Privacy and personal data processing policy

1. Purpose and scope

This policy explains how Evlogia S.A.S., the entity responsible for operating Renne Peruvian Bistro, collects, uses, retains, shares and deletes personal data received through Renne's website and associated contact channels. It applies to general enquiries, commercial requests, and communications by email, phone or WhatsApp. Employment, CCTV, suppliers and other specialised processing activities may be covered by additional notices or policies.

2. Data controller

Data controller: Evlogia S.A.S.
Tax ID: 901.595.355-0
Public-facing name: Renne Peruvian Bistro
Registered location: Bogotá, D. C., Colombia
Address: Carrera 8A #99-41, Local 119, World Trade Center, Bogotá
Phone and WhatsApp: +57 324 229 9244
Privacy and written requests: admin@ppisas.com
Responsible area: Renne Administrative and Financial Area

3. Legal framework and principles

Processing is governed by the Colombian Constitution, Law 1581 of 2012, the applicable chapter of Decree 1074 of 2015, and any rules that amend or replace them. Renne applies the principles of legality, purpose limitation, freedom, accuracy and quality, transparency, restricted access and circulation, security, and confidentiality. Only data relevant and appropriate to each purpose is requested.

4. Data we may process

Depending on the channel, request and preferences selected, we may process:

full name, email address, phone or WhatsApp number;
company or organisation and city or service location, where relevant;
subject, message, preferred channel and information voluntarily included;
information required for private events, catering or corporate agreements through the specialised form;
evidence of authorisation, including its version, date and time;
when a person allows measurement: a pseudonymous browser identifier, pages visited, language, traffic source or referrer, permitted UTM parameters, interactions with the menu, bookings and editorial content, session statistics, approximate location, and browser and device information;
the measurement preference and its date, stored locally in the browser;
minimum technical information for security, availability and abuse prevention;
the service history related to the enquiry or request.

The general form does not request identity documents, financial data, passwords, files, health information or other sensitive data. Renne will not send names, email addresses, phone numbers, messages or data submitted through forms to Google Analytics.

5. Purposes

Receive, identify, classify and answer enquiries, comments or requests.
Contact the person through the channel supplied or selected.
Route requests to bookings, events, catering, corporate agreements, press or another relevant area.
Prepare and manage proposals or commercial relationships requested by the person.
Maintain a service record and avoid duplicate contacts.
When consent has been granted, understand how the website is used, distinguish traffic sources and visits to news pages, measure selections of the menu, bookings and editorial content, and improve navigation and content.
Handle access, correction, withdrawal, deletion, enquiry and complaint requests.
Prevent abuse, fraud, unauthorised access and security incidents.
Meet legal, contractual, accounting or tax duties and valid authority requests.
Prepare internal service metrics, preferably aggregated or anonymised.
Send marketing information only under a separate, optional and valid authorisation.

Submitting an enquiry does not make a booking, guarantee availability, accept a proposal, or create an agreement or contract.

6. Authorisation

Where required by law, Renne will obtain prior, express and informed authorisation no later than the time data is collected. The checkbox used to manage an enquiry will be unticked by default. Marketing authorisation must be separate and optional; refusing it will not prevent an enquiry. Renne will retain verifiable evidence of the authorisation and the accepted policy version.

Measurement with Google Analytics is optional and governed by a separate choice. The tag will remain blocked until the person selects Allow measurement. If the person selects Necessary only or makes no choice, no data will be sent to Google Analytics. The choice can be changed at any time through Privacy preferences.

7. Sensitive data and children

We do not request sensitive data in the general form. People must not include health, biometric or financial information, passwords, identity documents, or data that may affect their privacy or lead to discrimination. If unnecessary sensitive information is provided, Renne may refrain from processing it, ask for the enquiry to be resubmitted, or delete it where appropriate.

The forms are intended for people legally able to authorise processing. Renne does not seek to collect children's or adolescents' data. If such processing is lawful and necessary, special protection, best-interest, authorisation and rights requirements will apply.

8. Processors, international processing and third parties

Renne may appoint technology providers as processors for hosting, databases, communications, security, backups or support. They may process data only under authorised instructions and purposes, subject to security and confidentiality duties. Any international data transmission will be governed by the applicable contracts and safeguards.

If a person allows measurement, Google LLC will provide Google Analytics and may process information outside Colombia under its Analytics data-protection terms and Google Privacy Policy. Renne keeps optional data-sharing settings, Google Signals, user-provided data collection and ads personalisation disabled.

Renne does not sell personal data. It may disclose data to authorities under a legal duty or valid order, and to advisers or providers when necessary for an authorised purpose and subject to confidentiality.

9. External channels and websites

The website may link to WhatsApp, Instagram, Apparta, Google Maps or other services. A third party may process information under its own terms and policies when a person visits that service. Renne does not control external practices. WhatsApp is optional and another available channel may be used.

On pages that show Renne's location, the embedded map loads automatically as the visitor approaches that section. The browser connects to Google Maps, and that service's terms and privacy policies apply.

The forms use Cloudflare Turnstile to prevent automated and abusive submissions. When the verification loads or is completed, the browser connects to Cloudflare and that provider's terms apply. Renne receives only the result required to validate the submission.

10. Cookies, analytics and technical logs

Infrastructure may process minimum technical logs to deliver and secure the website, diagnose errors, limit request frequency and prevent abuse. Embedded Google Maps and Cloudflare Turnstile may use their providers' own technologies under their respective policies.

Google Analytics will be activated only after an affirmative choice. When measurement is allowed, Analytics may set the first-party _ga cookie with a pseudonymous identifier and receive navigation, session, referrer, approximate location, browser and device data, together with the limited events and parameters described in this policy. Google states that it may process the IP address temporarily to provide and protect the service and derive approximate location, but discards the IP address without associating it with user identifiers.

Renne uses basic consent mode: before acceptance, the tag does not load and no data, consent signals or cookieless pings are sent to Google. Enhanced measurement is disabled. Email addresses and URL parameters associated with form fields are redacted; controlled UTM parameters may be retained for attribution and must never contain personal data.

The preference is stored locally in the browser to remember the choice. It can be reset through Privacy preferences or by clearing the website's data in the browser. If Renne introduces advertising, profiling, new tools or additional non-essential cookies, it will update this policy and request the relevant choice before activation.

11. Security

Renne applies reasonable administrative, human and technical measures against loss, alteration, unauthorised access, use or disclosure. Access is limited by role. No system is completely secure; if an incident creates a risk for data subjects, the response procedure and legally required notifications to the authority or affected people will apply.

12. Retention and deletion

General enquiries with no commercial relationship: up to 24 months after the last interaction, then securely deleted or anonymised unless a legal duty or active request applies.
Contacts with marketing authorisation: while it remains valid, with an inactivity review every 24 months and marketing stopped on withdrawal.
Google Analytics data: user-level and event-level data governed by the retention control is configured for 14 months, with the window reset on new activity. Analytics standard aggregated reports are not subject to that control and may be retained for longer.
Measurement preference: remains in the browser until the person changes it or clears the website's data.
Commercial, contractual or accounting records: up to 10 years after the last applicable record, or the relevant statutory period.
Evidence of authorisation and rights requests: throughout processing and for the additional time required to demonstrate compliance.
Security logs: for a limited and proportionate period.

Deletion does not apply where a legal or contractual retention duty exists. Where possible, the data will be blocked from uses unrelated to that duty.

13. Data subject rights

Know, access, update and correct personal data.
Request evidence of authorisation, subject to legal exceptions.
Be informed of how data has been used.
Submit enquiries and complaints.
Withdraw authorisation or request deletion where permitted.
Access personal data free of charge.
File a complaint with the Colombian Superintendence of Industry and Commerce after completing Renne's procedure where required by law.

14. How to exercise these rights

Personal data enquiries and complaints, together with written requests and complaints concerning the website, must be sent to admin@ppisas.com. They must include the person's name, a response channel, a clear description of the request, and relevant supporting documents. Renne may request reasonable information to verify identity or authority without collecting unnecessary data.

Enquiries

Renne will respond within 10 business days. If this is not possible, it will explain the reason and provide a new date no later than 5 additional business days after the initial deadline.

Complaints

If incomplete, correction will be requested within 5 days. If no completion is received within 2 months, the complaint will be treated as withdrawn. If Renne is not competent, it will transfer the complaint within 2 business days and inform the person. A complete complaint will be answered within 15 business days from the day after receipt; an explained extension will not exceed 8 additional business days.

The procedure is free. Where required by law, the enquiry or complaint procedure before Renne must be completed before a complaint is filed with the authority.

15. National Database Registry

Based on the current corporate confirmation, Evlogia S.A.S. does not exceed the total-assets threshold of 100,000 Colombian tax value units (UVT) that triggers RNBD registration for companies and non-profit entities. This condition will be reviewed periodically and whenever assets or regulation change. The absence of a registration duty does not remove any other personal data protection obligation.

16. Changes, versions and governing language

This policy may be updated for legal, operational or technology changes. Material changes to the controller's identity or purposes will be communicated before application, and renewed authorisation will be obtained where necessary. Previous versions will be retained as evidence.

Version 1.1 has been in effect since 28 August 2026. It incorporates the information and consent controls prepared for Google Analytics; the tag remains disabled until full validation and express publication authorisation. This English version is provided for accessibility; if there is any discrepancy, the approved Spanish version governed by Colombian law prevails.

Employment supplement 1.0 · Applications and résumés

Effective since 28 August 2026 as a traceable supplement to Policy version 1.1. For an application, Renne processes first and last names, email, mobile number, area of interest, the strengths and expectations statement, the résumé and its security metadata: sanitised original name, random internal name, detected format, size, integrity hash and private reference.

The sole purpose is to record and assess the profile, organise it by area, and consider it for current or future opportunities. After durable storage, the application fields and résumé are also sent to Renne's authorised operational inbox through Gmail as an internal reception and management channel. Submission does not promise a vacancy, interview, response or employment and does not authorise marketing communications.

The form does not request age, date of birth, identity document, photograph, gender, marital status, nationality, medical information or salary expectations. The person should avoid including unnecessary sensitive or potentially discriminatory data.

The résumé will remain outside public routes and the repository and may be retrieved only through a future authorised, controlled access mechanism. Format, signature and macro validation reduces disallowed content but does not certify that a file is malware-free.

The initial retention recommendation is up to 12 months from submission and remains pending approval. Automated deletion is not enabled in this lot. Until authorised and validated durable private storage exists, the form remains blocked and will not receive real applications. The rights and procedures for access, correction, withdrawal and deletion are those set out in this Policy.