Personal Data Privacy Policy
Los Sauces Hotel Investments S.A.
Contents
Objective
Authorization for the Processing of Personal Data
Purposes of Personal Data Processing
Processing of Personal Data
Rights of the Data Subject
Procedures for Submitting Inquiries and Claims and Responsible Area
Information About the Data Controller
Duration and Modification of the Personal Data Privacy Policy
I. Policy Objective
Inversiones Hoteleras Los Sauces S.A. (hereinafter “Sauces”), in strict compliance with current personal data protection regulations, particularly Law 1581 of 2012, Decree 1377 of 2013, and other related provisions, and committed to protecting the personal information of its clients, partners, suppliers, contractors, users, employees, and the general public, adopts the following Personal Data Privacy Policy (hereinafter the “Policy”).
This Policy, applicable to personal data stored in Sauces’ databases, sets forth general corporate guidelines for the proper handling of personal data, the rights of data subjects, the area responsible for addressing inquiries and claims, and the procedures for accessing, updating, correcting, or deleting personal data.
In accordance with the constitutional right to Habeas Data established in Article 15 of the Colombian Constitution, Sauces only collects personal data when previously authorized, expressly and informed, by the data subject, pursuant to data transmission or transfer agreements, implementing clear policies and procedures regarding confidentiality, security, and privacy.
II. Authorization for the Processing of Personal Data
Personal data included in Sauces’ databases comes from information collected under commercial, contractual, labor, or other relationships with its users, clients, partners, suppliers, contractors, employees, and/or the general public.
Upon collection, Sauces requests authorization from the data subjects for the processing of their personal data, informing them of:
The processing operations and specific purposes of the processing;
The freedom to respond to questions about minors or sensitive data;
The rights of data subjects and the procedures to exercise them;
Identification of Sauces as the data controller; and
The location of this Policy.
Personal data is stored via physical and digital means, owned or contracted from specialized providers, ensuring confidentiality and security.
III. Purposes of Processing
Corporate and Legal Purposes
Carry out activities necessary for Sauces’ corporate purpose.
Execute contracts with data subjects, either on their own behalf or representing a legal entity.
Contact data subjects via different channels to fulfill contractual obligations.
Proper execution of commercial agreements with third-party partners.
Implement video surveillance to ensure the safety of data subjects and Sauces’ assets.
Respond to requests from judicial or administrative authorities, disclosing only relevant and necessary information.
Manage inquiries and claims from data subjects regarding the processing of their data.
Report to relevant authorities (EPS, ARL, municipal/district health offices) regarding pandemics or contagious diseases.
Labor Purposes
Carry out selection, admission, and recruitment processes.
Comply with obligations related to salaries, benefits, and other legal compensations.
Manage labor, apprenticeship, and service relationships.
Conduct administrative activities including identification, record-keeping, and management of personal and professional information.
Prevent fraud and money laundering, and ensure security protocols and video surveillance.
Offer employee wellness programs.
Monitor health status of employees, apprentices, contractors, and related personnel.
Commercial and Marketing Purposes
Organize events and programs, directly or in partnership with third parties.
Maintain communication about Sauces’ activities, programs, and events.
Conduct marketing campaigns and offer products/services.
Inform about offers, discounts, or promotions.
Guarantee products and services according to applicable law.
Manage inquiries, complaints, or claims related to products/services.
Contact data subjects for satisfaction surveys.
Conduct market research and analytics, generating aggregated insights without linking to individual personal data.
Develop loyalty programs and improve products/services.
Address sales, order status, and customer service requests.
IV. Processing of Personal Data
Sauces performs operations including collection, storage, use, circulation, and deletion of personal data exclusively for authorized purposes.
(a) Retention Period
Data will be processed for a reasonable period, no less than the duration of Sauces or the contractual, legal, or commercial relationship. Once the purpose ceases, data will be deleted or securely archived.
(b) Types of Personal Data
Identification, contact, location, date and place of birth, gender, marital status, occupation, academic and professional information, social security affiliation, family group, disciplinary records, photos/videos, facial recognition, height, weight, ethnicity, disabilities, blood tests, medical diagnostics, cookies, and others.
Data from minors will be collected with parental or guardian authorization, respecting the child’s rights. Sensitive data will be treated following Law 1581 of 2012.
(c) Sauces as Data Processor
Sauces may process personal data provided by third parties with contractual relationships, adhering to Article 18 of Law 1581 of 2012.
(d) Data Transmission and Transfer
Data may be transferred to third parties in Colombia or abroad, including subsidiaries, for authorized purposes. Sauces will implement legal and technological safeguards.
(e) Access Control and Video Surveillance
Cameras ensure security. Recordings are retained up to 90 days unless needed for claims, complaints, or legal processes.
(f) Use of Cookies
Cookies may be used to enhance website navigation, advertising, and content. Users can adjust cookie preferences, noting that some restrictions may limit functionality.
V. Rights of Data Subjects
According to Article 8 of Law 1581 of 2012, data subjects have the right to:
Access personal data free of charge.
Request proof of authorization, unless legally exempt.
Know the use of their data.
Update and correct incomplete or inaccurate data.
Revoke authorization and request deletion, unless legal obligations prevent it.
File complaints with the Superintendence of Industry and Commerce.
Refuse to answer questions about sensitive data or data of minors.
VI. Procedures for Inquiries and Claims
Procedures may be exercised:
By the data subject or their legal representative (for minors).
By heirs of the data subject.
By an authorized representative.
Submission Methods:
Attention: Commercial Department
Include: full name, ID copy, description of facts, specific request, contact information, and supporting documents.
Response Times:
Inquiries: within 10 business days. Extension: 5 days.
Claims: within 15 business days. Extension: 8 days.
Requests for deletion or revocation will not proceed if legal or contractual obligations exist.
VII. Data Controller Information
Company Name: Inversiones Hoteleras Los Sauces S.A.
NIT: 900.274.900-4
Legal Representative: [Insert Name]
Address: Carrera 69 #49 A – 30, Medellín, Antioquia
Phone: +57 3218018394
VIII. Duration and Modification of the Policy
This Policy is effective upon publication. Sauces may modify it to comply with new laws, jurisprudence, or best practices. Modifications will be communicated to data subjects via authorized contact information and the website, indicating the effective date.
Inversiones Hoteleras Sauces del Estadio S.A.
