Colombia - Personal Data Policy




We have updated the information about the use of personal data in our Privacy Policy. We use our own and third party cookies to improve your experience and our services, analyzing the browsing in the web. If you continue browsing, we acknowledge your acceptance.



Your are receiving this email because you have shown interest in purchasing or have made purchases in one of our Attenza stores and/or Duty Free affiliated stores.
In our page we have updated, (i) the Cookies Policy; and (ii) the Privacy Policy, Processing of the Information of Personal Data..
In case that, you want to be removed from our data base, you should send an email to: Not answering to this email, implies your consent to our policies and to the processing of your personal data.






1. Definition of “cookie (s)”
A cookie is a small fragment of information that a web site places in your PC, telephone, or any other device, with information about your browsing in such site. The cookies are necessary to facilitate the browsing, making it more friendly, and to allow the Web Site to recognize you.


2. Use of the cookies in the Web Site
The main purpose of the cookies that we use, is to know how you interact with the Web Site, and to be able to improve your experience while browsing. For example, by recording your preferences (language, country, etc.) while browsing and in future visits. Additionally, the gathered information in the cookies allows us to improve the web, by estimated numbers and patterns of use, the speed of search, etc. In occasions, if we have obtained you previous consent, we can use the cookies, tag and any other similar device to obtain information that allows us to show you from our web site, third party, or any other media, advertisement based on the analysis of your browsing habits. The recorded information in the cookies of the Web Site is exclusively used by us, with the exception of the ones later identified as "third party cookies", that are used and managed by external entities, to provide us with services requested by us, to improve our services and the experience of the user when browsing our web site. The main services for which the "third party cookies" are used, are to obtain the access statistics and to guarantee the performed payment operations.


3. Avoid the use or disable the use of Cookies in the Web Site
In the case of wanting to avoid the use of the cookies in the Web Site, taking into consideration what was previously explained, you should: (i) disable the use of cookies in your browser; and, (ii) eliminate from your browser the saved cookies associated to the Web site. The possibility of avoiding the use cookies can be carried out by you at any time. If you want to limit, block the use, or delete the cookies of the Web Site, you can do so at any time, by modifying the configuration of the browser. Although every browser is different, usually, to configure the cookies, you should select the "Configuration", “Preferences”, or "Tools" menu. For more details about the configuration of the cookies in your browser, check its "Help" menu.


4. Cookies used in the Web Site.
The Cookies that are used in the Web site are the following:

  • 1. Session ID. Identifies the http session of the user. It is common in every web application to identify requests of a user in a session.
  • 2. Acceptance of the use of cookies. Identify if the user has accepted the use of cookies in the web.
  • 3. Google Analytics (third party cookie). Allowing the follow-up of the web by the Google Analytics tool, which is a service provided by Google to obtain information of the accesses of users to the web sites. Some of the recorded data for previous analysis are: number of times that the user has visited the web, dates of the first and last visit of the users, duration of the visits, from which page did the user accessed the web, what search engine did the user used to reach the web or which link was clicked, from which part of the world the user accessed, etc. The configuration of these cookies is predetermined by the service offered by Google, reason why we suggest you to check the Google Analytics privacy page, to obtain more information about the cookies used and of how to disable them (understanding that we are not responsible of the content nor the truthfulness of third party web sites).



IN BOND GEMA, S.A.S., is committed to the legal, lawful, legit and safe processing of the personal data contained in its information systems. Responsible for such processing, notifies that, the personal data of the clients, contractors, providers, employees and third parties, is done in accordance to the Personal Data Processing Policy, which content is available in the Web Site. Therefore, the provided information is processed with the purpose and scopes decreed in the mentioned policy, in which their rights are indicated as owners of the information to know, update, or correct its data and the rest of the decreed rights in the current legislation, which can be exercised through the email address



I have been informed, by IN BOND GEMA, S.A.S. (Responsible for processing), of the following:


  • i. The data provided in this document will be processed for the following purposes: To send and utilize the information for contractual purposes, client services, marketing (Such as consumption analysis, traceability of the brand, among others), Commercials (Such as benefits, promotions, discounts, current campaigns, promotional events, documents, images, data messages, affiliated brands, and programs of own brands or the affiliates, among others), update data and offer relevant information; for consultation to answer inquires about offered products and services, realization of studies with statistical purposes, of client knowledge. Of Information, to notify the data owners about news, products, services, and special offers, for the development of activities related to telephonic customer services, billing, or similarities. Allowing the transfer or transmission of the data, or partial or total information to their affiliates, businesses, companies and/or affiliated entities and commercial or strategic allies that operate or not in other jurisdictions.
  • ii. Answering questions about sensitive data or of a minor is optional;
  • iii. As the owner of the data and/or representative of the minor, I have the rights to access, correct, cancel, or oppose to the use of the information; and/or revoke the given authorization;
  • iv. In case that my request is not resolved, I directly and alternatively have the right to present complaints before the competent authority;
  • v. My rights and obligations, I can exercise them when strictly complying with the Privacy Policy, Attenza Information and Personal Data Processing, available in and writing to email address See Privacy Policy, Information and Personal Data Processing. [INCLUDE HIPERLINK].

I declare that the supply of third-parties data, has been done with their unequivocal and expressed authorization.



IN BOND GEMA, S.A.S., located in Panama, with email address, makes known to the Owners of Personal Data that is processed by the company, this Processing Policy in compliance to: (i) Law 1266 of 2008, Law 1581 of 2012 and the Decree 1377 of 2013, in Colombia; (ii) Law No. 81 of 26 March 2019, in Panama; and (iii) Law No. 787 of 29 March 2012 in Nicaragua, in conjunction with, the “Applicable Legislation”).


The policies and procedures held in this document will apply at any time and during the realization of every activity that involves the gathering, recording, use, circulation, and transfer of information or personal data, registered in any data base that makes them sensitive to their processing by IN BOND GEMA, S.A.S.
This document shall be strictly adhered to by MOIN BOND GEMA, S.A.S, as the responsible party for the processing of data, available for physical and electronic consultation by any of the Owners.
Both, the responsible party as well as the in-charge, shall protect the safety of the data base that contains personal data and keep the confidentiality in regards to it.


In accordance with the current normative and with the purpose of facilitating the understanding of the present document, the following definitions will apply:


  • 3.1. Authorization: Previous consent, expressed and notified by the Owner to proceed with the processing of personal data.
  • 3.2. Privacy Notice: Electronic document or in any other format, generated by the Responsible party available to the Owner for the processing of its personal data.
  • 3.3. Data Base: Group of personal data that is subject to processing by the Responsible party;
  • 3.4. Personal Data: Any information linked to one or several particular or determinable person.
  • 3.5. Public Data: Data related to the marital status of the people, occupation and trade and capacity as a merchant or public official. Given its nature, the Public Data may be found, among others, in public records, public documents, gazettes, and official journals and legal sentences duly executed, not committed to confidentiality..
  • 3.6. Sensible Data: All information that can affect the intimacy of the Owner, or its use can generate its discrimination, such as the ones that can reveal the racial or ethnic origin, political orientation, religious or philosophic convictions, union presence, human rights social organizations, or that ensure the rights and guarantees of opposition politic parties, as well as data related to health, sexual life and biometric data.
  • 3.7. In charge of Processing: Natural or judicial party, that by themselves or in conjunction with others, caries out the processing of the personal data on behalf of the Responsible of Processing.
  • 3.8. Responsible of Processing: Natural or judicial party, public or private, that by themselves or in conjunction with others, makes decisions about the data base or the data processing, in other words, IN BOND GEMA, S.A.S.
  • 3.9. Owner: Natural or judicial person, public or private, who is the owner of the information or personal data that is included in the Data Base of the Responsible Party;
  • 3.10. Processing: Any operation or group of operations on Personal Data, such as the gathering, recording, use, circulation or suppression.
  • 3.11. Transfer: The Transfers of data takes place when the responsible party and/or the in charge of Processing the Personal Data sends the information or the Personal Data to a receptor, which at the same time is Responsible of the Processing and it is located in or outside the country.
  • 3.12. Transmission: Processing of Personal Data that implies the communication of such inside or outside of the territory, when its objective is the realization of the Processing by the In-charge on behalf of the Responsible Party.


In accordance with the Applicable Legislation, the Owners of the Information have the following rights:


  • 4.1. To Know, update, and correct their Personal Data before IN BOND GEMA, in its capacity as the Responsible of Processing. This right may be executed before partial data, inaccurate, incomplete, fractionated, that prompt to error, or if its processing is expressly prohibited or not previously authorized.
  • 4.2. To request a prove of the authorization given to IN BOND GEMA or to the local affiliated company, in its capacity as the Responsible of Processing, unless it is expressly exempt from been a requirement for processing, in accordance to the Applicable Legislation.
  • 4.3. To be informed, by IN BOND GEMA, about the use given to its personal data, in case it is expressly required.
  • 4.4. To revoke the authorization and/or request the deletion of the data, when in the Processing, principles, rights, and legal and constitutional guarantees are not respected. The revocation and/or deletion will proceed when the competent authority has determined that, in the Processing, the Responsible Party or In Charge has incur in conducts in contradiction to the Applicable Legislation.
  • 4.5. Free access to its personal data, which is in the data base of IN BOND GEMA, S.A.S.
  • 4.6. To be informed of essential changes that are done in the present Information Processing Policy, included and not limited to: changes in the identification of the Responsible of the Information and the purpose of the Processing of the personal data of the clients, providers, and employees of IN BOND GEMA, S.A.S.
  • 4.7. To receive a new request for the Processing of Information when the changes done by IN BOND GEMA, S.A.S., to the Privacy Policy, that modify the purpose of the Processing of Information.
  • 4.8. Assistance for requests to the Privacy Official (updates, corrections, deletions of the Information and revocation of the authorization), inquiries and claims related to the Processing of Information.




  • 5.1. To reach an efficient communication related to our products, services, offers, promotions, alliances, contests and other activities, and in this way, to facilitate the general access to the their information.
  • 5.2. To evaluate the quality of our products and services by satisfaction surveys and making studies about consumption habits, preferences, purchase interests, product testing, concept, service evaluation and satisfaction, and others, related to our services.
  • 5.3. To do activities for marketing, promotion, advertising, invoicing, billing, collection, service improvements, consultations, verification, control, enabling methods of payment, fraud prevention, as well as any other activity related to our services and current and future offers, for the compliance of the contractual obligations and of our social purpose, through any direct means.
  • 5.4. Control and prevent fraud in all of its forms.
  • 5.5. To do basic tasks of administrative management.


Subject to obtaining your approval, we can communicate with you by email, text message (SMS, MMS), direct mail, or by telephone.
If you prefer not to receive notices through any mean or all channels, you can communicate it at any time at and request to stop receiving such notices.




For the processing of petitions, complaints, claims and modification applications, formulated by the Owners exercising the rights herein established, the Owners or whomever acts as their representative should be able to contact the responsible party of IN BOND GEMA, S.A.S., from Monday to Friday from 8:00 a.m. to 5:00 p.m., at email address




The owner or any authorized person in accordance to what has been established in this Policy, that considers that the information contained in the data base of IN BOND GEMA, S.A.S., should be subject to correction, update or deletion, or when alleged breach of the Applicable legislation is advised or of any other norm that complements it or modifies it, is able to present a claim before IN BOND GEMA, S.A.S., which will be handle in accordance to the following rules:


  • 7.1. The claim will be formulated by applications, processed in writing at email address
  • 7.2. If the claim is incomplete, IN BOND GEMA, S.A.S. will require, from the interested party, within the following five (5) days, receipt of the claim to alleviate the flaws. Two (2) months after, from the date of the request, in case the applicant fails to submit the information requested, a withdrawal of the claim will be acknowledged.
  • 7.3. The maximum term to handle a claim will be fifteen (15) business days, starting from the next day from the date it was received. When it is impossible to handle the claim within such term, the interested party will be informed about the reasons of the delay and the date of when the claim will be handle, which should never, by any means, overpass eight (8) business days following the expiration of the first term.




The owner has the right, at any time, to request from IN BOND GEMA, S.A.S, the deletion of its personal data when:


  • • it is considered that such is not being processed in accordance to the principles, duties, and obligations stated in the Applicable Legislations.
  • • Becoming unnecessary or pertinent for the purpose they were gathered for.
  • • When the necessary period has exceeded for the fulfillment of the purposes for which they were gathered.


This deletion involves the total elimination of the personal information in accordance to what was requested by the owner in the records, files, or data base of IN BOND GEMA, S.A.S.

The right of deletion is not absolute and the Responsible Party can deny its exercise when, The Owner has a contractual or legal duty to stay in the data base of IN BOND GEMA, S.A.S.




The Owner of the personal data can revoke the approval of the Processing of its personal data at any time, as long as it is not prohibited by a legal disposition.




When data is sent or transferred to other countries, the authorization of the owner of the personal information been transferred, should be available. In this respect, before sending the personal data to another country, the ones bound to fulfill this policy should verify that a previous, expressed, and unequivocal authorization, that allows the transferring of the personal data, is available.
This transfer of personal data in only done to third parties, with whom IN BOND GEMA, S.A.S. has a contractual, commercial, and/or judicial bond, with the purpose of receiving assistance from them for functions related to the delivery of promotions, collecting payments, product delivery, or outsourcing our client service systems. We can exchange information with third parties for the protection against fraud and credit risk reduction.
IN BOND GEMA, S.A.S. should be able to transfer the data to other Responsible of Processing parties when authorized by the Owner of the information, by the law, or an administrative or judicial order.




IN BOND GEMA, S.A.S. uses several video surveillance systems installed in different internal and external places in its facilities and offices. Reason why, it informs all public in general about the existence of these mechanisms through the broadcasting in visible advertisement video surveillance sites.
The information gathered through this mechanism is utilized for security, improvement of our services and experience in the facilities of IN BOND GEMA, S.A.S., as well as, a proof for any type of process before any type of authority or organization.
IN BOND GEMA, S.A.S. does not give out video recordings obtained by a third party, except in response to a court order or a request from a judicial or competent authority or allowed by law.




In implementing the principle of security, IN BOND GEMA, S.A.S. has adopted technical, administrative, and reasonable humane means to protect the information of the Owners, and to avoid falsification, lost, consultation, fraudulent or unauthorized use or authorization. The access to the personal data is restricted to its Owners, and IN BOND GEMA, S.A.S will not allow the access to this information by third parties under different conditions from the ones already stated, with the exception of an expressed request from the owner of the data or authorized personnel in accordance to the national regulations.
Notwithstanding the foregoing, IN BOND GEMA, S.A.S is not responsible for any action aimed at infringing the security measures established for the protection of the Personal Data.




IN BOND GEMA, S.A.S. can modify the present Policy at any, and will always published the current version in all of its commercial establishments.




The Policy is in forced starting from the approval date of its Terms and Conditions. As a general rule, the term of the authorizations about the use of personal data shall be deemed by the term of the commercial relationship and during the exercise of the social aim of the company.

We have updated the information about the use of your personal data in our Privacy Policy.

We use our own and third party cookies to improve your experience and our services, analyzing the browsing in the web. Is you continue browsing, we acknowledge your acceptance.