PRIVACY POLICIES
PRIVACY AND PERSONAL DATA PROCESSING POLICY MANUAL – MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S.)
For MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S.), the preservation, protection, integrity, and confidentiality of its customers’ personal data are of the utmost importance. To this end, we have designed a policy for the storage and processing of the information our customers provide through the various marketing channels for our products and services (such as websites and call centers), and we are committed to the protection and proper handling of such information, in accordance with the legal framework for the protection of personal data applicable in the territory where we operate.
CHAPTER I GENERAL PROVISIONS
ARTICLE 1. DEFINITIONS.
For the purposes of applying the rules contained in this manual and in accordance with the provisions of Article 3 of Law 1581 of 2012, the following definitions apply:
a) Authorization: The Data Subject’s prior, explicit, and informed consent to process personal data.
b) Privacy Notice: A verbal or written communication issued by the Data Controller and addressed to the Data Subject regarding the processing of their personal data, informing them of the existence of the data processing policies that will apply to them, how to access those policies, and the purposes for which their personal data will be processed.
(c) Database: An organized collection of personal data that is subject to processing.
d) Personal data: Any information that relates to or can be associated with one or more identified or identifiable natural persons.
e) Personal data: Data that, due to its intimate or private nature, is relevant only to the data subject.
f) Sensitive data: Sensitive data refers to data that affects the Data Subject’s privacy or whose misuse may lead to discrimination against the Data Subject, such as data revealing racial or ethnic origin, political views, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations, or organizations promoting the interests of any political party, or those that safeguard the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.
(g) Data Processor: A natural or legal person, whether public or private, that, either alone or jointly with others, processes personal data on behalf of the Data Controller.
(h) Data Controller: A natural or legal person, whether public or private, who, acting alone or jointly with others, determines the purposes and means of the processing of personal data.
(i) Data subject: A natural person whose personal data is being processed.
(j) Processing: Any operation or set of operations performed on personal data, such as the collection, storage, use, dissemination, or deletion of such data.
ARTICLE 2. PURPOSE.
The purpose of this document is to regulate the procedures for the collection, handling, and processing of personal data carried out by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S.), in order to guarantee and protect the fundamental right to data protection of its guests, visitors, customers, users, and suppliers within the framework established by law. All of the foregoing is in compliance with the provisions of paragraph (k) of Article 17 of Law 1581 of 2012, which regulates the duties of those responsible for the processing of personal data, including the adoption of an internal manual of policies and procedures to ensure proper compliance with the law and, in particular, to address inquiries and complaints.
ARTICLE 3. SCOPE OF APPLICATION.
This manual applies to personal data currently stored and to be stored in the various databases managed by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), that is, the databases of our guests, visitors, customers, and suppliers who provide us with their information for commercial purposes.
The information it collects MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), may include, in whole or in part depending on the specific requirements of each product and/or service, the following information, among others:
• First and last names. • Type and number of identification. • Nationality and country of residence. • Date of birth and gender. • Marital status and/or relationship to minors or individuals with disabilities who are requesting our services. • Landline and cell phone numbers (personal and/or work). • Mailing and email addresses (personal and/or work). • Profession or occupation. • Company where you work and job title. • Origin and destination • Purpose of your trip • Credit card information (number, issuing bank, expiration date). • Cardholder’s personal information (first and last names, type and number of identification). • Information regarding the address where the cardholder receives their bank statements.
This data may be stored and/or processed on servers located in data centers, whether owned by us or contracted from third-party providers, which is authorized by our guests, visitors, customers, users, and suppliers upon their acceptance of this Privacy Policy.
ARTICLE 4. ACCURACY OF INFORMATION.
Our guests, visitors, customers, users, and suppliers must provide accurate personal information to enable MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) to provide its services, and they agree to provide the required information on this condition.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), assumes the accuracy of the information provided and does not verify, nor does it assume any obligation to verify, the identity of guests, visitors, customers, users, and suppliers, nor the accuracy, validity, sufficiency, or authenticity of the data provided by each of them. Therefore, it assumes no liability for damages and/or losses of any kind that may arise from the lack of accuracy, validity, sufficiency, or authenticity of the information, including damages and losses that may be due to homonymy or identity theft.
ARTICLE 5. GOVERNING LAW.
This manual was prepared in accordance with the provisions of Law 1581 of 2012, “Establishing General Provisions for the Protection of Personal Data,” and Decree No. 1377 of 2013, “Partially Regulating Law 1581 of 2012.”
ARTICLE 6. INFORMATION REGARDING MINORS.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), will ensure the appropriate use of the personal data of children and minors, guaranteeing that the processing of their data respects their best interests and their fundamental rights and, to the extent possible, takes into account their views as data subjects.
ARTICLE 7. PURPOSES OF THE PROCESSING OF PERSONAL DATA
The information collected is used to process, confirm, fulfill, and provide the services and/or products purchased, either directly or with the involvement of third-party product or service providers, as well as to promote and advertise our activities, products, and services; conduct transactions; submit reports to various national or international administrative control and oversight authorities, law enforcement agencies, or judicial authorities; and provide information to banking institutions and/or insurance companies for internal administrative and/or commercial purposes such as market research, audits, accounting reports, statistical analysis, billing, and the offering and/or recognition of benefits specific to our loyalty programs.
By accepting this Privacy and Data Processing Policy, our guests, visitors, customers, users, and suppliers, in their capacity as data subjects, authorize MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S)to process their data, in whole or in part, including the collection, storage, recording, use, dissemination, processing, and deletion of such data, for the purpose of carrying out activities related to the services and products purchased, such as making reservations, modifications, cancellations, and changes thereto, refunds, handling inquiries, complaints, and claims, payment of compensation and indemnities, accounting records, correspondence, processing and verification of credit cards, debit cards, and other payment instruments, fraud detection, and prevention of money laundering and other criminal activities, and/or for the operation of loyalty programs and other purposes indicated in this document.
The foregoing is without prejudice to any other purposes that have been disclosed in this document and in the terms and conditions of each of the products and services offered by our various business units.
Please note that third-party providers (such as reservation system providers, travel agencies, call centers, banks, and insurance companies) may be involved in these activities.
In addition, our travelers, customers, and users, as the owners of the collected data, by accepting this privacy policy, authorize us to:
• Use the information received from them for marketing purposes regarding their products and services, as well as the products and services of third parties with whom MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S.) has a business relationship. • Provide personal data to police or judicial oversight and enforcement authorities pursuant to a legal or regulatory requirement and/or use or disclose this information and personal data in defense of its rights and/or assets, provided that such defense relates to the products and/or services contracted by its travelers, customers, and users. • Allow access to personal information and data to auditors or third parties contracted to conduct internal or external audits specific to the commercial activities we carry out. • Review and update personal data at any time to keep such information current. • Contract with third parties for the storage and/or processing of personal information and data to ensure the proper execution of contracts entered into with us, in accordance with the security and confidentiality standards to which we are bound.
CHAPTER II AUTHORIZATION
ARTICLE 8. AUTHORIZATION.
The collection, storage, use, disclosure, or deletion of personal data by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S)requires the free, prior, express, and informed consent of the data subject. MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), in its capacity as the controller of personal data, has established the necessary mechanisms to obtain the consent of data subjects, ensuring in all cases that it is possible to verify that such consent has been given.
By providing the aforementioned authorization, the customer agrees to the policies and terms set forth in this document.
ARTICLE 9. PROCEDURES AND MECHANISMS FOR GRANTING AUTHORIZATION.
The data subject's consent shall be included in each of the data collection channels and mechanisms of MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S).
Thus, it may be recorded in a physical document, an electronic document, or any other format that ensures it can be consulted at a later date. The authorization will be issued by the data subject prior to the processing of their personal data, in accordance with the provisions of Law 1581 of 2012.
Con el procedimiento de autorización consentida se garantiza que se ha puesto en conocimiento del titular de los datos personales, tanto el hecho que su información personal será recogida y utilizada para fines determinados y conocidos, como que tiene la opción de conocer cualquier alternación a los mismos y el uso específico que de ellos se ha dado. Lo anterior con el fin de que el titular tome decisiones informadas con relación a sus datos personales y controle el uso de su información personal.
CHAPTER III RIGHTS AND DUTIES
ARTICLE 10. RIGHTS OF DATA SUBJECTS.
In accordance with the provisions of Article 8 of Law 1581 of 2012, the data subject has the following rights:
a) To access, update, and correct your personal data held by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), in its capacity as the data controller. b) To request proof of the authorization granted to MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), in its capacity as the data controller. c) To be informed by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S)upon request, regarding the use made of your personal data. d) File complaints with the Superintendency of Industry and Commerce regarding violations of the provisions of Law 1581 of 2012, once you have exhausted the consultation or complaint process with the Data Controller. e) Revoke authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees. f) Access, free of charge, your personal data that has been processed.
ARTICLE 11. DUTIES OF ESTELAR HOTELS REGARDING THE PROCESSING OF PERSONAL DATA.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), You shall bear in mind at all times that personal data belongs to the individuals to whom it pertains and that only they may make decisions regarding such data. Accordingly, you shall use such data only for the purposes for which you are duly authorized, and in all cases in compliance with Law 1581 of 2012 on the protection of personal data.
In accordance with the provisions of Article 17 of Law 1581 of 2012, MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S.) undertakes to comply at all times with the following obligations:
a) Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.
b) Store the information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
c) To update, rectify, or delete data in a timely manner, that is, in accordance with the terms set forth in Articles 14 and 15 of Law 1581 of 2012.
d) Process inquiries and complaints submitted by Data Subjects in accordance with the terms set forth in Article 14 of Law 1581 of 2012.
e) Enter the notation “information under judicial dispute” into the database once notified by the competent authority regarding legal proceedings related to the quality or details of the personal data.
f) Refrain from disseminating information that is being contested by the Data Subject and whose blocking has been ordered by the Superintendency of Industry and Commerce.
g) Allow access to the information only to those persons authorized to access it.
h) Notify the Superintendency of Industry and Commerce when security breaches occur and there are risks in the management of Data Subjects’ information.
i) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
CHAPTER IV PROCEDURES FOR ACCESS, INQUIRIES, AND COMPLAINTS
ARTICLE 13. RIGHT OF ACCESS:
The data subject’s right to control or decide regarding the information that concerns them necessarily entails the right to access and determine whether their personal information is being processed, as well as the scope, conditions, and general nature of such processing.
Furthermore, the data subject has the right to request the correction of such data if it is inaccurate or incomplete, and to have it deleted if it is not being used in accordance with legal or contractual purposes and terms, or in accordance with the purposes and terms set forth in this Privacy Policy.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), shall guarantee the right of access when, upon verification of the identity of the data subject or their representative or authorized agent, such access is requested in accordance with the provisions of Law 1581 of 2012.
Customers and users may exercise their rights to access, update, correct, and delete their personal data by sending a request to the following email address: miradorcerrov@gmail.com or via the Cell phone: 321-511-5242, in accordance with this Privacy Policy.
Please include the following information in your request: • First and last names. • Type of document. • Document number. • Phone number. • Email address. • Country. • Subject.
ARTICLE 13. RESPONSE TO INQUIRIES.
In any case, regardless of the mechanism implemented to handle inquiries, such inquiries will be addressed within a maximum of ten (10) business days from the date of receipt. If it is not possible to address the inquiry within that timeframe, the interested party will be notified before the 10-day period expires, stating the reasons for the delay and indicating the date by which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial deadline.
ARTÍCULO 14. RECLAMOS.
De conformidad con lo establecido en el artículo 14 de la Ley 1581 de 2012, el Titular o sus causahabientes que consideren que la información contenida en una base de datos debe ser objeto de corrección, actualización o supresión, o cuando adviertan el presunto incumplimiento de cualquiera de los deberes contenidos en la Ley 1581 de 2012, podrán presentar un reclamo ante el Responsable del Tratamiento, el cual será tramitado bajo las siguientes reglas:
1. The Guest may submit the complaint using the forms provided for this purpose by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) through its hotel registration system. If the complaint received does not contain complete information necessary for processing—that is, the Cardholder’s identification, a description of the facts giving rise to the complaint, the address, and any supporting documents—the Cardholder will be requested within five (5) days of receipt to correct the deficiencies. If two (2) months have elapsed from the date of the request without the claimant submitting the required information, it will be understood that the claimant has withdrawn the complaint. If, for any reason, the Company receives a complaint that should not actually be directed against it, it will forward it to the appropriate party within a maximum of two (2) business days and inform the interested party of the situation.
2. Once the complete claim has been received, a note stating “claim pending” and the reason for the claim will be added to the database maintained by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) within two (2) business days. This notation must remain in place until a decision is made on the claim.
3. The maximum time limit for addressing the complaint shall be fifteen (15) business days, counted from the day following the date of receipt. If it is not possible to address the claim within that period, the claimant will be informed, prior to the expiration of the aforementioned period, of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial period.
ARTICLE 15. IMPLEMENTATION OF PROCEDURES TO GUARANTEE THE RIGHT TO FILE COMPLAINTS.
At any time and free of charge, the data subject or their representative may request from MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) the correction, updating, or deletion of their personal data, upon verification of their identity. The rights to rectification, updating, or deletion may only be exercised by:
• The account holder or their successors, upon verification of their identity, or through electronic means that allow them to identify themselves. • Their representative, upon verification of the power of attorney.
If the application is filed by someone other than the account holder and there is no proof that the person is acting on the account holder’s behalf, the application will be deemed not to have been filed.
Si la solicitud la presenta una persona que no sea el titular de la cuenta y no hay pruebas de que dicha persona actúe en nombre del titular, se considerará que la solicitud no se ha presentado.
1. The name and address of the data subject or any other means of receiving a response. 2. Documents proving the identity of the data subject or their representative. 3. A clear and precise description of the personal data regarding which the data subject seeks to exercise any of their rights. 4. If applicable, other information or documents that facilitate the identification of the personal data.
SECTION 1. CORRECTION AND UPDATE OF DATA.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) is obligated to correct and update, at the data subject’s request, any information pertaining to the data subject that is found to be incomplete or inaccurate, in accordance with the procedure and terms outlined above. In this regard, the following shall be taken into account: In requests for the correction and updating of personal data, the data subject must indicate the corrections to be made and provide documentation supporting their request.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) has full discretion to implement mechanisms that facilitate the exercise of this right, provided that such mechanisms benefit the data subject. Consequently, the company may implement electronic or other means it deems appropriate.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) may establish simplified forms, systems, and other methods, which must be disclosed in the privacy notice and made available to data subjects on the website.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) will use the customer service channels it currently operates, provided that response times do not exceed those specified in Article 15 of Law 1581 of 2012.
Whenever MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) makes a new tool available to help data subjects exercise their rights or modifies existing tools, it will provide notice on its website.
SECTION 2. DATA DELETION.
The data subject has the right, at any time, to request that MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), delete their personal data when:
a.) You believe that such data is not being processed in accordance with the principles, duties, and obligations set forth in Law 1581 of 2012.
b.) The data is no longer necessary or relevant for the purpose for which it was collected.
c.) The period necessary to fulfill the purposes for which the data was collected has expired.
This deletion involves the total or partial removal of personal information, as requested by the data subject, from the records, files, databases, or processing operations carried out by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S). It is important to note that the right to erasure is not absolute, and the data controller may refuse to grant it when:
• Requests to delete information will not be granted if the data subject has a legal or contractual obligation to remain in the database.
• The deletion of data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the enforcement of administrative penalties.
• The data is necessary to protect the data subject’s legally protected interests; to carry out an action in the public interest; or to comply with a legal obligation incumbent upon the data subject.
If the deletion of personal data is deemed appropriate, MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) must carry out the deletion in such a way that the information cannot be recovered.
ARTICLE 16. REVOKATION OF THE AUTHORIZATION.
Data subjects may revoke their consent to the processing of their personal data at any time, provided that no legal provision prevents such revocation. To do so, they must contact MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) via email at miradorcerrov@gmail.com or by phone at 3215115242.
It should be noted that there are two ways in which consent may be revoked. The first may apply to all of the consented purposes, meaning that MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) must completely cease processing the data subject’s data; the second may apply to specific types of processing, such as for advertising or market research purposes. In the second case—that is, the partial revocation of consent—other processing purposes remain unaffected, which the data controller may carry out in accordance with the authorization granted and to which the data subject has consented.
Therefore, when submitting a request to revoke consent to MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S), the data subject must specify in the request whether the revocation is intended to be total or partial. In the latter case, the data subject must specify which processing activities they object to. There may be instances where consent, due to its necessity in the relationship between the data subject and the data controller for the fulfillment of a contract, cannot be revoked by law. The mechanisms or procedures established by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S.) to address requests for revocation of consent may not exceed the time limits established for addressing complaints, as set forth in Article 15 of Law 1581 of 2012.
CHAPTER V INFORMATION SECURITY
ARTICLE 17. SECURITY MEASURES.
In accordance with the security principle established in Law 1581 of 2012, MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) has implemented the necessary technical, human, and administrative measures to ensure the security of its records, preventing their alteration, loss, unauthorized or fraudulent access, use, or disclosure.
No obstante lo anterior el cliente asume los riesgos que se derivan de entregar esta información en un medio como internet, el cual está sometido a diversas variables – ataques de terceros, fallas técnicas o tecnológicas, entre otras. MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) hará su mejor esfuerzo tecnológico para garantizar la seguridad de la información personal de todos sus clientes y/o usuarios, empleando razonables y actuales métodos de seguridad para impedir el acceso no autorizado, para mantener la exactitud de los datos y garantizar la correcta utilización de la información.
ARTICLE 18. IMPLEMENTATION OF SECURITY MEASURES.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) will enforce mandatory security protocols for personnel with access to personal data and information systems. The procedure must address, at a minimum, the following aspects:
a) Third parties contracted by MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) are required to adhere to and comply with our information security policies and manuals, as well as the security protocols we apply to all our processes.
b) Any contract between MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) and third parties (contractors, external consultants, temporary staff, etc.) involving the processing of information and personal data shall include a confidentiality agreement detailing their commitments to the protection, care, security, and preservation of the confidentiality, integrity, and privacy of such information.
c) Scope of application of the procedure with a detailed specification of the protected resources.
d) Measures, norms, procedures, rules, and standards aimed at ensuring the level of security required by Law 1581 of 2012.
e) Functions and obligations of personnel.
f) Structure of personal databases and description of the information systems that process them.
g) Procedure for reporting, managing, and responding to incidents.
h) Procedures for making backup copies and recovering data.
i) Periodic checks to be performed to verify compliance with the provisions of the security procedure implemented.
j) Measures to be taken when a medium or document is to be transported, disposed of, or reused.
k) The procedure must be kept up to date at all times and must be reviewed whenever significant changes occur in the information system or its organization.
l) The content of the procedure must comply at all times with current regulations regarding personal data security.
CHAPTER VI FINAL PROVISIONS
ARTICLE 19. CHANGES TO THE PRIVACY POLICY.
MIRADOR CERRO VERDE (Inversiones Jarapineda S.A.S) reserves the right to modify or update this Privacy Policy at any time to address changes in legislation, internal policies, or new requirements related to the provision or offering of its services or products.
ARTICLE 20. DURATION OF THE PROCESSING OF PERSONAL INFORMATION AND DATA.
The information provided by customers and users will be stored for up to fifteen (15) years from the date of the last processing, to enable us to comply with our legal and/or contractual obligations, particularly in the areas of accounting, taxation, and tax matters.