TREATMENT OF PERSONAL INFORMATION POLICY

In compliance with the provisions contained in Article 15 of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013, and additional laws that modify, add, accompany or develop, the company Tradición Hacienda SAS, henceforth Hacienda, is committed to the respect and assurance of the rights of its affiliates, suppliers, employees and third parties in general, discloses the policies and procedures for the treatment of the personal data that is stored and protected on their database, and the mandatory compliance in regards to any and all activities that involve, totally or partially, the collection, storage, use, circulation and / or transfer of said information.

1. LEGAL FRAMEWORK

This policy for treatment of personal information has its regulative support in Article 15 of the Political Constitution, in Law 1581 of 2012, Regulatory Decree 1377 of 2013, stipulates that: 

 

Article 15.  All persons have the right to their personal and familial privacy and to their good name, and, the State must respect their right to privacy and enforce it. Similarly, they have the right to know, update and update the information that has been collected about them in data banks and in files that are held by public and private entities. 

In the collection, treatment and circulation of data, freedom and other guarantees protected by the Constitution will be respected. 

 

Correspondence and other forms of private communication are inviolable. They can only be intercepted or registered by judicial order, in cases and with the formalities established by law. 

 

For tax or judicial purposes and for cases of inspection, surveillance and intervention by the State, the presentation of accounting books and other private documents may be required, under the terms established by law. 

 

Statutory Law 1581 of 2012 

 

“Whereby general provisions for the protection of personal data are issued” 

 

Regulatory Decree 1377 of 2013 

 

“By which Part 1581 of 2012 is partially regulated”

2. GENERAL INFORMATION REGARDING HACIENDA AND ITS RESPONSIBILITY FOR THE TREATMENT OF PERSONAL INFORMATION

Corporate name: Tradición Hacienda s.a.s 

NIT. 900.630.461 

Address: Cra 43 A No. 1 south – 150 local 210 office 215B 

Email: 

Web page:

3. THE OBJECTIVE OF THE TREATMET OF PERSONAL INFORMATION POLICY

The policy for the treatment of personal information is intended to make it known to the general public about the corporate and legal guidelines under which Hacienda will enact the treatment of personal information, the purpose of the policy, the supportive rights and titles as well as the internal and external procedures that exist for the exercise of such rights before Hacienda, among others.

4. LEGAL DEFINITIONS

For the purposes of the enactment of this policy and in accordance with legal regulations, the following definitions shall apply: 

 

a) Authorization: Prior, express and informed consent of the Holder to carry out the processing and treatment of personal data;

  

b) Database: Organized set of personal data that is subject to processing;

  

c) Owner: Natural person whose personal data are subject to processing, whether client, supplier, employee, or any third party who, by reason of a commercial or legal relationship, provides personal data to Hacienda.

 

d) Treatment: Any operation or set of operations conducted on personal data, such as collection, storage, use, circulation or deletion

  

e) Personal data: Any information linked to or associated with one or several natural persons determined or determinable;

  

f) Public data: It is the data that is not semi-private, private or sensitive. They are considered public information, among others, the data relative to the civil status of the people, to their profession or trade and to their quality of merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, newspapers and official bulletins and judicial sentences duly executed that are not subject to reservation.

 

 

g) Sensitive data: Sensitive data are those that affect the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, belonging to trade unions, social organizations, human rights organizations or those that promote the interests of any political party or that guarantee the rights and assurances of opposing political parties, as well as data related to health, sexual life, and biometric data.

 

h) Transfer: The transfer of data takes place when the person in charge and / or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a receiver, who in turn is responsible for the processing and is within or out of the country.

  

i) Transmission: Processing of personal data that implies their communication within or outside the territory of the Republic of Colombia when its purpose is to carry out processing of the data by the Person in Charge on behalf of the Responsible Party.

When a term used is defined in this Information Processing Policy, that definition will be used. Likewise, when a term used is not expressly defined in this document or in the applicable Law, it will be the literal meaning of the stipulations, provided that such interpretation is consistent with the purpose of the Information Processing Policy.

5. PRINCIPLES THAT GOVERN THE ACTING OF HACIENDA IN THE PROCESSING OF PERSONAL DATA

The principles that govern the Treatment of Personal Data by Hacienda are the following:

• Principle of legality: the treatment of personal data is a regulated activity that must be subject to the provisions of Law 1581 of 2012 in Decree 1377 of 2013 and the other provisions that develop them.

• Principle of purpose: the purpose of the processing of data must be legitimate, and the owner informed.

• Principle of reasonable limit: the storage and processing of personal data will be limited to what is essentially necessary to fulfill the previously specified purposes of the business relationship, as well as the fulfillment of the purposes authorized by the Holder.

• Principle of freedom: personal data can only be treated with the prior, express and informed consent of the Holder or by legal or judicial mandate.

• Principle of truth: the information must be true, complete, accurate, updated, verifiable and understandable.

• Principle of transparency: the right of the Holder to obtain information about their personal data whose treatment is carried out by Hacienda must be guaranteed.

• Principle of Access and restricted circulation: The Treatment of personal data can only be done by persons authorized by the Holder or by the persons provided for in the Law.

• Principle of Security: the information must be handled with the necessary measures to grant security to the records and avoid their contamination, loss, consultation, use or unauthorized or fraudulent access.

• Principle of Confidentiality: personal data that is not public in nature are reserved and can only be provided in the terms of the Law.

• Principle of systematic incorporation: the principles of Personal Data Protection will be implemented in all processes and procedures of the commercial activity of Hacienda

6. RIGHTS THAT SUPPORT THE HOLDERS OF PERSONAL DATA

a) Know, update and rectify your personal data in front of the Responsible for the Treatment or Managers of the Treatment of personal data. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose Treatment is expressly prohibited or has not been authorized;

  

b) Request proof of the authorization granted to the Person Responsible for Processing, except when expressly excluded as a requisite for the Treatment, in accordance with the provisions of article 10 of this law;

  

c) To be informed by the Person Responsible for the Treatment or the Person in Charge of the Treatment, upon request, regarding how the personal data has been utilized;

 

 

d) Submit complaints to the Superintendent of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add or complement it;

  

f) Revoke the authorization and / or request the deletion of the data when in the Treatment, the principles, rights and constitutional and legal guarantees are not respected. The revocation and / or suppression will proceed when the Superintendent of Industry and Commerce has determined that in the Treatment the Responsible or Person in Charge has entered into conduct that is contrary to this law and the Constitution;

  

Access, free of charge, to your personal data that have been subject to Treatment.

7. AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

Hacienda acting as Responsible for the Treatment has adopted procedures to request, at the latest, at the time of the collection of your personal data, your authorization for the Treatment of the information and inform you of the personal data that will be collected as well as all the specific purposes of the Treatment for which your consent is obtained. 

 

It will be understood that the Holder has granted the Authorization of the Processing of their personal data when it manifests: (i) in writing; (ii) orally; or (iii) through unequivocal conduct of the Holder that allows the reasonably conclusion that the latter granted the respective authorization to Hacienda. In no case will silence be understood as unequivocal behavior. 

 

Notwithstanding the preceding, the Holder’s authorization shall not be necessary in the case of: (i) Information required by a public or administrative entity in the exercise of its legal functions or by court order; (ii) Data of a public nature; (iii) Cases  

of medical or sanitary emergency; (iv) Processing of information authorized by law for historical, statistical or scientific purposes; and (v) Data related to the Civil Registry of Persons

8. REVOCATION OF THE AUTHORIZATION AND / OR SUPPRESSION OF THE DATA

The Owner of the personal data may at any time request Hacienda as Responsible for the Treatment, the deletion of their personal data and / or revoke the authorization that has been granted for the Treatment thereof, by submitting a claim, in accordance with what is established in article 15 of Law 1581 of 2012. 

Notwithstanding the preceding, we warn that the request to suppress the information and / or the revocation of the authorization will not proceed when the owner of the personal data has a legal or contractual duty by virtue of which it must remain in the Hacienda database.

9. PURPOSE OF THE PROCESSING OF PERSONAL DATA

Hacienda will carry out the processing of personal data for the following purposes: 

  

i.Perform, through any means directly or through third parties, marketing activities, promotion and / or own advertising or third parties, sale, billing, collection management, collection, programming, technical support, market intelligence, improvement of the service, verifications and consultations, control, behavior, habit and authorization of means of payment, fraud prevention, as well as any other related to our products and services, current and future, for compliance with contractual obligations and our corporate purpose. 

 

Generate optimal communication in relation to our services, products, promotions, billing and other activities.

  

iii. Evaluate the quality of our products and services and conduct studies on consumer habits, preference, purchase interest, product testing, concept, service evaluation, satisfaction and others related to our services and products. 

  

Provide assistance, servicesortechnical support for our products and services. 

  

Carry out the necessary steps to comply with the obligations inherent to the services provided by Hacienda. 

 

Comply with the obligations contracted with our affiliates, allies, users, suppliers, their subsidiaries, distributors, subcontractors and others directly or indirectly related to the corporate purpose of Hacienda.

 

vii. Control and prevent fraud in all its forms.

10. PROCEDURE FOR ATTENTION OF REQUESTS AND CONSULTATIONS RELATED TO PERSONAL INFORMATION

The holder of personal data or who is duly authorized may: 

  1. Formulate a request or consult to identify the personal information of the Holder that rests in Hacienda.

 

  1. Request the updating, modification, rectification or deletion of the data of the Holder, when this is done in accordance with this Policy and the applicable Law.

  

  1. Request a copy of the authorization granted by the Owner to Hacienda to carry out the Processing of your Personal Data.

 

These consultations may be carried out free of charge at least once each calendar month and each time there are substantial modifications of the Information within the Treatment Policies that motivate new consultations. The Holder or whoever is authorized to do so, may make queries to Hacienda about the Holder’s personal information through the following mechanisms: 

 

 

In writing, sent to the following address: Cra 43 A No. 1 sur 150 local 210 office 215B. 

 

Email to the address: 

The consultation will be attended within a maximum term of ten (10) business days counted from the date of receipt of the correspondence. 

When it is not possible to attend the consultation within the aforementioned term, Hacienda will inform the interested party, stating the reasons and stating the date on which the request will be addressed, at the latest within five (5) business days following the expiration of the first request.

11. PROCEDURE FOR THE ATTENTION OF CLAIMS AND REVOCATION OF THE AUTHORIZATION OF THE PROCESSING OF PERSONAL DATA

Through this procedure, the Holder or whoever is duly authorized may: 

  1. Revoke the Authorization for Data Processing.

  

  1. Submit a claims when it considers that there is an alleged breach of the duties of Hacienda related to the Processing of Personal Data, in accordance with the provisions of these Policies or the Law on Protection of Personal Data.

 

Revocation of the Holder’s Authorization for the Processing of Personal Data. 

The Holder may revoke the authorization and request the deletion of their data in the following events: 

 

 

  • By unilateral, free and voluntary decision of the Holder of the Personal Data, when there is no legal or contractual obligation that imposes the Holder the duty to remain in the database; and

 

  • When the principles, rights and constitutional and legal guarantees are not respected, as long as the Superintendent of Industry and Commerce has determined that in the Treatment the Responsible or Person in Charge has incurred in conducts contrary to the ordering.

 

The foregoing, without prejudice to the rules that the Hacienda must observe in terms of documented retention for compliance with formal obligations. Consequently, Hacienda will suppress the data or suspend its use when this is the case, respecting the documented protection norms that are applicable to it. 

The procedure for handling complaints about the Holder’s personal data is as follows: 

The Owner or whoever is duly authorized to do so, may submit claims to Hacienda in relation to the Processing of their Personal Data, in the following events: 

 

  • When it considers that the Holder’s information contained in a database should be subject to correction, updating or deletion; or
  • When it notices the alleged breach of any of the duties contained in the Data Protection Law.

 

The formulation of claims must be made through any of the following channels of attention: 

 

  • In writing, sent to the following address:Cra43 A No. 1 south – 150 local 210 office 215B. 

 

  • Email to the following email address:

 

The claim presented by the Holder or by the person authorized to do so must contain at least the following: (i) Identification of the Holder of the Personal Data; (ii) Description of the facts that give rise to the claim; (iii) Contact information and location of the Personal Data Owner (Address, telephone, cell phone, email, etc.); and (iv) The documents or evidence that supports your claim. In case of not having the previous information, it will be understood that the claim is not complete. 

 

 

If the claim is incomplete, Hacienda will request the interested party to correct the faults or send the information or documentation that is required within five (5) business days following receipt of the claim by Hacienda. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been abandoned and the file will be archived. 

 

Hacienda has a term of fifteen (15) business days to address the claim, counted from the business day following the date of receipt by Hacienda. 

When it is not possible to meet the claim within the aforementioned term, Hacienda will inform the interested party of the reasons for the delay and the date on which the claim will be handled, which may not exceed eight (8) business days following the expiration of the first term.  

 

Area Responsible for the Attention of Requests, Queries and Claims 

The area of Customer Service for Hacienda oversees receiving the requests, queries and claims of the Owner of the Personal Data related to their rights to know, update, rectify and delete the Personal Data and revoke the authorization. Likewise, the Customer Service area will ensure the timely and appropriate response issued by each of the areas of Hacienda to the requests, queries and claims of the Data Owners.

12. VALIDITY OF THE PERSONAL INFORMATION PROCESSING POLICY

The present policy of treatment of personal information is effective as of January 1, 2015 and until such time as it is expressly revoked or modified.