Privacy and Personal Data Protection Policy
Abraspungo Tourist Lodge Limited Company
Abraspungo Limited Company – Riobamba, Ecuador
Introduction
This policy is established based on the legal, technical and organizational guidelines that govern the processing of personal data by Albergue Turístico Abraspungo Compañía Limitada, in compliance with the LOPDP, its General Regulations and the applicable international regulations on the protection of personal data.
This Privacy and Personal Data Protection Policy describes our practices regarding the personal data you submit to us or that we collect when you use our website and services, with the aim of respecting your privacy. We firmly believe in transparency and are committed to respecting your rights and freedoms, ensuring the security of any information related to your personal data.
Aim
Implement an internal Privacy and Personal Data Protection Policy that allows:
- Identify, classify and process personal data in accordance with legal principles.
- Guarantee the exercise of rights of data subjects (ARCO+).
- Establish security measures proportionate to the level of risk.
- Comply with the obligations of the data controller and its processors.
- Demonstrate active responsibility in the face of audits or inspections by the Personal Data Protection Authority.
Scope
This policy applies to all individuals associated with Abraspungo Tourist Hostel Limited Company, including all personal data of guests, clients, employees, suppliers, strategic partners, and associates, among others. Compliance is mandatory.
Identification of the Responsible Party
Abraspungo Tourist Lodge Limited Company is responsible for the management and protection of personal data provided by its community and users when accessing its platforms or services. In this regard, it is committed to guaranteeing the security and confidentiality of said information, safeguarding the rights of its owners.
The contact information for Abraspungo Tourist Hostel Limited Company is provided below:
- Address: Via a Guano KM 3 ½, Riobamba – Ecuador
- RUC: 0690073005001
- Phone: 032364274 / 032364275
- Cellular: 0997694445
- Email: [email protected]
To ensure the proper handling of your data, Albergue Turístico Abraspungo Compañía Limitada has appointed a Data Processor, whom you can contact for any questions you may have and who can be contacted at the email address [email protected] .
Definitions
To facilitate understanding of this policy, certain important definitions are set out below, obtained in accordance with Article 4 of the Organic Law on the Protection of Personal Data:
- Personal data: Data that identifies or makes identifiable a natural person, directly or indirectly.
- Data Subject: Natural person whose data is being processed.
- Data controller: Natural or legal person, public or private, public authority or other body which, alone or jointly with others, decides on the purpose and processing of personal data.
- Data processor: Natural or legal person, public or private, public authority or other body that, alone or jointly with others, processes personal data on behalf of and for the account of a data controller.
- Processing: Any operation or set of operations performed on personal data, whether by automated, partially automated or non-automated technical procedures, such as collection, compilation, obtaining, recording, organization, structuring, storage, custody, adaptation, modification, deletion, indexing, extraction, consultation, elaboration, use, possession, exploitation, distribution, assignment, communication or transfer, or any other form of enabling access, comparison, interconnection, limitation, deletion, destruction and, in general, any use of personal data.
Beginning
In addition to other principles established in the Constitution of the Republic, international instruments ratified by the State or other legal norms, this policy will be governed by all the principles contained in Article 10 of the Organic Law on the Protection of Personal Data, among which the following are mentioned:
- Principle of Legality: Personal data must be processed in strict adherence to and compliance with the principles, rights and obligations established in the Constitution, international instruments, this Law, its Regulations and other applicable regulations and jurisprudence.
- Principle of Loyalty: Data subjects must be informed precisely for what purpose their personal data is being collected, consulted, used or otherwise processed; furthermore, the processing of personal data through illicit or unfair means or purposes is prohibited.
- Principle of Transparency: The processing of personal data must be transparent, so all information or communication relating to this processing must be easily accessible and easy to understand, using simple and clear language.
- Principle of Purpose: The purposes of the processing must be determined, explicit, legitimate and communicated to the data subject; personal data may not be processed for purposes other than those for which they were collected.
- Principle of Preservation: Personal data will be kept for no longer than necessary to fulfill the purpose of its processing.
Personal Data
Abraspungo Tourist Hostel Limited Company collects, among other personal data, the following:
- Identifying information: Names, surnames, ID number, RUC, passport, among others.
- Contact information: Email address, landline/mobile phone number, home address, etc.
- Data relating to personal characteristics: Date of birth, age, marital status, nationality, country, among others.
- Economic and financial data: Bank account details, credit or debit card information, and credit data, among others.
- Visual data: Through the security system present by means of the cameras installed in our facilities.
The types of data described in this section are merely illustrative and are collected in specific cases, according to the needs of the company and the owner, depending on the services requested.
Obtaining the Data
Abraspungo Tourist Hostel Limited Company collects and processes personal information from its guests, clients, employees, suppliers, strategic partners and associates, among others, obtained through various means and interactions with users.
The data may be obtained in digital or physical format through:
- Administrative, operational, commercial and service personnel.
- Computer systems, booking platforms and video surveillance cameras with audio and video.
- Suppliers, business partners and third parties acting as data processors.
This can be done through requests for information, reservation processes, accommodation, event organization, and other forms of communication.
It should be mentioned that, according to the classification of sensitivity of personal data, this policy will not refer to sensitive data due to its non-existence within the data protection processing described herein.
Purposes of the Treatment
Abraspungo Tourist Hostel Limited Company may process your personal data for the following purposes:
Service Management
| Purpose | Basis of legitimacy |
|---|---|
| Provision of lodging services | Article 7.5 of the LOPDP |
| Provision of restaurant and catering services | Article 7.5 of the LOPDP |
Human Talent and Others
| Purpose | Basis of legitimacy |
|---|---|
| Application and selection for vacancies | Article 7.1 and 7.5 of the LOPDP |
| Contracting and general management | Article 7.2, 7.5 and 7.8 of the LOPDP |
| Selection and hiring in civil relations | Article 7.5 of the LOPDP |
Administrative Management
| Purpose | Basis of legitimacy |
|---|---|
| Management with managers and third parties | Article 7.5 of the LOPDP |
| Security and video surveillance | Article 7.8 of the LOPDP |
| Constant attention and quality of service | Article 7.2, 7.5, 7.6 and 7.8 of the LOPDP |
Financial Management
| Purpose | Basis of legitimacy |
|---|---|
| Collections | Article 7.5 of the LOPDP |
| Payments to collaborators | Article 7.2 and 7.5 of the LOPDP |
| Supplier Billing | Article 7.2 of the LOPDP |
Marketing
| Purpose | Basis of legitimacy |
|---|---|
| Applicants | Article 7.1, 7.5 and 7.8 of the LOPDP |
| Customers | Article 7.5 and 7.8 of the LOPDP |
| Administrators and collaborators | Article 7.5 and 7.8 of the LOPDP |
| Third parties | Article 7.1 and 7.8 of the LOPDP |
Other Purposes
For other purposes of processing, it will be legitimized in accordance with the legality provisions set out in Article 7 of the Organic Law on the Protection of Personal Data.
Retention of Personal Data
Abraspungo Tourist Hostel Limited Company has stipulated that personal data will be kept for the time necessary to fulfill the specific purposes for which they were obtained, guaranteeing compliance with article 8 of the General Regulation of the LOPDP.
This retention will extend for a reasonable period of 10 years to allow for the defense against future claims and audits, both internal and external, administrative or judicial, related to the provision of the services it offers.
In exceptional circumstances, data will be retained for longer periods, provided its use is limited to archiving and public interest purposes, scientific and historical research, or statistical purposes. In such cases, the institution undertakes to implement appropriate technical, organizational, administrative, and legal measures, in accordance with the provisions of the Organic Law on the Protection of Personal Data.
After these periods have elapsed and provided that the data is no longer necessary for the authorized purposes, Albergue Turístico Abraspungo Compañía Limitada will proceed to the elimination, blocking or anonymization of the data in its possession.
Communication of Personal Data
Given the nature of our economic activity, the databases of Albergue Turístico Abraspungo Compañía Limitada are protected by agreements with systems that allow us to collect them.
Notwithstanding the foregoing, Albergue Turístico Abraspungo Compañía Limitada may make communications of personal data within the framework of the conditions of legitimation established in Chapter V of the Organic Law on the Protection of Personal Data.
These transfers, among others, can be:
- Transfer/communication to hotel entities and systems: Data transfer will be carried out through platforms that allow us to obtain your data for the purpose of making reservations and providing our services in the best way.
- Transfer to national institutions (public and private): Sharing data with institutions at the national level through agreements and contracts, in order to guarantee the quality and proper provision of the services offered, complying with the provisions of the law and regulations.
- Transfer to international institutions: Facilitate the transfer of data to institutions if necessary, provided that the Personal Data Protection Authority guarantees that it is secure.
Your personal data may be shared with third-party processors, only in cases necessary for the execution of the services contracted or requested by you, such as:
- Online booking and payment platforms.
- Hotel management software providers.
- Technology service providers (systems maintenance, cloud, email).
- Security or surveillance companies.
- Marketing agencies that manage promotions or information campaigns.
All these third parties are contractually obligated to comply with the Organic Law on the Protection of Personal Data, to process the data exclusively for the agreed purposes and to apply the necessary technical and organizational measures for its protection.
Exercise of the ARCO Rights Access System
Abraspungo Tourist Hostel Limited Company has implemented an ARCO Rights Management and Protection System for review and ease of the holder.
Data subjects may exercise the following rights regarding the processing of their personal data:
- Right to information.
- Right of access.
- Right of rectification and updating.
- Right to elimination.
- Right to object.
- Right to portability.
- Right to consultation.
- Right not to be subject to automated decisions.
For more information, you can consult the complete document of the Abraspungo Tourist Hostel System Limited Company and access the corresponding application to exercise these rights.
The request must be sent to the email addresses [email protected] and [email protected] . Once the request regarding any of the aforementioned rights has been sent, the data subject will receive a response within 10 days .
Technical Measures Adopted
Abraspungo Tourist Hostel Limited Company is committed to ensuring the security of its users' information. To achieve this, it has implemented a robust system to protect the rights and freedoms of data subjects, as well as various administrative, technical, legal, and organizational security measures.
These measures are intended to protect the security, confidentiality, integrity and availability of personal data, preventing misuse, unauthorized alteration, unauthorized access and loss of information.
Similarly, Albergue Turístico Abraspungo Compañía Limitada conducts internal audits of these measures to ensure their suitability and effectiveness against potential breaches or threats, maintaining current and continuous protection of the personal data of guests, clients, employees, suppliers, strategic partners and associates, among others.
Notice of Use of Digital Platforms
Abraspungo Tourist Hostel Limited Company informs you that access to and use of its digital platforms is governed by a Digital Legal Notice, which contains the conditions and guidelines for use.
This notice will establish the responsibilities of both the data controller and the user, and is intended to ensure ethical protection in accordance with current regulations.
The user agrees to make proper and respectful use of the content and services offered through the digital platforms of Albergue Turístico Abraspungo Compañía Limitada, avoiding any conduct that may compromise the operation of these or that affects the rights and interests of the company, other users or third parties.
Furthermore, Abraspungo Tourist Lodge Limited may take the necessary measures in the event of non-compliance with these provisions. For more information on the conditions applicable to the use of digital platforms, please carefully review the aforementioned notice.
Terms and Conditions
The data subject declares that they have read and understood the content of this policy, including the provisions and details on data processing, by ticking a box.
By selecting this box, the holder confirms that they have read and understood the policy in its entirety and gives their free, specific, informed and unequivocal consent, in accordance with Article 8 of the Organic Law on the Protection of Personal Data and Article 5 of its General Regulations.
Abraspungo Tourist Hostel Limited Company reserves the right to unilaterally modify or update the terms of this Privacy and Personal Data Protection Policy in the future, whenever it deems appropriate.
Any modifications made will be published on this same page of the Abraspungo Tourist Hostel Limited Company and will be reviewed at least once a year, or when there are regulatory changes, a security breach is detected or a new treatment is incorporated.
Disseminating this policy is the responsibility of Albergue Turístico Abraspungo Compañía Limitada; however, it is also the responsibility of guests, clients, employees, suppliers, strategic partners, and associates, among others, to read and understand the established terms, as this will allow them to make informed decisions about the delivery of their data.
Validity
This Protocol will come into effect on August 11, 2025 and will be mandatory for all areas, employees, contractors and third parties that interact with personal data under the control of Albergue Turístico Abraspungo Compañía Limitada.
These policies are available at reception, on the institutional website, and at each data collection point. Acceptance is considered tacit upon contracting or using the services, and express when requested through forms, reservations, or specific consent.