LA AMALIA S.A.S. NIT: 901.095.151-1, as the party responsible for personal data, recognizes the importance of such data and, through this document, complies with the Personal Data Protection Regime in Colombia, undertaking to safeguard the privacy and security of the information provided to us, guaranteeing the protection of the rights to reputation, Habeas Data, intimacy and privacy, and aligning all its actions with the principles of legality, good faith, freedom, self-determination and transparency.
This policy has been structured in accordance with the Constitution and applicable laws, with the purpose of guaranteeing your rights under standards of transparency, confidentiality and legality in the management of such information.
In view of the foregoing, we recommend that you carefully read this policy.
1. CHAPTER ONE — GENERAL PROVISIONS
1.1. Identification of the Data Processing Controller
LA AMALIA S.A.S. NIT: 901.095.151-1, hereinafter referred to as LA AMALIA, is a commercial company domiciled in Venecia (Antioquia) [confirm exact address of registered office], email address contacto@haciendalaamalia.com, and hereinafter shall be understood as the DATA CONTROLLER.
As the Controller of Personal Data directly or indirectly related to LA AMALIA, this policy complies with Law 1581 of 2012, Decree 1377 of 2013 and other applicable regulations.
This policy is a public document that may be consulted at any time and will contain updated information regarding the company responsible for the processing of personal data, in order to guarantee your rights.
Vereda La Amalia, vía principal, entrada a Venecia, Antioquia
www.la-amalia.com +57 300 640 5986 | contacto@haciendalaamalia.com
1.2. Scope
This policy establishes the principles, rights, procedures, uses, purposes and limitations regarding the processing of personal information contained in all databases, physical and electronic files of the CONTROLLER, as well as the mechanisms available to data subjects to exercise their rights to reputation, Habeas Data, intimacy and privacy, aligning all actions with the principles of legality, good faith, freedom, self-determination, transparency, confidentiality and legality in the management of such information.
1.3. Purpose
This policy is structured in accordance with legal requirements, recognizing the importance of the rights of data subjects, with the purpose of guaranteeing the security, privacy and confidentiality of such data, and establishing the guidelines under which the personal data of customers, suppliers, employees, contractors and, in general, all persons whose personal data is collected, stored and managed, is processed. Such data is contained in databases and physical and electronic files managed by the CONTROLLER.
1.4. Definitions
1.4.1. Data Protection Authority: In Colombia, the Superintendence of Industry and Commerce —SIC—, through its Delegation for Personal Data Protection, is the entity responsible for overseeing compliance in order to guarantee rights, principles and procedures regarding the processing of personal data carried out by legal or natural persons.
1.4.2. Authorization: Prior, express and informed consent given by the Data Subject to carry out the Processing of personal data.
1.4.3. Authorized Party: Refers to all persons who, under the responsibility of LA AMALIA, its Data Processors or business partners, may carry out the Processing of Personal Data by virtue of the Authorization granted by the Data Subject.
1.4.4. Privacy Notice: Verbal or written communication issued by the Controller and addressed to the Data Subject regarding the Processing of their personal data, through which the existence of the Information Processing Policies applicable to them, the means of accessing such policies and the purposes of the Processing of personal data are disclosed.
LA AMALIA S.A.S. NIT: 901.095.151-1, as the party responsible for personal data, recognizes the importance of such data and, through this document, complies with the Personal Data Protection Regime in Colombia, undertaking to safeguard the privacy and security of the information provided to us, guaranteeing the protection of the rights to reputation, Habeas Data, intimacy and privacy, and aligning all its actions with the principles of legality, good faith, freedom, self-determination and transparency.
This policy has been structured in accordance with the Constitution and applicable laws, with the purpose of guaranteeing your rights under standards of transparency, confidentiality and legality in the management of such information.
In view of the foregoing, we recommend that you carefully read this policy.
1. CHAPTER ONE — GENERAL PROVISIONS
1.1. Identification of the Data Processing Controller
LA AMALIA S.A.S. NIT: 901.095.151-1, hereinafter referred to as LA AMALIA, is a commercial company domiciled in Venecia (Antioquia) [confirm exact address of registered office], email address contacto@haciendalaamalia.com, and hereinafter shall be understood as the DATA CONTROLLER.
As the Controller of Personal Data directly or indirectly related to LA AMALIA, this policy complies with Law 1581 of 2012, Decree 1377 of 2013 and other applicable regulations.
This policy is a public document that may be consulted at any time and will contain updated information regarding the company responsible for the processing of personal data, in order to guarantee your rights.
Vereda La Amalia, vía principal, entrada a Venecia, Antioquia
www.la-amalia.com +57 300 640 5986 | contacto@haciendalaamalia.com
1.2. Scope
This policy establishes the principles, rights, procedures, uses, purposes and limitations regarding the processing of personal information contained in all databases, physical and electronic files of the CONTROLLER, as well as the mechanisms available to data subjects to exercise their rights to reputation, Habeas Data, intimacy and privacy, aligning all actions with the principles of legality, good faith, freedom, self-determination, transparency, confidentiality and legality in the management of such information.
1.3. Purpose
This policy is structured in accordance with legal requirements, recognizing the importance of the rights of data subjects, with the purpose of guaranteeing the security, privacy and confidentiality of such data, and establishing the guidelines under which the personal data of customers, suppliers, employees, contractors and, in general, all persons whose personal data is collected, stored and managed, is processed. Such data is contained in databases and physical and electronic files managed by the CONTROLLER.
1.4. Definitions
1.4.1. Data Protection Authority: In Colombia, the Superintendence of Industry and Commerce —SIC—, through its Delegation for Personal Data Protection, is the entity responsible for overseeing compliance in order to guarantee rights, principles and procedures regarding the processing of personal data carried out by legal or natural persons.
1.4.2. Authorization: Prior, express and informed consent given by the Data Subject to carry out the Processing of personal data.
1.4.3. Authorized Party: Refers to all persons who, under the responsibility of LA AMALIA, its Data Processors or business partners, may carry out the Processing of Personal Data by virtue of the Authorization granted by the Data Subject.
1.4.4. Privacy Notice: Verbal or written communication issued by the Controller and addressed to the Data Subject regarding the Processing of their personal data, through which the existence of the Information Processing Policies applicable to them, the means of accessing such policies and the purposes of the Processing of personal data are disclosed.
1.4.5. Database: An organized collection of personal data subject to Processing. The Law excludes from the protection regime: (i) files and databases belonging to the personal or domestic sphere; (ii) those intended for national security and defense, and the prevention, detection, monitoring and control of money laundering and terrorist financing; (iii) those containing intelligence and counterintelligence information; (iv) journalistic information and other editorial content; (v) those regulated by Law 1266 of 2008 (financial and credit, commercial, service and information originating from third countries); and (vi) those regulated by Law 79 of 1993 (regarding population and housing censuses).
1.4.6. Unambiguous Conduct: Refers to clear conduct by the Data Subject, or a duly authorized person, that leaves no room for doubt or error regarding consent or authorization for the processing of their personal data.
1.4.7. Consent: Any freely given, specific, informed and explicit expression of will whereby the interested party accepts, either through a statement or a clear affirmative action, the Processing of personal data concerning them.
1.4.8. Personal Data: Any information linked to or capable of being associated with one or more identified or identifiable natural persons, such as name, age, sex, marital status, address, among others. Such data may be stored in any physical or electronic medium and processed manually or automatically.
1.4.9. Private Data: Data which, due to its intimate or confidential nature, is only relevant to the Data Subject.
1.4.10. Public Data: Data that is not semi-private, private or sensitive. Public data includes, among others, information regarding a person’s marital status, profession or occupation, and status as a merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, gazettes, official bulletins and duly enforceable judicial decisions that are not subject to confidentiality.
1.4.11. Semi-Private Data: Data that is neither intimate, confidential nor public in nature, and whose knowledge or disclosure may be of interest not only to the Data Subject, but also to a certain sector or group of persons or society in general, such as financial and credit information related to commercial or service activities referred to in Title IV of Law 1266 of 2008.
2. CHAPTER TWO — PRINCIPLES
LA AMALIA adopts and complies with the principles governing this matter, which constitute the basic guidelines to be followed in the collection, management, use, processing, storage, deletion, transmission or transfer of personal data, as follows:
2.1. Principle of Legality: Data Processing shall at all times comply with applicable legislation, particularly the provisions of the Political Constitution, Law 1581 of 2012, Decree 1377 of 2013 and other regulations governing the matter.
2.2. Principle of Freedom: The Processing of Personal Data may only be carried out with the prior, informed and express authorization of the Data Subject. In accordance with the right to information and the foregoing, the Data Subject shall always be informed of the purpose for which their personal information is processed, which shall always be described herein and available for consultation at any time. Personal data may not be obtained or disclosed without the prior, express and informed consent of the Data Subject, or pursuant to a legal or judicial mandate that exempts the need for such consent.
2.3. Principle of Purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the Law, which must be previously, clearly and sufficiently disclosed to the Data Subject.
2.4. Principle of Accuracy or Quality: Information subject to Processing must be truthful, complete, accurate, up-to-date, verifiable and understandable. The Processing of partial, incomplete or fragmented data, or data that may lead to error, is prohibited.
2.5. Principle of Transparency: During Processing, the Data Subject’s right to obtain from the Data Controller or Data Processor, at any time and without restrictions, information regarding the existence of data concerning them shall be guaranteed.
2.6. Principle of Restricted Access and Circulation: Processing shall be subject to the limits arising from the nature of personal data, the provisions of Law 1581 of 2012, the Constitution and other applicable regulations. Accordingly, Processing may only be carried out by persons authorized by the Data Subject and/or persons contemplated under the aforementioned regulations.
Personal data, except for public information, may not be made available on the Internet or through other means of mass dissemination or communication, unless access can be technically controlled to provide restricted access only to Data Subjects or authorized third parties in accordance with the law.
Accordingly, access to Personal Data shall only be permitted to the following persons:
The Data Subject.
Persons authorized by the Data Subject.
Persons authorized by law or judicial order to access the Data Subject’s information.
Personnel authorized by the CONTROLLER under this policy who, due to their position, duties or the ordinary course of business or corporate purpose of the company, need to know such information, always ensuring the custody, confidentiality and security of personal data.
2.7. Principle of Security: Information subject to Processing by the Data Controller or Data Processor shall be handled using the technical, human and administrative measures necessary to safeguard the records and prevent their alteration, loss, unauthorized consultation, use or access, whether fraudulent or otherwise.
2.8. Principle of Confidentiality: All persons involved in the Processing of personal data that is not public in nature are required to guarantee the confidentiality of such information, including after their relationship with any of the activities involving Processing has ended. Personal data may only be supplied or disclosed when this corresponds to the performance of activities authorized by law.
2.9. Principle of Collection Limitation: The Processing of personal data shall be limited to the collection, storage, use and processing that is strictly necessary according to the nature of the personal data, applicable legal provisions and the Political Constitution. Accordingly, the recording and disclosure of data unrelated to the purpose of the Processing is prohibited.
2.10. Principle of Temporality: Personal Data shall be retained only for the reasonable and necessary period required to fulfill the purpose of the Processing and applicable legal requirements or instructions issued by supervisory and regulatory authorities or other competent authorities. Data shall be retained when necessary to comply with a legal or contractual obligation. In determining the duration of Processing, the regulations applicable to each purpose and the administrative, accounting, tax, legal and historical aspects of the information shall be considered.
3. CHAPTER THREE — DATA SUBJECTS TO WHOM THIS POLICY APPLIES
3.1. Final Consumer or Customer.
3.2. Suppliers and Corporate Customers.
3.3. Employees.
3.4. Contractors.
3.5. Data Processors.
3.6. Data Subjects, whether acting on their own behalf or as legal representatives, whose personal information is required in connection with activities in which they are involved with the CONTROLLER.
4. CHAPTER FOUR — PROCESSING OF PERSONAL DATA
Law 1581 of 2012 defines the processing of personal data as follows: any operation or set of operations performed on personal data, such as collection, storage, use, circulation or deletion.
This policy is structured in accordance with legal requirements, recognizing the importance of the rights of Data Subjects, with the purpose of guaranteeing their security, privacy and confidentiality, and establishing the guidelines under which the personal data of customers, suppliers, employees, contractors and, in general, all persons whose personal data is collected, stored and managed, is processed. Such data is contained in databases and physical and electronic files managed by the CONTROLLER.
Accordingly, LA AMALIA S.A.S. NIT: 901.095.151-1 collects personal data of a public, semi-private, private and sensitive nature, including:
4.1. Types of Personal Data
4.1.1. Identification Data: First name(s), last name(s), type of identification, identification number, etc.
4.1.2. Contact Information: Address, city, telephone number and email address.
4.1.3. Biometric Data: Fingerprints, iris, facial or body geometry, photographs and videos. Marital status, sexual orientation or gender.
4.1.4. Sensitive Data: Information concerning the health status of the person (employee), including test results, laboratory results, medical examinations, diagnoses, medical records, psychological or psychiatric information, medications and therapeutic treatments.
4.1.5. Financial and credit information related to commercial or service activities.
4.1.6. Socioeconomic Data: Information related to employment history, work experience, position, dates of employment and termination, records, disciplinary notices, etc.
4.1.7. Data related to affiliation and contributions to the comprehensive social security system: EPS, IPS, ARL, EPS enrollment/termination dates, AFP, etc.
4.1.8. Personal Data for Access to Information Systems: Usernames, IP addresses, passwords, profiles, etc.
4.2. Purposes of Processing
LA AMALIA shall process the personal data collected for purposes related to the reservation and provision of accommodation, food and event services; customer service and management of requests, complaints, claims and suggestions (PQRS); billing and compliance with contractual, accounting, tax and legal obligations; sending communications, news, promotions and commercial content, provided that prior authorization has been obtained; administration of suppliers, contractors and employees; improvement of services and the security of persons and facilities; and compliance with requirements from competent authorities.
4.2.1. LA AMALIA may transmit or transfer to third-party partners, through a data transmission or transfer process, only public, semi-private and private information for purposes consistent with the development of the company’s corporate purpose.
4.3. Circulation
LA AMALIA S.A.S. NIT: 901.095.151-1, as the party responsible for personal data, recognizes the importance of such data, as well as its security, confidentiality and purpose. Likewise, its actions regarding data processing are governed by the principles set forth herein and by law. Accordingly, with particular regard to this section, we comply with the Principle of Restricted Access and Circulation:
Processing shall be subject to the limits arising from the nature of personal data, the provisions of Law 1581 of 2012, the Constitution and other applicable regulations. Accordingly, Processing may only be carried out by persons authorized by the Data Subject and/or persons contemplated under the aforementioned regulations.
Accordingly, access to Personal Data shall only be permitted to the following persons:
The Data Subject.
Persons authorized by the Data Subject.
Persons authorized by law or judicial order to access the Data Subject’s information.
Personnel authorized by the CONTROLLER under this policy who, due to their position, duties or the ordinary course of business or corporate purpose of the company, need to know such information, always ensuring the custody, confidentiality and security of personal data.
In accordance with the foregoing and subject to the Principle of Restricted Access and Circulation described herein, LA AMALIA S.A.S. NIT: 901.095.151-1 may transfer or transmit public, semi-private and private personal information shared with it, provided that such actions are justified and that the prior and express authorization of the Data Subject has been obtained at the time the information is collected or prior to the transmission or transfer, if such authorization has not previously been obtained.
Likewise, such actions shall be preceded by a personal data transmission or transfer agreement, guaranteeing restricted circulation of the information, confidentiality and, in general, its security and integrity, in order to prevent fraudulent or unauthorized use of databases and personal information.
4.4. Deletion
Personal information shall be deleted once the purpose for which the data was collected has been fulfilled, provided that the Data Subject wishes to have it deleted. Otherwise, it may be retained, except in cases where the Data Subject requests the deletion of the information, in which case such deletion shall take place whenever permitted by law.
5. CHAPTER FIVE — RIGHTS OF PERSONAL DATA SUBJECTS
LA AMALIA S.A.S. NIT: 901.095.151-1, in its capacity as Data Controller, respects and guarantees the rights of Personal Data Subjects.
The Fundamental Right of Habeas Data entitles the Data Subject to request access to, updating, correction and deletion of their personal data stored in databases or physical or digital files. Likewise, the Data Subject has the right to revoke the authorization granted for the Processing of such data.
5.1. Accordingly, we inform you of the rights you have:
5.1.1. Right to know and consult your personal data.
5.1.2. Right to update your personal data if it is fragmented, incomplete, among other circumstances.
5.1.3. Right to rectify and/or correct your personal data if it is incorrect, partial or misleading.
5.1.4. Right to request the deletion of your personal data from the company’s databases. The exercise of this right shall always be respected, provided that information required by law continues to be retained for the purposes established by law.
5.1.5. Right to request, at any time, proof of the authorization granted to the CONTROLLER for the Processing of your personal data, except where expressly exempted by law.
5.1.6. Right to revoke authorization for the Processing of your personal data, provided that doing so does not cause the CONTROLLER to breach other legal obligations concerning the retention of such data.
5.1.7. Right to be informed by the CONTROLLER, upon request, regarding the use made of your personal data.
5.1.8. Right to refrain from answering questions concerning sensitive data.
5.1.9. Right to submit requests, complaints, suggestions or appeals regarding the Processing of your personal data to LA AMALIA S.A.S. NIT: 901.095.151-6. Such requests may also be submitted to the Superintendence of Industry and Commerce in accordance with the aforementioned Law and any regulations that amend, supplement or replace it.
5.1.10. Right to receive, by email, WhatsApp message or other applications or communication channels used by the CONTROLLER, the Personal Data Processing Policy.
5.2. Mechanisms for Exercising Your Rights
5.2.1. Requests, Appeals, Complaints and Inquiries
You may submit requests, appeals, complaints and inquiries to contacto@haciendalaamalia.com, during our business hours: [PENDING — customer service hours].
Such requests shall be resolved within a maximum period of fifteen (15) business days, counted from the day following receipt of the request and the submission of all information necessary to provide a response, namely: name, type of identification document, identification number, telephone number, address, email address, the facts supporting the request and all information necessary to process it, including documents where applicable. Please remember that you must be the Data Subject whose information is requested or have duly documented authority to represent the Data Subject, always justifying the need for the request, and attaching a copy of your identification card and/or professional license.
The foregoing is subject to the limitations arising from the rights over personal data belonging to third parties that could be affected; that is, the CONTROLLER shall verify that the request does not affect the right to privacy or other fundamental rights of third parties other than the Data Subject.
LA AMALIA is committed to protecting the security and confidentiality of your personal data, in accordance with the scope, parameters, conditions, principles, rights and obligations regarding its Processing described in this policy, which shall always be available for consultation.
Please note that the email address indicated above is the designated channel for requests, appeals, complaints, inquiries and suggestions.
6. CHAPTER SIX — DUTIES AND OBLIGATIONS OF THE CONTROLLER AND DATA PROCESSORS
6.1. Guarantee the Data Subject, at all times, the full and effective exercise of the right of Habeas Data.
6.2. With respect to Data Subjects:
6.2.1. Request and retain a copy of the authorization granted by the Data Subject.
6.2.2. Guarantee that the information provided is complete, accurate, up-to-date, understandable, verifiable and truthful.
6.2.3. Timely communicate all updates regarding data previously provided by the Data Subject and adopt the necessary measures to ensure that the information provided remains up-to-date.
6.2.4. Timely inform the Data Processor of any corrections made by the Data Subject so that the relevant adjustments can be made.
6.2.5. Require the Data Processor, at all times, to respect the security and privacy conditions applicable to the Data Subject’s information.
6.2.6. Inform when certain information is under dispute by the Data Subject, as well as of the resolution thereof, where such dispute affects the Processing.
6.3. With respect to the Superintendence of Industry and Commerce:
6.3.1. Report when risks arise in the Processing of personal data.
6.3.2. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
6.4. With respect to video surveillance systems:
LA AMALIA [PENDING — confirm whether video surveillance systems are installed at its facilities]. If such systems are in place, for the safety of persons and property and for the improvement of services and good business practices, the public shall always be informed of their existence through visible notices indicating the purpose of the collection and Processing of personal data, in accordance with this policy.
As the CONTROLLER of personal data, we state that videos or photographs obtained through these systems shall not be provided to any third party, except pursuant to a judicial or competent authority order or where required by law.
7. CHAPTER SEVEN — PARAMETERS REGARDING AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA
LA AMALIA S.A.S. NIT: 901.095.151-6 shall only carry out the Processing of Personal Data with the prior, express and duly informed authorization of the Data Subject. Authorization shall not be required in the exceptions established by law.
Accordingly, we have appropriate mechanisms that allow such authorization to be verified. Such authorization may be recorded through any medium, whether a physical or electronic document, data message, Internet, website or any format that guarantees its subsequent consultation through technical means, in compliance with the requirements established by law and subject to the rights of the Data Subject.
Accordingly, through this policy, we inform Personal Data Subjects of the following parameters that apply prior to granting authorization, which shall always be communicated through the different means and mechanisms used to obtain such authorization.
Please note:
7.1. The Processing of personal data shall always be disclosed.
7.2. The purpose of Processing personal data, as established in this policy, shall be disclosed.
7.3. With respect to sensitive data, the Data Subject is not required to answer questions concerning such data. In such cases, the Data Subject shall always be informed in advance of the sensitive nature of the personal data being collected, as well as the purpose for which it is collected.
7.4. The rights granted to you as a Data Subject.
7.5. Processing shall only be carried out with the prior, informed and express authorization of the Data Subject, obtained through the mechanisms described in this policy and subject to its provisions.
7.6. In the event of substantial changes to the identification of the Controller or the purpose of Processing, the Data Subject shall be informed in a timely manner.
8. CHAPTER EIGHT — TRANSFER AND TRANSMISSION OF DATA
8.1. LA AMALIA may transfer and/or transmit personal data to third parties, whether national or international, in the following cases:
8.2.1. When there is express and unequivocal authorization from the Data Subject.
8.2.2. When the data is public in nature.
8.2.3. In cases of medical or health emergencies.
8.2.4. Transfers necessary for the performance of a contract between the Data Subject and the Data Controller, or for the implementation of pre-contractual measures, provided that the Data Subject’s authorization has been obtained.
8.2.5. Transfers legally required to safeguard the public interest, or for the recognition, exercise or defense of a right in judicial proceedings, as well as any other cases determined by law, the Superintendence of Industry and Commerce or the competent authority.
9. CHAPTER NINE — PROTECTION MEASURES IMPLEMENTED FOR THE SECURITY OF PERSONAL DATA
LA AMALIA has adopted the necessary technical, legal, human and administrative measures to safeguard the security of personal data, protecting its confidentiality, integrity and proper use and preventing unauthorized and/or fraudulent access.
Likewise, we have internally implemented mandatory security protocols for all personnel with access to personal data and information systems, with the objective of preventing the alteration, loss, consultation, use or unauthorized or fraudulent access to personal data.
10. CHAPTER TEN — BINDING NATURE OF THIS POLICY
Any Data Subject who has a relationship with LA AMALIA shall comply with this policy. In the event that it is not accepted, when access to the facilities is involved, LA AMALIA reserves the right to deny admission due to the impossibility of processing the person’s personal data.
This Personal Data Processing Policy shall enter into force as of [PENDING — effective date].
Internal note (remove before publication): This document is an adaptation of Casa Candela’s Personal Data Processing Policy for use by La Amalia S.A.S. Before publication, it is recommended that the content be reviewed by a lawyer and that the fields marked as [PENDING] be confirmed: exact legal address, whether video surveillance systems are installed at the facilities, customer service hours, and the effective date of the policy.