Privacy policy
How I process the personal data of colombia.io visitors: what data, for what purposes, with which services and how to exercise your rights.
This policy explains how I process the personal data of colombia.io visitors, in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Spanish data protection law (LOPDGDD). For details on cookies and similar technologies, see the cookie policy.
In short: colombia.io has no sign-ups, comments, forms or newsletter, and doesn’t sell anything. It only collects the technical data needed to run the site and, only if you consent, data for analytics and advertising. If you email me, I only use your address to reply.
Data controller
The data controller is me, Gianluca Orlandi, the author of the site.
- Address: C. Mejorada del Campo 4, Madrid (Spain)
- Tax ID (NIF): Y0580335J
- Email for privacy requests: gianluca@colombia.io
My other identifying details are in the legal notice. I haven’t appointed a data protection officer (DPO), as it isn’t required for a site of this size: you can write to me directly with any question.
What data I process, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running and protecting the site against attacks and abuse | IP address, browser and device type, pages requested, date and time | legitimate interest in providing a secure site (Art. 6(1)(f) GDPR) | as set by Cloudflare’s policies for technical logs |
| Remembering your cookie choices | the preferences you set in the consent message | legal obligation to record consent (Art. 6(1)(c) and 7(1) GDPR) | in essential cookies in your browser, up to 13 months |
| Visitor statistics | browsing data, analytics cookie ID, approximate country and city | your consent (Art. 6(1)(a) GDPR) | according to Clicky’s plan, then deleted |
| Advertising | advertising cookie IDs, IP address, browsing data and interaction with ads | your consent (Art. 6(1)(a) GDPR); without consent Google may show non-personalised ads | according to the policies of Google and its partners |
| Replying to your messages | email address, name and message content | steps taken at your request (Art. 6(1)(b) GDPR) and legitimate interest | as long as needed to handle the request and any follow-up |
| Tracking affiliate commissions | click data (date, time, link used), processed by the partner on its own site | the partner’s and my legitimate interest; cookies on the partner’s site follow its own rules | according to each partner’s policy |
I don’t use your data for automated decision-making or profiling of my own, I don’t sell it and I don’t share it with third parties for their marketing.
Third-party services I use
To run the site I rely on a few providers. Some act on my behalf (processors), others, such as Google for advertising, act as independent controllers.
- Cloudflare, Inc. (United States): site hosting, content delivery and protection against attacks. All the site’s traffic goes through its servers. Cloudflare privacy policy.
- Clicky – Roxr Software Ltd. (United States): visitor statistics, only with your consent. Clicky privacy policy · Opt-out.
- Google AdSense – Google Ireland Limited (Ireland, with possible transfers to the United States): advertising and the cookie consent message (an IAB TCF certified platform). Personalised ads are shown only with your consent. To learn how Google uses data, see How Google uses information from sites or apps that use its services. You can also manage personalised ads in My Ad Center.
- Google Maps – Google Ireland Limited: some pages include an interactive map, which only loads if you click “Load the map”. From then on Google receives your IP address and may set its own cookies. Google privacy policy.
- Email provider: if you write to me, your message is stored in the colombia.io mailbox at my email provider.
The site does not use Google Fonts (fonts are hosted on the site itself), embedded videos, social media buttons or contact forms. If I start using Google Analytics or other services, I’ll update this page and the cookie policy before switching them on.
Affiliate links
Many pages contain links to commercial partners (tours, accommodation, flights, eSIMs, insurance, financial services). When you click one of these links you leave colombia.io and land on the partner’s site, sometimes via the servers of an affiliate network that records the click. From then on your data is processed by the partner under its own privacy policy, and I only receive aggregated, anonymous booking data (for example the number of sales and the commission amount), never your name or payment details.
The partners and networks I work with are listed in the cookie policy and the affiliate disclosure.
Data transfers outside the European Union
Some providers (Cloudflare, Clicky, Google) are based in or have servers in the United States. Transfers rely on the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or, where that doesn’t apply, on the Commission’s standard contractual clauses.
Children
The site isn’t aimed at children under 14 and I don’t knowingly collect their data. If you’re a parent and think your child has sent me personal data, write to me and I’ll delete it.
Security
The site is served over HTTPS only and doesn’t keep any database of user data. I take reasonable steps to protect the emails I receive, but no online system is 100% secure, so please never send me sensitive data such as ID documents or payment details.
Your rights
At any time you can ask me to:
- access your data and get a copy of it;
- correct it if it’s inaccurate;
- erase it;
- restrict its processing;
- object to processing based on legitimate interest;
- receive your data in a portable format (portability).
You can withdraw your consent to analytics and advertising at any time via the “Cookie preferences” link at the bottom of every page: withdrawal doesn’t affect what was done before. To exercise your other rights, email gianluca@colombia.io: I’ll reply within one month.
If you believe the processing of your data breaks the law, you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), or to the authority where you live or work: in the UK, the Information Commissioner’s Office (ICO).
Changes to this policy
I update this policy when the services used by the site or the law change. The date of the latest update is shown at the bottom of the page; if the changes affect consent, the consent message will ask for your choices again.
Updated