Data policy

Personal data processing at Mantra Rooftop and Mantra Café.

Personal Data Processing Policy

Casa Duque Holdings SAS

This is a courtesy translation. In case of any discrepancy, the Spanish version prevails.

1 · Data controller

Casa Duque Holdings SAS, tax ID (NIT) 901.759.279-4, domiciled in Cali, Colombia, at Av 9a Norte #10N-22, Granada neighborhood, is responsible for processing personal data. Casa Duque Holdings SAS operates several brands and trade names, including Mantra, with its spaces Mantra Rooftop and Mantra Café, and Guru. This policy applies to the data collected through the websites, forms and contact channels of all of them. Its contact details are the WhatsApp line +57 317 138 3701 (wa.me/573171383701) and casaduquemarketing@gmail.com.

2 · Legal framework

This policy is governed by Colombian Law 1581 of 2012, Decree 1377 of 2013, compiled in Decree 1074 of 2015, and any rules that amend or complement them.

3 · Data collected

We collect identification and contact data, such as name, phone number and email address, and reservation details, such as date, time, space and number of guests. We also process the data the data subject provides when writing through WhatsApp or requesting an event quote, as well as aggregated website browsing data. Casa Duque Holdings SAS does not request sensitive data. If it ever does, providing it will be optional.

4 · Purposes

Personal data is used to:

Manage, confirm and administer reservations.
Respond to inquiries, requests and event quotes.
Recognize returning guests and improve the service.
Send commercial information, such as news, events, promotions and commercial activities, from any of the brands and trade names of Casa Duque Holdings SAS, and not only from the brand the data subject was in contact with, when the data subject has expressly authorized it.
Invite guests to its brands' membership or benefits programs, when they exist and with the data subject's authorization.
Produce internal statistics on the use of its websites.
Comply with legal obligations and requests from competent authorities.

5 · Authorization

Data is processed with the prior, express and informed authorization of the data subject, given by checking the corresponding box in the website forms or through any other means that allows it to be consulted later. Authorization to receive commercial information is separate from authorization to manage a reservation, and declining it does not affect the reservation. Whoever grants it agrees to receive information from all the brands and trade names of Casa Duque Holdings SAS, through WhatsApp, text messages, email or social media, and may ask at any time to stop receiving it, through the channels in section 7.

6 · Rights of the data subject

The data subject has the right to:

Know, update and correct their personal data.
Request proof of the authorization granted.
Be informed, upon request, of how their data has been used.
File complaints with the Superintendence of Industry and Commerce (SIC), once the inquiry or claim process with the controller has been completed.
Revoke the authorization and request the deletion of their data, when there is no legal or contractual duty to keep it.
Access their personal data free of charge.

7 · Inquiries and claims

Inquiries and claims are handled mainly through the WhatsApp line +57 317 138 3701 (wa.me/573171383701), and also through casaduquemarketing@gmail.com, managed by the marketing area of Casa Duque Holdings SAS. They may be submitted by the data subject, their successors, their representative or their attorney.

Inquiries are answered within a maximum of ten (10) business days from receipt. If that is not possible, the person is informed of the reason and the response date, which may not exceed five (5) business days after the first deadline.

Claims to correct, update or delete data, or regarding a possible breach of this policy, must include the identification of the data subject, a description of the facts, the address or email for the response, and any supporting documents. If a claim is incomplete, the person is asked to complete it within five (5) days of receipt. If two (2) months pass without it being completed, the claim is considered withdrawn. Claims are answered within a maximum of fifteen (15) business days from the day after receipt. If that is not possible, the person is informed of the reason and the response date, which may not exceed eight (8) business days after the first deadline.

8 · Transfer to third parties

Data may be shared with the technology providers that host the websites and the reservation systems, only to fulfill the purposes of this policy and under a duty of confidentiality. Casa Duque Holdings SAS does not sell or assign personal data to third parties.

9 · Minors

The online services of the brands of Casa Duque Holdings SAS are intended for adults. If the data of minors is ever processed, it will be done in their best interest and with the authorization of their legal representative.

10 · Security

Casa Duque Holdings SAS applies reasonable technical, human and administrative measures to protect personal data against alteration, loss, consultation, use or unauthorized access.

11 · Cookies and browsing

The websites may use cookies and analytics tools to measure visits and improve the browsing experience. The data subject can disable them in their browser settings.

12 · Effective date

This policy is effective as of October 14, 2026. Personal data is kept for as long as it is needed for the purposes described, or while there is a legal or contractual duty to keep it. Any substantial change to this policy will be announced on the websites of its brands.