Privacy Policy - Sacha Lodge

Privacy Policy

Discover More

PERSONAL DATA PROCESSING POLICY

This Policy describes how SACHALODGE S.A. collects, stores, uses, shares, and deletes personal data, as well as the rights granted to data subjects under the applicable data protection laws of Ecuador.

Purpose of the Policy

This Personal Data Processing Policy informs data subjects of their legal rights, explains how SACHALODGE S.A. guarantees the privacy and protection of their personal information, and discloses how such data will be processed throughout its lifecycle (collection, storage, circulation, use, exploitation, and deletion). It also identifies communication channels for inquiries and complaints regarding personal data. SACHALODGE S.A., hereinafter “the Data Controller,” adopts this Policy as a formal commitment to data subjects.

Scope of the Policy

This Policy applies to all personal data processing carried out directly by SACHALODGE S.A. as the Data Controller, as well as to any processing delegated to third-party processors who act on behalf of the Data Controller pursuant to contractual obligations.

Mandatory Compliance

This Policy is mandatory for every process, department, and organizational level of SACHALODGE S.A. involved directly or indirectly in personal data processing. All internal procedures must include the guiding principles for lawful processing as required by Ecuadorian law.

Definitions

  • Data Subject: A natural person whose personal data is processed.
  • Personal Data: Verifiable information that identifies or makes a natural person identifiable, directly or indirectly.
  • Anonymization: Measures intended to prevent the identification or reidentification of a natural person without disproportionate effort.
  • Database/File: A structured set of data stored, organized, or accessed in centralized or decentralized formats on any type of media or platform.
  • Consent: Free, specific, informed, and unequivocal declaration by which the data subject authorizes the processing of personal data.
  • Biometric Data: Unique personal data related to physical, physiological, or behavioral characteristics allowing unique identification (e.g., facial images, fingerprints).
  • Genetic Data: Personal data relating to inherited/acquired genetic traits providing unique information about an individual's physiology or health.
  • Credit Data: Information that forms a natural person’s economic record to evaluate financial behavior and capacity over time.
  • Data Related to Special Categories: Information relating to ethnicity, gender identity, cultural identity, religion, ideology, political affiliation, criminal history, immigration status, sexual orientation, health, biometric data, genetic data, data of stateless persons or refugees requiring international protection, and any data whose improper processing may lead to discrimination or affect fundamental rights.
  • Health Data: Personal data concerning physical or mental health, including healthcare services revealing health status.
  • Sensitive Data: Data whose improper use may lead to discrimination, including ethnicity, gender identity, cultural identity, religion, ideology, political affiliation, criminal history, immigration status, sexual orientation, health, biometric data, and genetic data.
  • Data Protection Officer (DPO): Individual responsible for advising on legal obligations, monitoring compliance, and acting as liaison with the Data Protection Authority.
  • Recipient: Natural or legal person who receives personal data for lawful purposes.
  • Profiling: Any processing that analyzes or predicts personal aspects such as economic status, health, preferences, interests, skills, or geolocation.
  • Processor: Entity that processes personal data on behalf of the Controller.
  • Pseudonymization: Processing that prevents attribution of data to a data subject without additional information kept separately under appropriate safeguards.
  • Transfer/Disclosure: Any communication or release of personal data to third parties, which must be timely, accurate, complete, and updated.
  • Processing: Any operation involving personal data, whether automated or manual, including collection, storage, use, transfer, consultation, modification, extraction, restriction, and deletion.
  • Personal Data Breach: A security incident affecting the confidentiality, integrity, or availability of personal data.

Principles of Personal Data Processing

  • a) Legality: Processing must comply strictly with applicable law.
  • b) Loyalty: Processing must be lawful, transparent, and in no case deceptive or used for illegal purposes.
  • Transparency: Information regarding processing must be clear, accessible, and easy to understand.
  • d) Purpose Limitation: Data must be collected for explicit, legitimate purposes and not used for incompatible purposes.
  • e) Data Minimization & Relevance: Processing must be limited to what is strictly necessary.
  • f) Proportionality: Processing must be adequate, relevant, and not excessive.
  • g) Confidentiality: Data must be kept confidential and not disclosed unless legally permitted.
  • h) Accuracy & Quality: Data must be accurate, complete, verifiable, and updated when necessary.
  • i) Retention Limitation: Data must not be retained longer than necessary, except for public interest, research, historical or statistical purposes with security guarantees.
  • j) Security: Adequate organizational and technical measures must protect personal data against risks, threats, and vulnerabilities.

Purposes and Processing of Personal Data

  • a) Human Resources
    • Data Processed: Name, ID/passport, address, email, phone, date of birth, education, work history, marital status, ethnicity, blood type, spouse/partner data, children’s data, bank information, photos, images, geolocation, occupational health data.
    • Purposes: Compliance with labor laws, social security, tax laws, corporate benefits (insurance, telecommunications, training).
  • b) Clients
    • Data Processed: Name, ID/passport, address, email, phone, date of birth, health data, minors' data, payment card data, photos, images.
    • Purposes: Reservation and tourism services; medical assistance during stay; payment processing; compliance with legal obligations.
  • c) Suppliers
    • Data Processed: Name, ID/passport, address, email, phone, economic activity, bank and commercial references.
    • Purposes: Contract execution and compliance with legal obligations.

Obligations of the Data Controller

The Controller commits to: (a) Process data in accordance with the Law and its regulations; (b) Implement legal, organizational, and technical safeguards; (c) Conduct compliance evaluations; (d) Implement security mechanisms; (e) Conduct risk and impact assessments when required; (f) Inform data subjects at the time of data collection; (g) Guarantee the exercise of data subject rights; (h) Obtain valid consent; (i) Use data solely for authorized purposes; (j) Ensure all transfers comply with applicable law.

Data Retention

Data will be retained only for the duration necessary to fulfill the processing purposes and within the legal limits established under Ecuadorian law. Confidentiality, integrity, and availability will be guaranteed throughout the retention period.

Final Disposal of Data

Once the purpose of processing has been fulfilled, personal data will be deleted manually or physically. A formal record of deletion will be signed by the Area Responsible and the Data Protection Officer.

Rights of Data Subjects

Data subjects have the following rights: (i) Right to Information; (ii) Right of Access (response within 15 days); (iii) Rectification and Updating; (iv) Deletion (within 15 days upon request); (v) Objection (partial restriction of processing); (vi) Portability; (vii) Suspension; (viii) Right not to be subject to automated decisions or profiling.

To exercise these rights contact: info@sachalodge.com