PRIVACY POLICY

Controller

  • Identity: HOTELMASHPI S.A.
  • Address: Reserva Privada Mashpi, Mashpi 150150.
  • Phone: +593 96-3871-001 option Data Protection
  • E-mail: [email protected]
In this privacy statement, we explain what we do with the data we collect about you through www.mashpilodge.com. If you have any questions or want to know exactly what data we store about you, please contact us.

Data processing purpose

HOTELMASHPI S.A. S.A. processes the personal data for which you are the holder through both automated and non-automated information systems, such as email systems, computer applications, paper documentation, among others, with the purpose of managing the request made through the website, whether through a contact form or any other type of online form, or through an email request. This is also to ensure the proper professional management and business relationship, as well as contact with you to enable the effective provision of the service or operation contracted, after-sales service management, and the processing of any potential claims.

Additionally, when applicable, the provided data will also be processed to send you commercial information about our products and services that may be of interest to you, by mail, email, SMS, or any other equivalent electronic communication means. If the user does not wish for this last treatment, they will have the opportunity to opt-out of receiving commercial communications, by not checking the corresponding box in the information or contact form itself, or even by exercising their right to object at the previously mentioned address.

Access to this website may involve the use of cookies. Cookies are small amounts of information that are stored in the browser used by the user, so the server records information that can be used in subsequent accesses. The stored information allows for the identification of a specific user and keeps a record of information about their preferences, pages they visit, etc. If you do not wish to allow the installation of cookies on your computer, you should configure your browser accordingly. For more information about cookies, please consult our Cookie Policy.

Conservation period

The information about you will be kept for the duration of the business relationship, or the interest for which you are reading this policy (for example, if you have sent a CV, or subscribed to commercial communications) until you request the deletion of your data, during the period of limitation of any actions that may arise in connection with this contract; as well as for any claim that we may receive from official bodies in compliance with legislative standards.

Information to send you commercial communications

Personal data provided for the sending of commercial communications will continue to be retained until you revoke your consent, without prejudice to your right of deletion or opposition.

Legitimation for the processing of your data

The legal basis for the processing of your data is the execution of the contractual relationship to which you are a party, so that we can manage, develop and control the corresponding commercial and contractual relationship, including communication with you for such management.

For all other processing, your consent will be requested, which you may revoke at any time.

The data may only be used for the purposes set out in the previous paragraph, in accordance with the guiding principles of the regulations on the protection of personal data.

Refusal to provide the requested personal data, or the provision of inaccurate or incomplete data, may result in the impossibility of providing the service. You are responsible for the veracity of the data provided, as well as for informing HOTELMASHPI S.A. of any modification of the same.

Communication or transfer of data and international data transfer.

The data will be transferred in those cases in which it is legally required to public entities with competence in the matter or competent merchant/maritime authorities, migration and customs, the Galapagos National Park and the Galapagos Government Council, as well as to any other third parties necessary to enable the provision of the contracted service (hotels, airlines, shipping companies…).

Within the framework of the Business Group to which HOTELMASHPI S.A. belongs, you are informed that your data may be communicated to the companies of the Group for the purpose of providing intra-group services at the corporate level and for the use of corporate tools. Likewise, with your prior consent, your data may be transferred for the Group’s own purposes, such as the sending of previously informed commercial communications.

Furthermore, on the occasion of the use of corporate tools, whose servers are hosted in the USA and elsewhere, personal data are subject to international data transfers. However, such international transfer of data has all the security guarantees given that our suppliers are adhered to the standard contractual clauses, which provides the international transfer of data with the necessary security guarantees to comply with Regulation (EU) 2016/679 of the European Parliament for Data Protection.

Rights

You have the right to obtain confirmation about whether we are processing personal data concerning you, and if so, you will have the right of access to your personal data, the purposes of the processing, and the categories of personal data in question.

Likewise, you will have the right to request the rectification and updating of inaccurate data or, where appropriate, request its deletion or removal when the data is no longer necessary for the purposes for which they were collected; the given consent has been revoked or it is indicated that it has not been granted for one or several specific purposes, without the need for any justification; the personal data has been processed unlawfully; they must be deleted to comply with a legal obligation; the personal data retention period has expired; or the processing affects fundamental rights or individual freedoms.

You may request the limitation or suspension of the processing of your data when you contest the accuracy of the personal data during the period that allows the data controller to verify its accuracy; the processing is unlawful and you oppose the deletion of the personal data and request instead the limitation of its use; the data controller no longer needs the personal data for the processing purposes, but you need them for the formulation, exercise, or defense of claims; or you have objected to the processing while it is being verified if the legitimate reasons of the data controller prevail over yours. In such cases, we will only keep the data for the exercise or defense of claims.

Under certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. HOTEL CASAGANGOTENA S.A. will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims.

You have the right to receive the personal data that concerns you, by exercising the right to data portability, in a compatible, updated, structured, common, interoperable, and machine-readable format, and to transmit them to another data controller without hindrance from the one who had provided them, when the processing is based on consent; the processing is carried out by automated means; it is a significant volume of personal data; or the processing is necessary for the fulfillment of obligations and the exercise of rights of the data controller or processor, or of the data subject in the field of labor law and social security. Such portability will be economically and financially efficient, expedient, and unhindered.

If applicable, you have the right not to be subject to a decision based solely or partially on assessments that are the product of automated processes, including profiling, that produce legal effects on you or that infringe upon your fundamental rights and freedoms.

Finally, you have the right to public and free consultation of the National Register of Personal Data Protection of HOTELMASHPI S.A., in accordance with this Law.

When the affected persons exercise the aforementioned rights, they must communicate it by email to the address [email protected].

Please make sure to always clearly indicate who you are so that we can be sure not to modify or delete any data from the wrong person.

Security

We are committed to the security of personal data. We take appropriate security measures to limit misuse and unauthorized access to personal data. This ensures that only necessary persons have access to your data, that access to data is protected and that our security measures are regularly reviewed.

Third-party websites

This privacy statement does not apply to third party websites linked to our website. We cannot guarantee that these third parties will handle your personal data reliably or securely. We recommend that you read the privacy statements of these sites before using them.

Changes to this privacy statement

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly to be aware of any changes. In addition, we will actively inform you whenever possible.

Claims

If you are not satisfied with the way we handle or process your personal data, you have the right to file a complaint with the applicable Data Protection Authority, as well as with the Data Protection Superintendence of Ecuador, especially when you have not obtained satisfaction in the exercise of your rights.

If you are interested in more information, please review the following resources:

HOTELMASHPI S.A., located at Reserva Privada Mashpi, Mashpi 150150, with the email address [email protected], processes personal data for which you are the holder through automated and non-automated information systems, such as email systems, computer applications, paper documentation, and others. The purpose of this is to carry out reservations requested by passengers or agencies (flight bookings, purchase of migration cards, services of the Galápagos National Park, catering and hotels, migration and customs procedures), as well as the verification and management of the passenger list and cabin assignment. This could involve processing data on dietary or health restrictions requested through our health status forms. Additionally, in the case of processing personal data of minors under your care, as parents or legal guardians, you authorize the treatment of this data for the previously described purposes.

The legal basis for the processing of your data is the present business relationship. The data may only be used for the purposes set out in the previous section, in accordance with the guiding principles of the regulations on personal data protection. Refusing to provide the requested personal data, or providing inaccurate or incomplete data, could result in the inability to provide the service. You are responsible for the accuracy of the data provided and for informing HOTELMASHPI S.A. of any modifications to them. The data will be transferred in cases where it is legally required to public entities with jurisdiction in the matter or competent maritime/merchant authorities, immigration and customs, the Galápagos National Park and the Galápagos Government Council, as well as any other third parties necessary to enable the provision of the contracted service (hotels, airlines, shippers…).

Within the framework of the Business Group to which HOTELMASHPI S.A. belongs, you are informed that your data may be communicated to the Group’s companies, due to the provision of intra-group services at the corporate level and the use of corporate tools.

Furthermore, due to the use of corporate tools, whose servers are hosted in the U.S. and others, personal data is subject to international data transfers. However, this international data transfer is fully secure since our suppliers adhere to standard contractual clauses, providing the necessary security guarantees for the international data transfer to comply with Regulation (EU) 2016/679 of the European Parliament for Data Protection.

You can exercise your rights of access, rectification, deletion, opposition, limitation of processing, and portability by sending a request for rights exercise to the email address [email protected] and providing a two-sided photocopy of your legal identification document. You can also file a complaint with the applicable Data Protection Control Authority, as well as with the Ecuador Data Control Authority, especially when you have not obtained satisfaction in exercising your rights. You can contact our Data Protection Officer at [email protected].

Identification of the Data Processing Officer:
Identity: HOTELMASHPI S.A.
Address: Reserva Privada Mashpi, Mashpi 150150
Phone: +593 96-3871-001 Data Protection Option
Email: [email protected]

Purpose of Processing your personal data:
HOTEL CASAGANGOTENA processes your personal data, both through automated and non-automated systems such as email, software applications, paper documentation, among others, for the purpose of effectively carrying out professional management, the business relationship, as well as contacting you to ensure the effective delivery of the contracted service or operation, post-sales service management, and processing any potential claims.

Furthermore, we wish to use your data to send service quality surveys to measure your experience as a customer.

Additionally, in the event of processing personal data of minors under your care, as parents or legal guardians, by this document, you authorize the treatment of such data for the purposes described above.

The provided personal data will be kept while the business and professional relationship is maintained and, subsequently, during the prescription period of actions according to the applicable legal requirements.

Legitimization for the processing of your data:
The legal basis for the processing of your data is the approval of a contract, as detailed in its terms and conditions.

For other treatments, your consent will be requested, which you can revoke at any time.

Data can only be used for the purposes set out in the previous paragraph, in accordance with the guiding principles of personal data protection regulations.

Refusal to provide the requested personal data, or provision of inaccurate or incomplete data, could result in the inability to provide the service. You are responsible for the accuracy of the data provided and for notifying HOTEL CASAGANGOTENA of any changes.

Communication or Transfer of Data and International Data Transfers:
Data will be transferred in cases where it is legally required to competent public entities or maritime/shipping competent authorities, immigration and customs, Galápagos National Park and Galápagos Government Council, as well as any other necessary third parties to enable the provision of the contracted service (hotels, airlines, shippers, etc.).

Within the Business Group to which HOTEL MASHPILODGE belongs, you are informed that your data can be communicated to group companies for the provision of intra-group corporate services and the use of corporate tools. Likewise, with your consent, your data can be transferred for purposes specific to the Group, such as sending commercial communications related to the previously informed tourism sector.

Also, due to the use of corporate tools, whose servers are hosted in the U.S. and others, personal data is subject to international data transfers. However, such international data transfer has all the necessary security guarantees since our suppliers adhere to standard contractual clauses, providing the necessary security guarantees to comply with Regulation (EU) 2016/679 of the European Parliament for Data Protection.

Rights:
Anyone has the right to obtain confirmation as to whether HOTEL MASHPILODGE is processing personal data concerning them, and in such a case, they will have the right of access to their personal data, the purposes of the processing, and the categories of personal data concerned.

They will also have the right to request the rectification and updating of inaccurate data or, if appropriate, request its deletion or elimination when the data is no longer necessary for the purposes for which it was collected; the given consent has been revoked or is indicated as not granted for one or more specific purposes, without the need for any justification; personal data has been processed unlawfully; must be deleted to comply with a legal obligation; the data retention period has expired; or the treatment affects fundamental rights or individual freedoms.

You can request the limitation or suspension of the processing of your data when you dispute the accuracy of the personal data during the period that allows the person in charge to verify the accuracy of the same; the treatment is unlawful, and the interested party opposes the deletion of personal data and requests instead the limitation of its use; the person responsible no longer needs the personal data for the processing purposes, but the interested party needs them for the formulation, exercise, or defense of claims; or the interested party has opposed the processing, while verifying if the legitimate reasons of the person responsible prevail over those of the interested party. In such cases, we will only keep the data for the exercise or defense of claims.

Under certain circumstances and for reasons related to your particular situation, you can object to the processing of your data. HOTEL MASHPILODGE will stop processing the data, except for compelling legitimate reasons or the exercise or defense of possible claims.

You have the right to receive the personal data that concerns you, by exercising the right to portability, and that you have provided, in a compatible, updated, structured, common, interoperable, and machine-readable format, and to transmit them to another person responsible for processing without being prevented by the person responsible to whom they had been provided, when the treatment is based on consent; the treatment is carried out by automated means; a significant volume of personal data is involved; or the treatment is necessary for the fulfillment of obligations and the exercise of rights by the person responsible or in charge of processing personal data, or by the owner in the field of labor law and social security. Such portability will be economically and financially efficient, expeditious, and without obstacles.

If applicable, you have the right not to be subject to a decision based solely or partially on evaluations that are the result of automated processes, including profiling, that produce legal effects on your person or that affect your fundamental rights and freedoms.

Finally, you have the right to public and free consultation of the National Register of Personal Data Protection of MASHPILODGE, in accordance with this Law.

When affected individuals exercise the above rights, they must communicate it by email to [email protected]

You can also file a complaint with the applicable Data Protection Control Authority, as well as with the Ecuador Data Protection Control Authority, especially when you have not obtained satisfaction in the exercise of your rights.

Origin:
The personal data that we process at MASHPILODGE comes from the interested party.

In evidence of compliance, I am informed and give my consent for the informed treatments.

Compliance with Data Protection Regulations:
In compliance with established data protection regulations, we inform you of the following:

Identification of the Data Processing Officer:
Identity: HOTEL MASHPILODGE S.A.
Address: Reserva Privada Mashpi, Mashpi 150150.
Phone: +593 96-3871-001 Data Protection Option
Email: [email protected]

Purpose of Processing your personal data:
HOTEL MASHPILODGE processes your personal data using both automated and non-automated systems, such as email systems, software applications, paper documentation, among others, with the purpose of efficiently managing suppliers and communicating with them.

The provided personal data will be retained as long as the business and professional relationship lasts and, once this relationship ends, during the period for any possible legal actions related to this agreement.

Legitimization for the processing of your data:
The legal basis for processing your data is the approval of a contract, as detailed in its terms and conditions, as well as complying with legal obligations.

Data can only be used for the purposes mentioned previously, following the guiding principles of personal data protection regulations.

Refusing to provide the requested personal data, or providing inaccurate or incomplete data, could lead to the inability to provide the service. You are responsible for the accuracy of the data given and for notifying HOTEL MASHPILDOGE of any changes.

Communication or Transfer of Data and International Data Transfers:
Data will be transferred in cases where legally required to competent public entities or banking entities.

Within the Business Group to which HOTEL MASHPILODGE belongs, you are informed that your data can be communicated to companies within the Group for the provision of intra-group corporate services and the use of corporate tools.

Moreover, due to the use of corporate tools whose servers are hosted in the U.S. and elsewhere, personal data is subject to international data transfers. Nevertheless, such international data transfer is secure since our providers adhere to standard contractual clauses, providing the necessary security guarantees to comply with Regulation (EU) 2016/679 of the European Parliament for Data Protection.

Rights:
Anyone has the right to obtain confirmation whether HOTEL MASHPILODGE is processing personal data concerning them. If so, they have the right of access to their personal data, the purposes of the processing, and the categories of personal data involved.

They also have the right to request the rectification and updating of inaccurate data or, if applicable, its deletion when the data is no longer necessary for the purposes it was collected for; the given consent has been revoked, or it is indicated that consent has not been granted for one or more specific purposes; personal data has been processed unlawfully; must be deleted to fulfill a legal obligation; the data retention period has expired; or the processing infringes on fundamental rights or individual freedoms.

You can request the limitation or suspension of the processing of your data in the following scenarios: you dispute the accuracy of the personal data while allowing the entity time to verify its accuracy; the processing is unlawful, and you oppose the deletion of your data, requesting instead its limitation; the entity no longer needs the personal data for processing purposes, but you require it to file, exercise, or defend claims; or you have objected to the processing, pending verification of whether the entity’s legitimate grounds override yours.

In certain circumstances and for reasons related to your specific situation, you may oppose the processing of your data. HOTEL MASHPILODGE will cease processing the data, except for compelling legitimate reasons or for the exercise or defense of potential claims.

You have the right to receive the personal data that concerns you in a structured, commonly used, and machine-readable format, exercising the right to data portability, and transmit this data to another processing entity without hindrance.

If applicable, you have the right not to be subject to a decision based solely or partially on automated processing, including profiling, which produces legal effects or significantly affects you.

Lastly, you have the right to free public consultation of the National Register of Personal Data Protection of HOTEL MASHPILODGE, in accordance with this law.

To exercise any of the aforementioned rights, affected individuals should communicate via email to [email protected].

Furthermore, you can file a complaint with the appropriate Data Protection Control Authority, as well as with the Ecuador Data Protection Control Authority, especially when you have not achieved satisfaction in exercising your rights.

HOTEL MASHPILODGES.A., located at Reserva Privada Mashpi, Mashpi 150150, with the email address [email protected], processes your personal data through both automated and non-automated information systems, such as email systems, software applications, paper documentation, among others, with the purpose of managing visits to our facilities. The provided data will be retained for the duration of the visit and for 30 days thereafter. Refusing to provide the requested personal data, or providing inaccurate or incomplete data, could result in the inability to provide the service. You are responsible for the accuracy of the data provided and for notifying HOTEL MASHPILODGE of any changes to it. The data will not be transferred to third parties, except in cases where there is a legal obligation to do so. You can exercise your rights of access, rectification, deletion, opposition, limitation of processing, and portability by sending a request to exercise these rights to the email address [email protected], accompanied by a photocopy of both sides of your legal identification document. Likewise, you can file a complaint with the relevant Data Protection Control Authority, as well as with the Ecuador Data Protection Control Authority, especially when you have not received satisfaction in exercising your rights. You can contact our Data Protection Officer at [email protected].

In compliance with data protection regulations, we inform you of the following aspects:

Identification of the Data Controller:

  • Identity: HOTEL MASHPILODGE S.A.
  • Address: Reserva Privada Mashpi, Mashpi 150150.
  • Phone: +593 96-3871-001, Data Protection option
  • Email: [email protected]

Purpose of Processing Your Personal Data:
MASHPILODGE processes the personal data for which you are the owner through automated information systems with the purpose of managing the security of the facilities through a video surveillance system.
The personal data provided will be retained for a maximum period of 30 days, unless they have to be preserved to accredit the commission of acts that attack the integrity of people, property, or facilities.

Legal Basis for the Processing of Your Data:

  • Legitimate interest based on the Private Surveillance and Security Law, in which the processing of images for security reasons is covered.
  • The data can only be used for the purposes mentioned in the previous section, in accordance with the principles of transparency and purpose limitation.

Communication or Transfer of Data and International Data Transfers:

  • The personal data of your image, captured through the video surveillance system, will only be transferred by judicial requirement or when legally established to the state security forces and bodies.
  • Furthermore, there are Data Processors on behalf of MASHPILODGE whose legitimacy of the processing is the execution of the contract of commission for the provision of maintenance services of systems and security of facilities.

Rights:
The interested party can exercise their rights of access, rectification, deletion, opposition, limitation of processing, and portability by sending a request to exercise rights to the address [email protected] and providing a photocopy of both sides of their legal identification document.
Furthermore, you can file a complaint with the Data Protection Control Authority that applies to you, as well as with the Superintendency of Data Protection of Ecuador, especially when you have not obtained satisfaction in the exercise of your rights.

HOTEL MASHPILODGE S.A. con domicilio en Reserva Privada Mashpi, Mashpi 150150, y dirección de email [email protected], lleva a cabo el tratamiento de los datos personales de los que Usted es titular a través de sistemas de información automatizados y no automatizados, tales como:

  • Sistemas de correo electrónico,
  • Aplicaciones informáticas,
  • Documentación en papel, entre otros,

Con la finalidad de llevar a cabo la realización del pedido, facturación de los servicios y la gestión de las correspondientes comunicaciones relacionadas con el propio servicio ofrecido. La base legal para el tratamiento de sus datos es la presente relación comercial. Los datos sólo podrán ser utilizados para los fines expuestos en el anterior epígrafe, de acuerdo con los principios rectores de la normativa en materia de protección de datos personales.

La negativa a suministrar los datos personales solicitados, o la entrega de datos inexactos o incompletos, podría ocasionar la imposibilidad de prestación del servicio. Usted se hace responsable de la veracidad de los datos facilitados, así como de comunicar a HOTEL MASHPILODGE cualquier modificación de los mismos. Los datos serán cedidos en aquellos casos en que así se exija legalmente a las entidades públicas con competencia en la materia o autoridades mercantes competentes, así como a cualesquiera otros terceros necesarios para habilitar la prestación del servicio contratado (hoteles, aerolíneas, navieros…).

En el marco del Grupo Empresarial al que pertenece HOTEL MASHPILODGE se le informa de que sus datos pueden ser comunicados a las sociedades del Grupo, con motivo de:

  • La prestación de servicios intragrupo a nivel corporativo y
  • Uso de herramientas corporativas.

Asimismo, previo consentimiento por su parte, sus datos pueden ser cedidos para finalidades propias del Grupo, tales como el envío de comunicaciones comerciales previamente informado.

Con ocasión del uso de herramientas corporativas, cuyos servidores se encuentran alojados en EE.UU. y otros, los datos personales están sujetos a transferencias internacionales de datos. No obstante, dicha transferencia internacional de datos cuenta con todas las garantías de seguridad dado que nuestros proveedores se encuentran adheridos a las cláusulas contractuales tipo, que dota a la transferencia internacional de los datos de las garantías de seguridad necesarias para cumplir con el Reglamento (UE) 2016/679 del Parlamento Europeo para la Protección de Datos.

Usted puede ejercitar sus derechos de acceso, rectificación, supresión, oposición, limitación del tratamiento y portabilidad, mediante el envío de una solicitud de ejercicio de derechos a la dirección [email protected], y aportando una fotocopia por las dos caras de su documento legal de identificación. Asimismo, podrá presentar una reclamación ante la Autoridad de Control de Protección de Datos que le resulte de aplicación, así como frente a la Autoridad de Control de Protección de Datos de Ecuador, especialmente cuando no haya obtenido la satisfacción en el ejercicio de sus derechos. Puede contactar con nuestro Responsable de Protección de Datos en [email protected].