1 MANUAL OF POLICIES AND PROCEDURES FOR THE PROCESSING OF PERSONAL DATA
1. Scope and application of the policy
2. Obligations of VILLEGAS ASOCIADOS SA
3. Rights of the data owner:
3.1. Right of access to personal data.
3.2. Right to correct personal data.
3.3. Right to oppose direct marketing actions.
1 SCOPE AND APPLICATION VILLEGAS ASOCIADOS SA, is a company established by public deed as follows: Public Deed No. 4,216 Ninth (9) Notary of Bogotá, on August 5, 1974, registered before the Chamber of Commerce of Bogotá. That by public deed 2251 of October 23, 2001 of notary 7 of Bogotá, registered on November 6, 2001, under number 801139 of book IX, the company in the reference changed its name from: Benjamín Villegas Asociados Ltda ., by: VILLEGAS ASOCIADOS SA To comply with the corporate purpose, VILLEGAS ASOCIADOS SA creates, adopts and safeguards confidential information and personal data, including databases of its employees, suppliers and clients. Through this document, and in accordance with the provisions of Law 1581 of October 17, 2012 and Decree 1377 of 2013, a Data Privacy Policy Manual is adopted. This policy regulates the way in which VILLEGAS ASOCIADOS SA obtains, collects, uses, stores, custody, circulates, processes, transfers, deletes and otherwise processes confidential information and personal data of individuals. VILLEGAS ASOCIADOS SA ensures that its employees are trained, understand and apply the protocols that regulate this policy. This policy explains the rights of individuals in relation to their personal data processed by VILLEGAS ASOCIADOS SA and regulates the circumstances in which VILLEGAS ASOCIADOS SA may transfer personal data to other entities. VILLEGAS ASOCIADOS SA is responsible and in charge of processing the personal data of its employees, suppliers and clients for different business objectives, which include: Processing employee data for payroll, historical and statistical management purposes. Process supplier data to operate for the company's administrative purposes. Process customer data for commercial information on promotions, news, settlements that may be presented in each of the sales channels, complying with the corporate purpose. 2 Process the data of employees, suppliers, clients to comply with legal and tax guidelines. 2 OBLIGATIONS OF VILLEGAS ASOCIADOS SA 2.1 To protect personal data included in the databases and/or systems of VILLEGAS ASOCIADOS SA or those databases and/or systems for which it is responsible, the company will process personal data in a manner fair, lawful, truthful, transparent, secure and confidential. In particular, it will not process personal data at all, unless one of the following conditions is met: I. That the person involved has given authorization for such processing; II. That VILLEGAS ASOCIADOS SA needs to carry out the processing for: a) Statistical purposes, suppressing the identity of the interested party; b) Comply with a legal obligation, or c) Protect the vital interests of the person involved in a “life or death” situation. 2.2 When a person authorizes the processing of their personal data about themselves to VILLEGAS ASOCIADOS SA, VILLEGAS ASOCIADOS SA will take reasonable measures so that said person is informed about the purpose of the processing of their data. 2.3 VILLEGAS ASOCIADOS SA generally does not seek to obtain sensitive data related to the following aspects: Racial or ethnic origin. Political opinions. Religion or other similar beliefs. Union affiliation, human rights social organizations or that promote the interest of any political party. Physical or mental health. Sexual life. Biometric data. 3 2.4 VILLEGAS ASOCIADOS SA will not obtain said data, except when: 2.4.1 The owner of the data or interested party has given explicit authorization to said processing; 2.4.2 The processing is necessary to safeguard the vital interest of the data owner and he or she is physically or legally incapacitated. In these cases, the legal representatives must grant authorization; 2.4.3 The processing refers to data that is necessary for the knowledge, exercise or defense of a right in a judicial process; 2.4.4 The treatment has a historical, statistical or scientific purpose. In this event, measures must be adopted leading to the deletion of the identity of the owners of the personal data. 2.5 VILLEGAS ASOCIADOS SA as data controller: 2.5.1 It will guarantee to the data owner the full and effective exercise of the right of habeas data; 2.5.2 Request and keep a copy of the respective authorization granted by the data owner; 2.5.3 It will inform the owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted; 2.5.4 It will keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access; 2.5.5 It will guarantee that the information provided to the person in charge of the treatment (in the event that VILLEGAS ASOCIADOS SA entrusts the treatment to a third party) is true, complete, exact, updated, verifiable and understandable; 2.5.6 It will update the information, communicating in a timely manner to the person in charge of the treatment (in the event that VILLEGAS ASOCIADOS SA entrusts the treatment to a third party), all the news regarding the data that it has previously provided and will adopt the other necessary measures to that the information provided to it is kept up to date; 4 2.5.7 It will rectify the information when it is incorrect and will communicate the pertinent information to the person in charge of the treatment (in the event that VILLEGAS ASOCIADOS SA entrusts the treatment to a third party); 2.5.8 It will provide the data processor only data whose processing is previously authorized in accordance with the provisions of this manual and current law; 2.5.9 It will require the person in charge of the treatment at all times (in the event that VILLEGAS ASOCIADOS SA entrusts the treatment to a third party), respect for the security and privacy conditions of the data owner's information; 2.5.10 It will process the queries and claims made by the data holders. 2.5.11 It will inform the data processor when certain information is under discussion by the data owner, once the claim has been submitted and the respective procedure has not been completed; 2.5.12 Will inform, at the request of the data owner, about the use given to their data; 2.5.13 It will inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the data owners. 2.5.14 It will comply with the instructions and requirements issued by the Superintendency of Industry and Commerce. 2.6 In those cases in which VILLEGAS ASOCIADOS SA jointly fulfills the function of “Data Processor”, it will additionally proceed with the following obligations: 2.6.1 It will guarantee the data owner the full and effective exercise of the right of habeas data; 2.6.2 Will promptly update, rectify or delete the data; 2.6.3 Will update the reported information within five (5) business days from receipt; 2.6.4 The legend “Claim in process” will be recorded in the database when applicable. 5 2.6.5 Will refrain from circulating information that is being controversial by the owner of the data and whose blocking has been ordered by the Superintendence of Industry and Commerce; 2.6.6 Allow access to information only to people who can have access to it; 2.6.7 It will inform the Superintendence of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the data owners; 2.6.8 It will comply with the instructions and requirements issued by the Superintendency of Industry and Commerce. 2.7 In the event that VILLEGAS ASOCIADOS SA hires a third party responsible for processing data on its behalf, VILLEGAS ASOCIADOS SA recognizes the importance of having adequate security. When VILLEGAS ASOCIADOS SA signs these contracts, it will be ensured that the data processing service providers of VILLEGAS ASOCIADOS SA maintain binding contracts through which they are obliged to act only according to instructions from VILLEGAS ASOCIADOS SA and to maintain security agreements to protect said data. personal and to comply with the current legislation that is applicable. 2.8 VILLEGAS ASOCIADOS SA will comply with the policies and procedures designed to eliminate personal data in accordance with the purpose for which said data is maintained. 2.9 VILLEGAS ASOCIADOS SA will not allow the processing of the data for which it is responsible in those countries that do not provide adequate levels of data protection. It is understood that a country offers an adequate level of data protection when it complies with the standards established in this manual and in Law 1581 of October 17, 2012. 2.10 VILLEGAS ASOCIADOS SA will not allow the personal data in its custody, except the public information, are available on the Internet or other means of dissemination or mass communication, unless there is authorization or access is technically controllable to provide knowledge restricted only to the owners of the data or authorized third parties. 6 3 RIGHTS OF THE DATA HOLDER 3.1 Right of access 3.1.1 Through a written request from an individual, and when VILLEGAS ASOCIADOS SA has confirmed the information that allows it to identify the person making the request, and if it has stored such personal data about said individual, VILLEGAS ASOCIADOS SA: I. Will inform the person if VILLEGAS ASOCIADOS SA has their personal data; II. It will describe the data it has, the reason and purpose for which it is maintained; and III. It will provide the individual with copies of the personal data held about him or her, together with an indication of the source(s) thereof. 3.1.2 The query will be formulated through the means authorized by VILLEGAS ASOCIADOS SA, as long as proof of this can be maintained. 3.1.3 VILLEGAS ASOCIADOS SA will respond to the query within a maximum period of ten (10) business days from the date of receipt thereof. When it is not possible to attend to the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case will exceed five (5) business days following the expiration date. of the first term. 3.2 Right to correction 3.2.1 The owner of the data or his successors who consider that the information contained in a database of VILLEGAS ASOCIADOS SA must be corrected, updated or deleted, may file a claim with VILLEGAS ASOCIADOS SA, for which VILLEGAS ASOCIADOS SA has made available to its employees, its clients and its suppliers, and to all those whose data is processed in the databases of VILLEGAS ASOCIADOS SA, makes the following communication channels available to the owners. : Email: informacion@villegaseditores.com. Address: Avenida 82 n° 11-50, Interior 3 Attention lines: 6 16 17 88 – 2 47 38 83 7 3.2.2 The claim will be made through a request addressed to VILLEGAS ASOCIADOS SA or to the person in charge of the treatment, if so. If there is, with the identification of the owner of the data, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to assert. 3.2.3 If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. After one (1) month from the date of the request, without the data owner presenting the required information, it will be understood that he or she has withdrawn the claim. 3.2.4 In the event that VILLEGAS ASOCIADOS SA is not competent to resolve the claim, it will notify the interested party within a maximum period of two (2) business days. 3.2.5 Once the complete claim is received, a legend that says “Claim in process” and the reason for it will be included in the database within a period of no more than five (5) business days. The legend will remain until the claim is resolved. 3.2.6 The maximum term to address the claim will be ten (10) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case will exceed five (5) business days following the expiration of the first term. . 3.3 Right to oppose direct marketing actions. VILLEGAS ASOCIADOS SA will comply with any request from an individual not to use their personal data for direct marketing purposes. The Personal Data Policy of VILLEGAS ASOCIADOS SA was created in September 2013 and came into effect on September 19, 2013. It was updated on February 17, 2017.