DATA PRIVACY POLICIES AND INFORMATION HANDLING LAW 1581 OF 2012 AND REGULATORY DECREE 1377 OF 2013
DATA PROCESSING RESPONSIBLE
Name: Hoteles B3 Corp Colombia
NIT: 900510142-0
Direction: Carrera 15 # 88-36, Bogotá (Colombia)
EMAIL: info@hotelesb3.es15
WEBSITE: https://hotelesb3.com
1. OBJECTIVE
Establish and disseminate the Information Treatment and Protection of Personal Data Policies, implemented by Hoteles B3 Corp Colombia., in order to guarantee adequate compliance with Law 1581 of 2012 and Decree 1377 of 2013, which are intended objective is to develop the constitutional right that all people have to know, update and rectify the information that has been collected about them in databases or files, and the other rights, freedoms and constitutional guarantees referred to in article 15 of the Constitution. “Habeas Data” Policy; as well as the right to information enshrined in article 20 of the same.
The company Hoteles B3 Corp Colombia adopts the internal manual of policies and procedures to guarantee compliance with this precept and these normative regulations.
2. REACH:
This document applies to personal data, registered in any database managed by the company and that makes them susceptible to Treatment.
3. DEFINITIONS:
3.1. Authorization: prior, express and informed consent of the Owner to carry out the processing of personal data.
3.2. Database: organized set of personal data that is subject to processing.
3.3. Personal data: any information linked or that can be associated with one or more specific or determinable natural or legal persons.
3.4. Data processor: natural or legal person, public or private, who, by themselves or in association with others, processes personal data on behalf of the person responsible for it.
3.5. Responsible for the treatment: natural or legal person, public or private, who alone or in association with others, decides on the basis of data and/or their treatment.
3.6. Owner: natural or legal person whose personal data is processed.
3.7. Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
3.8. Inquiries: request for the Owner's personal information that resides in any database, on which Hoteles B3 Corp Colombia has the obligation to provide the Owner or his successors in title, all the information contained in the individual record or that is linked to the identification of the Owner.
3.9. Complaint: request for correction, update or deletion of the information contained in a database processed by Hoteles B3 Corp Colombia. or request for alleged breach of any of the duties contained in Law 1581 of 2012, made by the Owner or his successors in title.
3.10. Public data: is data that is not semi-private, private or sensitive. Public data are considered, among others, data relating to the marital status of people, their profession or trade, and their status as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins and duly executed judicial rulings that are not subject to confidentiality.
3.11. Sensitive data: personal data that reveals racial or ethnic origin, political opinions, religious or moral convictions, union membership, information regarding health or sexual life or any other data that may produce, due to its nature or context, any treatment. discriminatory to the owner of the data. These data are specially protected.
3.12. Habeas data: fundamental right that allows knowing, updating and rectifying the information stored about people in data banks and in files of public and private entities. 3.13. Incumbent: person who has succeeded or been subrogated by any title in the right of another or others.
4. GENERAL GUIDELINES
4.1 The policies contemplated in this document are mandatory for Hoteles B3 Corp Colombia as a source of data information, as well as for those in charge who process personal data on behalf of the Company.
4.2 Both the controller and those in charge must safeguard the databases that contain personal data and maintain confidentiality regarding the treatment.
5. REGULATORY BACKGROUND
5.1 Article 15 of the Political Constitution.
“All people have the right to their personal and family privacy and to their good name, and the State must respect them and ensure they are respected. Likewise, they have the right to know, update and rectify the information that has been collected about them in data banks and in files of public and private entities. In the collection, processing and circulation of data, freedom and other guarantees enshrined in the Constitution will be respected.”
5.2 Article 20 of the Political Constitution.
“Every person is guaranteed the freedom to express and disseminate their thoughts and opinions, to report and receive truthful and impartial information, and to found mass media. These are free and have social responsibility. The right to rectification under equitable conditions is guaranteed. “There will be no censorship.”
6. Hoteles B3 Corp Colombia IN REGULATIONS
We are a source of information.
6.1 WHY ARE WE A SOURCE OF INFORMATION?
Since Hoteles B3 Corp Colombia is a company that is responsible for collecting credit information from users to whom services are offered through credit and cash payment systems, this constitutes the so-called sources of information they deal with. literal (b) of the third article of Law 1266 of 2008. (…)
“It is the person, entity or organization that receives or knows personal data of the owners of the information, by virtue of a commercial or service relationship or of any other nature and that, by reason of legal authorization or of the owner, provides those data. to an information operator, who in turn will deliver them to the end user. If the source delivers the information directly to the users and not through an operator, the source will have the dual status of source and operator and will assume the duties and responsibilities of both. The source of the information is responsible for the quality of the data provided to the operator which, as soon as it has access and provides personal information of third parties, is subject to compliance with the duties and responsibilities provided to guarantee the protection of the rights of the owner of the data. data"(…)
6.2 DUTIES OF THE SOURCES OF INFORMATION ARTICLE 8, LAW 1266 OF 2008:
The sources of the information must comply with the following obligations, without prejudice to compliance with the other provisions provided for in this law and in others that govern their activity:
to. Guarantee that the information provided to data bank operators or users is true, complete, exact, updated and verifiable.
b. Report, periodically and in a timely manner, to the operator, all the news regarding the data that has previously been provided and adopt the other necessary measures so that the information provided to it remains updated.
c. Rectify the information when it is incorrect and inform the operators as pertinent.
d. Design and implement effective mechanisms to timely report information to the operator.
and. Request, when applicable, and keep a copy or evidence of the respective authorization granted by the owners of the information, and ensure not to provide operators with any data whose supply is not previously authorized, when such authorization is necessary, in accordance with what is provided for in this law.
F. Certify, semi-annually, to the operator, that the information provided is authorized in accordance with the provisions of this law.
g. Resolve the claims and requests of the owner in the manner regulated in this law.
h. Inform the operator that certain information is under discussion by its owner, when the request for rectification or updating thereof has been submitted, so that the operator includes a mention in that regard in the data bank until said process has been completed.
Yo. Comply with the instructions issued by the control authority in relation to compliance with this law.
j. Others derived from the Constitution or this law.
7. PROCESSING OF PERSONAL DATA
7.1 Principles for the processing of personal data.
The following principles will be taken into account by Hoteles B3 Corp Colombia in the personal data management process.
7.1.1 Legality regarding data processing.
Data processing must be subject to the provisions contained in Law 1581 of 2012 and any rule that develops or regulates such provision.
7.1.2 Purpose and treatment.
The processing of data must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Owner. The data processing and the purpose of the information in the Hoteles B3 Corp Colombia databases are based on the provision of the service, the contractual relationship, commercial and/or advertising purposes Hoteles B3 Corp Colombia may transmit the information to third parties, suppliers and authorities.
The treatment can only be carried out with the prior, express and informed consent of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that requires consent.
7.1.3 Veracity or quality.
The information subject to processing must be true, complete, accurate, up-to-date, verifiable and understandable. The processing of partial, incomplete, fragmented or misleading data is prohibited.
7.1.4 Transparency.
In the treatment, the right of the Owner to obtain advertising Hoteles B3 Corp Colombia or the person in charge of the treatment, at any time and without restrictions, information about the existence of data that concerns him or her must be guaranteed.
7.1.5 Restricted access and circulation.
The treatment is subject to the limits derived from the nature of the personal data, the provisions of Law 1581 of 2012 and the Constitution. In this sense, the treatment can only be carried out by people authorized by the Owner and/or by the people provided for in the Law.
Personal data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide knowledge restricted only to the Owners or authorized third parties in accordance with the Law.
7.1.6 Security
The information subject to processing by the person responsible or in charge of processing must be handled taking reasonable technical, human and administrative measures to provide security to the records, trying to avoid their adulteration, loss, consultation, unauthorized or fraudulent use or access.
7.1.7 Confidentiality.
All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks included in said procedure has ended, and may only supply or communicate of personal data when this corresponds to the development of the activities authorized in the Law and in the terms thereof.
7.2 Special categories of data.
7.2.1 Sensitive data.
These are the data that affect the privacy of the Owner or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, or human rights organizations. or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data.
7.2.1.1 The processing of sensitive data is prohibited, except when:
to. The Owner has given explicit authorization to said treatment, except in cases where the granting of said authorization is not required by law. The treatment is necessary to safeguard the vital interest of the Owner and the Owner is physically or legally incapacitated. In these events, legal representatives must grant their authorization.
b. The processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or union, provided that they refer exclusively to to its members or to people who maintain regular contacts due to their purpose.
c. In these events, the data cannot be provided to third parties without the authorization of the Owner.
d. The processing refers to data that is necessary for the recognition, exercise or defense of a right in a judicial process. and. The processing has a historical, statistical or scientific purpose. In this event, measures must be adopted leading to the deletion of the identity of the Holders.
F. In the processing of sensitive personal data, when such processing is possible in accordance with the aforementioned exceptions contained in article 6 of Law 1581 of 2012, the following obligations must be met:
Inform the Owner that since it is sensitive data, he is not obliged to authorize its processing. Inform the Owner explicitly and in advance, in addition to the general requirements of authorization for the collection of any type of personal data, which of the data that will be processed are sensitive and the purpose of the Treatment, as well as obtain their express consent. .
7.2.2 Rights of children and adolescents.
Respect for the prevailing rights of children and adolescents will be ensured in the treatment. The processing of personal data of children and adolescents is prohibited, except for data that is public in nature. 7.2.3 Rights of the Holders:
7.2.3.1 Know, update and rectify your personal data in front of Hoteles B3 Corp Colombia, or in front of the designated data processor. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or has not been authorized.
7.2.3.2 Request proof of the authorization granted to Hoteles B3 Corp Colombia Except when it is expressly excepted as a requirement for the treatment, in accordance with the provisions of article 10 of Law 1581 of 2012.
7.2.3.3 Be informed by Hoteles B3 Corp Colombia, or by the designated data processor, upon request, regarding the use that has been given to your personal data.
7.2.3.4 Present complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
7.2.3.5 Revoke the authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the processing,Hoteles B3 Corp Colombia or the designated manager, have engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
7.2.3.6 Access free of charge, under the conditions defined in this document, to your personal data that has been processed.
8. CONDITIONS FOR DATA PROCESSING
8.1 Authorization
In development of the principles of purpose and freedom, the collection of data carried out by Hoteles B3 Corp Colombia must be limited to those personal data that are relevant and appropriate for the purpose for which they are collected or required in accordance with current regulations, except in the cases expressly provided for in the Law.
8.2 Authorization of the Owner
For Hoteles B3 Corp Colombia to carry out any action to process personal data, the prior and informed authorization of the Owner is required, which must be obtained by any means that can be subject to subsequent consultation. These mechanisms may be predetermined through technical means that facilitate the Owner's automated manifestation or may be in writing or orally. Authorizations by Owners will be recorded as follows:
Hoteles B3 Corp Colombia requests authorization for the processing of information from all its owners, as long as said collection involves carrying out information processing by Hoteles B3 Corp Colombia, or third parties (with prior authorization), this request for authorization It is carried out at the time of generating commercial relationships with clients (Credit and Cash Sales), purchasing products and services with suppliers and hiring personnel to perform the tasks inherent to the organization.@@company@@ adopts the procedures to request, no later than at the time of data collection, the authorization of the Owner for the processing of the data and will inform the personal data that will be collected as well as all the specific purposes of said treatment. for which consent is obtained.
Personal data found in publicly accessible sources, regardless of the means by which it is accessed, understood as those data or databases that are available to the public, may be processed by Hoteles B3 Corp Colombia, as long as, by their nature, they are public data.
In the event of making substantial changes to the content of the Treatment Policies, referring to the identification of the Controller and the Purpose of the processing of personal data, which may affect the content of the authorization, Hoteles B3 Corp Colombia will communicate these changes. to the Owners, at least 3 days before the entry into force of the new policy, and will also obtain a new authorization from the Owner when the change refers to the Purpose of the Treatment. For communication of changes and authorization.
8.2.1 Cases in which authorization is not necessary
to. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
b. Public data.
c. Medical or health emergency cases.
d. Processing of information authorized by law for historical, statistical or scientific purposes.
and. Data related to the Civil Registry of people.
8.3 Supply of information The information requested by the Owner will be supplied by Hoteles B3 Corp Colombia, it may be provided by any means, including electronic means, as required by the Owner. The information must be easy to read, without technical barriers that prevent access, and must correspond entirely to that contained in the database.
8.4 Duty to inform the Owner Hoteles B3 Corp Colombia, when requesting authorization from the Owner, must clearly and expressly inform the Owner of the following: The processing to which your personal data will be subjected and the purpose thereof. The optional nature of the response to the questions asked, when they deal with sensitive data or the data of children and adolescents. The rights that assist you as Owner. The identification, physical or electronic address and telephone number of the person responsible for the treatment.
8.5 Persons to whom the information can be provided: Information about the personal data that has been the subject of Treatment by Hoteles B3 Corp Colombia., may be provided to the following people: To the Owners, their successors or their representatives. legal. To public or administrative entities in the exercise of their legal functions or by court order. To third parties authorized by the Owner or by law.
9. RIGHTS OF THE OWNER
9.1 Revocation of authorization and/or deletion of data:
The Owners may at any time request Hoteles B3 Corp Colombia to delete their personal data and/or revoke the authorization granted for their processing, by submitting a claim, in accordance with the provisions of article 15. of Law 1581 of 2012. The request for deletion of information and revocation of authorization WILL NOT APPLY WHEN THE OWNER HAS A LEGAL OR CONTRACTUAL DUTY TO REMAIN IN THE DATABASE OF Hoteles B3 Corp Colombia The procedure will be as established in this document to submit claims.
9.2 Queries and complaints:
The Owner or his successors have the right to present queries and/or claims to Hoteles B3 Corp Colombia, after validation of their identity, through any of the following user service mechanisms provided by the Company at the national level. Hoteles B3 Corp Colombia will respond to the query and/or claim by the same means that was formulated.
9.2.1 Query:
The Owners or their successors may consult the personal information of the Owner that resides in the database of the person responsible Hoteles B3 Corp Colombia will provide the applicant with all the information contained in the individual record or that is linked to the identification of the Owner.
The Owner may consult their personal data free of charge:
At least once (1) time each calendar month. Every time there are substantial modifications to the Information Treatment Policies, which motivate new queries. For queries whose frequency is greater than one (1) for each calendar month, Hoteles B3 Corp Colombia will only charge the costs of shipping, reproduction and where applicable, certification of documents. The reproduction costs may not be greater than the recovery costs of the corresponding material.
Response to queries
For the purposes of responding to queries, Hoteles B3 Corp Colombia has a period of ten (10) business days from the date of receipt thereof. When it is not possible to attend to the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case may exceed five (5) business days following the expiration of the first term.
Claims
The Owner or his successors who consider that the information contained in a database must be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, may file a claim with Hoteles B3 Corp Colombia, which will be processed under the following rules and will be formulated through a request addressed to Hoteles B3 Corp Colombia, with at least the following information:
Name of the person responsible for the Treatment or the person in charge of it.
Name of the petitioner.
Petitioner identification number.
Facts on which the request is based.
Object of the request.
Mailing address.
Provide the documents that you intend to assert.
If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. After two (2) months from the date of the request, without the applicant presenting the required information, it will be understood that the claim has been abandoned. In the event that the person who receives the claim is not competent to resolve it, he or she will forward it to the appropriate person within a maximum period of two (2) business days and will inform the interested party of the situation. Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database within a period of no more than two (2) business days. Said legend must be maintained until the claim is resolved. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
9.2.3 Procedural requirement: The Owner or assignee may only file a complaint with the Superintendence of Industry and Commerce once the consultation or claim process has been exhausted before the person responsible for the treatment or in charge of the same.
9.2.4 Procedure for queries and complaints.
In compliance with the above, Hoteles B3 Corp Colombia will respond to the query and/or claim by the same means that was formulated.
The procedure established by Hoteles B3 Corp Colombia, to present claims, make inquiries and/or exercise your rights as owner of the information collected is as follows.
9.2.4.1 Reception of the claim or query in any of the complexes, these can be identified on the Web pages https://hotelesb3.com, they can also be sent in writing directly to the administrative offices at Carrera 15 # 88-36, Bogotá (Colombia)9.2.4.2 They can also be sent complaints or queries via email: info@hotelesb3.es15, in accordance with the Second Section, Second Literal, ARTICLE 16 Law 1266 of 2008-Second Section, Article 15, Law 1581 of 2012.
9.2.4.3 For requests or queries, you have 10 business days from receipt; if necessary, the response may be extended by 5 more business days.
9.2.4.4 For claims, you have 15 business days to resolve the same, third paragraph of article 16 of law 1266 of 2008.
9.2.4.5 Exceptionally, there is an additional 8 business days to the first 15, to respond to the right of request, as long as the person making the right to request is notified.
9.2.4.6 Hoteles B3 Corp Colombia, within 2 business days following receipt of the claim, will impose in the operator's database the record or legend that the “claim is in process”.
9.2.4.7 If they are not competent, they have 2 business days to transfer the information to the competent entity.
9.2.4.8 Once the response to the query or claim raised by the client is available, it will be sent to the address provided in the request and to the means by which the query was made.
9.2.4.9 In case of doubts or concerns about the procedure for submitting claims, making queries and/or exercising your rights as owner of the data collected by Hoteles B3 Corp Colombia, general information may be requested through the Customer Service department by via Email info@hotelesb3.es15.
10. DUTIES OF Hoteles B3 Corp Colombia IN THE PROCESSING OF DATA
to. Guarantee to the Holder, at all times, the full and effective exercise of the right of habeas data.
b. Request and keep, under the conditions provided for in the Law, a copy of the respective authorization granted by the Owner.
c. Duly inform the Owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted.
d. Take measures aimed at preserving the information under security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
and. Ensure that the information provided to the data processor is true, complete, exact, updated, verifiable and understandable.
F. Update the information, communicating in a timely manner to the person in charge of the treatment, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to him remains updated.
g. Rectify the information when it is incorrect and communicate the pertinent information to the person in charge of treatment.
h. Provide the person in charge of processing, as the case may be, only data whose processing is previously authorized in accordance with the provisions of the Law.
Yo. Require the data processor at all times to respect the security and privacy conditions of the Owner's information.
j. Process queries and claims made in the terms indicated in the law.
k. Adopt an internal manual of policies and procedures to guarantee adequate compliance with this law and, especially, to respond to queries and complaints.
l. Inform the person in charge of the treatment when certain information is under discussion by the Owner, once the claim has been submitted and the respective procedure has not been completed.
m. Inform at the request of the Owner about the use given to their data.
n. Inform the data protection authority when violations of security codes occur and there are risks in the administration of the Owners' information.
either. the instructions and requirements issued by the Superintendency of Industry and Commerce.
10.1 Duties of the data processor:
Those in charge of treatment must comply with the following duties, without prejudice to the other provisions provided for in the Law and in others that govern their activity:
to. Guarantee to the Holder, at all times, the full and effective exercise of the right of habeas data.
b. Take measures to preserve the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
c. Timely update, rectify or delete data under the terms of this law.
d. Update the information reported by those responsible for the treatment within five (5) business days from receipt.
and. Process queries and claims made by the Owners in the terms indicated in the Law.
F. Adopt a document that guarantees adequate compliance with the Law and, especially, for the attention of queries and claims by the Owners.
g. Register in the database the legend “claim in process” in the manner regulated by the Law.
h. Insert into the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data.
Yo. Refrain from circulating information that is being controversial by the Owner and whose blocking has been ordered by the Superintendency of Industry and Commerce.
j. Allow access to information only to people who can have access to it.
k. Inform the Superintendency of Industry and Commerce when violations of security codes occur and there are risks in the administration of the Owners' information.
l. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
m. Safeguard databases containing personal data.
n. Maintain confidentiality regarding the Processing of personal data.
11. SECURITY MEASURES
Hoteles B3 Corp Colombia takes all reasonable precautions and technical, administrative and organizational measures to guarantee the security of the personal data of the Owners, mainly those intended to prevent its alteration, loss and unauthorized treatment or access. Security measures apply to both files and treatments. The application of security measures is intended to ensure the conservation, confidentiality, integrity, and availability of data.
12. MODIFICATIONS
Hoteles B3 Corp Colombia reserves the right to modify these Information Processing Policies, in whole or in part. In the event of substantial changes in the Treatment Policies referring to the identification of Hoteles B3 Corp Colombia and the purpose of the Processing of personal data, which may affect the content of the authorization, Hoteles B3 Corp Colombia will communicate these changes to the owner at at the latest at the time of implementing the new policies.