DATA PRIVACY AND INFORMATION MANAGEMENT POLICIES LAW 1581 OF 2012 AND REGULATORY DECREE 1377 OF 2013
DATA CONTROLLER
NAME: HOTEL PORTON DE LA CABRERA
TAX ID (NIT): 901523573 - 1
ADDRESS: 84C STREET # 7-55
EMAIL: reservas@hotelportondelacabrera.com
WEBSITE: https://portondelacabrerasuiteshotel.com/
1. OBJECTIVE
To establish and disclose the Information Processing and Personal Data Protection Policies implemented by HOTEL PORTON DE LA CABRERA, in order to guarantee proper compliance with Law 1581 of 2012 and Decree 1377 of 2013, which are intended to develop the constitutional right of all persons to know, update, and rectify information collected about them in databases or files, and other constitutional rights, freedoms, and guarantees referred to in Article 15 of the Political Constitution "Habeas Data"; as well as the right to information enshrined in Article 20 of the same.
The company HOTEL PORTON DE LA CABRERA adopts the internal manual of policies and procedures to guarantee compliance with this precept and these regulatory regulations.
2. SCOPE:
This document applies to personal data registered in any database administered by the company and that makes them susceptible to Processing.
3. DEFINITIONS:
3.1. Authorization: prior, express, and informed consent of the Data Subject to carry out the processing of personal data.
3.2. Database: organized set of personal data that is subject to processing.
3.3. Personal data: any information linked or that can be associated with one or more determined or determinable natural or legal persons.
3.4. Data Processor: natural or legal person, public or private, who, by themselves or in association with others, performs the processing of personal data on behalf of the controller.
3.5. Data Controller: natural or legal person, public or private, who, by themselves or in association with others, decides on the database and/or the processing thereof.
3.6. Data Subject: natural or legal person whose personal data is subject to processing.
3.7. Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
3.8. Inquiries: request for the personal information of the Data Subject that rests in any database, regarding which HOTEL PORTON DE LA CABRERA has the obligation to provide the Data Subject or their successors all information contained in the individual record or linked to the identification of the Data Subject.
3.9. Claim: request for correction, update, or deletion of the information contained in a database processed by HOTEL PORTON DE LA CABRERA, or request for alleged breach of any of the duties contained in Law 1581 of 2012, made by the Data Subject or their successors.
3.10. Public data: is data that is not semi-private, private, or sensitive. Considered public data, among others, are data related to the marital status of persons, their profession or trade, and their quality as a merchant or public servant. By their nature, public data may be contained, among others, in public records, public documents, gazettes, and official bulletins, and duly executed judicial sentences that are not subject to confidentiality.
3.11. Sensitive data: those personal data that reveal racial or ethnic origin, political opinions, religious or philosophical convictions, trade union membership, information referring to health or sex life, or any other data that may produce, by its nature or context, any discriminatory treatment to the data subject. These data are specially protected.
3.12. Habeas data: fundamental right that allows knowing, updating, and rectifying information stored about persons in databases and files of public and private entities. 3.13. Successor: person who has succeeded or been subrogated by any title in the right of another or others.
4. GENERAL GUIDELINES
4.1 The policies contemplated in this document are mandatory for HOTEL PORTON DE LA CABRERA in its capacity as a source of information, as well as for the processors who carry out the processing of personal data on behalf of the Company.
4.2 Both the controller and the processors must safeguard the databases containing personal data and maintain confidentiality regarding the processing.
5. REGULATORY BACKGROUND
5.1 Article 15 of the Political Constitution.
“All persons have the right to their personal and family privacy and to their good name, and the State must respect them and cause them to be respected. Likewise, they have the right to know, update, and rectify information collected about them in databases and files of public and private entities. In the collection, processing, and circulation of data, the freedom and other guarantees enshrined in the Constitution shall be respected.”
5.2 Article 20 of the Political Constitution.
“Every person is guaranteed the freedom to express and disseminate their thoughts and opinions, to inform and receive truthful and impartial information, and to found mass media. These are free and have social responsibility. The right to rectification is guaranteed under conditions of equity. There will be no censorship.”
6. HOTEL PORTON DE LA CABRERA IN THE REGULATION
We are a source of information.
6.1 WHY ARE WE A SOURCE OF INFORMATION?
Since HOTEL PORTON DE LA CABRERA is a company in charge of collecting credit information from users to whom services are offered through payment systems under credit and cash modalities, it constitutes one of the so-called information sources referred to in literal (b) of the third article of Law 1266 of 2008. (…)
“It is the person, entity, or organization that receives or knows personal data of the information subjects by virtue of a commercial or service relationship or of any other nature and that, by reason of legal authorization or that of the data subject, provides that data to an information operator, which in turn will deliver it to the end user. If the source provides the information directly to the users and not through an operator, it will have the dual status of source and operator and will assume the duties and responsibilities of both. The source of the information is responsible for the quality of the data provided to the operator, which, insofar as it has access to and provides personal information of third parties, is subject to compliance with the duties and responsibilities provided to ensure the protection of the rights of the data subject”(…)
6.2 DUTIES OF INFORMATION SOURCES ARTICLE 8, LAW 1266 OF 2008:
The sources of information must comply with the following obligations, without prejudice to the fulfillment of the other provisions provided in this law and in others that govern their activity:
a. Ensure that the information provided to the operators of the databases or to the users is truthful, complete, exact, updated, and verifiable.
b. Report, periodically and in a timely manner to the operator, all updates regarding the data previously provided to it and adopt other necessary measures so that the information provided to it is kept updated.
c. Rectify information when it is incorrect and inform the operators accordingly.
d. Design and implement effective mechanisms to report information to the operator in a timely manner.
e. Request, when applicable, and keep a copy or evidence of the respective authorization granted by the information subjects, and ensure not to provide to the operators any data whose supply is not previously authorized, when such authorization is necessary, in accordance with the provisions of this law.
f. Certify, semi-annually to the operator, that the information provided has the authorization in accordance with the provisions of this law.
g. Resolve claims and petitions from the data subject in the manner regulated in this law.
h. Inform the operator that certain information is under dispute by its subject, when a request for rectification or update has been submitted, so that the operator includes a mention to that effect in the database until such procedure has been completed.
i. Comply with the instructions issued by the control authority in relation to compliance with this law.
j. Others derived from the Constitution or this law.
7. PERSONAL DATA PROCESSING
7.1 Principles for personal data processing.
The following principles will be taken into account by HOTEL PORTON DE LA CABRERA in the personal data management process.
7.1.1 Legality in data processing matters.
Data processing must be subject to the provisions contained in Law 1581 of 2012 and any regulation that develops or regulates such provision.
7.1.2 Purpose and processing.
Data processing must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject. Data processing and the purpose of the information in HOTEL PORTON DE LA CABRERA's databases are based on the provision of the service, the contractual relationship, and commercial and/or advertising purposes. HOTEL PORTON DE LA CABRERA may transmit the information to third parties, providers, and authorities.
Processing can only be exercised with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves the requirement for consent.
7.1.3 Veracity or quality.
The information subject to processing must be truthful, complete, exact, updated, verifiable, and understandable. The processing of partial, incomplete, fractionated, or misleading data is prohibited.
7.1.4 Transparency.
In processing, the right of the Data Subject to obtain information from HOTEL PORTON DE LA CABRERA or the data processor, at any time and without restrictions, regarding the existence of data concerning them must be guaranteed.
7.1.5 Access and restricted circulation.
Processing is subject to the limits derived from the nature of the personal data, the provisions of Law 1581 of 2012, and the Constitution. In this sense, processing may only be carried out by persons authorized by the Data Subject and/or by persons provided for by Law.
Personal data, except for public information, may not be available on the Internet or other means of mass disclosure or communication, unless access is technically controllable to provide restricted knowledge only to the Data Subjects or third parties authorized in accordance with the Law.
7.1.6 Security
Information subject to processing by the controller or data processor must be handled by taking technical, human, and administrative measures that are reasonable to ensure the security of the records, seeking to avoid their adulteration, loss, consultation, use, or unauthorized or fraudulent access.
7.1.7 Confidentiality.
All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks included in said procedure has ended, being able to perform the supply or communication of personal data only when it corresponds to the development of the activities authorized by Law and under the terms thereof.
7.2 Special categories of data.
7.2.1 Sensitive data.
These are data that affect the privacy of the Data Subject or whose improper use may lead to discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations, or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life, and biometric data.
7.2.1.1 The processing of sensitive data is prohibited, except when:
a. The Data Subject has given their explicit authorization for such processing, except in cases where such authorization is not required by law. The processing is necessary to safeguard the vital interest of the Data Subject and they are physically or legally incapacitated. In these cases, legal representatives must grant their authorization.
b. The processing is carried out in the course of legitimate activities and with appropriate guarantees by a foundation, NGO, association, or any other non-profit organization whose purpose is political, philosophical, religious, or union-related, provided that it refers exclusively to its members or to persons who maintain regular contact due to its purpose.
c. In these events, the data may not be provided to third parties without the authorization of the Data Subject.
d. The processing refers to data necessary for the recognition, exercise, or defense of a right in a judicial proceeding. e. The processing has a historical, statistical, or scientific purpose. In this event, measures must be adopted to suppress the identity of the Data Subjects.
f. In the processing of sensitive personal data, when such processing is possible according to the aforementioned exceptions contained in Article 6 of Law 1581 of 2012, the following obligations must be met:
Inform the Data Subject that, because they are sensitive data, they are not obliged to authorize their processing. Inform the Data Subject explicitly and in advance, in addition to the general requirements for the authorization for the collection of any type of personal data, which of the data that will be subject to processing are sensitive and the purpose of the Processing, as well as obtain their express consent.
7.2.2 Rights of children and adolescents.
In the processing, respect for the prevailing rights of children and adolescents will be ensured. The processing of personal data of children and adolescents is prohibited, except for data that is of a public nature. 7.2.3 Rights of the Data Subjects:
7.2.3.1 Know, update, and rectify their personal data before HOTEL PORTON DE LA CABRERA, or before the designated data processor. This right may be exercised, among others, against partial, inaccurate, incomplete, fractionated, misleading data, or those whose processing is expressly prohibited or has not been authorized.
7.2.3.2 Request proof of the authorization granted to HOTEL PORTON DE LA CABRERA, except when expressly excepted as a requirement for processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.
7.2.3.3 Be informed by HOTEL PORTON DE LA CABRERA, or by the designated data processor, upon request, regarding the use that has been given to their personal data.
7.2.3.4 File complaints with the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other rules that modify, add, or complement it.
7.2.3.5 Revoke the authorization and/or request the deletion of the data when the constitutional and legal principles, rights, and guarantees are not respected in the processing. The revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that HOTEL PORTON DE LA CABRERA or the designated processor have engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
7.2.3.6 Access their personal data that has been subject to processing free of charge under the conditions defined in this document.
8. CONDITIONS FOR DATA PROCESSING
8.1 Authorization
In development of the principles of purpose and freedom, the collection of data carried out by HOTEL PORTON DE LA CABRERA must be limited to those personal data that are relevant and appropriate for the purpose for which they are collected or required in accordance with current regulations, except in cases expressly provided for in the Law.
8.2 Authorization of the Data Subject
For HOTEL PORTON DE LA CABRERA to perform any personal data processing action, the prior and informed authorization of the Data Subject is required, which must be obtained by any means that can be subject to subsequent consultation. These mechanisms may be predetermined through technical means that facilitate the Data Subject's automated expression or may be in writing or orally. Authorizations by Data Subjects will be registered as follows:
HOTEL PORTON DE LA CABRERA requests authorization for the processing of information from all its data subjects, provided that such collection implies the processing of information by HOTEL PORTON DE LA CABRERA or third parties (with prior authorization); this request for authorization is made at the time of generating commercial relationships with clients (Credit and Cash Sales), purchasing products and services with suppliers, and hiring personnel for the performance of duties inherent to the organization. HOTEL PORTON DE LA CABRERA adopts procedures to request, at the latest at the time of data collection, the authorization of the Data Subject for the processing thereof and will inform the personal data that will be collected as well as all the specific purposes of said processing for which the consent is obtained.
Personal data found in publicly accessible sources, regardless of the means by which access is obtained, understood as those data or databases that are available to the public, may be processed by HOTEL PORTON DE LA CABRERA, provided that, by their nature, they are public data.
In the event of substantial changes in the content of the Processing Policies, referring to the identification of the Controller and the Purpose of the personal data processing, which may affect the content of the authorization, HOTEL PORTON DE LA CABRERA will communicate these changes to the Data Subjects at least 3 days before the entry into force of the new policy, and will also obtain a new authorization from the Data Subject when the change refers to the Purpose of the Processing. For the communication of changes and authorization.
8.2.1 Cases in which authorization is not necessary
a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
b. Data of a public nature.
c. Cases of medical or health emergency.
d. Processing of information authorized by law for historical, statistical, or scientific purposes.
e. Data related to the Civil Registry of persons.
8.3 Supply of information The information requested by the Data Subject will be provided by HOTEL PORTON DE LA CABRERA, and may be provided by any means, including electronic ones, as required by the Data Subject. The information must be easy to read, without technical barriers that prevent its access, and must correspond in its entirety to that which rests in the database.
8.4 Duty to inform the Data Subject HOTEL PORTON DE LA CABRERA, at the time of requesting authorization from the Data Subject, must inform them clearly and expressly of the following: The processing to which their personal data will be subjected and the purpose thereof. The optional nature of the response to questions asked, when these deal with sensitive data or data of children and adolescents. The rights that assist them as a Data Subject. The identification, physical or electronic address, and telephone number of the data controller.
8.5 Persons to whom the information may be supplied: The information regarding personal data that has been subject to Processing by HOTEL PORTON DE LA CABRERA may be provided to the following persons: To the Data Subjects, their successors, or their legal representatives. To public or administrative entities in the exercise of their legal functions or by court order. To third parties authorized by the Data Subject or by law.
9. RIGHTS OF THE DATA SUBJECT
9.1 Revocation of authorization and/or deletion of data:
Data Subjects may at any time request HOTEL PORTON DE LA CABRERA to delete their personal data and/or revoke the authorization granted for the processing thereof, by filing a claim, in accordance with the provisions of Article 15 of Law 1581 of 2012. The request for deletion of information and the revocation of authorization WILL NOT PROCEED WHEN THE DATA SUBJECT HAS A LEGAL OR CONTRACTUAL DUTY TO REMAIN IN HOTEL PORTON DE LA CABRERA's DATABASE. The procedure will be that established in this document for filing claims.
9.2 Inquiries and claims:
The Data Subject or their successors have the right to file inquiries and/or claims before HOTEL PORTON DE LA CABRERA, after validation of their identity, through any of the following customer service mechanisms arranged by the Company nationwide. HOTEL PORTON DE LA CABRERA will respond to the inquiry and/or claim by the same means it was formulated.
9.2.1 Inquiry:
The Data Subjects or their successors may consult the personal information of the Data Subject that rests in the controller's database. HOTEL PORTON DE LA CABRERA will provide the requester with all information contained in the individual record or linked to the identification of the Data Subject.
The Data Subject may consult their personal data free of charge:
At least one (1) time every calendar month. Each time there are substantial modifications to the Information Processing Policies that motivate new inquiries. For inquiries with a frequency greater than one (1) per calendar month, HOTEL PORTON DE LA CABRERA will only charge the costs of shipping, reproduction, and, where applicable, certification of documents. Reproduction costs may not be greater than the recovery costs of the corresponding material.
Response to inquiries
For the purpose of responding to inquiries, HOTEL PORTON DE LA CABRERA has a term of ten (10) business days from the date of receipt thereof. When it is not possible to attend to the inquiry within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the inquiry will be attended to, which in no case may exceed five (5) business days following the expiration of the first term.
Claims
The Data Subject or their successors who consider that the information contained in a database should be corrected, updated, or deleted, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, may file a claim before HOTEL PORTON DE LA CABRERA, which will be processed under the following rules and will be formulated through a request addressed to HOTEL PORTON DE LA CABRERA, with at least the following information:
Name of the controller or the processor of the Processing.
Name of the petitioner.
Identification number of the petitioner.
Facts on which the request is based.
Object of the petition.
Address for correspondence.
Provide the documents intended to be asserted.
If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the flaws. After two (2) months from the date of the requirement, without the requester presenting the required information, it will be understood that they have withdrawn from the claim. In the event that the person receiving the claim is not competent to resolve it, they will transfer it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation. Once the complete claim is received, a legend stating “claim in process” and the reason for it will be included in the database within a term not exceeding two (2) business days. Such legend must be maintained until the claim is resolved. The maximum term to address the claim will be fifteen (15) business days from the day following the date of its receipt. When it is not possible to attend to the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be attended to, which in no case may exceed eight (8) business days following the expiration of the first term.
9.2.3 Procedural requirement: The Data Subject or successor may only file a complaint with the Superintendency of Industry and Commerce once they have exhausted the inquiry or claim procedure before the controller or processor of the processing.
9.2.4 Procedure for inquiries and claims.
In compliance with the above, HOTEL PORTON DE LA CABRERA will respond to the inquiry and/or claim by the same means it was formulated.
The procedure established by HOTEL PORTON DE LA CABRERA for filing claims, making inquiries, and/or exercising their rights as the subject of the information collected is as follows.
9.2.4.1 Reception of the claim or inquiry in any of the complexes, these can be identified on the Web pages https://portondelacabrerasuiteshotel.com/, they can also send a written document directly to the administrative Offices at 84C STREET # 7-55 9.2.4.2 Claims or inquiries can also be sent via email: reservas@hotelportondelacabrera.com, in accordance with Numeral Second, Literal Second, ARTICLE 16 Law 1266 of 2008-Numeral Second, Article 15, Law 1581 of 2012.
9.2.4.3 For petitions or inquiries, there are 10 business days from receipt; if necessary, the response can be extended by 5 more business days.
9.2.4.4 For claims, there are 15 business days to resolve the same, Numeral third of Article 16 of Law 1266 of 2008.
9.2.4.5 Exceptionally, there are 8 additional business days beyond the first 15 to respond to the right of petition, provided that the person exercising the right of petition is notified.
9.2.4.6 HOTEL PORTON DE LA CABRERA, within 2 business days following receipt of the claim, will impose in the operator's database the record or legend that it is “claim in process”.
9.2.4.7 In case of not being competent, there are 2 business days to transfer the information to the competent entity.
9.2.4.8 Once the response to the inquiry or claim raised by the client is available, it will be sent to the address provided in the request and/or to the means by which the inquiry was made.
9.2.4.9 In case of doubts or concerns about the procedure for filing claims, making inquiries, and/or exercising your rights as the subject of the data collected by HOTEL PORTON DE LA CABRERA, general information can be requested through the Customer Service department via Email reservas@hotelportondelacabrera.com.
10. DUTIES OF HOTEL PORTON DE LA CABRERA IN DATA PROCESSING
a. Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
b. Request and keep, under the conditions provided for in the Law, a copy of the respective authorization granted by the Data Subject.
c. Duly inform the Data Subject about the purpose of the collection and the rights that assist them by virtue of the authorization granted.
d. Take measures aimed at keeping the information under security conditions to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access.
e. Ensure that the information provided to the data processor is truthful, complete, exact, updated, verifiable, and understandable.
f. Update the information, communicating in a timely manner to the data processor all updates regarding the data previously provided and adopt other necessary measures so that the information provided to it is kept updated.
g. Rectify information when it is incorrect and communicate the relevant information to the data processor.
h. Provide the data processor, as the case may be, only with data whose processing is previously authorized in accordance with the provisions of the Law.
i. Require the data processor at all times to respect the security and privacy conditions of the Data Subject's information.
j. Process inquiries and claims formulated in the terms indicated in the law.
k. Adopt an internal manual of policies and procedures to ensure proper compliance with this law and especially for the handling of inquiries and claims.
l. Inform the data processor when certain information is under dispute by the Data Subject, once the claim has been filed and the respective procedure has not been completed.
m. Inform at the request of the Data Subject about the use given to their data.
n. Inform the data protection authority when security code violations occur and there are risks in the management of the Data Subjects' information.
o. Follow the instructions and requirements issued by the Superintendency of Industry and Commerce.
10.1 Duties of the data processor:
The processors must comply with the following duties, without prejudice to other provisions provided for in the Law and others that govern their activity:
a. Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
b. Take measures to keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access.
c. Carry out the update, rectification, or deletion of data in a timely manner under the terms of this law.
d. Update the information reported by the controllers within five (5) business days from its receipt.
e. Process inquiries and claims formulated by the Data Subjects in the terms indicated in the Law.
f. Adopt a document that ensures proper compliance with the Law and, especially, for the handling of inquiries and claims by the Data Subjects.
g. Register in the database the legend “claim in process” in the manner regulated by Law.
h. Insert into the database the legend “information under judicial dispute” once notified by the competent authority regarding judicial processes related to the quality of personal data.
i. Refrain from circulating information that is being contested by the Data Subject and whose blocking has been ordered by the Superintendency of Industry and Commerce.
j. Allow access to information only to persons who may have access to it.
k. Inform the Superintendency of Industry and Commerce when security code violations occur and there are risks in the management of the Data Subjects' information.
l. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
m. Safeguard the databases containing personal data.
n. Maintain confidentiality regarding the Processing of personal data.
11. SECURITY MEASURES
HOTEL PORTON DE LA CABRERA takes all reasonable precautions and technical, administrative, and organizational measures leading to guarantee the security of the personal data of the Data Subjects, mainly those intended to prevent their alteration, loss, and unauthorized processing or access. Security measures apply to both files and processing. The application of security measures aims to ensure the preservation, confidentiality, integrity, and availability of the data.
12. MODIFICATIONS
HOTEL PORTON DE LA CABRERA reserves the right to modify these Information Processing Policies, in whole or in part. In the event of substantial changes in the Processing Policies referring to the identification of HOTEL PORTON DE LA CABRERA and the purpose of the personal data Processing, which may affect the content of the authorization, HOTEL PORTON DE LA CABRERA will communicate these changes to the data subject at the latest at the time of implementing the new policies.