Video surveillance policy
Statement on policy
TOUR VACATION HOTELES AZUL SAS BIC, with registered address in the city of Bogotá at Calle 100 # 7 A -81, 6th Floor, Telephone: 601 3904884, hereinafter referred to as the Company, and its website www.onvacation.com , hereinafter referred to as the Portal, hereby announces its video surveillance policy and informs you that it uses a closed-circuit television system (hereinafter, "CCTV") on its premises. The objective of this policy is to establish TOUR VACATION HOTELES AZUL SAS BIC's position regarding the management, operation, and use of CCTV on its premises.
This policy applies to all passengers, guests, clients, employees, contractors, monitored individuals, third parties, users, and those who visit the facilities of TOUR VACATION HOTELES AZUL SAS BIC, and all other persons whose images may be captured by the CCTV system.
This policy takes into account all applicable legislation and guidelines, including:
Political Constitution of Colombia of 1991. Right of Habeas Data.
Law 1581 of October 17, 2012 By which general provisions are issued for the protection of personal data.
The Guide on the Protection of Personal Data in Video Surveillance Systems of the Superintendency of Industry and Commerce.
Purpose of CCTV
The primary purpose of CCTV video surveillance is to capture and/or process images to ensure the safety of property and people. However, the proliferation of these systems is expanding their applications.
The data collected by our staff and video surveillance cameras (content stored on specialized recording devices) is intended to record entry to the establishment's facilities. In the case of entry logs, this information includes: name, identification number, blood type, name and telephone number of contact person in case of emergency, health insurance provider (EPS) and occupational risk insurance (ARL) information, information on computer equipment brought in, position, department, name of immediate supervisor, and a photo. This information in the logs is protected by physical access control. Security videos are protected by physical access control to the data center, wiring closets, and communications racks. These devices have a username and password known to the corresponding IT administrators. Images and videos will be stored for no more than fifteen (15) calendar days, and payroll information will be stored for no more than two (2) years, after which this physical information will be permanently disposed of.
The main ones are listed below:
Use for the security of material goods and people to provide a safe and secure environment related to monitoring security situations for passengers, guests, clients, employees, contractors and visitors: This purpose includes capturing images to control public safety, road safety, access to private environments, etc.
Use in business environments for workplace monitoring purposes, to supervise compliance with regulations on safety, health, and occupational risk prevention; monitoring employee work schedules: In this case, the use of cameras is intended to provide the employer with information on the employee's fulfillment of their work obligations and duties. This verification power has its limits and cannot be exercised in a way that infringes on the right to privacy of employees.
For the investigation of incidents related to the protection of minors.
To prevent loss or damage to the buildings and/or property of TOUR VACATION HOTELES AZUL SAS BIC.
To help in the prevention of crimes and to collaborate with the National Police, Public Prosecutor's Office, security forces and judicial investigation in the arrest of criminals.
To prevent violence, racism, xenophobia and intolerance in the activities carried out at TOUR VACATION HOTELES AZUL SAS BIC.
Inventory verification and transfer, receiving conditions, status and dispatch.
Other purposes. The rise of these systems has led to their use in other areas, such as tourism promotion, research, behavioral studies, and so on.
Transparency
Signs will be installed to inform people that they are in an area where CCTV is in operation.
Transparent information on the processing of CCTV data will be made available to individuals upon request in the form of a Privacy Notice at all receptions, service points and information points of the Society.
Treatment of images as personal data
The processing of personal data has been defined as “any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or erasure.” In the case of electronic security activities, this specifically involves the processing of personal data consisting of images and, potentially, biometric data of identified or identifiable individuals, through operations such as capture, recording, transmission, storage, retention, or reproduction in real time or later, among others. These operations are considered personal data processing and are subject to the General Data Protection Regulation.
The General Data Protection Regime establishes two figures regarding the processing of personal data:
The data controller, by definition, is the natural or legal person who decides on the database and/or the processing of the data. The law has established various obligations for this controller, particularly to guarantee the protection of data subjects' rights regarding the collection, storage, use, and disposal of their personal data. In the field of electronic security, this data consists of images and biometric data of the data subjects.
The data processor is a third party, a natural or legal person distinct from the data controller, who processes personal data on behalf of the controller. In the field of electronic security, specifically in the case of CCTV video surveillance, when the implementation of video surveillance systems is carried out by a third party, such as private security and surveillance companies that use technological means, among other things, to provide their service, these third parties are considered both the data processor and the data controller's client.
Image processing of children and adolescents
The processing of images of children and adolescents must respect their prevailing rights and may only be carried out when (i) it responds to and respects their best interests, and (ii) it ensures respect for their fundamental rights.
As those responsible for processing images of children and adolescents, special rules apply to their processing, some of which are:
Having the authorization of the parents or legal representatives of the minors and with their consent, taking into account their maturity, autonomy and capacity to understand the matter.
Inform parents or legal guardians about the purpose and processing of the personal data of minors, as well as their rights.
Limit the collection and other processing of images, in accordance with what is proportionate and appropriate considering the previously informed purpose.
To guarantee the security and confidentiality of minors' personal data.
Restrict access to and circulation of the images, in accordance with the law.
TOUR VACATION HOTELES AZUL SAS BIC. in its capacity as the entity responsible for the processing of images of children and adolescents, will require those responsible to fulfill their duties.
Content
TOUR VACATION HOTELES AZUL SAS BIC. must request prior, express and informed authorization from the Holders of the personal data on which it requires processing, which they can exercise through unequivocal conduct that allows a reasonable conclusion that they granted authorization; except for the cases defined in article 10 of law 1581 of 2012.
Prior authorization means that consent must be given by the Data Subject no later than at the time of collection of Personal Data.
Express authorization means that the Data Subject's consent must be explicit and specific; open and nonspecific authorizations are not valid. The Data Subject must expressly state their willingness to authorize TOUR VACATION HOTELES AZUL SAS BIC to process their personal data.
This expression of the Holder's will can be given through different mechanisms made available by TOUR VACATION HOTELES AZUL SAS BIC., such as:
In writing, for example, by filling out an authorization form.
Orally, for example, in a telephone conversation or video conference.
Through unequivocal conduct that allows one to conclude that he gave his authorization, for example, through his entry into the company's facilities that have a video surveillance system and notices informing of its existence.
Regarding authorizations for video surveillance systems, since these can be implemented in places such as commercial establishments, copProperties, buildings, hotels, stands, shopping centers, among others, in all cases the Holders of personal data that they are in a video surveillance area will be informed and their authorization will be obtained for the
The handling of these matters. For this purpose, distinctive signs or notices may be used in video surveillance areas, primarily at entrances to and within the premises being monitored. Audio announcements may also be used. In cases where audio recording is being made, the data subjects will also be informed of this.
The privacy notices or signs contain the following information, namely:
Information about who is the Data Controller and their contact details
Indication of the rights as holders
Indication of where the Video Surveillance Policy and Privacy and Confidentiality Policy for Personal Data – Data Protection is published.
Data subjects
TOUR VACATION HOTELES AZUL SAS BIC. processes personal data of the following categories: public, semi-private, and private, with the exception of some sensitive data concerning the following data subjects:
Employee Customers Drivers Supplier Third Parties
Prospective client, Petitioner, Former clients
Job applicant Former employee
Family member of the worker; Prospective supplier; Inactive suppliers
Visitors
Monitored Client, Monitored Employee, Shareholders
Members of the Board of Directors of the SENA Apprenticeship
Intern Passengers Guests
Government officials Users
Holder's rights
Your rights as the data subject are those provided for in the Constitution and in Law 1581 of 2012, especially the following:
Access free of charge to the data provided that has been processed.
Request updating and rectification of your information in the face of partial, inaccurate, incomplete, fragmented data, data that induces error, or data whose processing is prohibited or has not been authorized.
Request proof of the authorization granted.
To file complaints with the Superintendency of Industry and Commerce (SIC) for violations of the provisions of current regulations.
Revoke authorization and/or request the deletion of the data, unless there is a legal or contractual duty that makes it imperative to retain the information.
Refrain from answering questions about sensitive data or data about girls, boys and adolescents.
Access to images by personal data holders
Data subjects are entitled to exercise their right of access to images processed through video surveillance systems. To do so, data subjects wishing to access the images must include the following in their request:
For consultation, in addition to the requirements mentioned above, the date, time and place, to facilitate the location of the image and limit the exposure of images to third parties as much as possible.
System Description
There are two CCTV systems in operation:
Analog System which corresponds to a perimeter system that covers the external perimeter and entrances to the establishments of TOUR VACATION HOTELES AZUL SAS BIC.; this same system monitors the interior in the internal areas of the establishments, hotels, offices in the corridors.
Digital IP System which corresponds to a recording system for the cash registers of the different establishments of TOUR VACATION HOTELES AZUL SAS BIC.
Each system has been installed on a separate local area network that cannot be accessed externally (the systems that have external access are those previously authorized by the TOUR VACATION HOTELES AZUL SAS BIC. steering committee, in order to monitor these locations for processes or special cases); access to the recordings, internally or externally, can only be authorized through the Technology Management and/or a person delegated by this management.
Camera locations
Proportionality will be taken into account before considering the installation of a CCTV system, as well as with regard to the number of cameras to be used and their type (analog or IP), whether fixed cameras or cyber domes. All CCTV cameras will be positioned in such a way as to fulfill the purposes described in section 2 above.
The cameras will not be positioned, as far as possible, in such a way that they record areas not intended to be monitored. TOUR VACATION HOTELES AZUL SAS BIC will make every effort to ensure that the external CCTV captures the minimum street area necessary to fulfill its intended purpose.
The cameras will not be placed in areas where people expect a high degree of privacy, such as changing rooms, bathrooms, or bedrooms.
Management and access
The perimeter CCTV system will be managed by the Administrative Headquarters and Technology Management of TOUR VACATION HOTELES AZUL SAS BIC, using their specialized recording devices as data processors.
CCTV will not be connected to an alarm receiving center or an external control center without a prior review of the planned configuration and the corresponding access authorizations.
The recorded images stored by the perimeter and internal analog CCTV systems, and the digital IP systems of the boxes, will have restricted access and only the technology management and/or administration head with technology supervision (or persons delegated by them) will be able to access them, who will arrange and authorize the reproduction and delivery of the videos that are required by other areas of the company, judicial and administrative orders and the data owners.
No other person shall have the right to view or access CCTV images except as provided in the terms of this policy regarding the disclosure of images.
CCTV systems have preventive and, if necessary, corrective maintenance processes and are regularly checked by the technology area personnel to ensure that they function effectively.
Image storage and preservation
All images recorded by the CCTV system will be kept for a maximum period of 15 calendar days.
Images will only be kept for longer periods when necessary for an ongoing investigation, complying with the legal obligations to do so and, in particular, with the obligation to make them available to the competent authority within the legally prescribed period.
In this case, and only with the explicit authorization of the legal representative of TOUR VACATION HOTELES AZUL SAS BIC. and/or the Data Protection Officer, the images will be kept for the duration of the investigation and the legal process.
Security measures
TOUR VACATION HOTELES AZUL SAS BIC will ensure that appropriate security measures are in place to prevent the unlawful or accidental disclosure of recorded images. Existing measures include:
The location of CCTV recording systems in restricted access areas.
The encryption or password protection of the CCTV system.
Policies that limit permissions to certain profiles within the company with the ability to do copias (system administrator).
All CCTV equipment is configured with access credentials that limit the risk of unauthorized access to them.
Access points for viewing CCTV images will be located in secure rooms such as the IT department, security posts, and the boardroom.
TOUR VACATION HOTELES AZUL SAS BIC. maintains records of requests and all access to CCTV images, including the date and time and the person who accessed the images through ServiceTonic's Help Desk Software.
Disclosure of the images to the interested parties or representatives of the minors
Any person whose image is recorded by CCTV will be considered an interested party for the purposes of the provisions of the Data Protection Legislation and has the right to request access to said images.
Any person requesting access to their own images will be considered to have made a request for access to their data, in accordance with the provisions of Law 1581 of 2012, the General Data Protection Regime. This request must be sent immediately to atencionalcliente@onvacation.com for processing, following the established procedure . Within the maximum retention period outlined in this policy, it should be noted that due to storage capacity limitations, the various establishments of TOUR VACATION HOTELES AZUL SAS BIC have shorter storage periods than the maximum stated.
When such a request is made, the head of administration and the technology management (or delegated persons) will review the CCTV recordings, with respect to the relevant time periods where appropriate, in accordance with the request.
If the recording only includes the person who made the request, then that person will be allowed to view the recording. If the recording contains images of minors, the protection of the minor's rights and freedoms will prevail in all cases. If necessary, disclosure will only be possible if the images cannot be distorted, or if the minor's legal representatives have given their consent for the disclosure of the images, or if it has been required by a government authority. A record of all access requests will be maintained through ServiceTonic's Help Desk Software and the OSIRIS platform, specifying:
When was the request made?
The process followed to determine if the images contained third parties.
Considerations regarding whether access to such images is permitted or not, and if so, the reasons for doing so.
The people who have been allowed to see the images and when.
If one was provided copia of the images and, if so, to whom, when and in what format.
Procedure to exercise your rights as a data subject
Area responsible for requests, inquiries and claims regarding personal data
The area responsible for handling requests, inquiries and complaints from data subjects to exercise their rights to know, update, rectify and delete their data and revoke their authorization is the Customer Service Area.
The law has defined two ways to exercise rights; the first being consultations and the second being claims.
Inquiries will be answered within a maximum of ten (10) business days from the date of receipt of this.
When it is not possible to address the query within said term, the interested party will be informed of the reasons, indicating the new date on which their query will be resolved, which will not be more than five (5) business days following the expiration of the first term.
Claims will be addressed within a maximum of fifteen (15) business days from the day following the date of receipt. TOUR VACATION HOTELES AZUL SAS BIC may extend the response time in special cases by notifying the interested party. This new period will not exceed eight (8) business days.
Service Channels
TOUR VACATION HOTELES AZUL SAS BIC. has an information area designed to ensure proper attention to customer requirements, especially inquiries and complaints related to data protection, in order to guarantee the exercise of the rights contained in the Constitution and the Law.
Therefore, data subjects can submit their inquiries and complaints through the following channels:
The client and/or user has the right at any time to revoke this authorization and/or request the deletion, updating, rectification, and access to their data authorized for processing, by contacting the email address atencionalcliente@onvacation.com . They may also send a physical letter to the address Calle 100 # 7 A -81, 6th Floor, Bogotá, addressed to the Customer Service Department of TOUR VACATION HOTELES AZUL SAS BIC. The request will be answered within the timeframe stipulated by Law 1581 of 2012. If it is not possible to address the inquiry within this timeframe, the client will be notified promptly, stating the reasons for the delay and indicating the date on which the request will be addressed.
Please note that a request for removal or deletion will not be processed when there is a contractual or legal obligation to maintain the information in our database, as is the case with outstanding receivables.
All of the above channels have trained personnel to perform their functions, as well as the necessary control systems so that the updates to personal information requested by users are documented and can be verified.
However, it should be noted that TOUR VACATION HOTELES AZUL SAS BIC. will only send personal data for the purpose of the inquiry or complaint to the following persons:
To the data subject, their successors or their legal representatives, provided that they prove this status as mentioned in the definitions section of this document.
To persons authorized by the data subject.
To persons authorized by court or legal order.
In this last case, one must consider what the Constitutional Court said in ruling C-748 of 2011 regarding requests for information from public or administrative entities:
The public or administrative entity must justify its request by indicating the link between the need to obtain the data and the fulfillment of its constitutional or legal functions.
Secondly, with the delivery of the information, the public or administrative entity will be informed that it has the duty to comply with the obligations and requirements imposed on it by Law 1581 of 2012, as the data controller, or in charge in certain cases.
The receiving administrative entity must comply with all legal mandates that exist on the subject at the time of receipt of the information, especially the principles of – purpose – legitimate use – restricted circulation – confidentiality and – security.
Following established channels is the path to a prompt response
Data subjects may know, update and rectify the personal information held in the databases of TOUR VACATION HOTELES AZUL SAS BIC.
The procedures for exercising the rights of data subjects are established in each of the processing policies included in the Comprehensive Data Management Program; however, it is noted that the response time will begin to run from the moment TOUR VACATION HOTELES AZUL SAS BIC. has effective knowledge of the data subject's request, if the request was received through the established channels.
Requirements for inquiries and claims regarding personal data
Regardless of the channel the holder chooses to submit their request, it must be addressed to TOUR VACATION HOTELES AZUL SAS BIC and include at least the following items:
Include the holder's identification (name and identification document). Include a description of the events giving rise to the inquiry or complaint. State the purpose of the request.
Specify the Holder's notification address, either physical or electronic (e-mail).
Attach the documents you wish to use as evidence. (Especially for claims)
In the event that the inquiry or complaint is submitted in person, the holder must put their request or complaint in writing without any formality other than the requirements demanded in the previous point.
We care about your satisfaction
If the holder considers that the response does not satisfy their needs, they have a period of fifteen (15) business days from the receipt of this to request that it be re-evaluated in cases where it has been unfavorable to their interests.
Authorizations to third parties
The data subject must provide TOUR VACATION HOTELES AZUL SAS BIC., either physically or via a previously registered email address, with the necessary authorization to allow a third party to consult, update, or correct their information. This requirement is solely for the purpose of protecting and restricting access to the information by unauthorized third parties.
This authorization must contain at least the following: Identification of the authorizing holder
Copia of the holder's national identity card
Name and identification details of the authorized person.
Time period for which you can consult, update or correct the information (only once, for one year, for the duration of the legal relationship, or until further notice, etc.).
Voluntary and free nature of the authorization.
Disclosure of images to third parties
TOUR VACATION HOTELES AZUL SAS BIC. will only disclose CCTV images to third parties when permitted to do so in accordance with data protection legislation.
CCTV images will only be disclosed to law enforcement authorities in accordance with the purposes for which the CCTV system exists.
If a request for the release of CCTV footage is received from a law enforcement authority (Prosecutor's Office, Judicial Police, Investigative Bodies, Judges, or Courts), the Legal Representative must follow the same procedure outlined above for requests from interested parties. In these cases, TOUR VACATION HOTELES AZUL SAS BIC will verify that the requests are justified and that the release of the footage is proportionate to the purpose of the request.
The above information must be recorded in connection with any disclosure.
If a court issues an order for the release of CCTV footage, it must be complied with. However, it is necessary to carefully examine exactly what the court order requires.
Review of CCTV policy and system
This policy will be reviewed annually and, in any case, whenever legislative changes occur that make it advisable.
The CCTV system and the privacy impact assessment relating to it will be reviewed annually by the Comprehensive Data Committee, or sooner if a major change in the installation or configuration of the system makes it advisable.
Misuse of CCTV systems
Misuse of the CCTV system could constitute a criminal offense.
Any employee of TOUR VACATION HOTELES AZUL SAS BIC. who violates this policy may be subject to disciplinary action.
Validity
This video surveillance policy is effective from the date of its publication for ten (10) years until December 31, 2023, a period that will be automatically renewed unless the data subject requests its deletion. Image and video databases will be stored for a maximum of five (5) calendar days, except for equipment that allows for a longer storage period, in which case the maximum will be fifteen (15) calendar days. Payroll information will be stored for no more than two (2) years, at which time this physical information will be permanently disposed of.
