Your privacy

Who processes your data

Grupo 5 Elementos S.A.S., NIT 901.392.193-2, is responsible for processing data in the 5 Elementos SPA app. This policy explains the app's specific processing and supplements our general data processing policy (Spanish).

You can contact us through our locations' official channels:

What data we use and why

We use the data needed to authenticate you, identify the customer, manage reservations and gift cards, issue supporting records, handle requests and provide your selected services:

• Account and contact: first and last names, WhatsApp phone number, email, identification document and type, gender and contact country, when you provide them in forms.
• Services and purchases: reservations, gift cards, payments, membership, points, notification preferences and text you include in gift messages or change and cancellation requests.
• Access and operation: account, session and device identifiers; IP address, user agent, dates, request statuses and server technical errors. We use these to operate and protect the service, prevent fraud and resolve incidents.

We do not request access to your contacts or WhatsApp messages. The app does not request your GPS location. Your default city, favorites and app language preference are saved on your device; the location of a reservation or purchase is part of that transaction.

Payments and channel measurement

Bold processes the payment form and authorization. The app does not request your full card number or security code in its native forms. We receive and retain references, results, amounts and payment data that Bold sends to the merchant; these may include the payment method, card network, cardholder and masked card number.

We identify purchases started in the app and create reports of reservations, conversion and collections by channel and payment method to understand their performance. Reports are based on commercial transaction records.

We do not sell your personal data or use an advertising identifier for this measurement.

Features and providers

WhatsApp or SMS verification. You can request sign-in, registration and account-deletion codes via WhatsApp or, when available, SMS. WhatsApp uses Meta WhatsApp Cloud; SMS uses the company's messaging gateway and its sending line's mobile carrier. The selected channel receives the recipient number and content needed to deliver the code. We retain sending records and apply phone and source limits to prevent abuse. This does not allow the app to read your conversations or SMS inbox.

Apple Maps. Choosing “Directions in Apple Maps” opens that service with the location's public address, without your credentials or account details. Location permissions and data handling while using Apple Maps depend on your settings in that service.

Notifications. If you authorize them, we register an installation identifier, the token supplied by Apple, your selected notification categories and the language used for notifications. Apple Push Notification service delivers the alerts. You can change your preferences in My account → Notifications and withdraw permission in iPhone Settings. Declining notifications does not prevent you from using the app. Marketing preferences are kept separate from service alerts.

Apple Wallet, calendar and sharing. When you choose to add a reservation to Apple Wallet, the corresponding pass is provided for you to confirm its addition in Apple's system. If you add an appointment to the calendar or share content, you confirm the action using the iPhone editor or share sheet. The app does not read your calendar or contacts for these features.

Location map. The embedded map loads Google Maps content. This communicates your IP address and technical browser, device and request data to Google, as needed to display the map. The app looks up the location's public address; it does not send your GPS location or Spa5 account credentials to the map. We use nonpersistent web storage for this view; this does not prevent Google from receiving or retaining request information. Google's handling of that data is described in its privacy policy. Choosing “Directions in Google Maps” opens that external service.

Payment, messaging, hosting and technology support providers access the information needed to provide their services in accordance with applicable obligations. Links you open to external services are also subject to those services' own policies.

Retention and account deletion

We retain data for as long as needed for the stated purposes, the contractual relationship and legal, accounting or claims-handling obligations. A session or access code expiring does not, by itself, mean that all associated records have been deleted.

The process deletes your Spa5 account's digital data and links for Medellín and Bogotá, revokes access and removes its devices and preferences. If your identity also gives access to another brand, that separate account is retained.

Necessary reservation, payment, invoice, gift card, membership and outstanding obligation records are retained. Deleting the account does not itself cancel, refund or extinguish those transactions.

To prevent a subsequent registration from automatically recovering deleted links, we retain a technical reference protected with a private key. This reference is not anonymous and is used for that protection. A new registration does not automatically recover the deleted account's purchases; you may contact our official channels for assistance with your commercial rights.

Your rights and how to contact us

You can access, update or correct your data; request information about its use and proof of authorization; revoke authorization or request deletion when applicable. You can also submit inquiries or complaints to the company and, when applicable, to the Superintendencia de Industria y Comercio.

Write to us through the official channels listed above and explain your request. We will verify your identity to prevent another person from accessing your data. The general policy (Spanish) details applicable response periods and retention obligations.