Personal Data Processing Policy — Voilá Hotels
Draft for review, version draft-1. Some controller details remain to be completed.
1. Data controller
HUESPEDIA S.A.S., with Colombian tax identification number (NIT) 901158134-6, based at [DIRECCIÓN / ADDRESS], is responsible for processing personal data collected through the Voilá Hotels Pre-arrival form. For questions, complaints or requests concerning your data, contact [CORREO / EMAIL]. Responsibilities by hotel: [CONFIRM CONTROLLERS BY HOTEL].
2. Information we collect
We may collect the reservation holder’s full name, email address, phone number, hotel, arrival date and reservation reference, as well as information you choose to share about your arrival, travel companions, purpose of travel, pets, celebrations, interests and stay preferences. We do not request identity documents or payment information through this form. Avoid including personal data about companions or third parties other than the reservation holder in text fields.
3. Purposes
We use this information to identify your stay, prepare for your arrival, address requests, understand your preferences and contact you about services or experiences you request. Requesting information about a transfer or another experience does not confirm a booking, availability or cost. We will not use the form information to send advertising unrelated to these purposes without separate authorization.
4. Sensitive data and optional disclosure
Answers about allergies, mobility or other needs may contain health information, which is sensitive data. You are not required to provide it or authorize its processing. If you choose to share it, we will request your explicit authorization to use it exclusively to prepare for your arrival and address the needs you communicate. Declining to provide it does not affect access to accommodation. Avoid sharing diagnoses, medical records or sensitive information unnecessary to address your request.
5. Storage and access
Responses will be stored in a private Google Cloud Firestore database accessible only to authorized staff who need them for the stated purposes. We may use technology providers for storage and notifications, under applicable contractual conditions and safeguards. These services may involve processing information outside Colombia; the controller will verify applicable requirements before enabling them. If a request requires sharing information with a service provider, we will inform the guest and obtain any required authorization.
6. Your rights
You may access, update and correct your data; request proof of authorization; learn how your information has been used; access your data free of charge; and request deletion or withdraw authorization where applicable. You may also file complaints with the Colombian Superintendence of Industry and Commerce after completing the applicable procedure with the controller.
7. Questions and complaints
Send requests to [CORREO / EMAIL], including your name, a response channel and a description of your request. Where necessary, we will verify your identity proportionately to protect your information. Questions will be answered within ten business days, with a permitted extension of up to five additional business days. Complaints will be answered within fifteen business days, with a permitted extension of up to eight additional business days. Reasons for any extension will be communicated.
8. Retention and security
We will retain responses for [RETENTION PERIOD TO BE DEFINED], according to the purpose of the form and applicable obligations. After this period they will be deleted or anonymized, unless an obligation justifies further retention. We will apply technical and organizational measures to restrict access and prevent unauthorized use, alteration or disclosure.
9. Effective date and changes
This policy takes effect on [FECHA / DATE], version draft-1. Substantial changes will be communicated on the website; new authorization will be requested where applicable.