Data Protection

POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA - ECUADOR

  1. Applicable Regulations

Organic Law on Personal Data Protection (Fifth Supplement No. 459) (hereinafter referred to as the "LOPD") concerning the protection of individuals with regard to the processing of their personal data.

  1. Controller (owner) of the Personal Data Bank

· GHL UIO S.A.S (Sheraton Quito)

  o RUC: 1793198474001

  o Av. Republica del el Salvador N36-212 and NNUU Quito

· GHL GYE S.A.S (Sheraton Guayaquil)

  o RUC: 0993374210001

  o Av. Joaquín Orrantia G. Plaza del Sol frente al Mall del Sol, Guayaquil

· GHL Ecuador S.A.S (Sonesta Loja, Four Points Sheraton Cuenca, and Radisson Guayaquil)

  o RUC: 1793197658001

  o Av. Republica del el Salvador N36-212 and NNUU Quito

· Holding Hotelera GHL S.A.S

  o NIT: 901580112 2

  o Central Office: Calle 72 # 6-30, Bogotá – Colombia

  o Phone: +57 3139333

  1. Definitions

Database or file: Structured set of data in any form, mode of creation, storage, organization, type of support, treatment, processing, location or access, centralized, decentralized, or distributed functionally or geographically.

Consent: Manifestation of free, specific, informed, and unequivocal will, by which the data subject authorizes the controller to process their personal data.

  1. Legitimacy for the processing of personal data

4.1 Guests and Clients Execution of a contract:

  • Reservation and registration management
  • Reception services and hotel stay
  • Management of payments and invoicing of services
  • Management of third-party services contracted by the hotel (e.g., transportation or tour services)
  • Management of relationships with suppliers and external service providers Legitimate interest:
  • Handling and management of requests, inquiries, and complaints
  • Sending information and advertising about hotel promotions, events, and services
  • Analysis of preferences and consumption habits to improve service quality
  • Analysis of marketing effectiveness and continuous improvement of services offered
  • Protection of security and privacy Access control and security in hotel facilities Conducting market studies and competition analysis Consent:
  • Sending information and advertising about hotel promotions, events, and services
  • Management of customer loyalty programs and personalized offers Compliance with a legal obligation:
  • Compliance with legal and tax obligations Vital interest:
  • Handling medical emergencies and health risk situations 4.2 Owner, Suppliers, Candidates, Collaborators, and Retired Collaborators

The legitimacy for processing personal data of suppliers, candidates, collaborators, and retired collaborators shall primarily be based on the provisions established in paragraph 5) of Article 7 of the LOPD, namely, for the execution of pre-contractual measures at the request of the data subject or for the fulfillment of contractual obligations pursued by the Hotel or a third party legally authorized. Likewise, they may be processed based on GHL's legitimate interest.

Thus, GHL's grounds for legitimacy in its relationship with owners, suppliers, candidates, collaborators, and retired collaborators are based on:

i. Paragraph 5 of Article 7 of the LOPD, for the execution of pre-contractual measures at the request of the data subject or for the fulfillment of contractual obligations pursued by the data controller, data processor, or by a third party legally authorized, which are necessary to formalize the contract and perform the supplier's service.

ii. Paragraph 4 of Article 7 of the LOPD, carried out in compliance with a legal obligation, when necessary to meet legal requirements in terms of Social Security, tax obligations, arising from a collective agreement, among others.

iii. Paragraph 7 of Article 7 of the LOPD, to satisfy a legitimate interest of GHL or a third party, provided that the interests or fundamental rights of the data subjects do not prevail under the provisions of the LOPD. The application will be carried out, in any case, in a proportionate manner and as minimally intrusive as possible.

iv. Paragraph 1 of Article 7 of the LOPD, when the consent of the data subject is necessary for the processing to take place. In such cases, separate consent will be requested, strictly following the provisions of the LOPD in this regard.

  1. Response Time for Queries or Requests

GHL will respond to the request within a maximum period of fifteen (15) days from its receipt. Likewise, requests will be addressed within a maximum period of ten (10) days, and the data subject must follow the same procedure.

Here is the translation of the text into English:


Below are the details of the Personal Data Protection Officer for GHL:

8. Validity and Changes

This Annex to the Personal Data Processing Policy is approved on May 22, 2024, from which date it becomes applicable.

This Policy may be modified by GHL as required without prior notice, provided that such modifications are not substantial. Otherwise, they will be communicated to the Data Subjects in advance.

Cookies Policy, More details can be found in our page Cookies Policy