PERSONAL DATA PROCESSING POLICY CARVAJAL LLC

Business name:CARVAJAL LLC
Nit:890.321.567-0
Home:29th Street North 6A-40 Cali
Phone:(2) 6675011
Email:protecciondedatos@carvajal.com
Web page:www.carvajal.com

 

  1. LEGAL REGULATIONS AND SCOPE OF APPLICATION: The present policy of processing of personal data is prepared in accordance with the provisions of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other complementary provisions and will be applied by CARVAJAL LLC regarding the collection, storage, use, circulation, deletion and of all those activities that constitute the processing of personal data.
  2. DEFINITIONS: For the purposes of executing this policy and in accordance with legal regulations, the following definitions shall apply: a) Authorization: Prior, express and informed consent of the Holder to carry out the processing of personal data; b) Privacy notice: Physical document, electronic or in any other format generated by the Responsible that is made available to the Owner for the processing of their personal data. In the Privacy Notice, the Owner is informed about the existence of the information treatment policies that will be applicable to them, the way to access them and the purpose of the treatment that is intended to give personal data; c) Database: Organized set of personal data that is subject to Treatment; d) Personal data: Any information linked or that may be associated with one or several natural persons determined or determinable; e) Public information: It is the data classified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Are public, among others, the data regarding the civil status of people, their occupation or trade, their status as a merchant or public servant and those that can be obtained without any reservation. By its nature, public data may be contained, among others, in public records, public documents, gazettes and official bulletins; f) Private data: It is the data that by its intimate or reserved nature is only relevant for the owner; g) Sensitive data: Sensitive data is understood to be those that affect the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations, of human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data; h) Data Processor: Individual or legal person, public or private, that by itself or in association with others, performs the processing of personal data on behalf of the Controller; i) Data Processor: An individual or legal person, public or private, that by itself or in association with others, decides on the database and/or the treatment of the data; j) Owner: Individual whose personal data are subject to Treatment; k) Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion of the same.
  3. PURPOSE WITH WHICH THE COLLECTION OF PERSONAL DATA AND THEIR TREATMENT OF THEM ARE CARRIED OUT: CARVAJAL LLC may use personal data to: a) Execute the existing contractual relationship with its customers, suppliers and employees, including the payment of contractual obligations; b) Provide the services and/or products required by its users; c) Inform about new products or services and/or about changes in them; d) Evaluate the quality of the service; e) Carry out internal studies on consumption habits; f) Send to the physical, electronic, cellular or mobile device, via text messages (SMS and/or MMS) or through any other analogous and/or digital means of communication created or to be created, commercial, advertising or promotional information about the products and/or services, events and/or promotions of commercial type or not of these, in order to promote, invite, direct, execute, inform and in a general way, carry out campaigns, promotions or competitions of a commercial nature or advertising, advanced by CARVAJAL LLC and/or by third parties; g) Develop the process of selection, evaluation, and employment linkage; h) Support internal or external audit processes; i) Record the information of employees and/or pensioners (active and inactive) in the databases of CARVAJAL LLC]: i) Those indicated in the authorization granted by the owner of the data or described in the respective privacy notice, depending on the case; j) Provide, share, send or deliver your personal data to subsidiaries, affiliates, or subordinates of CARVAJAL LLC located in Colombia or any other country in the event that said companies require the information for the purposes indicated herein.

Regarding the data (i) collected directly at the security points, (ii) taken from the documents that people provide to the security personnel and (iii) obtained from the video recordings that are made inside or outside the facilities of CARVAJAL LLC, these will be used for security purposes of the people, assets and facilities of CARVAJAL LLC and may be used as evidence in any type of process.

If a personal data is provided, said information will be used only for the purposes indicated herein, and therefore, CARVAJAL LLC will not proceed to sell, license, transmit, or disclose it, unless: (i) there is express authorization to do so; (ii) it is necessary to allow the contractors or agents to provide the entrusted services; (iii) is necessary in order to provide our services and/or products; (iv) it is necessary to disclose it to the entities that provide marketing services on behalf of CARVAJAL LLC or to other entities with which they have joint market agreements; (v) the information is related to a merger, consolidation, acquisition, disinvestment, or other restructuring process of the company; (vi) that is required or permitted by law.

CARVAJAL LLC may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is effectively subcontracted with third parties or personal information is provided to third party service providers, CARVAJAL LLC warns those third parties about the need to protect such personal information with appropriate security measures, the use of the information forbidden is prohibited. own purposes and it is requested that personal information not be disclosed to others.

  1. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA: The processing of personal data in CARVAJAL LLC will be governed by the following principles: a) Principle of purpose: The treatment of the collected personal data must obey a legitimate purpose, which must be informed to the Holder; b) Principle of freedom: The Treatment can only be carried out with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent; c) Principle of truth or quality: The information subject to Treatment must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data will not be carried out; d) Principle of transparency: In the Treatment must guarantee the right of the Owner to obtain CARVAJAL

SA at any time and without restrictions, information about the existence of data that concerns him; e) Principle of access and restricted circulation: The Treatment is subject to the limits derived from the nature of the personal data, the provisions of this law and the Constitution. Personal data, except public information, and the provisions of the authorization granted by the owner of the data, may not be available on the Internet or other means of dissemination or mass communication, unless the access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties; f) Safety principle: The information subject to Treatment by CARVAJAL LLC must be protected through the use of technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access; g) Principle of confidentiality: All persons involved in the processing of personal data are required to guarantee the reservation of information, even after the end of their relationship with any of the tasks involved in the treatment.

PARAGRAPH ONE: In the event that sensitive personal data is collected, the Holder may refuse to authorize its Treatment.

  1. RIGHTS OF THE PERSONAL DATA HOLDERS OBJECT OF TREATMENT BY CARVAJAL LLC: Holders of personal data by themselves or through their representative and/or attorney-in-fact or their successor in title may exercise the following rights, with respect to personal data that are subject to treatment by CARVAJAL LLC: a) Right of access: By virtue of which you can access the personal data that are under the control of CARVAJAL LLC, for the purpose of consulting them free of charge at least once each calendar month, and each time there are substantial modifications of the Treatment Policies of the information that motivate new consultations; b) Right to update, rectify and delete: By virtue of which it will be able to request the update, rectification and/or suppression of the personal data object of treatment, in such a way that the purposes of the treatment are satisfied; c) Right to request proof of the authorization: except in the events in which, according to the legal norms in force, the authorization to carry out the treatment is not required; d) Right to be informed regarding the use of personal data; e) Right to file complaints with the Industry and Commerce Superintendence: for infractions to the provisions of current regulations on the processing of personal data; f) Right to require compliance with the orders issued by the Superintendence of Industry and Commerce.

PARAGRAPH ONE: For the purposes of exercising the rights described above, both the owner and the person representing them must prove their identity and, if applicable, the quality by virtue of which they represent the owner. SECOND PARAGRAPH: The rights of minors shall be exercised by means of the persons who are authorized to represent them.

  1. DUTIES OF CARVAJAL LLC: All those obliged to comply with this policy must keep in mind that CARVAJAL LLC is obliged to comply with the duties imposed by law. Consequently, the following obligations must be fulfilled: Duties when acting as responsible: (i) Request and keep, under the conditions set forth in this policy, a copy of the respective authorization granted by the owner. (ii) Clearly and sufficiently inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted. (iii) Inform at the request of the owner about the use given to their personal data (iv) Process the consultations and claims formulated in the terms indicated in this policy (v) Ensure that the principles of truth, quality, security and confidentiality in the terms established in the following policy (vi) – Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (vii) Update the information when necessary. (viii) Rectify personal data when appropriate. B. Duties when acting as the Data Processor in charge of processing personal data. If you perform data processing on behalf of another entity or organization (Responsible for processing), you must comply with the following duties: (i) Establish that the Data Controller is authorized to supply the personal data that will be processed by the Manager (ii) Guarantee the owner, at all times, the full and effective exercise of the right of habeas data. (iii) Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (iv) Make timely update, rectification or deletion of data. (v) Update the information reported by the Managers of the treatment within five (5) business days counted from its receipt. (vi) Process inquiries and claims made by the holders in the terms indicated in this policy. (vii) Register in the database the legend “claim in process” in the form established in this policy. (ix) Insert in the database the legend “information in judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data. (x) Refrain from circulating information that is being contested by the owner and whose blockade has been ordered by the Superintendence of Industry and Commerce. (xi) Allow access to information only to persons authorized by the owner or authorized by law for such effect. (xii) Inform the Industry and Commerce Superintendence when there are violations of the security codes and there are risks in the administration of the information of the owners. (xiii) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce. C. Duties when carrying out the treatment through a Processor (i) Provide the Data Processor only the personal data whose treatment is previously authorized. For the purposes of national or international transmission of data, a contract for the transmission of personal data must be signed or contractual clauses agreed as established in article 25 of decree 1377 of 2013. (ii) Guarantee that the information provided to the Manager of the treatment is true, complete, accurate, updated, verifiable and understandable. (iii) Communicate in a timely manner to the Data Processor all the news regarding the data previously provided to it and adopt the other necessary measures so that the information provided to it is kept up-to-date. (iv) Report in a timely manner to the person in charge of processing the rectifications made on the personal data so that the latter may proceed to make the appropriate adjustments. (v) To demand from the person in charge of the processing, at all times, respect for the security and privacy conditions of the holder’s information. (vi) Inform the Person in charge of the processing when certain information is under discussion by the owner, once the claim has been filed and the respective procedure has not been completed. D. Duties regarding the Industry and Commerce Superintendence (i) Inform you of possible violations of the security codes and the existence of risks in the administration of the information of the owners. (ii) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

7 APPLICATION FOR AUTHORIZATION TO PERSONAL DATA HOLDER: In advance and/or at the time of collecting the personal data, CARVAJAL LLC will ask the owner of the data for authorization to carry out its collection and treatment, indicating the purpose for which the data is requested, using automated technical means for this purpose. written or oral, that allow to preserve proof of the authorization and/or the unequivocal conduct described in article 7 of Decree 1377 of 2013. Said authorization shall be requested for as long as is reasonable and necessary to satisfy the needs that gave rise to the request of the data and, in any case, with observance of the legal provisions that govern the matter.

  1. NOTICE OF PRIVACY: In the event that CARVAJAL LLC can not make this information treatment policy available to the owner of the personal data, it will publish the privacy notice that is attached to this document, the text of which will be kept for later reference by the owner of the information. data and/or the Industry and Commerce Superintendence.
  2. TEMPORARY LIMITATIONS TO THE PROCESSING OF PERSONAL DATA. CARVAJAL LLC may only collect, store, use or circulate personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the treatment, taking into account the provisions applicable to the subject matter and administrative aspects, accounting, tax, legal and historical information. Once the purpose(s) of the treatment have been fulfilled and without prejudice to legal norms that stipulate otherwise, it will proceed to the suppression of the personal data in its possession. Notwithstanding the foregoing, personal data must be retained when required for the fulfillment of a legal or contractual obligation.
  3. RESPONSIBLE AREA AND PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF PERSONAL DATA HOLDERS: The AREA OF VICE-PRESIDENCY OF ORGANIZATIONAL DEVELOPMENT of CARVAJAL LLC will be responsible for addressing petitions, complaints and claims made by the owner of the data in exercise of the rights contemplated in paragraph 5 of this policy, except for the one described in its literal). For such purposes, the owner of the personal data or whoever exercises his representation may send his request, complaint or claim from Monday to Friday from 8:00 a.m. to 5:00 p.m. to this email address protecciondedatos@carvajal.com, call the telephone line of CARVAJAL LLC, Cali telephone (1) 667-50-11, or file it at the following address corresponding to our offices
OFFICEADDRESS
CaliN#6A-40 29 street

The petition, complaint or claim must contain the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents you want to assert. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it shall be understood that the claim has been abandoned. In case the person who receives the claim is not competent to resolve it, it will transfer to the corresponding one in a maximum term of two (2) business days and will inform the interested party of the situation. Once the complete claim has been received, a legend that says “claim in process” and the reason thereof will be included in the database, in a term not exceeding two (2) business days. This legend must be maintained until the claim is decided. The maximum term to attend the claim will be fifteen (15) beginning with the date of the day following the date of receipt. When it is not possible to meet the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be handled, which in no case may exceed eight (8) business days following the expiration of the first finished.

  1. DATA COLLECTED BEFORE THE ISSUANCE OF DECREE 1377 OF 2013: In accordance with the provisions of numeral 3 of Article 10 of Regulatory Decree 1377 of 2013 CARVAJAL LLC will proceed to publish a notice on its official website carvajal.com addressed to the holders of personal data for the purposes of publicizing this information processing policy and how to exercise their rights as holders of personal data housed in CARVAJAL LLC databases
  2. SECURITY MEASURES: In development of the security principle established in Law 1581 of 2012, CARVAJAL LLC will adopt the technical, human and administrative measures that are necessary to grant security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. The personnel that carry out the processing of the personal data will execute the established protocols in order to guarantee the security of the information.
  3. EFFECTIVE DATE OF ENTRY: This Personal Data Policy was created on July 27, 2013 and becomes effective as of August 19, 2013. Any change that occurs with respect to this policy, will be reported through the electronic address: carvajal.com

Sincerely,

CARVAJAL LLC

HOME: Calle 29 N # 6A-40 Cali

 

 

NOTICE OF PRIVACY

CONTROLLER:

CARVAJAL LLC

HOME: 29N Street # 6a-40

EMAIL: protecciondedatos@carvajal.com

TELEPHONE: 667-50-11 Cali

PURPOSE WITH WHICH THE COLLECTION OF PERSONAL DATA AND THEIR TREATMENT OF THEM ARE CARRIED OUT: CARVAJAL LLC may use personal data to: a) Execute the existing contractual relationship with its customers, suppliers and employees, including the payment of contractual obligations; b) Provide the services and/or products required by its users; c) Inform about new products or services and/or about changes in them; d) Evaluate the quality of the service; e) Carry out internal studies on consumption habits; f) Send to the physical, electronic, cellular or mobile device, via text messages (SMS and/or MMS) or through any other analogous and/or digital means of communication created or to be created, commercial, advertising or promotional information about the products and/or services, events and/or promotions of commercial type or not of these, in order to promote, invite, direct, execute, inform and in a general way, carry out campaigns, promotions or competitions of a commercial nature or advertising, advanced by CARVAJAL LLC and/or by third parties; g) Develop the process of selection, evaluation, and employment linkage; h) Support internal or external audit processes; i) Record the information of employees and/or retirees (active and inactive) in the databases of CARVAJAL LLC: j) Those indicated in the authorization granted by the owner of the data or described in the respective privacy notice, depending on the case; k) Provide, share, send or deliver your personal data to subsidiaries, affiliates, or subordinates of CARVAJAL LLC located in Colombia or any other country in the event that said companies require the information for the purposes indicated herein.

Regarding the data (i) collected directly at the security points, (ii) taken from the documents that people provide to the security personnel and (iii) obtained from the video recordings that are made inside or outside the facilities of CARVAJAL LLC, these will be used for security purposes of the people, assets and facilities of CARVAJAL LLC and may be used as evidence in any type of process.

If a personal data is provided, said information will be used only for the purposes indicated herein, and therefore, CARVAJAL LLC will not proceed to sell, license, transmit, or disclose it, unless: (i) there is express authorization to do so; (ii) it is necessary to allow the contractors or agents to provide the entrusted services; (iii) is necessary in order to provide our services and/or products; (iv) it is necessary to disclose it to the entities that provide marketing services on behalf of CARVAJAL LLC or to other entities with which they have joint market agreements; (v) the information is related to a merger, consolidation, acquisition, disinvestment, or other restructuring process of the company; (vi) that is required or permitted by law.

CARVAJAL LLC may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is effectively subcontracted with third parties or personal information is provided to third party service providers, CARVAJAL LLC warns those third parties about the need to protect such personal information with appropriate security measures, the use of the information forbidden is prohibited. own purposes and it is requested that personal information not be disclosed to others.

RIGHTS OF THE PERSONAL DATA HOLDERS: Holders of personal data by themselves or through their representative and/or attorney-in-fact or their successor in title may exercise the following rights, with respect to personal data that are subject to treatment by CARVAJAL LLC: a) Right of access: By virtue of which you can access the personal data that are under the control of CARVAJAL LLC, for the purpose of consulting them free of charge at least once each calendar month, and each time there are substantial modifications of the Treatment Policies of the information that motivate new consultations; b) Right to update, rectify and delete: By virtue of which it will be able to request the update, rectification and/or suppression of the personal data object of treatment, in such a way that the purposes of the treatment are satisfied; c) Right to request proof of the authorization: except in the events in which, according to the legal norms in force, the authorization to carry out the treatment is not required; d) Right to be informed regarding the use of personal data; e) Right to file complaints with the Industry and Commerce Superintendence: for infractions to the provisions of current regulations on the processing of personal data; f) Right to require compliance with the orders issued by the Superintendence of Industry and Commerce.

PERSONAL DATA PROCESSING POLICY: It can be consulted at the following address: www.carvajal.com, Any change that occurs with respect to this policy, will be reported through the electronic address: www.carvajal.com

In the event that sensitive personal data is collected, the Holder may refuse to authorize its Treatment.

The AREA OF VICE-PRESIDENCY ORGANIZATIONAL DEVELOPMENT of CARVAJAL LLC will be responsible for addressing petitions, complaints and claims made by the owner of the data in exercise of the rights contemplated in paragraph 5 of the personal data processing policy, except for the one described in its literal e). For such purposes, the owner of the personal data or whoever exercises his representation may send his request, complaint or claim from Monday to Friday from 8:00 a.m. to 5:00 p.m. to the email protecciondedatos@carvajal.com, call the telephone line in Cali 667-50-11, or file it at the following address, corresponding to our offices:

OFFICEADDRESS
CALIN#6A-40 29 street

 

Sincerely,

CARVAJAL LLC