The protection of personal data, as enshrined constitutionally, is understood as the right of individuals to know, update, and rectify the information collected about them in databases and files of public and private entities. The hotel, in its administrative and/or commercial processes, knows, stores, and processes personal data, which generates a responsibility for the proper management of this data. Thus, in compliance with current regulations, especially Article 15 of the Political Constitution, Law 1266 of 2008, Law 1581 of 2012, and its regulatory decree, CASA CAROLINA HOTEL S.A.S. must ensure that when a person provides information to be incorporated into the hotel’s databases or files, there are adequate processes in place to protect it and ensure its proper use. In this regard, the hotel develops this policy to protect the client’s property. The data of individuals who, through any activity, direct or indirect, including labor and commercial activities, whether permanent or occasional, provide any type of information or personal data to the hotel, will be protected. The hotel acts as the data controller and will allow the data subject to know, update, and rectify their information.
Below are several definitions that will serve as a guide for interpreting and applying this data processing policy:
1.4.1 DATA SUBJECT: The natural or legal person to whom the information in a data bank refers, and the subject of the right to habeas data and other rights and guarantees.
1.4.2 INFORMATION SOURCE: The person, entity, or organization that receives or knows personal data from the data subject, and, by legal authorization or the data subject’s consent, provides this data to an information operator, who in turn will pass it on to the final user. If the source provides the information directly to users and not through an operator, it will have the dual role of both source and operator, and will assume the duties and responsibilities of both. The information source is responsible for the quality of the data provided to the operator, which, as it accesses and provides personal information about third parties, must comply with the duties and responsibilities aimed at protecting the data subject’s rights.
1.4.3 DATA SUBJECT: The natural person whose personal data is subject to processing.
1.4.4 PERSONAL DATA: Any piece of information related to one or more determined or determinable persons, or that can be associated with a natural or legal person. Impersonal data is not subject to the data protection regime of this law. Any information linked to or that can be associated with one or more specific or identifiable natural persons.
1.4.5 CONSENT: The prior, express, and informed consent of the data subject to carry out the processing of personal data.
1.4.6 DATA CONTROLLER: The natural or legal person, public or private, that alone or in association with others decides on the processing of personal data.
1.4.7 PROCESSING: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.
1.4.8 DATA SUBJECT’S CONSENT: Processing requires prior and informed consent from the data subject, which must be obtained by any means that allows future consultation.
1.4.9 DATABASE: An organized set of personal data that is subject to processing.
1.4.10 PRIVACY NOTICE: A physical, electronic, or any other format document known or to be known, made available to the Data Subject for the processing of their personal data. Through this document, the Data Subject is informed about the existence of the applicable data processing policies, how to access them, and the characteristics of the processing intended for the personal data.
1.4.11 PUBLIC DATA: Data that is not semi-private, private, or sensitive; Public data includes, among others, data relating to a person’s civil status, profession, occupation, or their status as a merchant or public servant. By nature, public data can be found in public records, public documents, gazettes, official bulletins, and judicial rulings that are not subject to confidentiality.
1.4.12 SENSITIVE DATA: Data that affects the privacy of the data subject or whose misuse can lead to discrimination, revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations for human rights, political parties or opposition, as well as data related to health, sexual life, and biometric data.
1.4.13 TRANSFER: The transfer of data occurs when the data controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient who is responsible for processing the data, either within or outside the country.
1.4.14 TRANSMISSION: The processing of personal data, involving communication of the data within or outside the territory of the Republic of Colombia, when it is intended for processing by the processor on behalf of the controller.
CASA CAROLINA HOTEL S.A.S. will apply the constitutional and legal principles in data processing as part of its data treatment policy, for interpretation and application purposes, including:
• Principle of legality in data processing
• Principle of purpose
• Principle of freedom
• Principle of accuracy or quality
• Principle of transparency
• Principle of restricted access and circulation
• Principle of security
• Principle of confidentiality
The rights of data subjects whose personal data is processed by CASA CAROLINA HOTEL S.A.S., according to Article 8 of Law 1581 of 2012, include the following:
a) Know, update, and rectify their personal data before the data controllers or processors. This right can be exercised, among others, in cases of partial, inaccurate, incomplete, fragmented data, data that induces error, or data whose processing is expressly prohibited or unauthorized.
b) Request proof of the authorization granted to the data controller, unless it is expressly excluded as a requirement for processing, in accordance with Article 10 of this law.
c) Be informed by the data controller or processor, upon request, about how their personal data has been used.
d) File complaints with the Superintendence of Industry and Commerce for violations of this law and any subsequent amendments, additions, or supplements.
e) Revoke the authorization and/or request the deletion of data when the processing does not respect the constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the controller or processor has engaged in behavior contrary to this law and the constitution.
f) Access their personal data that has been subject to processing, free of charge.
Additionally, Decree 1377 of 2013 establishes that the controllers must retain proof of the authorization granted by the data subjects for processing their data.
1.6.1 LEGITIMACY FOR EXERCISING THE DATA SUBJECT’S RIGHTS: The following persons may exercise the rights of the data subjects:
a) The data subject, who must sufficiently prove their identity through various means provided by the hotel.
b) The heirs of the data subject (in cases of death or incapacity), who must prove such status.
c) The representative and/or attorney of the data subject, with prior accreditation of the corresponding representation or power.
d) By stipulation in favor of another person.
2.1 IDENTIFICATION: In each department of the hotel, personal data under its management and custody must be identified.
2.2 PROTECTION: According to Article 15 of the Political Constitution of Colombia and its legal and jurisprudential development, the right to privacy must be guaranteed at all times, as well as the ability to update and rectify personal information. In this regard, CASA CAROLINA HOTEL S.A.S., in compliance with the law and in order to ensure respect for the rights of its guests, will adopt the following information processing policies:
a) All information related to the data subject may only be accessed, consulted, or requested by the data subject or an authorized representative.
b) In the case of a minor data subject, their parents may access this information due to parental authority.
c) The data subject can access their data at any time.
d) In all cases, the data subject can request the necessary updates and/or rectifications.
e) Data must be stored in such a way that it does not deteriorate, except as a result of the passage of time.
f) Data must be stored with due diligence and care.
g) In the event of data loss, CASA CAROLINA HOTEL S.A.S. must inform the client. Therefore, to mitigate risks, records of all information must be kept.
h) If the information is digital, backup copies should be maintained.
i) Efforts should be made to digitize and manage documents electronically, ensuring proper backup copies.
j) The data collected by CASA CAROLINA HOTEL S.A.S. will be used solely for purposes related to the hotel’s social purpose.
2.3 RESPONSIBILITIES OF THE DATA CONTROLLER
In accordance with Article 17 of Law 1581 of 2012, CASA CAROLINA HOTEL S.A.S. commits to fulfilling the following duties during personal data processing:
a) Guarantee the data subject the full and effective exercise of the right to habeas data at all times.
b) Request and keep a copy of the respective authorization granted by the data subject, in the conditions established by the law.
c) Inform the data subject about the purpose of the data collection and the rights they have as a result of the authorization granted.
d) Maintain the data under necessary security conditions to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
e) Ensure that the information provided to the data processor is truthful, complete, accurate, updated, verifiable, and understandable.
f) Update the information by communicating promptly with the data processor about any changes to previously provided data and adopt necessary measures to ensure the data remains current.
g) Correct any incorrect information and communicate the rectification to the data processor.
h) Provide the data processor, as applicable, with only data whose processing has been previously authorized, in accordance with the law.
i) Require the data processor to respect the security and privacy conditions of the data subject’s information at all times.
j) Address inquiries and complaints made in the terms set forth by the law.
k) Adopt an internal manual of policies and procedures to ensure compliance with the law and to manage consultations and complaints properly.
l) Inform the data processor if specific information is disputed by the data subject, once the complaint is filed and the process is ongoing.
m) Inform the data subject, upon request, about how their data has been used.
n) Inform the data protection authority of any security breaches or risks regarding the management of the data subjects’ information.
o) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
2.4 CASES IN WHICH AUTHORIZATION IS NOT NECESSARY
• Information required by a public or administrative authority in the exercise of its legal functions or by judicial order.
• Publicly available data.
• Medical or health emergencies.
• Information processing authorized by law for historical, statistical, or scientific purposes.
• Data related to the civil registry of individuals.
CASA CAROLINA HOTEL S.A.S. has provided the following communication channels to address requests, inquiries, and complaints from data subjects:
Main office: Calle del Arzobispado, Cra. 5 #34-14, Cartagena de Indias, Colombia
Phone: 6056543330
Email: gerencia@casacarolinahotel.com
Each data subject may exercise their rights to know, update, rectify, delete their data, and revoke their authorization.
3.1 PROCEDURE TO EXERCISE THE RIGHTS TO KNOW, UPDATE, RECTIFY, DELETE DATA, AND REVOKE AUTHORIZATION
Data subjects or their legal heirs may request, through the email info@casacarolinahotel.com, personal information belonging to the data subject that is held in any database and/or files of CASA CAROLINA HOTEL S.A.S., to exercise any of the aforementioned rights.
If the data subject or their legal heirs believe that the information in a database should be corrected, updated, or deleted, or if they notice a potential breach of any obligations under the law, they may file a complaint with CASA CAROLINA HOTEL S.A.S. The complaint can be submitted by the data subject via the email gerencia@casapestagua.com, taking into account the provisions of Article 15 of Law 1581 of 2012 and Decree 1377 of 2013.
At any time and free of charge, the data subject or their representative may request the responsible personnel of the Database Management team to rectify, update, or delete their personal data, after proving their identity.
The rights of rectification, update, or deletion may only be exercised by:
The data subject or their legal heirs, upon proving their identity, or through electronic means that allow for identification.
Their representative, after proving their authority. If the request is made by someone other than the data subject, the person must duly prove their representation or mandate; if they fail to do so, the request will be considered not submitted.
Additionally, the request for rectification, update, or deletion must be submitted through the means provided by CASA CAROLINA HOTEL S.A.S., as indicated in the privacy notice, and must contain at least the following information:
a) The name and address of the data subject or another means to receive the response.
b) The documents that prove the identity or authority of the representative.
c) A clear and precise description of the personal data for which the data subject seeks to exercise any of the rights.
The present Personal Data Processing Policies took effect on March 1, 2024.
Notwithstanding the above, the policies established by CASA CAROLINA HOTEL S.A.S. regarding the processing of personal data may be modified at any time.
Any modifications will be made in compliance with current legal regulations. Such modifications will take effect and be enforceable from their publication on the CASA CAROLINA HOTEL S.A.S. website.
Calle Arzobispado, Cra. 5 #34-14,
Cartagena de Indias, Colombia.
+57 (605) 654 3330
+57 318 574 7684
SIC | NIT: 901613438-1 | RNT:132298
All rights reserved Casa Carolina 2025 ©
