Personal data protection policy

1. SCOPE

This Personal Data Protection Policy shall apply to all Databases and/or Files containing Personal Data that are subject to Processing by Onparle SAS identified with NIT 901057632-9 considered as responsible and/or in charge of the processing of Personal Data, (hereinafter THE COMPANY).

3. DEFINITIONS

  • Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of Personal Data.
  • Privacy Notice: Verbal or written communication generated by the Controller, addressed to the Data Subject for the Processing of his Personal Data, by means of which he is informed about the existence of the Information Processing Policies that will be applicable to him, the way to access them and the purposes of the Processing that is intended to be given to the personal data.
  • Database: Organized set of Personal Data that is subject to Processing.
  • Personal Data: Any information linked or that can be associated to one or several determined or determinable natural persons.
  • Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of Personal Data on behalf of the Data Controller. In the events in which the Controller does not act as Data Processor, the Data Processor shall be expressly identified.
  • Data Controller: Natural or legal person, public or private, who by himself or in association with others, decides on the Database and/or the Processing of the data.
  • Terms and Conditions: general framework in which the conditions for participants in promotional or related activities are established.
  • Data Subject: Natural person whose Personal Data is the object of Processing.
  • Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.
  • Transfer: The transfer of data takes place when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is the Data Controller and is located inside or outside the country.
  • Transmission: Processing of Personal Data that involves the communication of such data within or outside the territory of the Republic of Colombia when the purpose is the performance of a Processing by the Processor on behalf of the Controller.

4. TREATMENT

THE COMPANY, acting as Responsible for the Processing of Personal Data, for the proper development of its commercial activities, as well as for the strengthening of its relationships with third parties, collects, stores, uses, circulates and deletes Personal Data corresponding to natural persons with whom it has or has had a relationship, such as, without limitation, employees and their relatives, shareholders, consumers, customers, distributors, suppliers, creditors and debtors.

5. PURPOSE

Personal Data are processed by THE COMPANY for the following purposes:

5.1. For sending information to your employees and family members;

For the recognition, protection and exercise of the rights of the COMPANY's shareholders;

5.4. To strengthen relationships with its consumers and customers, by sending relevant information, taking orders and attention to Petitions, Complaints and Claims (PQR's) by the customer service area, evaluating the quality of its customer service and inviting them to events organized or sponsored by THE COMPANY, among others;

5.5. To consolidate a timely and quality supply with its Suppliers, through the invitation to participate in selection processes, the evaluation of the fulfillment of its obligations and the invitation to events organized or sponsored by THE COMPANY, among others;

5.6. For the verification of balances of your creditors;

5.7. For the determination of outstanding obligations, the consultation of financial information and credit history and the report to information centers of unfulfilled obligations, with respect to its debtors;

5.8. To improve, promote and develop its products and those of its related companies worldwide;

5.9. For marketing, statistical, research and other commercial purposes that do not contravene the legislation in force in Colombia;

5.10. For the attention of judicial or administrative requirements and compliance with judicial or legal mandates;

5.11. To eventually contact, via e-mail, or by any other means, natural persons with whom it has or has had a relationship, such as, but not limited to, employees and their relatives, shareholders, consumers, clients, distributors, suppliers, creditors and debtors, for the aforementioned purposes.

RIGHTS OF THE HOLDERS OF PERSONAL DATA

The natural persons whose Personal Data are subject to Processing by THE COMPANY, have the following rights, which may be exercised at any time:

6.1. To know the Personal Data on which THE COMPANY is performing the Processing. Similarly, the Data Subject may request at any time, that their data be updated or rectified, for example, if you find that your data is partial, inaccurate, incomplete, fractioned, misleading, or those whose treatment is expressly prohibited or has not been authorized.

6.2. Request proof of the authorization granted to THE COMPANY for the Processing of your Personal Data.

6.3. Be informed by THE COMPANY, upon request, regarding the use that it has given to their Personal Data.

6.4. File complaints before the Superintendence of Industry and Commerce for violations to the provisions of the Personal Data Protection Law.

6.5. Request to THE COMPANY the deletion of their Personal Data and/or revoke the authorization granted for the Processing thereof, by filing a claim, in accordance with the procedures set forth in paragraph 11 of this Policy. However, the request for deletion of the information and the revocation of the authorization will not proceed when the Data Subject has a legal or contractual duty to remain in the Database and/or Files, nor while the relationship between the Data Subject and THE COMPANY is in force, by virtue of which the data were collected.

6.6. Access free of charge to your Personal Data subject to Processing.

7. AREA RESPONSIBLE FOR IMPLEMENTATION AND ENFORCEMENT OF THIS POLICY

Onparle. is responsible for the development, implementation, training and enforcement of this Policy. For this purpose, all employees who process Personal Data in the different areas of THE COMPANY are obliged to report these Databases to the legal representative and to immediately inform the latter of all requests, complaints or claims received from Personal Data Holders.

8. AUTHORIZATION

THE COMPANY must request prior, express and informed authorization from the Data Controllers of the Personal Data on which the Processing is required.

8.1. Prior authorization means that consent must be given by the Data Subject at the latest at the time of collection of the Personal Data.

Express authorization means that the consent of the Data Subject must be explicit and specific, open and non-specific authorizations are not valid. The Data Subject is required to express his/her willingness to authorize THE COMPANY to process his/her Personal Data.

This manifestation of will of the Holder may be given through different mechanisms made available by THE COMPANY, such as:

  • In writing, for example, by filling out an authorization form as shown in Annex 1.
  • Orally, for example, in a telephone conversation or videoconference.
  • Through unequivocal conduct that allows concluding that you granted your authorization, for example, through your express acceptance to the Terms and Conditions of an activity within which the authorization of the participants is required for the Processing of your Personal Data.

IMPORTANT: In no case shall THE COMPANY assimilate the Holder's silence to an unequivocal conduct.

Whatever the mechanism used by THE COMPANY, it is necessary that the authorization be kept for later consultation.

8.3. Informed Authorization means that at the time of requesting the consent of the Data Subject, he/she must be clearly informed:

  • The Personal Data that will be collected.
  • The identification and contact details of the Data Controller and the Data Processor.
  • The specific purposes of the intended Processing, i.e.: how and for what purpose the Personal Data will be collected, used and circulated.
  • What are the rights that you have as a Personal Data Subject; for this purpose, please refer to section 6 of this Policy.
  • The optional nature of the answer to the questions asked, when they deal with sensitive data or with the data of children and adolescents.

9. SPECIAL PROVISIONS FOR THE PROCESSING OF SENSITIVE PERSONAL DATA.

According to the Personal Data Protection Law, sensitive data are considered to be those that affect privacy or whose improper use may generate discrimination, such as those related to :

  • Racial or ethnic origin.
  • Political orientation.
  • Religious / philosophical convictions.
  • Membership in trade unions, social organizations, human rights organizations or political parties.
  • Health.
  • Sex life.
  • Biometric data (such as fingerprint, signature and photo).

The Processing of Personal Data of a sensitive nature is prohibited by law, except with the express, prior and informed authorization of the Data Subject, among other exceptions enshrined in Article 6 of Law 1581 of 2012.

In this case, in addition to complying with the requirements established for authorization, THE COMPANY shall:

  • Inform the Data Subject that since it is sensitive data, he/she is not obliged to authorize its processing.
  • Inform the Data Subject which of the data to be processed are sensitive and the purpose of the processing.

IMPORTANT: No activity may be conditioned to the provision of sensitive Personal Data by the Data Subject.

10. SPECIAL PROVISIONS FOR THE PROCESSING OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS

According to the provisions of Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, THE COMPANY shall only carry out the Processing, that is, the collection, storage, use, circulation and/or deletion of Personal Data corresponding to children and adolescents, provided that this Processing responds to and respects the best interests of children and adolescents and ensures respect for their fundamental rights.

Once the above requirements have been met, THE COMPANY shall obtain the Authorization of the legal representative of the child or adolescent, after the minor has exercised his or her right to be heard, an opinion that shall be assessed taking into account the maturity, autonomy and capacity to understand the matter.

11. PROCEDURE FOR ATTENTION AND RESPONSE TO REQUESTS, INQUIRIES, COMPLAINTS AND CLAIMS OF THE HOLDERS OF PERSONAL DATA

The Owners of Personal Data that is being collected, stored, used, circulated by THE COMPANY, may at any time exercise their rights to know, update, rectify and delete information and revoke the authorization.

For this purpose, the following procedure will be followed, in accordance with the Personal Data Protection Law:

11.1.ATTENTION AND RESPONSE TO REQUESTS AND INQUIRIES:

What does the procedure consist of?

The Holder or its assignees, may request the COMPANY, through the means indicated below:

  • Information about the Personal Data of the Data Subject that are subject to Processing.
  • Request proof of the authorization granted to THE COMPANY for the processing of your Personal Data.
  • Information regarding the use given by THE COMPANY to your personal data.

Means available for the presentation of petitions and consultations:

THE COMPANY has provided the following means for the reception and attention of requests and consultations, all of which allow to keep proof of the same:

  • Direct mail to: Cra 62#165A-88 T2 502
  • Cell phones: +57 318 317 4287 / WHATSAPP +57 310 242 7646.
  • Request submitted to e-mail: contacto@onparle.net

Attention and response from THE COMPANY:

Requests and inquiries will be answered within a maximum term of ten (10) working days from the date of receipt thereof. When it is not possible to attend the request or consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the request or consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

11.2. ATTENTION AND RESPONSE TO COMPLAINTS AND CLAIMS:

What does the procedure consist of?

The Holder or its assignees, may request the COMPANY, through a complaint or claim filed through the channels indicated below:

  • Correction or updating of information.
  • The deletion of your Personal Data or the revocation of the authorization granted for the Processing thereof.
  • That the alleged breach of any of the duties contained in the Personal Data Protection Law be remedied or corrected.

The request must contain a description of the facts giving rise to the complaint or claim, the address and contact details of the applicant, and must be accompanied by the documents to be asserted.

Means for the presentation of complaints and claims:

THE COMPANY has provided the following means for the reception and attention of complaints and claims, all of which allow to keep proof of their presentation:

  • Direct mail to: Cra 62#165A-88 T2 502
  • Cell phones: +57 318 317 4287 / WHATSAPP +57 310 242 7646.
  • Request submitted to e-mail: contacto@onparle.net

Attention and response from THE COMPANY:

If the complaint or claim is incomplete, THE COMPANY shall require the interested party within five (5) days of receipt of the complaint or claim to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the complaint or claim has been withdrawn.

In the event that the person receiving the complaint or claim is not competent to resolve it, he/she will transfer it to the Legal Division of Onparle S.A.S., within a maximum term of two (2) working days and will inform the interested party of the situation.

Once the complete complaint or claim is received, a legend will be included in the Data Base stating "claim in process" and the reason for the same, within a term no longer than two (2) business days. Such legend shall be maintained until the complaint or claim is decided.

The maximum term to address the complaint or claim will be fifteen (15) working days from the day following the date of receipt. When it is not possible to address the complaint or claim within such term, the interested party will be informed of the reasons for the delay and the date on which the complaint or claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

12. INFORMATION OBTAINED PASSIVELY

When accessing or using the services contained within the websites of THE COMPANY, it may collect information passively through technologies for information management, such as "cookies", through which information is collected about the hardware and software of the computer, IP address, browser type, operating system, domain name, access time and the addresses of the websites of origin; through the use of these tools do not directly collect Personal Data of users. Information will also be collected about the pages that the person visits most frequently on these websites in order to know their browsing habits. However, the user of the websites of THE COMPANY has the possibility to configure the operation of cookies, according to the options of your Internet browser.

13. SECURITY OF PERSONAL DATA

THE COMPANY, in strict application of the Principle of Security in the Processing of Personal Data, will provide the technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. The obligation and responsibility of THE COMPANY is limited to having the appropriate means for this purpose. THE COMPANY does not guarantee the total security of its information nor is it responsible for any consequence derived from technical failures or improper access by third parties to the Database or File in which the Personal Data subject to Processing is stored by THE COMPANY and its Agents. THE COMPANY shall require the service providers it hires to adopt and comply with the appropriate technical, human and administrative measures for the protection of the Personal Data in relation to which such providers act as Processors.

14. TRANSFER, TRANSMISSION AND DISCLOSURE OF PERSONAL DATA

THE COMPANY may disclose to its related companies worldwide, the Personal Data on which it carries out the Processing, for its use and Processing in accordance with this Personal Data Protection Policy.

Likewise, THE COMPANY may deliver Personal Data to third parties not related to THE COMPANY when: a. They are contractors in execution of contracts for the development of THE COMPANY's activities; b. By transfer to any title of any line of business with which the information is related to.

In any case, in the contracts for the transmission of Personal Data, which are signed between THE COMPANY and the Data Processors for the Processing of Personal Data, it shall be required that the information be processed in accordance with this Personal Data Protection Policy and the following obligations shall be included for the respective Data Processor:

  • To treat, on behalf of THE COMPANY, the Personal Data in accordance with the principles that protect them.
  • Safeguard the security of databases containing Personal Data.
  • Keep confidentiality with respect to the processing of Personal Data.

15. APPLICABLE LAW

This Personal Data Protection Policy, the Privacy Notice and the Authorization Form that is part of this Policy as Annex 1, are governed by the provisions of current legislation on the protection of Personal Data referred to in Article 15 of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013, Decree 1727 of 2009 and other regulations that modify, repeal or replace them.

16. VALIDITY

This Personal Data Protection Policy is effective as of March 30, 2017.