Privacy Policy
How we handle the personal data you give us through this website, under Law 81 of 2019 of the Republic of Panama.
This is a courtesy translation. The Spanish version of this Privacy Policy is the only binding version and governs; in the event of any discrepancy between the two, the Spanish text prevails in full.
Contents
- 1. Who is responsible for your data
- 2. Applicable legal framework
- 3. Language of this policy
- 4. What data we collect
- 5. The free-text field and sensitive data
- 6. What we use your data for
- 7. The lawful basis for processing
- 8. Where your data is hosted: the United States of America
- 9. Who we share your data with
- 10. How long we keep your data
- 11. Your rights and how to exercise them
- 12. Complaining to the authority
- 13. Information security
- 14. Cookies and tracking technologies
- 15. Minors
- 16. Changes to this policy
- 17. Contact
1. Who is responsible for your data
The controller of your personal data is Birding in Panama, registered in the Republic of Panama.
Channel for privacy matters and for exercising your rights: info@birdinginpanama.com.
2. Applicable legal framework
This policy is governed by Law 81 of 2019 on the protection of personal data of the Republic of Panama, and by its implementing regulation, Executive Decree 285 of 2021.
The competent data protection authority in Panama is the National Authority for Transparency and Access to Information (ANTAI).
3. Language of this policy
The Spanish version of this Privacy Policy is the binding one. This English translation is informative.
4. What data we collect
We collect only the data you give us voluntarily through the forms on this site. We do not buy lists, we do not obtain your data from third parties, and we do not build profiles.
Contact form: first name, last name, email address, phone number, subject and the text of your message.
Booking form: first name, last name, email address, phone number, the tour you are interested in, start and end dates, number of people, preferred language and a free-text field.
Technical data: our server logs the requests it receives — IP address, date and time, page requested and browser type — for the sole purpose of keeping the service running and detecting abuse or attacks.
If you write to us on WhatsApp, the conversation takes place on that platform and is additionally subject to its provider’s terms, which are outside our control.
5. The free-text field and sensitive data
IMPORTANT. The free-text field on the booking form is optional. If you use it to tell us about a medical condition, a mobility limitation, an allergy or a dietary requirement, you are giving us SENSITIVE DATA, which Panamanian law protects under a stricter regime.
When that happens, we handle the information with the following reinforced safeguards:
- We use it for one purpose only: adapting the activity so you can take part safely and comfortably.
- Only the staff strictly needed to organise and run your tour can see it.
- We do not share it with third parties without your express consent, except in a medical emergency where your life or physical integrity is at stake.
- We never use it for marketing, segmentation or any commercial purpose.
- It is kept for far less time than the rest of the booking: roughly 90 days after the tour ends, after which it is deleted from our active records.
Please write only what we need in order to look after you properly. Do not include clinical records, detailed diagnoses, policy numbers or other people’s data.
If you would rather not type that information into a web form, you can tell the guide directly before the activity starts.
6. What we use your data for
- Answering your enquiry and sending you an individual quotation for the service you ask about.
- Managing your booking: confirming date, site, time and meeting point, and organising the logistics of the tour.
- Adapting the activity to your health, mobility or dietary needs, when you tell us about them.
- Communicating with you about a service already booked, including last-minute changes due to weather or site closure.
- Issuing the corresponding tax receipt and meeting our accounting and tax obligations in Panama.
- Handling complaints and defending our rights in the event of a claim or a formal request from an authority.
We do not use your data to send you unsolicited marketing. If we ever wanted to, we would first ask for specific, separate consent, which you could refuse with no effect whatsoever on the service.
We do not make automated decisions with legal effects about you, and we do not build behavioural profiles.
7. The lawful basis for processing
We process your data on three bases, depending on the purpose:
- Your consent, given freely and on an informed basis when you tick the relevant box and submit the form. This is the basis for sending your request, for processing any sensitive data you choose to tell us, and for transferring your data to servers located in the United States of America.
- Performance of the contractual relationship, once there is an accepted quotation and a confirmed booking: without your data we cannot provide the service.
- Compliance with legal obligations, chiefly Panamanian accounting and tax rules, which require us to keep the record of the transaction even if you ask us to delete everything else.
You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand, nor the retention of documents that tax law requires us to keep.
8. Where your data is hosted: the United States of America
Your data is stored and processed on servers located in the UNITED STATES OF AMERICA, operated by our infrastructure provider DigitalOcean, LLC. By submitting the form you expressly consent to that international transfer.
This means your data leaves Panamanian territory and is, in practice, subject to United States jurisdiction, whose data protection framework differs from Panama’s.
We rely for that transfer on your informed consent — which is why this section names the country and the provider rather than referring vaguely to "the cloud" — and on the data processing agreement signed with that provider, which we keep on file and available to the authority.
Exact data centre region: [PENDING: confirm DigitalOcean data centre region].
If you do not want your data transferred outside Panama, do not submit the form: write to us or call us through the channels listed and we will handle your enquiry that way.
9. Who we share your data with
We do not sell your personal data. We do not pass it to third parties for commercial, advertising or profiling purposes.
Only those who need it for the service to work have access:
- Our hosting and infrastructure provider, DigitalOcean, LLC (United States), acting as a data processor and unable to use your data for its own purposes.
- The guide and our own staff running your tour, limited to what is needed to deliver it.
- Service providers forming part of the tour, where you ask for them and strictly with the data required: for example, your name for a named protected-area ticket, or a dietary restriction for a contracted meal.
- The competent Panamanian authorities, where there is a legal obligation or a formal request.
Full and current list of providers with access to personal data: [PENDING: list of data processors].
10. How long we keep your data
We do not keep everything of yours for the same length of time. Each item is kept for the period its own purpose requires, and each clock starts at a different moment:
| What | How long | Counting from |
|---|---|---|
| Booking with an invoiced service or a payment received | 10 years | December 31 of the tax year in which the service was provided |
| Booking that never generated a payment or a tax receipt | Up to 24 months | The date the request was recorded |
| Free-text field containing health, dietary or mobility data | Roughly 90 days | The date the tour ended |
| Contact request that did not lead to a booking | Up to 24 months | The date the request was recorded |
| Technical server logs | As long as needed for security and diagnostics | The date of the log entry |
The 10-year period for an invoiced booking is not a commercial decision of ours: it follows from Panamanian accounting and tax record-keeping obligations. In inbound tourism, the booking file is what proves to the administration that the service was provided within Panamanian territory and on what date. That is why an invoiced booking cannot be deleted before its tax record, even at your request.
Suspension during an ongoing matter. If there is a claim, an audit or an ongoing collection or tax inspection affecting your data, deletion is suspended until that matter concludes. We will tell you if this happens.
Once the period has elapsed, the data is deleted from our active records.
11. Your rights and how to exercise them
Panamanian data protection law gives you the following rights:
- Access: to know what data of yours we hold and what we do with it.
- Rectification: to correct data that is inaccurate or incomplete.
- Cancellation or deletion: to ask us to erase it, subject to what tax law requires us to keep.
- Objection: to object to a specific processing activity on legitimate grounds.
- Portability: to receive your data in a format you can reuse.
- Withdrawal of consent: to revoke it at any time, without retroactive effect on processing already carried out.
To exercise them, write to info@birdinginpanama.com stating which right you wish to exercise and attaching a copy of a document proving your identity. We ask for identification for one reason only: so that we do not hand your data to someone who is not you.
We undertake to reply within a maximum of FIVE (5) WORKING DAYS from receipt of your complete request, whichever right you exercise. This is a commitment we take on ourselves, without prejudice to the periods Panamanian law sets for each right.
If we cannot meet your request in whole or in part, we will explain in writing why, and the rule we rely on.
Exercising these rights is free of charge.
12. Complaining to the authority
If you believe we have not handled your request properly, or that we are processing your data improperly, you may lodge a complaint with the National Authority for Transparency and Access to Information (ANTAI) of the Republic of Panama.
We would be grateful if you wrote to us first: it is almost always faster and we can usually fix it straight away. But going to ANTAI is your right and does not require you to try us first.
13. Information security
We apply reasonable technical and organisational measures to protect your data: encryption of traffic between your browser and our server (HTTPS), restricted access to the administration panel behind authentication, and limiting access to staff who need it for their work.
No system is invulnerable. If a security breach affecting your personal data occurred and could pose a risk to you, we will tell you and notify the competent authority in accordance with Panamanian rules.
14. Cookies and tracking technologies
As at the date of this policy, this website does NOT use analytics, advertising or third-party tracking cookies. We have no Google Analytics, Google Tag Manager, Meta pixel or equivalent tools installed.
The page language is determined by the web address itself, not by a cookie. The administration panel, which is private and not part of the public site, uses browser session storage solely to keep the session open while it lasts.
If we add measurement tools in future, we will update this section and ask for your consent before switching them on.
15. Minors
This site is not directed at minors and we do not knowingly collect their data through it. When a minor takes part in an activity, the data is provided by their parent or legal guardian, who contracts on their behalf.
If you become aware that a minor has given us data directly, write to info@birdinginpanama.com and we will delete it.
16. Changes to this policy
We may update this Privacy Policy. The date of the last update appears at the top of the document.
If a change materially affects the purposes of processing or the international transfer of your data, we will seek your consent again before applying it to data already collected.
17. Contact
Privacy matters and exercise of rights: info@birdinginpanama.com. Telephone: +507 6676-4464, Republic of Panama.