Colombian Law 1581 of 2012

Privacy and personal data processing policy

This is an English translation provided for reference. In case of any difference, the Spanish version prevails.

At Hotel Casa Portones, the preservation, protection, integrity and confidentiality of our customers' personal data matters a great deal. We have designed this policy for storing and processing the information our customers provide through the channels we use to sell our products and services (websites, WhatsApp, check-in form). We are committed to protecting and handling this data properly under Colombia's personal data protection regime (Law 1581 of 2012).

Definitions

Authorisation: the prior, express and informed consent of the Data Subject for their personal data to be Processed.
Privacy notice: a verbal or written communication from the Controller to the Data Subject informing them of the data Processing policies that apply, how to access them, and the purposes for which their personal data will be Processed.
Database: an organised set of personal data that is subject to Processing.
Personal data: any information linked or that can be associated with one or more identified or identifiable natural persons.
Private data: data that, because of its intimate or confidential nature, is relevant only to the Data Subject.
Sensitive data: data that affects the Data Subject's privacy or whose misuse could lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions, social or human rights organisations, or organisations that promote the interests of any political party or guarantee the rights of opposition parties, as well as data relating to health, sex life and biometric data.
Processor: a natural or legal person, public or private, who, alone or jointly with others, Processes personal data on behalf of the Controller.
Controller: a natural or legal person, public or private, who, alone or jointly with others, decides on the database and/or the Processing of the data.
Data Subject: the natural person whose personal data is Processed.
Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Purpose

This document governs the procedures by which Hotel Casa Portones collects, handles and processes personal data, in order to guarantee and protect the fundamental right of habeas data of its guests, visitors, customers, users and suppliers, as set out in paragraph (k) of Article 17 of Law 1581 of 2012. That article sets out the duties of data controllers, including adopting an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, to handle enquiries and complaints.

Scope

This manual applies to the personal data recorded, now or in the future, in the databases managed by Hotel Casa Portones, namely the databases of our guests, visitors, customers and suppliers who provide their data for commercial purposes.

Depending on the needs of each product and/or service, the information collected by Hotel Casa Portones may include, in whole or in part, the following data, among others:

First and last names.
Type and number of identification.
Nationality and country of residence.
Date of birth and gender.
Marital status and/or relationship to minors or persons with disabilities who request our services.
Landline and mobile contact numbers (personal and/or work).
Postal and email addresses (personal and/or work).
Profession or occupation.
Employer and position.
Origin and destination.
Reason for travel.
Credit card information (number, issuing bank, expiry date).
Personal data of the cardholder (names, type and number of identification).
Address at which the cardholder receives their bank statements.

This data may be stored and/or processed on servers located in data centres, either our own or contracted from third-party providers. Our guests, visitors, customers, users and suppliers authorise this by accepting this Privacy Policy.

Accuracy of information

Our guests, visitors, customers, users and suppliers must provide truthful personal data so that Hotel Casa Portones can provide its services, and they agree to provide the requested information on that condition.

Hotel Casa Portones presumes that the information provided is accurate. It does not verify, and assumes no obligation to verify, the identity of guests, visitors, customers, users and suppliers, or the accuracy, validity, sufficiency and authenticity of the data each of them provides. It therefore accepts no liability for damages of any kind arising from inaccurate, outdated, insufficient or inauthentic information, including damages resulting from identical names or identity theft.

Applicable law

This manual was prepared in accordance with Law 1581 of 2012, which sets out general provisions for the protection of personal data, and Decree 1377 of 2013, which partially regulates Law 1581 of 2012.

Information about children and adolescents

Hotel Casa Portones will ensure the proper use of the personal data of children and adolescents, making sure that its processing respects their best interests and fundamental rights and, where possible, takes their opinion into account as owners of their personal data.

Purposes of processing personal data

The information collected is used to process, confirm, fulfil and provide the services and/or products purchased, directly and/or with the participation of third-party suppliers; to promote and advertise our activities, products and services; to carry out transactions; to report to national or international administrative, supervisory, police or judicial authorities, banks and/or insurance companies; and for internal administrative and/or commercial purposes such as market research, audits, accounting reports, statistical analysis, invoicing, and offering and/or granting the benefits of our loyalty programmes.

By accepting this Privacy and Processing Policy, our guests, visitors, customers, users and suppliers, as owners of the data collected, authorise Hotel Casa Portones to process it, in whole or in part, including its collection, storage, recording, use, circulation, processing and deletion, in order to carry out activities related to the services and products purchased. These include making, modifying, cancelling and changing reservations, refunds, handling enquiries, complaints and claims, paying compensation, accounting records, correspondence, processing and verifying credit cards, debit cards and other payment instruments, identifying fraud and preventing money laundering and other criminal activities, and/or running loyalty programmes and the other purposes set out in this document.

This is without prejudice to other purposes stated in this document and in the terms and conditions of each of the products and services of our business units.

Please note that third-party providers may be involved in these activities (such as reservation system providers, travel agencies, call centres, banks and insurers).

In addition, by accepting this privacy policy, our travellers, customers and users, as owners of the data collected, authorise us to:

Use the information received from them for the marketing of our products and services, and of the products and services of third parties with whom Hotel Casa Portones has a business relationship.
Provide personal data to supervisory, police or judicial authorities in response to a legal or regulatory requirement, and/or use or disclose this information in defence of our rights and/or assets, insofar as such defence relates to the products and/or services contracted by our travellers, customers and users.
Give auditors or third parties hired to carry out internal or external audits of our business access to the information and personal data.
Consult and update the personal data at any time in order to keep it up to date.
Contract third parties to store and/or process the information and personal data for the proper performance of the contracts entered into with us, under the security and confidentiality standards to which we are bound.

Authorisation

The collection, storage, use, circulation or deletion of personal data by Hotel Casa Portones requires the free, prior, express and informed consent of the Data Subject. As data controller, Hotel Casa Portones has put in place the mechanisms needed to obtain the Data Subjects' authorisation, ensuring in all cases that it is possible to verify that authorisation was given.

With this authorisation, the customer accepts the policies and conditions set out in this document.

How authorisation is given

The Data Subject's authorisation will be recorded in each of the data collection channels and mechanisms of Hotel Casa Portones. It may be recorded in a physical or electronic document, or in any other format that allows it to be consulted later. The Data Subject will give authorisation before their personal data is processed, in accordance with Law 1581 of 2012.

This consent procedure ensures that the Data Subject is informed both that their personal information will be collected and used for specific, known purposes, and that they have the option of learning about any change to those purposes and the specific use made of their data. This allows the Data Subject to make informed decisions about their personal data and control how their personal information is used.

Rights of Data Subjects

The Data Subject has the following rights:

To know, update and correct their personal data held by Hotel Casa Portones as data controller.
To request proof of the authorisation given to Hotel Casa Portones as data controller.
To be informed by Hotel Casa Portones, upon request, of how their personal data has been used.
To file complaints with the Superintendence of Industry and Commerce (SIC) for breaches of Law 1581 of 2012, once the enquiry or complaint procedure with the data controller has been exhausted.
To revoke the authorisation and/or request the deletion of data when the Processing does not respect constitutional and legal principles, rights and guarantees.
To access, free of charge, their personal data that has been Processed.

Duties of Hotel Casa Portones regarding personal data

Hotel Casa Portones will bear in mind at all times that personal data belongs to the people it refers to and that only they can decide on it. It will therefore use personal data only for the purposes for which it is duly authorised, and always in compliance with the law.

Hotel Casa Portones undertakes to permanently fulfil the following duties:

To guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
To keep the information under the security conditions needed to prevent its alteration, loss, consultation, use or unauthorised or fraudulent access.
To update, correct or delete data in a timely manner.
To handle enquiries and complaints made by Data Subjects.
To add the note "information under judicial dispute" to the database once notified by the competent authority of legal proceedings relating to the quality or details of the personal data.
To refrain from circulating information that is disputed by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.
To allow access to the information only to the people who are entitled to it.
To inform the Superintendence of Industry and Commerce of any breach of security codes and of risks in the management of Data Subjects' information.
To comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

Right of access

The Data Subject's power to decide over the information that concerns them necessarily includes the right to access and know whether their personal information is being processed, as well as the scope, conditions and general terms of that processing.

The Data Subject also has the right to request correction of their data if it is inaccurate or incomplete, and its cancellation when it is not being used in accordance with legal or contractual purposes and terms, or with the purposes and terms set out in this Privacy Policy.

Hotel Casa Portones will guarantee the right of access when requested by the Data Subject or their representative or attorney, once their identity has been verified.

Customers and users can exercise their rights to know, update, correct and delete their personal data by sending a request to gerencia@valerianosas.com or by calling +57 320 487 1876, in accordance with this Privacy Policy.

The request must include: first and last names, type of document, document number, telephone, email, country and subject.

Response to enquiries

Regardless of the mechanism used to handle enquiries, they will be answered within a maximum of ten (10) business days from the date of receipt. If it is not possible to answer within that period, the person concerned will be informed before the 10 days expire, with the reasons for the delay and the date on which the enquiry will be answered, which may in no case exceed five (5) business days after the first deadline.

Complaints

A Data Subject or their successors who consider that information in a database should be corrected, updated or deleted, or who notice an alleged breach of any of the duties set out in the law, may file a complaint with the data controller, which will be handled according to the following rules:

The Data Subject may file the complaint using the forms Hotel Casa Portones provides for this purpose in its guest registration. If the complaint received lacks the information needed to process it, namely the identification of the Data Subject, a description of the facts giving rise to the complaint, an address and any supporting documents, the person concerned will be asked within five (5) days of receipt to complete it. If two (2) months pass from the date of that request without the requested information being provided, the complaint will be considered withdrawn. If for any reason Hotel Casa Portones receives a complaint that should not be addressed to it, it will forward it to the appropriate party within two (2) business days and inform the person concerned.
Once the complete complaint has been received, a note reading "complaint in progress" and the reason for it will be added to the database maintained by Hotel Casa Portones within two (2) business days. This note will remain until the complaint is resolved.
The maximum period to resolve a complaint is fifteen (15) business days from the day after it is received. If it is not possible to resolve it within that period, the person concerned will be informed, before the deadline, of the reasons for the delay and the date on which the complaint will be resolved, which may in no case exceed eight (8) business days after the first deadline.

Procedures to guarantee the right to file complaints

At any time and free of charge, the Data Subject or their representative may ask Hotel Casa Portones to correct, update or delete their personal data, once their identity has been verified. The rights of correction, updating or deletion may only be exercised by:

The Data Subject or their successors, once their identity has been verified, or through electronic means that allow them to identify themselves.
Their representative, once the representation has been verified.

When the request is made by someone other than the Data Subject and it is not shown that they are acting on the Data Subject's behalf, the request will be deemed not to have been made.

Requests for correction, updating or deletion must be submitted through the channels enabled by Hotel Casa Portones as set out in the privacy notice, and must include at least the following:

The Data Subject's name and address, or any other means of receiving the response.
Documents proving the identity of the Data Subject or the standing of their representative.
A clear and precise description of the personal data in respect of which the Data Subject wishes to exercise any of their rights.
Where applicable, other information or documents that help locate the personal data.

Correction and updating of data

At the Data Subject's request, Hotel Casa Portones is obliged to correct and update any of their information that proves to be incomplete or inaccurate, in accordance with the procedure and deadlines set out above. In requests to correct or update personal data, the Data Subject must indicate the corrections to be made and provide documentation supporting the request.

Hotel Casa Portones is free to enable mechanisms that make it easier to exercise this right, provided they benefit the Data Subject. Accordingly, electronic or other means it considers appropriate may be enabled.

Hotel Casa Portones may establish forms, systems and other simplified methods, which must be stated in the privacy notice and made available to interested parties on the website.

Hotel Casa Portones will use its existing customer service channels, provided response times do not exceed those set out in the law.

Whenever Hotel Casa Portones makes a new tool available to help Data Subjects exercise their rights, or modifies existing ones, it will announce it on its website.

Deletion of data

The Data Subject has the right, at any time, to ask Hotel Casa Portones to delete their personal data when:

They consider that it is not being processed in accordance with the principles, duties and obligations set out in the law.
It is no longer necessary or relevant for the purpose for which it was collected.
The period needed to fulfil the purposes for which it was collected has passed.

Deletion means the total or partial removal of personal information, as requested by the Data Subject, from the records, files, databases or processing carried out by Hotel Casa Portones. Please note that the right to deletion is not absolute, and the controller may refuse it when:

The Data Subject has a legal or contractual duty to remain in the database.
Deleting the data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions.
The data is needed to protect the Data Subject's legally protected interests, to act in the public interest, or to fulfil an obligation legally acquired by the Data Subject.

When deletion of personal data is appropriate, Hotel Casa Portones must carry it out in a way that does not allow the information to be recovered.

Revoking authorisation

Data Subjects may revoke their consent to the processing of their personal data at any time, provided no legal provision prevents it. To do so, they must contact Hotel Casa Portones at gerencia@valerianosas.com or by calling +57 320 487 1876.

Consent may be revoked in two ways. The first covers all the purposes consented to, meaning Hotel Casa Portones must stop processing the Data Subject's data entirely. The second covers specific types of processing, for example advertising or market research. With partial revocation, the other purposes of processing that the controller may carry out under the authorisation given, and with which the Data Subject agrees, remain in place.

For this reason, when submitting a request to revoke consent, the Data Subject must state whether the revocation is total or partial and, if partial, which processing they object to. In some cases, consent cannot be revoked because it is necessary to the relationship between the Data Subject and the controller for the performance of a contract or because the law requires it. The mechanisms or procedures Hotel Casa Portones establishes to handle requests to revoke consent may not exceed the deadlines set by law for handling complaints.

Security measures

Hotel Casa Portones has adopted the technical, human and administrative measures needed to keep records secure and prevent their alteration, loss, consultation, use or unauthorised or fraudulent access.

Nevertheless, the customer assumes the risks of providing this information through a medium such as the internet, which is subject to various factors such as third-party attacks and technical or technological failures, among others. Hotel Casa Portones will make its best technological effort to guarantee the security of all its customers' and users' personal information, using reasonable, up-to-date security methods to prevent unauthorised access, keep the data accurate and ensure the information is used correctly.

Implementation of security measures

Hotel Casa Portones will maintain mandatory security protocols for staff with access to personal data and information systems. The procedure must cover at least the following:

Third parties hired by Hotel Casa Portones will be required to adhere to and comply with its information security policies and manuals, as well as the security protocols we apply to all our processes.
Every contract between Hotel Casa Portones and third parties (contractors, external consultants, temporary staff, etc.) involving the processing of personal information will include a confidentiality agreement detailing their commitments to protect, safeguard and preserve the confidentiality, integrity and privacy of that information.
The scope of the procedure, with a detailed specification of the protected resources.
Measures, rules, procedures and standards aimed at guaranteeing the level of security required by law.
Staff roles and obligations.
The structure of the personal databases and a description of the information systems that process them.
The procedure for reporting, managing and responding to incidents.
Procedures for backing up and recovering data.
Periodic checks to verify compliance with the security procedure implemented.
Measures to take when a medium or document is to be transported, discarded or reused.
The procedure must be kept up to date at all times and reviewed whenever there are significant changes to the information system or its organisation.
The content of the procedure must comply at all times with current personal data security regulations.

Changes to the privacy policy

Hotel Casa Portones reserves the right to modify or update this Privacy Policy at any time to address legislative changes, internal policies or new requirements for providing or offering its services or products.

Data retention

Information provided by customers and users will be stored for up to fifteen (15) years from the date of the last processing, so that we can meet our legal and/or contractual obligations, especially in accounting and tax matters.

Back to home