This is the privacy policy of Propiedades Luxur and our personal data processing policy (Política de Tratamiento de la Información) under Colombian Law 1581 of 2012. It explains what data we process, why, who we share it with, how long we keep it and how you exercise your rights.

The essentials: we use the contact details you give us in a form, on WhatsApp or in a Meta form to handle your request. In addition, from the moment you open the site we use the Meta Pixel and Google Analytics to measure our ads and how the site is used; section 7 explains how to stop it. At any time you can stop receiving our messages by replying "STOP" or "BAJA" (section 8) and ask us to delete your data (section 15).

Version 2.0 · Effective October 14, 2026

1. Data controller and who handles your requests

The controller of your data is Isabella Cadavid Tobón, an individual holding Colombian citizenship card (C.C.) 1037667808, who operates the brand «Propiedades Luxur».

Isabella Cadavid Tobón handles queries, claims and requests about personal data through info@propiedadesluxur.com, our only mailbox for privacy matters.

2. Scope and legal framework

This policy covers the data we process through:

  • The website propiedadesluxur.com, in Spanish and English, including its ad funnels (/funnel/…), its ad landing pages (/landing/…), the investment project pages (/projects/…) and shared listing links (/ficha/…).
  • Meta instant forms (Lead Ads) on Facebook and Instagram, and the brand's Instagram account.
  • WhatsApp (the brand's number and our advisors' numbers) and email.

It is governed by Law 1581 of 2012, Decree 1377 of 2013 (compiled in Single Regulatory Decree 1074 of 2015) and, for commercial contact, Law 2300 of 2023.

3. The data we process and where it comes from

  • Website forms (buy, rent, sell, inventory alert, newsletter, advisory or contact, and visit request): name, WhatsApp or phone, email (optional on most forms; required for the newsletter and alerts), area of interest, approximate budget range (a range for the property, never your income or debts), property type and expected price if you are selling, rental length and rent range if you are looking to rent, your message and your preferred date for a visit.
  • Record of your request: the date and time you sent it, the form and page you sent it from, the IP address (for the site's forms and the landing pages), the campaign parameters (UTM) in the page's address, if any, and, if you came from a Meta ad, the identifier of that click, so we know which ad or page brought you. On the landing pages we also keep your browser, the page's language and the version of this policy you accepted.
  • Ad funnel (/funnel/…): name, WhatsApp number, your yes/no answers about the area and about the property's price, the property, the assigned advisor and the channel you choose (WhatsApp or a call).
  • Ad landing pages (/landing/…): name, WhatsApp number with its country, email (optional), what you are looking for the property for (to live in, to invest or just exploring; optional), the property and who attends you: our brand or the advisor who shared the link.
  • Investment projects (/projects/…): name, email, WhatsApp, the way of taking part that interests you, the approximate investment range (only for the ways that require contributing capital) and your message.
  • Meta instant forms: the fields each form asks for (usually name, phone, email and answers), which reach us through Meta.
  • WhatsApp: your number, your profile name and the messages we exchange.
  • Browsing: cookies and events from your visit (pages viewed, content you open and interactions with the funnel, the landing pages and the projects), your IP address and your browser details, collected by the Meta Pixel, the Conversions API and Google Analytics, and the server logs kept by our hosting provider. Some third-party resources (fonts, maps and review photos) also receive your IP. Section 7 explains all of it.
  • Advisors: name, photo, phone or WhatsApp, bio, areas, languages and social links, published on their profile, in the /asesores directory and on listings.
  • Property owners: the property's details and the contact details you give us to publish it. We do not publish the exact address: the public map is approximate.

We do not ask for sensitive data (health, religion, political opinions, biometric data and the like) or for your income, debts or credit history.

Where your data is kept: requests from the forms and leads from the funnel, the landing pages, the projects and instant forms are kept in the client management system of our own website, on Hostinger's servers. We do not use an external CRM. Only authorised staff and the advisor assigned to your request can access it. The site's forms, the landing pages and the projects also send us a copy by email.

4. What we use your data for

Required purposes

They are the ones each form's notice explains. Without them we cannot help you:

  • Answering your request and contacting you about it through the channel you used, including automated confirmation and follow-up messages.
  • Prioritising our response according to your answers in the funnel (whether the area and the property's price suit you).
  • Assigning you an advisor and sharing your request with them and with that property's co-advisors.
  • Scheduling visits.
  • Sending you the newsletter or inventory alerts you asked for.
  • Keeping proof of your authorisation.
  • Keeping the site secure.
  • Meeting our legal obligations.

Optional purposes

They are not needed to help you, and you can object to each of them:

  • Sending you other offers and news.
  • Measuring and optimising our ads with Meta and building advertising audiences.
  • Web analytics with Google Analytics.

To stop receiving offers, reply "STOP" or "BAJA" to any of our messages or write to info@propiedadesluxur.com. To stop Meta's measurement and advertising and Google's analytics, follow the steps in sections 6 and 7. Objecting does not stop us from answering your request.

5. How you give your authorisation and how we prove it

The law requires your authorisation to process your data to be prior, express and informed. This is how we obtain it:

  • In the site's forms: you give us your data so we can handle what you ask for. The forms on the home page and in the funnel show a notice next to the button with the purpose and a link to this policy; those on the landing pages and the projects, a line under the button linking this policy. The site's footer links it too. By sending the form you authorise us for the purposes in section 4 that match your request.
  • In the ad funnel: the notice on the last step also says we use your data to measure our ads with Meta. By continuing you authorise us for both.
  • On the ad landing pages and the projects: sending the form under that line is your acceptance of this policy. The proof is kept with your request (section 3).
  • On WhatsApp: the forms that open WhatsApp only prepare a message; you decide whether to send it.
  • In Meta instant forms: the form links this policy before you send it.

Browsing the site, scrolling a page or seeing an ad is not an authorisation to process your contact details: under article 7 of Decree 1377 of 2013, silence can never be treated as unequivocal conduct. Measurement cookies and pixels, on the other hand, run from the moment you open the site; section 7 explains which ones and how to stop them.

As proof we keep your request with its date and time and, for the site's forms and the landing pages, the IP address you sent it from; on the landing pages, also your browser, the language, the page and the version of this policy. The version of this policy in force on that date is stated in section 19. You can ask us for a copy.

To revoke your authorisation, write to info@propiedadesluxur.com.

6. Meta tools

On this site, we and third parties, including Meta, may use cookies, pixels and other storage technologies to collect or receive information from this site and from elsewhere on the internet, and use it to measure results and to target and deliver ads.

Meta Pixel

The Meta Pixel (dataset 1966603087241749) runs on every public page of the site from the moment you open it: Meta's script is downloaded on your first interaction or a few seconds later (in the funnel and on the landing pages, straight away), and a minimal version of the Pixel works even if your browser has no JavaScript. It does not run if your browser sends the "Do Not Track" signal. It records these events:

  • PageView, on every page.
  • ViewContent, on property, article and other content pages, with the content's title, type and identifier.
  • In the funnel, also: FunnelStepView (the step you are on), LocationInterest (whether the area interests you: yes or no), BudgetFit (whether the property's price suits you: yes or no, with the property's published price), Lead, QualifiedLead, Contact and, when calls are enabled, Schedule.
  • On the landing pages and the projects, also: Lead, when you send the form, and Contact, when you tap the WhatsApp button on the thank-you page.

With its automatic configuration, the Pixel may also read the page's metadata and record button clicks. If Meta's automatic advanced matching is turned on in Meta's settings, it may also take, in your browser, the contact details you type into our forms, hash them and send them to Meta to match you with a Meta account.

Conversions API

In the funnel, on the ad landing pages and on the projects, our server also sends events to Meta through the Conversions API, unless your browser sends the "Do Not Track" signal. Each event may carry:

  • Hashed with SHA-256: first name, last name, phone, country (from the phone prefix), email if you gave us one, and our visitor identifier pl_vid.
  • Not hashed: IP address, browser user agent, the _fbp and _fbc cookies (_fbc includes the click identifier if you arrive from a Meta ad), the page URL and an event identifier.

Hashed or not, these are personal data: they are used to match you with a Meta account. The Lead, QualifiedLead and Contact events, which carry your name and phone, are sent when you complete the funnel's last step, whose notice tells you so. On the landing pages, the server sends PageView and ViewContent when the page opens, Lead when you send the form and Contact when you tap the WhatsApp button; on the projects, Lead when you send the form. We do not send Meta what you are looking for the property for, your investment range or your message.

Meta uses hashed contact data only to match it and then deletes it (Meta Business Tools Terms, §2.a.i), and keeps event data for up to two years (§4). Meta acts as our processor for matching and measurement, and as an independent controller when it uses the data to improve its ad systems; that part is a transfer of data to Meta.

Audiences

We may build audiences in Meta from site visitors and people who interacted with the funnel, the landing pages or the projects. If you ask us to (section 15), we leave you out of the audiences we build from then on.

Instant forms (Lead Ads)

If you fill in one of our instant forms on Facebook or Instagram, Meta gives us the fields that form asks for (usually name, phone, email and answers). That data is governed by this policy; we share it with the advisor handling your request and keep it for 24 months.

How to opt out of Meta advertising

7. Cookies and similar technologies

These cookies are set when you visit the site. Meta's are not set if your browser sends the "Do Not Track" signal.

Cookies on propiedadesluxur.com
Cookie Provider Purpose Duration Own or third-party When it is set
SESS… / SSESS… Propiedades Luxur Keeps the session of staff and advisors who sign in Up to 23 days Own On sign-in (staff and advisors only)
_fbp Meta, on our domain Identifies your browser to measure Meta ads 90 days Meta (first-party cookie) When the Pixel loads, on any page
_fbc Meta, on our domain Stores the click identifier when you arrive from a Meta ad 90 days Meta (first-party cookie) When you arrive from a Meta ad
pl_vid Propiedades Luxur Random visitor identifier we send to Meta hashed, as external_id 1 year Own When our server sends an event to Meta (funnel, landing pages and projects)
_ga, _ga_* Google Analytics 4 (G-6WJY0YQYX8) Distinguishes visits for web analytics Up to 2 years Google (first-party cookie) When any page loads

If you are logged into Facebook or Instagram, Meta may also read its own facebook.com cookies (for example, fr), which are governed by the Meta Cookies Policy.

Some third-party resources set no cookies but receive your IP address when the page loads them:

  • Google Fonts (fonts.googleapis.com and fonts.gstatic.com), for typefaces.
  • OpenStreetMap tiles (tile.openstreetmap.org), on property maps.
  • Google-hosted profile photos in the Google reviews block.

How to stop them: turn on your browser's "Do Not Track" signal (it stops the Pixel and the Conversions API on this site), block or delete cookies in your browser's settings and install the Google Analytics opt-out browser add-on. This stops future sending, but does not delete what was already sent (section 15).

8. WhatsApp, automated messages and commercial contact

The brand's number (+57 304 667 0026) and our advisors use WhatsApp Business. WhatsApp, a Meta company, processes your contact details and your messages as our processor, under its WhatsApp Business terms, on servers outside Colombia, including in the United States.

  • Who writes first: we only message you if you wrote to us, sent a form or authorised it. The site's forms open a chat that you send yourself.
  • Channels: we only contact you through the channels you authorised.
  • Hours (Law 2300 of 2023): commercial contact takes place Monday to Friday from 7:00 to 19:00 and Saturdays from 8:00 to 15:00, never on Sundays or public holidays, at most once a day and never through several channels in the same week. Replies to something you asked for are not limited by those hours (article 8 of Law 2300).
  • Confidentiality: we do not share your conversations with other clients.

Automated messages

Some messages are sent automatically by our client management system, by WhatsApp, email or text message:

  • Confirmation that we received your request.
  • Reminders of a visit you scheduled.
  • Follow-ups about your request.
  • The newsletter and inventory alerts, if you asked for them.

We only send them if you wrote to us or sent a form. They always say they come from Propiedades Luxur, they follow the hours in this section, and every commercial message reminds you how to unsubscribe.

How to unsubscribe

  • Reply "STOP" or "BAJA" to any of our messages, on the channel where you received it: WhatsApp, text message or email. Upper or lower case both work.
  • You can also block the number or write to info@propiedadesluxur.com.

From then on we stop sending you automated and commercial messages on every channel, and we confirm it with one last message. Unsubscribing does not stop us from answering you if you write to us again or send a new form, and it does not delete your data: for that, follow section 15. So that we do not write to you again, we keep your number or email address on an unsubscribe list (section 12).

9. Who we share your data with, and international transfers

We only share your data with these recipients and for the purposes in this policy. A processor handles data on our behalf and on our instructions; an independent controller also uses it for its own purposes.

Recipients of your data
Recipient What it does with your data Role Country
Meta Platforms, Inc. (and Meta Platforms Ireland Ltd. for European Union users) Pixel, Conversions API, WhatsApp, Instagram and instant forms Processor for measurement, matching and WhatsApp; independent controller for its own purposes United States (EU: Ireland)
Google LLC Google Analytics, Google Fonts, Google Places reviews and Gmail (copies of form emails in the team's inboxes) Processor (in Analytics, also for its own purposes under its terms) United States
Hostinger Hosting, CDN and the email service for info@propiedadesluxur.com (form emails are sent through its SMTP server) Processor United States (server on Hostinger's network)
OpenStreetMap Foundation Map tiles on property maps (receives your IP) and geocoding of property addresses Independent provider United Kingdom
Geoapify (KEPTAGO Ltd.) Autocompletes addresses when an advisor publishes a property; only receives the typed address Processor Cyprus (European Union)
Anthropic, PBC Drafts texts for listing publications and image descriptions from property data; receives no visitor data Processor United States
Our real-estate advisors (assigned advisor and the property's co-advisors) Receive your request by WhatsApp and, for the advisory or contact form, the landing pages and the projects, a copy by email Processors, acting on our instructions under a data transmission agreement Colombia
Authorities When the law requires it As provided by law —

The United States, Ireland, the United Kingdom and Cyprus are on the list of countries with an adequate level of data protection kept by Colombia's Superintendence of Industry and Commerce (SIC Circular Única, numeral 3.2, as amended by Circular Externa 008 of 2017).

We do not sell or rent your personal data, and we do not share your phone number or email with third parties so they can send you their own advertising. If we start working with a new processor (for example, an external CRM or a text-message provider), we will add it to this table before it receives your data.

10. Our real-estate advisors

Your request is handled by a Propiedades Luxur advisor. They receive the WhatsApp chat you start with them and, if you use the advisory or contact form, a landing page or a project's form, a copy of your request by email. If you came through a landing page an advisor shared, your request goes to that advisor. If the property has co-advisors, they may also receive it.

They all act as our processors, under a contract that only lets them use your data to handle your request. If an advisor wanted to use it for their own business, they would need your separate, express authorisation.

Advisors' profile data is published with their consent.

11. Our Meta app and Instagram

We use a Meta app to publish property carousels (photos and texts) on the brand's Instagram account, through Meta's Graph API.

  • From Meta we only obtain our Instagram account identifier, the identifiers of our own posts and an access token, which we keep on our server and never in public code.
  • No visitor data goes through this app, and listing photos do not show visitors.
  • We do not sell or share this data. We delete it when it is no longer needed or when someone asks us to (section 15).

12. How long we keep your data

Retention periods
Data Period
Requests from website forms and leads from the funnel, the landing pages, the projects and instant forms 24 months from the last change to the request; then we delete them
Newsletter and inventory alerts Until you unsubscribe (section 8)
Unsubscribe list (your number or email address, the channel and the date you unsubscribed) For as long as we send automated or commercial messages, so that we do not write to you again
Meta match keys stored with a lead (visitor identifier, _fbp, _fbc, IP, user agent and page) 90 days
Record of your request and your authorisation While we process your data and 3 more years, to prove it to you or to the authority
Copies of form emails in our mailboxes 24 months; we delete them manually under the same rule
Event data at Meta Up to 2 years, under Meta's terms
Google Analytics data According to the retention period set in Google Analytics

Our databases remain in force while Propiedades Luxur continues its activity (the database's period of validity, article 13 of Decree 1377 of 2013). Within that period, each item of data is kept only for the period in this table, unless the law requires us to keep it longer.

13. Your rights

Under article 8 of Law 1581 of 2012, you have the right to:

  • Know, update and correct your data.
  • Request proof of the authorisation you gave us.
  • Be told, on request, how we have used it.
  • File complaints with the Superintendence of Industry and Commerce (SIC, www.sic.gov.co), after first completing the query or claim procedure with us (article 16).
  • Revoke your authorisation or ask us to delete your data, provided there is no legal or contractual duty to keep it.
  • Access your data free of charge, at least once every calendar month and whenever this policy changes substantially (article 21 of Decree 1377 of 2013).

You can exercise them yourself, proving your identity, or through your successors, your representative or your attorney. The procedure is in section 14.

14. Queries and claims

You can use any of these channels:

  • Email: info@propiedadesluxur.com
  • WhatsApp: +57 304 667 0026
  • In writing: Calle 30 # 20-40, El Carmen de Viboral, Antioquia, Colombia.

Queries

If you want to know what data we hold about you or how we use it, we answer within 10 business days of receiving your query. If that is not possible, we tell you before the deadline, with the reason and the new date, which will be no more than 5 business days later.

Claims

If you believe your data should be corrected, updated or deleted, or that we have breached the law or this policy, you can file a claim:

  1. Include your identification, a description of the facts, your address and any documents you want to rely on.
  2. If the claim is incomplete, we ask you to complete it within 5 days of receiving it. If 2 months pass without you completing it, we treat it as withdrawn.
  3. Within 2 business days of receiving the complete claim, we tag your data with the label «reclamo en trámite» (claim in progress).
  4. We answer within 15 business days from the day after we receive it. If that is not possible, we tell you the reason and the new date, which will be no more than 8 business days later.

If the claim is not ours to resolve, we forward it to whoever should resolve it within 2 business days and let you know.

15. How to request the deletion of your data

Anyone can ask us to delete their data, whether or not they have used our site.

  1. Write to info@propiedadesluxur.com or by WhatsApp to +57 304 667 0026 with the subject «Eliminación de datos» (data deletion).
  2. Include your name and the phone or email you used with us.
  3. We may ask you to verify your identity.
  4. We handle it as a claim: we answer within 15 business days, which can be extended once by up to 8 business days with notice of the reason.

What we delete:

  • Website form submissions and leads from the funnel, the landing pages, the projects and instant forms.
  • Meta match keys.
  • Copies of your requests in our email inboxes.
  • The data from your conversations held by our advisors: we instruct them to delete it.
  • We also exclude you from the Meta audiences we build from then on.

What we keep: proof of your authorisation and of your deletion request, for 3 years, to show that we complied; if you unsubscribed, your number or email address on the unsubscribe list, so that we do not write to you again; and any data the law requires us to keep.

What was already sent to Meta or Google: we cannot recall it from our side. Meta keeps event data for up to 2 years; you can manage or delete it in Meta's settings, under "Your activity off Meta technologies", inside the Accounts Center. For Google, use your Google account's controls.

You can also stop future sending from your browser with the steps in section 7.

16. Security and incidents

  • The site runs on HTTPS.
  • Only authorised staff and the assigned advisor can access requests.
  • Credentials and tokens are kept outside the code.
  • Contact details and our visitor identifier are hashed before they are sent to Meta.
  • We delete data when the periods in section 12 run out.

If a security incident affects personal data, we will inform the Superintendence of Industry and Commerce and the people affected, as the law requires. To report a security issue, write to info@propiedadesluxur.com.

17. Minors and sensitive data

Our services are for people aged 18 and over. We do not knowingly process data of minors. If we learn that we have received a minor's data, we delete it, unless their legal representative authorises the processing on the terms of article 7 of Law 1581 of 2012.

We do not ask for sensitive data. The budget we ask about is an approximate range for the property, not your income or debts. On the projects, the investment range is the approximate amount you would consider contributing, not your income or debts either, and we do not send it to Meta. In the funnel we send Meta whether the property's price suits you (yes or no, with the BudgetFit event) together with the property's published price; we never send it your income or debts.

18. Visitors from the European Union and the United States

European Union and European Economic Area. For Pixel and Conversions API data, Meta Platforms Ireland Ltd. is joint controller with us for its collection and transmission (Meta's Controller Addendum). Meta is responsible for the processing it carries out afterwards. In the Meta Privacy Policy you will find its purposes, the legal basis it relies on and how to exercise your rights against Meta through its channels. You can also write to us at info@propiedadesluxur.com.

United States. We do not sell personal data. We do not send Meta the Limited Data Use flag. You can opt out of Meta advertising with the mechanisms in section 6.

19. Changes, effective date and version

If we make substantial changes to this policy, we will announce them before they apply, on the site and by email if we have yours. If a purpose changes, we will ask you for a new authorisation.

This is version 2.0, effective October 14, 2026. It replaces the version published on 6 June 2026. You can request previous versions at info@propiedadesluxur.com.