DATA PRIVACY AND INFORMATION MANAGEMENT POLICIES LAW 1581 OF 2012 AND REGULATORY DECREE 1377 OF 2013
DATA CONTROLLER
NAME: Hacienda Zorita Hotel SL
TAX ID (NIT): B24745499
ADDRESS: SA-300, km 10, 37115 Valverdón, Salamanca
EMAIL: zorita@haciendazorita.com
WEBSITE: https://hacienda-zorita-dot-secure-booking47.appspot.com/
1. OBJECTIVE
To establish and disclose the Information Processing and Personal Data Protection Policies implemented by Hacienda Zorita Hotel SL, in order to ensure proper compliance with Law 1581 of 2012 and Decree 1377 of 2013, which aim to develop the constitutional right that all persons have to know, update, and rectify information collected about them in databases or files, as well as other rights, freedoms, and constitutional guarantees referred to in Article 15 of the Political Constitution "Habeas Data"; as well as the right to information enshrined in Article 20 of the same.
The company Hacienda Zorita Hotel SL adopts the internal manual of policies and procedures to guarantee compliance with this precept and these regulatory regulations.
2. SCOPE:
This document applies to personal data registered in any database managed by the company that makes them subject to Processing.
3. DEFINITIONS:
3.1. Authorization: prior, express, and informed consent of the Data Subject to carry out the processing of personal data.
3.2. Database: organized set of personal data that is subject to processing.
3.3. Personal data: any information linked to or that can be associated with one or more determined or determinable natural or legal persons.
3.4. Data Processor: natural or legal person, public or private, who, by themselves or in association with others, carries out the processing of personal data on behalf of the Data Controller.
3.5. Data Controller: natural or legal person, public or private, who, by themselves or in association with others, decides on the database and/or the processing thereof.
3.6. Data Subject: natural or legal person whose personal data is subject to processing.
3.7. Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
3.8. Inquiries: request for the Data Subject's personal information resting in any database, regarding which Hacienda Zorita Hotel SL has the obligation to provide the Data Subject or their successors all the information contained in the individual record or linked to the identification of the Data Subject.
3.9. Claim: request for correction, updating, or deletion of the information contained in a database processed by Hacienda Zorita Hotel SL, or a request for alleged breach of any of the duties contained in Law 1581 of 2012, made by the Data Subject or their successors.
3.10. Public data: is data that is not semi-private, private, or sensitive. Considered public data are, among others, data relating to the marital status of persons, their profession or trade, and their status as a merchant or public servant. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial sentences that are not subject to confidentiality.
3.11. Sensitive data: those personal data that reveal racial or ethnic origin, political opinions, religious or philosophical convictions, trade union membership, information regarding health or sexual life, or any other data that may produce, by its nature or context, some discriminatory treatment to the data subject. These data are especially protected.
3.12. Habeas data: fundamental right that allows knowing, updating, and rectifying information stored about persons in databases and in files of public and private entities. 3.13. Successor: person who has succeeded or been subrogated by any title to the right of another or others.
4. GENERAL GUIDELINES
4.1 The policies contemplated in this document are mandatory for Hacienda Zorita Hotel SL as a source of information data, as well as for the processors who carry out the processing of personal data on behalf of the Company.
4.2 Both the controller and the processors must safeguard the databases containing personal data and maintain confidentiality regarding the processing.
5. REGULATORY BACKGROUND
5.1 Article 15 of the Political Constitution.
“All persons have the right to their personal and family privacy and to their good name, and the State must respect them and make them respected. Likewise, they have the right to know, update, and rectify information that has been collected about them in databases and in files of public and private entities. In the collection, processing, and circulation of data, freedom and other guarantees enshrined in the Constitution shall be respected.”
5.2 Article 20 of the Political Constitution.
“Every person is guaranteed the freedom to express and disseminate their thoughts and opinions, the right to report and receive truthful and impartial information, and the right to establish mass communication media. These are free and have social responsibility. The right to rectification under conditions of equity is guaranteed. There shall be no censorship.”
6. Hacienda Zorita Hotel SL IN THE REGULATIONS
We are a source of information.
6.1 WHY ARE WE A SOURCE OF INFORMATION?
Since Hacienda Zorita Hotel SL is a company in charge of collecting credit information from users to whom services are offered through payment systems under the credit and cash modality, it constitutes one of the so-called sources of information referred to in literal (b) of the third article of Law 1266 of 2008. (...)
“It is the person, entity, or organization that receives or knows personal data of the information subjects, by virtue of a commercial or service relationship or of any other nature and that, by reason of legal or owner authorization, supplies that data to an information operator, which in turn will deliver them to the end user. If the source delivers the information directly to the users and not through an operator, it will have the dual status of source and operator and will assume the duties and responsibilities of both. The source of the information is responsible for the quality of the data supplied to the operator, which, as it has access to and supplies personal information of third parties, is subject to compliance with the duties and responsibilities provided to ensure the protection of the data subject's rights”(…)
6.2 DUTIES OF THE SOURCES OF INFORMATION ARTICLE 8, LAW 1266 OF 2008:
The sources of information must comply with the following obligations, without prejudice to compliance with the other provisions provided in this law and in others that govern their activity:
a. Guarantee that the information supplied to the database operators or users is truthful, complete, accurate, updated, and verifiable.
b. Report, periodically and in a timely manner to the operator, all developments regarding the data previously supplied to them and adopt the other necessary measures so that the information supplied to them is kept updated.
c. Rectify the information when it is incorrect and inform the operators accordingly.
d. Design and implement effective mechanisms to report information to the operator in a timely manner.
e. Request, when applicable, and keep a copy or evidence of the respective authorization granted by the information subjects, and ensure not to supply to the operators any data whose supply is not previously authorized, when such authorization is necessary, in accordance with the provisions of this law.
f. Certify, semi-annually to the operator, that the supplied information has the authorization in accordance with the provisions of this law.
g. Resolve the claims and petitions of the data subject in the manner regulated in this law.
h. Inform the operator that certain information is under discussion by its subject, when a request for rectification or updating has been filed, so that the operator includes a mention to that effect in the database until said process has been completed.
i. Comply with the instructions issued by the supervisory authority in relation to compliance with this law.
j. Any others derived from the Constitution or this law.
7. PROCESSING OF PERSONAL DATA
7.1 Principles for the processing of personal data.
The following principles will be taken into account by Hacienda Zorita Hotel SL in the process of managing personal data.
7.1.1 Legality in data processing.
Data processing must be subject to the provisions contained in Law 1581 of 2012 and any regulation that develops or regulates such provision.
7.1.2 Purpose and processing.
Data processing must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject. The data processing and the purpose of the information in the Hacienda Zorita Hotel SL databases are based on the provision of the service, the contractual relationship, and commercial and/or advertising purposes. Hacienda Zorita Hotel SL may transmit the information to third parties, suppliers, and authorities.
The processing can only be exercised with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that exempts consent.
7.1.3 Truthfulness or quality.
The information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fractional data, or data that leads to error is prohibited.
7.1.4 Transparency.
In the processing, the Data Subject's right to obtain, at any time and without restrictions, information about the existence of data concerning them must be guaranteed by Hacienda Zorita Hotel SL or the data processor.
7.1.5 Restricted access and circulation.
The processing is subject to the limits derived from the nature of personal data, the provisions of Law 1581 of 2012, and the Constitution. In this sense, the processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for in the Law.
Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Data Subjects or third parties authorized in accordance with the Law.
7.1.6 Security
The information subject to processing by the controller or the data processor must be handled by taking technical, human, and administrative measures that are reasonable to grant security to the records, seeking to prevent their adulteration, loss, consultation, or unauthorized or fraudulent use or access.
7.1.7 Confidentiality.
All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks included in said procedure, only being able to supply or communicate personal data when it corresponds to the development of activities authorized in the Law and in the terms thereof.
7.2 Special categories of data.
7.2.1 Sensitive data.
These are data that affect the privacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations, or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.
7.2.1.1 The processing of sensitive data is prohibited, except when:
a. The Data Subject has given their explicit authorization for said processing, except in cases where such authorization is not required by law. The processing is necessary to safeguard the vital interest of the Data Subject and they are physically or legally incapacitated. In these events, legal representatives must grant their authorization.
b. The processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association, or any other non-profit organization, whose purpose is political, philosophical, religious, or union-related, provided that they refer exclusively to their members or persons who maintain regular contact for reason of their purpose.
c. In these events, the data may not be supplied to third parties without the authorization of the Data Subject.
d. The processing refers to data that is necessary for the recognition, exercise, or defense of a right in a judicial proceeding. e. The processing has a historical, statistical, or scientific purpose. In this event, measures must be adopted to suppress the identity of the Data Subjects.
f. In the processing of sensitive personal data, when said processing is possible in accordance with the aforementioned exceptions contained in Article 6 of Law 1581 of 2012, the following obligations must be met:
Inform the Data Subject that, as these are sensitive data, they are not obliged to authorize their processing. Inform the Data Subject explicitly and in advance, in addition to the general requirements of the authorization for the collection of any type of personal data, which of the data will be subject to processing and the purpose of the Processing, as well as obtain their express consent.
7.2.2 Rights of children and adolescents.
The processing will ensure respect for the prevailing rights of children and adolescents. The processing of personal data of children and adolescents is prohibited, except for data that is of a public nature. 7.2.3 Rights of the Data Subjects:
7.2.3.1 To know, update, and rectify their personal data before Hacienda Zorita Hotel SL, or before the designated data processor. This right may be exercised, among others, regarding partial, inaccurate, incomplete, fractional data, data that leads to error, or data whose processing is expressly prohibited or has not been authorized.
7.2.3.2 Request proof of the authorization granted to Hacienda Zorita Hotel SL except when it is expressly excepted as a requirement for processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.
7.2.3.3 Be informed by Hacienda Zorita Hotel SL, or by the designated data processor, upon request, regarding the use that has been given to their personal data.
7.2.3.4 File complaints before the Superintendence of Industry and Commerce for infringements of the provisions of Law 1581 of 2012 and other rules that modify, add, or complement it.
7.2.3.5 Revoke the authorization and/or request the deletion of the data when the processing does not respect the constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the processing, Hacienda Zorita Hotel SL or the designated processor have engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
7.2.3.6 Access free of charge, under the conditions defined in this document, to their personal data that have been subject to processing.
8. CONDITIONS FOR DATA PROCESSING
8.1 Authorization
In the development of the principles of purpose and freedom, the collection of data carried out by Hacienda Zorita Hotel SL must be limited to those personal data that are relevant and adequate for the purpose for which they are collected or required in accordance with current regulations, except in cases expressly provided for in the Law.
8.2 Authorization of the Data Subject
For Hacienda Zorita Hotel SL to perform any action of personal data processing, the prior and informed authorization of the Data Subject is required, which must be obtained by any means that can be subject to subsequent consultation. These mechanisms may be predetermined through technical means that facilitate the Data Subject's automated manifestation or may be in writing or orally. Authorizations by Data Subjects will be registered as follows:
Hacienda Zorita Hotel SL requests authorization for the processing of information from all its data subjects, provided that such collection implies the realization of information processing by Hacienda Zorita Hotel SL or third parties (prior authorization), this request for authorization is made at the moment commercial relationships with clients are generated (Credit and Cash Sales), purchase of products and services with suppliers, and hiring of personnel for the performance of tasks inherent to the organization. Hacienda Zorita Hotel SL adopts the procedures to request, at the latest at the time of data collection, the authorization of the Data Subject for the processing thereof and will inform the personal data that will be collected as well as all the specific purposes of said processing for which the consent is obtained.
Personal data that are in public access sources, regardless of the means by which access is obtained, understood as such data or databases that are available to the public, may be processed by Hacienda Zorita Hotel SL, provided that, by their nature, they are public data.
In case of making substantial changes to the content of the Processing Policies, referring to the identification of the Controller and the Purpose of personal data processing, which may affect the content of the authorization, Hacienda Zorita Hotel SL will communicate these changes to the Data Subjects at least 3 days before the entry into force of the new policy, and will also obtain a new authorization from the Data Subject when the change refers to the Purpose of the Processing. For the communication of changes and authorization.
8.2.1 Cases in which authorization is not necessary
a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
b. Data of a public nature.
c. Cases of medical or sanitary urgency.
d. Processing of information authorized by law for historical, statistical, or scientific purposes.
e. Data related to the Civil Registry of persons.
8.3 Supply of information The information requested by the Data Subject will be supplied by Hacienda Zorita Hotel SL, and may be supplied by any means, including electronic ones, as required by the Data Subject. The information must be easy to read, without technical barriers that prevent its access, and must correspond in its entirety to that which rests in the database.
8.4 Duty to inform the Data Subject Hacienda Zorita Hotel SL, at the time of requesting authorization from the Data Subject, must inform them clearly and expressly of the following: The processing to which their personal data will be subjected and the purpose thereof. The optional nature of the answer to the questions asked, when these concern sensitive data or data of children and adolescents. The rights that assist them as a Data Subject. The identification, physical or electronic address, and telephone number of the data controller.
8.5 Persons to whom information may be supplied: The information regarding personal data that has been subject to Processing by Hacienda Zorita Hotel SL may be supplied to the following persons: To the Data Subjects, their successors, or their legal representatives. To public or administrative entities in the exercise of their legal functions or by court order. To third parties authorized by the Data Subject or by law.
9. RIGHTS OF THE DATA SUBJECT
9.1 Revocation of authorization and/or deletion of data:
Data Subjects may at any time request Hacienda Zorita Hotel SL to delete their personal data and/or revoke the authorization granted for the processing thereof, by filing a claim, in accordance with the provisions of Article 15 of Law 1581 of 2012. The request for deletion of information and revocation of authorization WILL NOT PROCEED WHEN THE DATA SUBJECT HAS A LEGAL OR CONTRACTUAL DUTY TO REMAIN IN THE Hacienda Zorita Hotel SL DATABASE The procedure will be that established in this document to file claims.
9.2 Inquiries and claims:
The Data Subject or their successors have the right to file inquiries and/or claims before Hacienda Zorita Hotel SL, after validation of their identity, through any of the following mechanisms, of customer service provided by the Company at a national level. Hacienda Zorita Hotel SL will respond to the inquiry and/or claim by the same means it was formulated.
9.2.1 Inquiry:
Data Subjects or their successors may inquire about the personal information of the Data Subject that rests in the database of the controller. Hacienda Zorita Hotel SL will provide the requester with all the information contained in the individual record or linked to the identification of the Data Subject.
The Data Subject may inquire about their personal data free of charge:
At least once (1) every calendar month. Each time there are substantial modifications to the Information Processing Policies that motivate new inquiries. For inquiries whose periodicity is greater than one (1) per calendar month, Hacienda Zorita Hotel SL will only charge the costs of shipping, reproduction, and, where appropriate, certification of documents. Reproduction costs may not be greater than the recovery costs of the corresponding material.
Response to inquiries
For the purposes of responding to inquiries, Hacienda Zorita Hotel SL has a term of ten (10) business days from the date of receipt thereof. When it is not possible to address the inquiry within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.
Claims
The Data Subject or their successors who consider that the information contained in a database should be subject to correction, updating, or deletion, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, may file a claim before Hacienda Zorita Hotel SL, which will be processed under the following rules and will be formulated through a request addressed to Hacienda Zorita Hotel SL, with at least the following information:
Name of the Data Controller or the processor.
Name of the petitioner.
Identification number of the petitioner.
Facts on which the request is based.
Object of the petition.
Correspondence address.
Provide the documents intended to be asserted.
If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. If two (2) months pass from the date of the requirement without the requester presenting the required information, it will be understood that they have withdrawn the claim. In the event that the person receiving the claim is not competent to resolve it, they will transfer it to whoever corresponds within a maximum term of two (2) business days and will inform the interested party of the situation. Once the complete claim is received, a legend saying “claim in process” and the reason for it will be included in the database within a period not exceeding two (2) business days. Said legend must be maintained until the claim is resolved. The maximum term to address the claim will be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
9.2.3 Procedural requirement: The Data Subject or successor may only file a complaint with the Superintendence of Industry and Commerce once they have exhausted the inquiry or claim procedure before the data controller or processor.
9.2.4 Procedure for inquiries and claims.
In compliance with the above, Hacienda Zorita Hotel SL will respond to the inquiry and/or claim by the same means it was formulated.
The procedure established by Hacienda Zorita Hotel SL to file claims, make inquiries, and/or exercise their rights as a data subject of the collected information is as follows:
9.2.4.1 Reception of the claim or inquiry in any of the complexes, these can be identified on the websites https://hacienda-zorita-dot-secure-booking47.appspot.com/, they can also direct correspondence directly to the Administrative Offices at SA-300, km 10, 37115 Valverdón, Salamanca 9.2.4.2 Claims or inquiries can also be sent via email: zorita@haciendazorita.com, in accordance with the Second Numeral, Second Literal, ARTICLE 16 Law 1266 of 2008-Second Numeral, Article 15, Law 1581 of 2012.
9.2.4.3 For petitions or inquiries, there are 10 business days from receipt; if necessary, the response can be extended by 5 more business days.
9.2.4.4 For claims, there are 15 business days to resolve the same, Third Numeral of article 16 of Law 1266 of 2008.
9.2.4.5 Exceptionally, there are 8 additional business days to the first 15 to respond to the right of petition, provided that the person exercising the right of petition is notified.
9.2.4.6 Hacienda Zorita Hotel SL, within 2 business days following the receipt of the claim, will impose in the operator's database the proof or legend that it is “claim in process”.
9.2.4.7 In case of not being competent, there are 2 business days to transfer the information to the competent entity.
9.2.4.8 Once the response to the inquiry or claim raised by the client is obtained, it will be sent to the address provided in the request and/or to the means through which the inquiry was made.
9.2.4.9 In case of doubts or concerns about the procedure to file claims, make inquiries, and/or exercise their rights as a data subject of the information collected by Hacienda Zorita Hotel SL, general information can be requested through the Customer Service department via Email zorita@haciendazorita.com.
10. DUTIES OF Hacienda Zorita Hotel SL IN DATA PROCESSING
a. Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
b. Request and keep, under the conditions provided in the Law, a copy of the respective authorization granted by the Data Subject.
c. Duly inform the Data Subject about the purpose of the collection and the rights that assist them by virtue of the authorization granted.
d. Take measures aimed at keeping the information under security conditions to prevent its adulteration, loss, consultation, or unauthorized or fraudulent use or access.
e. Strive to ensure that the information supplied to the data processor is truthful, complete, accurate, updated, verifiable, and understandable.
f. Update the information, communicating in a timely manner to the data processor all developments regarding the data previously supplied to them and adopt the other measures necessary for the information supplied to them to be kept updated.
g. Rectify the information when it is incorrect and communicate the relevant information to the data processor.
h. Supply to the data processor, as the case may be, only data whose processing is previously authorized in accordance with the provisions of the Law.
i. Require the data processor at all times to respect the security and privacy conditions of the Data Subject's information.
j. Process inquiries and claims formulated in the terms indicated in the law.
k. Adopt an internal manual of policies and procedures to guarantee proper compliance with this law and especially for the attention of inquiries and claims.
l. Inform the data processor when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not finished.
m. Inform at the request of the Data Subject about the use given to their data.
n. Inform the data protection authority when there are violations of security codes and there are risks in the management of the Data Subjects' information.
o. The instructions and requirements issued by the Superintendence of Industry and Commerce.
10.1 Duties of the data processor:
The processors must comply with the following duties, without prejudice to the other provisions provided in the Law and in others that govern their activity:
a. Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
b. Take measures to keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, or unauthorized or fraudulent use or access.
c. Carry out the updating, rectification, or deletion of data in a timely manner in the terms of this law.
d. Update the information reported by the controllers within five (5) business days from its receipt.
e. Process the inquiries and claims formulated by the Data Subjects in the terms indicated in the Law.
f. Adopt a document that guarantees proper compliance with the Law and, especially, for the attention of inquiries and claims by the Data Subjects.
g. Register in the database the legend “claim in process” in the manner regulated in the Law.
h. Insert in the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of the personal data.
i. Refrain from circulating information that is being contested by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.
j. Allow access to information only to persons who may have access to it.
k. Inform the Superintendence of Industry and Commerce when there are violations of security codes and there are risks in the management of the Data Subjects' information.
l. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
m. Safeguard the databases that contain personal data.
n. Maintain confidentiality regarding the Processing of personal data.
11. SECURITY MEASURES
Hacienda Zorita Hotel SL takes all reasonable precautions and technical, administrative, and organizational measures leading to guarantee the security of the personal data of the Data Subjects, mainly those intended to prevent their alteration, loss, and unauthorized processing or access. Security measures apply to both files and processing. The application of security measures aims to ensure the preservation, confidentiality, integrity, and availability of data.
12. MODIFICATIONS
Hacienda Zorita Hotel SL reserves the right to modify these Information Processing Policies, in whole or in part. In case of substantial changes to the Processing Policies referring to the identification of Hacienda Zorita Hotel SL and the purpose of personal data Processing, which may affect the content of the authorization, Hacienda Zorita Hotel SL will communicate these changes to the data subject at the latest at the time of implementing the new policies.