Privacy Policy and Personal Data Processing

1. Art Hotels Ecuador’s Commitment

At Art Hotels Ecuador, the privacy of our guests, clients, visitors, partners, and digital users is part of the trusted experience we seek to provide in every interaction.

This Privacy Policy and Personal Data Processing Policy explains how we collect, use, store, protect, and manage data through our channels and services, including accommodation, restaurants, terraces, events, catering, web forms, social media, CRM, on-property registrations, and other commercial and customer service channels.

This policy has been prepared in accordance with Ecuador’s Organic Law on Personal Data Protection, its general regulations, and the complementary regulations issued by the Personal Data Protection Superintendence.

2. Identity and Contact Details of the Data Controller

The data controller responsible for processing personal data is:

ARTHOTELES ECUADOR S.A.
Trade name: Art Hotels Ecuador
Address: Quito, Centro Comercial Home Design Plaza, Ground Floor, Store 9, E28C, Tumbaco
Email for requests, inquiries, and the exercise of rights: tratamientodedatos@arthotelsecuador.com

This channel is available for inquiries related to privacy, data updates, withdrawal of consent, and the exercise of rights as a data subject.

3. Scope of This Policy

This policy applies to the processing of personal data obtained through:

• Website and contact, reservation, event, wedding, restaurant, terrace, catering, experience, and newsletter forms
• Social media, lead generation campaigns, and digital messaging
• Commercial and customer relationship systems, including CRM
• Reservation, pre-reservation, stay, and post-stay service processes
• In-person registrations at properties, events, and activations
• Interactions from agencies, OTAs, commercial partners, or authorized third parties

In certain forms or channels, Art Hotels Ecuador may display specific privacy notices or brief consent texts that complement this policy.

4. Principles Guiding Personal Data Processing

Art Hotels Ecuador processes personal data under the following principles:

• Lawfulness, fairness, and transparency
• Specific and legitimate purpose
• Data minimization and relevance
• Proportionality
• Quality and accuracy
• Security and confidentiality
• Proactive responsibility

Our institutional commitment involves all areas that participate in the collection, consultation, use, custody, or management of personal information, under authorized access schemes, need-to-know criteria, and control over suppliers and technology platforms.

5. Personal Data We May Collect

Depending on the service, channel, or interaction, we may collect the following categories of data:

5.1. Identification and Contact Data

First and last names, identification or passport number, nationality, email address, phone number, city or country of residence.

5.2. Reservation, Stay, and Service Data

Travel dates, number of guests, room preferences, reason for travel, stay history, special requests, consumption associated with our services, and relevant information for restaurants, terraces, events, or catering.

5.3. Billing and Transaction Data

Data required for quotations, reservations, confirmations, billing, and administrative management of the service.

5.4. Commercial and Relationship Data

Interests, travel preferences, contact history, source channel, campaign responses, interaction with content and forms, and commercial and communication preferences.

5.5. Technical and Browsing Data

IP address, device identifiers, cookies, browser type, pages visited, browsing time, and other data derived from the use of our website.

5.6. Security Data

Images or records derived from video surveillance systems, access control, or security validations implemented in our facilities or technological environments, when applicable.

5.7. Special Categories of Data

Exceptionally, and only when necessary for the informed purpose, we may process data related to allergies, food intolerances, accessibility requirements, mobility, health information relevant to the safe provision of the service, emergency assistance, or special wellness and safety requirements. In limited and justified cases, biometric or reinforced identification data may also be processed for security and access control purposes.

6. How We Obtain Data

We may obtain personal data:

• Directly from the data subject, when they complete forms, make a reservation, request a quote, subscribe to communications, participate in an event, or visit one of our properties
• From a third party authorized by the data subject, such as agencies, event organizers, or companions who make a reservation
• From digital platforms and channels used in our operations, such as booking engines, CRM, OTAs, form tools, or advertising platforms
• From digital interactions with our website, social media, and marketing campaigns

When we do not obtain data directly from the data subject, we will seek to ensure that the processing maintains a valid legal basis and the transparency required by law.

7. Purposes of Processing and Legal Bases

We process personal data for the following purposes:

7.1. Reservation Management and Service Provision

To handle requests, quotations, reservations, confirmations, check-in, stays, consumption, events, catering, customer service, and post-service follow-up.

7.2. Handling Inquiries, Requirements, and Requests

To respond to messages sent through forms, email, social media, messaging, or commercial channels.

7.3. Marketing, Loyalty, and CRM

To send information about experiences, promotions, benefits, updates, relevant content, event invitations, commercial campaigns, and communications related to Art Hotels Ecuador and its services.

You may withdraw your consent or request to stop receiving commercial communications at any time.

7.4. Commercial Segmentation and Profiling

To understand travel and consumption preferences, organize audiences, prioritize contacts, improve the relevance of our communications, and optimize commercial service.

Art Hotels Ecuador may use segmentation, lead scoring, or commercial analytics tools. These processes will not be used as the sole basis for decisions that produce legal effects or significant impacts on the data subject, unless permitted by law or with explicit consent and the corresponding safeguards.

7.5. Legal Compliance, Security, and Incident Prevention

For accounting, tax, audit, security, claims management, fraud prevention, business continuity, incident response, and protection of people, assets, and facilities.

7.6. Handling Special Health or Dietary Requirements

To adapt our accommodation, restaurant, terrace, event, or catering services to food safety, accessibility, or wellness requirements.

8. Children and Adolescents

Art Hotels Ecuador may process data of children and adolescents when necessary for the management of family reservations, accompanied accommodation, events, or related services, always with special care and under criteria of necessity, minimization, and enhanced protection.

9. Data Retention Period

We retain personal data only for the time necessary to fulfill the informed purposes, meet legal or contractual requirements, and manage the defense of rights and legitimate interests.

As a general criterion, we apply the following periods:

• General inquiries and contact forms without contracting: up to 24 months from the last interaction
• Commercial leads and marketing without conversion: up to 24 months from the last valid interaction or until the data subject withdraws consent or objects to processing
• Newsletter and promotions database: until the data subject unsubscribes, withdraws consent, or after 24 months of verified commercial inactivity
• Unconfirmed reservations or quotations: up to 24 months from the closure of the process, unless an obligation or dispute justifies a longer retention period
• Guests, clients, and contracted service records: during the commercial relationship and up to 7 years thereafter, or for any additional period required by applicable regulations or defense against claims
• Billing and contractual support data: for the periods required by applicable tax, corporate, accounting, or contractual legislation
• Video surveillance and security records: up to 30 days, unless they must be retained due to an investigation, incident, claim, or requirement from a competent authority
• Health, allergy, or special requirement data: only for the time strictly necessary to provide the service or handle the requirement, unless there is a legal obligation to retain it
• Minimum commercial exclusion or blocking records: for as long as necessary to ensure that we do not contact a person again after they have withdrawn consent or objected to processing

10. Transfer or Communication of Personal Data

To fulfill the purposes described, Art Hotels Ecuador may communicate or allow access to personal data to third parties acting as data processors or, in certain cases, as independent controllers, including:

• Hosting, analytics, form, and web support providers
• CRM and commercial automation tools, including GoHighLevel
• Hotel PMS, including Newhotel, booking engine, and channel manager
• Digital advertising and measurement platforms
• OTAs, agencies, or other authorized intermediaries
• Technology, storage, messaging, security, or support providers
• Advisors or providers related to compliance, auditing, or incident response
• Administrative or judicial authorities, when there is a legal obligation

Some of these providers may process data inside or outside Ecuador. In such cases, Art Hotels Ecuador will seek to ensure that the transfer or communication is supported by a valid legal basis and by appropriate contractual, organizational, and technical mechanisms, including duties of confidentiality, limited use, security, return, deletion, or blocking at the end of the relationship, as applicable.

Art Hotels Ecuador does not sell personal data to third parties.

11. Data Subject Rights

As the owner of your personal data, you may exercise the rights recognized under Ecuadorian law, including:

• Access
• Rectification and updating
• Deletion
• Objection
• Portability
• Suspension of processing, when applicable
• Withdrawal of consent
• The right not to be subject to decisions based solely or partially on automated assessments, including profiling, when they generate legal effects or affect rights and freedoms

How to Exercise Your Rights

You may send your request to: tratamientodedatos@arthotelsecuador.com

Your request must include at least:

• Full name of the data subject
• Email address or response channel
• Clear description of the right you wish to exercise
• Sufficient information to identify the relationship, interaction, or data to which the request refers
• Document or reasonable means of identity verification

If the request is submitted by a representative, corresponding proof of representation may be required.

When there is a legal basis for partially or fully denying a request, Art Hotels Ecuador will provide a reasoned response. Without prejudice to the above, the data subject may contact the competent authority in matters of personal data protection.

12. Information Security and Protection Measures

Art Hotels Ecuador adopts reasonable legal, organizational, physical, and technical measures to protect personal data against loss, unauthorized access, alteration, disclosure, misuse, or destruction.

These measures may include, depending on the nature of the processing:

• Access management based on roles and need-to-know criteria
• Authentication controls and credential updates
• Information backups and recovery measures
• Monitoring, traceability, and control of critical platforms
• Evaluation and control of suppliers with access to data
• Deactivation of access when the relationship with authorized personnel or suppliers ends
• Mechanisms for responding to incidents and security breaches
• Periodic risk review and control improvement

13. Personal Data Security Breaches

If Art Hotels Ecuador detects a security breach that may affect the rights and freedoms of data subjects, it will adopt reasonable measures for containment, analysis, correction, and documentation of the incident, as well as the notifications required under applicable regulations.

14. Cookies and Similar Technologies

Our website uses cookies and similar technologies to enable the site’s operation, remember preferences, measure traffic, analyze browsing, and, in certain cases, personalize content or campaigns.

You may manage your preferences through the cookie banner available on the website. Acceptance, rejection, or configuration of non-essential cookies may be carried out through that mechanism, subject to the technical capabilities implemented on the website.

Until Art Hotels Ecuador publishes a specific cookie policy, this section shall govern their general use on the site.

15. Third-Party Links

Our website may contain links to third-party pages, platforms, or services. Art Hotels Ecuador does not directly control the privacy policies of such third parties, so we recommend reviewing their terms before sharing personal information in those environments.

16. Updates to This Policy

Art Hotels Ecuador may update this policy when necessary due to regulatory, technological, operational, or business changes.

The current version will be the one published on the website with its update date. When the change is substantial and legally required, reasonable measures will be adopted to inform the data subject or obtain consent again.