1074 of 2015 provides that “every Controller and Processor must designate a person or area to take on the function of personal data protection”. It sets no threshold: it also applies to a natural person.
2. Data collected and from whom
2.1. From the person booking
Full name, email, phone, type and number of identity document, home address, address of the event venue, city, and any notes they choose to write.
The identity document and the home address are requested because the billing statement is issued in the name of the person booking and includes them (purposes 5 and 7 of section 3).
2.2. From third parties: the planner’s case
When the person booking is a wedding planner or another intermediary and provides data of their client, that data belongs to a third party. That third party’s authorization is not presumed. Whoever provides the data declares that they are authorized to do so, and the system requires recording proof of that consent before the data is processed.
2.3. Payment data
The Controller does not receive or store card numbers. Payment is processed entirely on the Wompi gateway (Bancolombia). The Controller keeps only the identifier of the transaction, the amount, the status and the date.
2.4. Sensitive data: not requested
Art. 5 of Law 1581 of 2012 defines as sensitive “those that affect the privacy of the Data Subject or whose improper use may lead to their discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social or human rights organizations […] as well as data relating to health, to sex life and biometric data”.
No field of the form requests sensitive data, and the Controller does not need it to provide the service.
⚠️ A warning about the free notes field. That field is free text and could receive, on the initiative of whoever writes in it, information about health, dietary restrictions of religious origin or beliefs. It is expressly requested that this kind of information not be included.
Art. 2.2.2.25.2.3 of Decree 1074 of 2015 requires, when sensitive data is processed, informing that “they are not obliged to authorize its Processing”, indicating which data is sensitive and obtaining express consent, and establishes that “no activity may be conditioned on the Data Subject providing sensitive personal data”.
2.5. From partner planners
Trade name and, if any, legal name; contact name, email and phone; city and address; type and number of identity document or tax ID (NIT); and the account their commissions are transferred to. The document is requested to support the payment of each commission (purposes 7 and 8 of section 3).
3. Purposes of the Processing
Required by Art. 2.2.2.25.3.1, numeral 2, of Decree 1074 of 2015 and by Art. 12, letter a), of Law 1581 of 2012.
The data is processed only to:
- Manage the booking: check availability, secure the date and record the agreement.
- Collect and reconcile the deposit and the balance through the payment gateway.
- Communicate the status of the booking: confirmation, payment link, receipt, reminder of the event, cancellation or refund.
- Perform the contracted service: coordinate travel, the setup and the painting of the work at the agreed place and date.
- Issue the billing documents and keep them for the legal period.
- Handle requests, inquiries and claims, including those relating to this same data.
- Comply with legal obligations, tax and accounting obligations included.
- Manage the relationship with partner planners: record the bookings they bring, calculate and pay their commissions, and keep a record of each payment.
It is not used for third-party advertising, it is not sold, it is not assigned for commercial purposes, and it is not used to build profiles or for automated decisions.
Art. 2.2.2.25.2.1 of Decree 1074 of 2015 establishes that “the collection of data must be limited to personal data that is pertinent and adequate for the purpose for which it is collected” and that “deceptive or fraudulent means may not be used”.
4. Authorization
Required by Arts. 9 and 12 of Law 1581 of 2012 and by Arts. 2.2.2.25.2.2, 2.2.2.25.2.4 and 2.2.2.25.2.5 of Decree 1074 of 2015.
Authorization is requested at the very moment of collection, through a checkbox that the Data Subject must actively check.
Silence does not amount to authorization. The checkbox is not pre-checked.
Art. 2.2.2.25.2.4 of Decree 1074 of 2015 allows authorization “in writing, orally or through unequivocal conduct”, and concludes: “In no case may silence be equated with unequivocal conduct”.
Proof of authorization. At the moment of acceptance, the following is recorded: the exact text accepted (through a cryptographic fingerprint that makes it possible to prove which version was accepted), the date and time, and the IP address from which it was given. That record is kept for as long as the processing lasts and is provided to the Data Subject upon request.
Art. 12, paragraph, of Law 1581 of 2012: “The Data Controller must keep proof of compliance with the provisions of this article and, when the Data Subject so requests, provide them with a copy thereof”.
5. Rights of the Data Subject
Art. 8 of Law 1581 of 2012, letters a) to f). Required as content of the policy by Art. 2.2.2.25.3.1, numeral 3, of Decree 1074 of 2015.
Whoever provides their data has the right to:
- Know, update and rectify their data. This applies especially to partial, inaccurate, incomplete or fragmented data, or data that is misleading.
- Request proof of the authorization given, except where the law does not require authorization.
- Be informed of the use that has been made of their data, upon request.
- File complaints with the Superintendence of Industry and Commerce for violations.
- Revoke the authorization and/or request the deletion of the data.
- Access free of charge their data that has been processed.
⚠️ Two clarifications, taken from the law:
- On right 5: the law places a condition on part of it. Art. 8, letter e): “Revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has engaged in conduct contrary to this law and to the Constitution”.
- Revocation or deletion is not available when the Data Subject has a legal or contractual duty to remain in the database (Art. 2.2.2.25.2.6 of Decree 1074 of 2015). In practice: the data associated with a paid booking must be kept for accounting and tax obligations, even if the authorization is revoked for other purposes.
Inquiries are free of charge. Art. 2.2.2.25.4.2 of Decree 1074 of 2015 allows the Data Subject to consult their data free of charge at least once every calendar month, and the mechanisms for exercising the rights must be free of charge and easy to access (Art. 2.2.2.25.2.6).
6. Procedure for exercising the rights
Required by Art. 2.2.2.25.3.1, numerals 4 and 5, of Decree 1074 of 2015. The time limits are those of Arts. 14 and 15 of Law 1581 of 2012 and are not negotiable.
Single channel: datos@elartedenicolas.com
State: full name, a detail that makes it possible to locate the booking (the code AN-YYYY-NNNN or
the email used to book), what is being requested, and an email or address for the reply.
6.1. Inquiries: up to 10 business days
To learn what the data is, its origin or the use that has been made of it.
| Time limit | Rule |
|---|---|
| 10 business days | maximum time to respond, from the date of receipt |
| +5 business days | if it is not possible to respond within the first period, the reason and the new date are reported; the new date may not be more than 5 business days after the first period expires |
6.2. Claims: up to 15 business days
To correct, update or delete data, or to report an alleged failure to comply.
| Time limit | Rule |
|---|---|
| 2 business days | the record is marked with the legend «reclamo en trámite» (claim in process) and the reason, and it stays until the claim is decided |
| 5 days | if the claim is incomplete, the person concerned is asked to complete it |
| 2 months | if they do not complete it within that time, counted from when they were asked to, they are deemed to have withdrawn the claim |
| 2 business days | if whoever receives it is not competent, they forward it to whoever is and inform the person concerned |
| 15 business days | maximum time to respond, from the day after receipt |
| +8 business days | maximum extension, stating the reason and the new date |
6.3. Before going to the Superintendence
Art. 16 of Law 1581 of 2012: “The Data Subject or their successor in title may only file a complaint with the Superintendence of Industry and Commerce once they have exhausted the inquiry or claim procedure before the Data Controller or the Data Processor”.
7. Term of the policy and of the databases
Required by Art. 2.2.2.25.3.1, numeral 6, of Decree 1074 of 2015.
- Entry into force of this policy: September 18, 2026.
- Term of the databases: the data is kept for as long as the purpose that justified its collection remains and, after that, for the periods imposed by the applicable legal, accounting and tax obligations. Once those periods have elapsed, it is deleted.
Art. 2.2.2.25.2.8 of Decree 1074 of 2015 orders keeping the data “for as long as is reasonable and necessary”, taking into account “administrative, accounting, tax, legal and historical aspects”, and deleting it once the purpose has been fulfilled, unless there is a legal or contractual obligation.
Changes to this policy. Any substantial change will be communicated to the Data Subjects before it is implemented. If the change concerns the purpose of the processing, a new authorization will be requested (Art. 2.2.2.25.2.2 of Decree 1074 of 2015).
8. Security and incidents
The Controller adopts technical and administrative measures to protect the information: encryption in transit, role-based access control, an audit log of the operations on bookings and payments, and random, unguessable access identifiers for the pages that expose the data of a booking.
This last measure responds to Art. 4, letter f), of Law 1581 of 2012, which prohibits personal data from being “available on the Internet or other means of mass dissemination or communication, unless access is technically controllable”.
Reporting incidents to the Superintendence. In the event of a breach of the security codes, or the loss, theft or unauthorized access to the information, the Controller will report the incident to the Superintendence of Industry and Commerce within fifteen (15) business days following its detection.
Single Circular (Circular Única) of the SIC, Title V, Chapter Two, numeral 2.1, letter f) (ii), in its version in force as of January 2026. That numeral expressly covers “the Data Controllers that are not obliged to register their databases in the RNBD”, which is the case here (see section 10). It is consistent with Art. 17, letter n), of Law 1581 of 2012.
9. Providers and data outside Colombia
To provide the service, the Controller relies on providers that process data on the Controller’s behalf and following the Controller’s instructions (Data Processors):
| Provider | For what | What it receives |
|---|---|---|
| Wompi (Bancolombia, Colombia) | processing the payments | name, email, amount, reference |
| Neon | database | the data of the booking |
| Vercel | hosting of the website | the data in transit of each request |
| Resend | sending emails | name, email and the content of the message |
The applicable legal concept is transmission, not transfer
Art. 2.2.2.25.5.1, numeral 2, of Decree 1074 of 2015: “International transmissions of personal data carried out between a Controller and a Processor to allow the processor to carry out the processing on behalf of the controller, shall not need to be reported to the Data Subject or have their consent when there is a contract under the terms of article 2.2.2.25.5.2”.
That contract must impose three minimum obligations on the Processor: to process the data in accordance with the principles of the law, to safeguard the security of the databases and to keep confidentiality (Art. 2.2.2.25.5.2).
About the hosting country
Art. 26 of Law 1581 of 2012 prohibits transfer “to countries that do not provide adequate levels of protection”, and makes exceptions for, among other cases, letter c) “bank or stock exchange transfers” and letter e) “transfers necessary for the performance of a contract between the Data Subject and the Controller”.
The Superintendence published the list of countries with an adequate level in numeral 3.2 of Chapter Three of Title V of its Single Circular (added by External Circular 005 of August 10, 2017 and amended by External Circulars 008 of 2017 and 002 of 2018). The United States of America is on that list.
The database (Neon) and the website (Vercel) are hosted in the United States, which is on that list of countries with an adequate level.
Wompi operates in Colombia, so Art. 26 is not triggered with respect to the gateway; and in any case letter c) covers bank transfers.
10. National Database Registry (RNBD)
The Controller, being a natural person, is NOT obliged to register their databases in the RNBD.
Decree 090 of January 18, 2018 (Ministry of Commerce, Industry and Tourism, Diario Oficial 50.480), which amended Art. 2.2.2.26.1.2 of Decree 1074 of 2015. Only the following are obliged: “a) Companies and non-profit entities with total assets exceeding 100,000 Tax Value Units (UVT)” and “b) Legal persons of a public nature”. The recitals are explicit: “Likewise, natural persons shall be excluded”.
⚠️ And what that exclusion does NOT mean, in the words of the decree itself:
“The limitation of the universe of supervised parties regarding the duty to register their databases does not in any way imply that the legal and natural persons that are exempted […] are relieved of compliance with the other duties […] they remain subject to compliance with the provisions contained in Law 1581 of 2012”.
11. Artificial intelligence
The Controller does not use artificial intelligence systems to process the personal data of the Controller’s clients, nor for profiling, nor for automated decisions.
If the Controller were to do so in the future, the Controller must observe External Circular 002 of August 21, 2024 of the Superintendence of Industry and Commerce (Diario Oficial 52.856), «Lineamientos sobre el Tratamiento de Datos personales en Sistemas de Inteligencia Artificial» (Guidelines on the Processing of Personal Data in Artificial Intelligence Systems), which requires weighing suitability, necessity, reasonableness and proportionality in the strict sense, and applying the precautionary principle:
“In case of a lack of certainty regarding the potential harm that the Processing of personal Data may cause, and with a view to preventing serious and irreversible harm, personal Data Administrators must refrain from carrying out such Processing or adopt precautionary or preventive measures”.
Legal basis
This Policy is based on the following rules:
| Rule | What it contributes |
|---|---|
| Statutory Law 1581 of 2012 (D.O. 48587) | arts. 4 (principles), 5 and 6 (sensitive data), 8 (rights), 9 and 12 (authorization), 14 to 16 (inquiries, claims, prerequisite for complaints), 17 (duties), 23 (penalties), 26 (transfer) |
| Decree 1074 of 2015, Book 2, Part 2, Title 2, Chapter 25 | 2.2.2.25.2.1 to 2.2.2.25.2.8 (authorization), 2.2.2.25.3.1 to 2.2.2.25.3.4 (policy and notice), 2.2.2.25.4.2 and 2.2.2.25.4.4, 2.2.2.25.5.1 and 5.2 (transmission), 2.2.2.25.6.1 and 6.2 |
| Decree 090 of 2018 (D.O. 50.480) | excludes natural persons from the RNBD |
| SIC Single Circular, Title V, Chap. 2 num. 2.1 letter f) (ii) | reporting incidents within 15 business days |
| SIC Single Circular, Title V, Chap. 3 num. 3.2 | list of countries with an adequate level |
| External Circular 002 of 2024 (D.O. 52.856) | artificial intelligence |