I. DEFINITIONS:
AUTHORIZATION: Prior, express and informed consent of the owner to carry out the processing of personal data.
DATABASE: Organized set of personal data that is subject to processing. The “databases” will have such status regardless of the medium in which they are contained, which may be physical, electronic, manual, automated, computer tools, etc.
PERSONAL DATA: Any information linked or that can be associated with one or several specific or determinable natural persons.
OWNER: Natural person whose personal data is processed.
PROCESSING: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
PRIVACY NOTICE: Verbal or written communication generated by the person responsible, addressed to the owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, the way to access to them and the purposes of the treatment that is intended to be given to personal data.
PUBLIC DATA: It is data that is not semi-private, private or sensitive. Public data are considered, among others, data relating to the marital status of people, their profession or trade, and their status as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial rulings that are not subject to confidentiality.
SENSITIVE DATA: These are those that affect the privacy of the owner or whose improper use can generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
TRANSFER: This takes place when the person responsible and/or in charge of processing personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is located inside or outside the country.
TRANSMISSION: Processing of personal data that involves the communication thereof within or outside the territory of the Republic of Colombia when its purpose is to carry out processing by the person in charge on behalf of a single person responsible.
II. BEGINNING:
In the development, interpretation and application of Law 1581 of two thousand twelve (2012) by which general provisions are issued for the Protection of Personal Data and the regulations that complement, modify or add it, the following guiding principles:
PRINCIPLE OF PURPOSE:
The treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the owner.
Regarding the collection of personal data, OPTIMY CALI NORTE SAS will be limited to those data that are relevant and appropriate for the purpose for which they are collected or required and must inform the owner of the reason for which the information is requested and the specific use that will be given to it.
PRINCIPLE OF FREEDOM:
The treatment can only be carried out with the prior, express, and informed consent of the owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that requires consent.
PRINCIPLE OF TRUTHFULNESS OR QUALITY:
The information will be true, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fragmented or misleading data is prohibited.
PRINCIPLE OF TRANSPARENCY:
The right of the owner to obtain from the data controller or processor, at any time and without restrictions, information about the existence of data that concerns him or her must be guaranteed.
PRINCIPLE OF ACCESS AND RESTRICTED CIRCULATION:
The processing is subject to the limits derived from the nature of the personal data, the provisions of the law and the Constitution. In this sense, the treatment can only be carried out by people authorized by the owner and/or by the people provided for by law.
Personal data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide knowledge restricted only to the owners or authorized third parties.
SAFETY PRINCIPLE:
The information subject to processing will be subject to the technical, human and administrative measures that are necessary to provide security to the records, preventing their adulteration, loss, consultation, unauthorized or fraudulent use or access.
To ensure compliance with this principle, OPTIMY CALI NORTE SASa will ensure the implementation of such measures.
PRINCIPLE OF CONFIDENTIALITY:
OPTIMY CALI NORTE SAS guarantees the confidentiality of information, even after its relationship with any of the tasks included in the treatment has ended, and may only supply or communicate personal data when this corresponds to the development of activities authorized by law.
III. PROCESSING TO WHICH PERSONAL DATA WILL BE SUBJECTED AND ITS PURPOSE
OPTIMY CALI NORTE SAS guarantees responsibility and that the processing of personal data will be in accordance with what is established by law, with the main purpose(s) of:
A. To fulfill the obligations contracted by OPTIMY CALI NORTE SAS with its clients and consumers when purchasing our products.
B. Send information about offers related to the services offered by OPTIMY CALI NORTE SAS
C. To strengthen relationships with its suppliers and clients, by sending relevant information, status of contracted services and evaluation of service quality.
D. For the determination of outstanding obligations, with respect to its debtors.
E. To improve, promote and develop its products
F. Respond to queries, requests, complaints and claims made by the owners and transmit the Personal Data to control bodies and other authorities that, by virtue of the applicable law, must receive the Personal Data.
G. To eventually contact, via email, or by any other means, natural persons with whom you have or have had a relationship, such as, without the list being limited, workers and their families, shareholders, suppliers, creditors and debtors. , for the aforementioned purposes.
H. Register your personal data in the information systems of OPTIMY CALI NORTE SAS and in its customer and supplier databases.
I. Manage and operate, directly or through third parties, the personnel selection and hiring processes, including the evaluation and qualification of participants and the verification of work and personal references, and the performance of security studies.
J. Develop the activities of human resources management within OPTIMY CALI NORTE SAS such as payroll, affiliations to entities of the general social security system, occupational health and well-being activities, exercise of the employer's sanctioning power, among others.
K. Make the necessary payments derived from the execution of the employment contract and/or its termination, and the other social benefits that may be applicable in accordance with the applicable law.
L. Contract labor benefits with third parties, such as life insurance, medical expenses, among others.
M. Notify authorized contacts in case of emergencies during work hours or during work hours.
N. Coordinate the professional development of employees, employee access to the Employer's computer resources and assist in their use.
O. Register contractors and suppliers in the OPTIMY CALI NORTE SAS systems and process their payments.
P. For the attention of judicial or administrative requirements and compliance with judicial or legal mandates.
Q. For payment processing and balance verification.
R. Any other activity of a similar nature to those previously described that is necessary to develop the corporate purpose of OPTIMY CALI NORTE SAS
IV. RIGHTS THAT ASSIST THE OWNER OF THE INFORMATION
The owner of the personal data will have the following rights:
A. Know, update and rectify your personal data against OPTIMY CALI NORTE SAS Including, against partial, inaccurate, incomplete, fractioned, misleading data or those whose processing is expressly prohibited or has not been authorized.
B. Request proof of the authorization granted to OPTIMY CALI NORTE SAS except when it is expressly excepted as a requirement for the treatment (cases in which authorization is not necessary).
C. Be informed by express request about the use that has been given to your personal data. OPTIMY CALI NORTE SAS will maintain a constant relationship with authorities and interest groups in order to be updated on changes in regulations and trends in Information Security.
D. Present complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of two thousand twelve (2012) and other regulations that modify, add or complement it.
E. Revoke the authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights and guarantees.
F. Access free of charge to your personal data that has been processed.
V. DUTIES OF OPTIMY CALI NORTE
Under this policy for the processing and protection of personal data, the duties of
A. Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.
B. Request and keep a copy of the respective authorization granted by the owner.
C. Duly inform the owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted.
D. Preserve the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
E. Rectify information when it is incorrect and communicate what is pertinent.
F. Process queries and claims made by the owners.
G. Inform the data protection authority when violations of security codes occur and there are risks in the administration of the owners' information.
H. Comply with the requirements and instructions issued by the Superintendency of Industry and Commerce on the particular topic.
I. Inform at the request of the owner about the use given to their data.
J. Guarantee that the information is true, complete, accurate, updated, verifiable and understandable.
K. Update the information, thus addressing all the news regarding the owner's data. Additionally, all necessary measures must be implemented so that the information is kept up to date.
L. Respect the security and privacy conditions of the owner's information.
M. Identify when certain information is under discussion by the owner.
N. Only use data whose processing is previously authorized in accordance with the provisions of Law 1581 of two thousand twelve (2012).
Duties of OPTIMY CALI NORTE SAS regarding the Superintendence of Industry and Commerce
A. Inform you of possible violations of security codes and risks in the administration of the Owners' information.
B. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
SAW. AUTHORIZATION OF THE INFORMATION HOLDERS
All those at OPTIMY CALI NORTE SAS who must comply with this policy must obtain the owner's prior, express and informed authorization to collect and process their personal data. This obligation is not necessary when dealing with data of a public nature, processing of information for historical, statistical or scientific purposes in which the information is not linked to a specific person and data related to the Civil Registry of Persons.
To obtain authorization, you must inform clearly and expressly:
The Treatment to which your personal data will be subjected and the purpose thereof
• The optional nature of the response to the questions asked, when they relate to sensitive data or the data of children and adolescents.
• The rights that assist you as Owner provided for in article 8 of law 1581 of 2012.
• The identification, physical or electronic address and telephone number of OPTIMY CALI NORTE SAS
• The Privacy Policy
Subsequently, the owner's consent must be obtained through any means that may be subject to subsequent consultation. Through written authorization of the CONSENT FORM FOR CONSULTATION, REPORT, COLLECTION, STORAGE, USE AND CIRCULATION OF PERSONAL DATA
Proof of compliance with the obligation to inform and consent must be left. If the Owner requests a copy of these, they must be provided.
Authorization may also be obtained from unequivocal conduct of the Data Owner that allows it to be reasonably concluded that he or she granted consent for the processing of his or her information. Said conduct(s) must be very clear so that it does not admit doubt or mistake about the will to authorize the treatment and in no case can the silence of the Owner be considered as unequivocal conduct. .
The following are entitled to grant consent:
• The Owner, who must prove his/her identity sufficiently by the different means made available by the Data Controller.
• The successors in title of the Owner, who must prove such quality.
• The representative and/or attorney-in-fact of the Owner, prior accreditation of the representation or power of attorney.
• Authorization may also be granted when there are cases of stipulation in favor of another or for another.
Authorization for processing sensitive data
When it comes to the collection of sensitive data, the following requirements must be met:
• Authorization must be explicit
• The Owner must be informed that he is not obliged to authorize the processing of said information.
• The Owner must be informed explicitly and in advance which of the data that will be processed are sensitive and the purpose of the same.
• Authorization for data processing of children and adolescents (NNA)
When it comes to the collection and processing of data from children and adolescents, the following requirements must be met:
• Authorization must be granted by people who are authorized to represent children and adolescents. The representative of the children and adolescents must guarantee them the right to be heard and value their opinion of the treatment, taking into account the maturity, autonomy and capacity of the children and adolescents to understand the matter.
• It should be informed that it is optional to answer questions about data on children and adolescents.
• Treatment must respect the best interests of children and adolescents and ensure respect for their fundamental rights. The Owner must be informed explicitly and in advance which of the data that will be processed are sensitive and the purpose thereof.
VII. EVENTS IN WHICH THE AUTHORIZATION OF THE OWNER OF THE PERSONAL DATA IS NOT NECESSARY
The authorization of the owner of the information will not be necessary when it comes to:
A. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
B. Data of public nature.
C. Cases of medical or health emergency.
D. Processing of information authorized by law for historical, statistical or scientific purposes.
E. Data related to the Civil Registry of people.
VIII. LEGITIMATION FOR THE EXERCISE OF THE OWNER'S RIGHT
The rights of the owners may be exercised by the following people:
A. By the owner, who must sufficiently prove his or her identity through the different means that OPTIMY CALI NORTE makes available.
B. By the successors in title of the holder (in cases where he is missing due to death or disability), who must prove such quality.
C. By the representative and/or attorney-in-fact of the owner, prior accreditation of the corresponding representation or power.
D. By stipulation in favor of another or for another.
The rights of children and adolescents will be exercised by the people empowered to represent them.
IX. TREATMENT TO WHICH THE DATA WILL BE SUBJECTED AND PURPOSE OF THE SAME
OPTIMY CALI NORTE SAS proceeds to classify personal data as follows:
ESSENTIAL DATA: These are understood as those personal data of the owners that are essential to carry out the activity described in the chamber of commerce. Data of an essential nature must be provided by their owners or those authorized to exercise these rights.
If the holder at will does not provide information of an essential nature, it is his withdrawal in relation to the continuity of the relationship he has with the institution.
The following will be understood as ESSENTIAL PERSONAL DATA:
For the Worker and/or Contractor:
• Personal data about the worker and/or contractor that must be collected by legal order by OPTIMY CALI NORTE SAS in its capacity as employer and/or contractor of certain services. By way of example: names, surnames, identity document, residence address, email, health affiliation, pension affiliation, work experience, etc.
• Resume and corresponding supports.
• Personal data generated due to the execution of employment contracts or the provision of services.
• Performance evaluations of teachers and workers.
• Results of occupational aptitude and health tests.
SENSITIVE DATA: Affect the privacy of the owner, its improper use may cause discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
In the case of sensitive data, it will be the owner's power to grant explicit authorization for the processing of said information.
In the event of receipt of sensitive data, OPTIMY CALI NORTE SAS will be rigorous in maintaining its security and confidentiality.
In accordance with the exception contained in literal "e" of article 6 of law 1581 of two thousand twelve (2012), OPTIMY CALI NORTE SAS may process sensitive personal data for a historical, statistical or scientific purpose as long as they are adopted. the measures leading to the suppression of the identity of the owners.
OPTIONAL DATA: These are the data that are required to offer additional services in research, extension, job offers, etc.
PUBLIC DATA: These are data relating to the marital status of people, their profession or trade and their status as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial rulings that are not subject to confidentiality.
PERSONAL DATA OF BOYS, GIRLS AND ADOLESCENTS: The treatment is
prohibited except when it involves data of a public nature, and when said processing meets the following parameters and/or requirements: a) that respond to and respect the best interest of children and adolescents; b) that respect for their fundamental rights is ensured. c) that there is authorization from the father or guardian of the child or adolescent.
X. PEOPLE TO WHOM THE INFORMATION MAY BE PROVIDED
The information that meets the conditions established by law may be provided to the following people:
• To the owners, their successors (when those are missing) or their legal representatives.
• To public or administrative entities in the exercise of their legal functions or by court order.
• To third parties authorized by the owner or by law.
XI. PERSON OR AREA RESPONSIBLE FOR ATTENTION TO REQUESTS, CONSULTATIONS AND CLAIMS
OPTIMY CALI NORTE SASha designated as the person responsible for ensuring compliance with this policy within the institution is XIMENA ARIAS General Manager; who will be available to respond to requests, queries and claims by the owners and to carry out any update, rectification and deletion of data.
XII. PROCEDURE
1. PROCEDURE FOR REQUESTING PERSONAL DATA
OPTIMY CALI NORTE SASin will previously inform the owners of the personal data required and the reason why the information is requested, understanding that said purpose will always be related to the activities of the organization.
OPTIMY CALI NORTE SAS may request the owner's authorization for the use of their essential data for the sending of optional information corresponding to additional services in job offers, etc.
Regarding the way to obtain authorization, OPTIMY CALI NORTE SAS will collect the information corresponding to personal data in writing through the formats and texts established for this purpose.
The documents, formats and/or texts that OPTIMY CALI NORTE SAS establishes for this purpose will always include:
• The mention of this treatment policy and the physical location of the consultation.
• Contact details of the person responsible for the treatment.
• Space for the signature of the owner and, if applicable, the parent, guardian, legal representative, and/or any other person authorized to exercise the rights.
Request for Personal Data for Minor Employees
Authorizations to request personal data from minors will be granted jointly by the parents (guardians, legal representatives, guardians, etc.) and, if possible, with the corresponding owners. The signature of the parents will constitute the legal authorization and the subscription by the minor EMPLOYEE will represent their consent to the authorization granted by the parents and/or guardians.
The signing of the authorization by the minor will be taken into account, while he must be listened to and valued in his opinion taking into account his maturity, autonomy and ability to understand the matter.
Request for Personal Data for Employees of Legal Age
OPTIMY CALI NORTE SAS will implement in the contract a text, format and/or authorization in which the EMPLOYEE and/or applicant will have the possibility of including their power to authorize a third party to request information related to their personal data and/or any other information.
Likewise, OPTIMY CALI NORTE SAS will include a space in which the EMPLOYEE/applicant previously and expressly authorizes the processing of personal data directly related to the organization's activity.
Request for Personal Data for Workers and/or Contractors
OPTIMY CALI NORTE SAS will implement in employment and/or service provision contracts a text, format and/or authorization in order to previously and expressly authorize the processing of personal data related to the execution of the corresponding contract, which will include the authorization to collect, modify or correct the owner's personal data.
The text, format and/or authorization will also include the authorization that some of the data may be delivered to third parties with whom OPTIMY CALI NORTE SAS has outsourced tasks which in any case will be limited in the use that these third parties may give it. to the data.
2. PERSONAL DATA INFORMATION STORAGE PROCEDURE
OPTIMY CALI NORTE SAS will adopt appropriate and sufficient technical and administrative measures that allow the care and conservation of the personal data of the owners, avoiding its adulteration, loss, consultation, unauthorized or fraudulent use or access.
Likewise, the implementation of these measures will allow the conservation of the authorization granted by the owners of the personal data for their processing.
OPTIMY CALI NORTE SAS will adopt all mechanisms to maintain the confidentiality of the information and will refrain from using the information for purposes other than those expressly authorized by the owner.
3. PROCEDURE FOR THE USE AND CIRCULATION OF INFORMATION.
Transfer of Personal Data
For the event in which third parties require validation, rectification or confirmation of information corresponding to the personal data of the owners contained in the Organization's databases, the prior and express authorization of the owner will be required to provide the information so that operate the transfer.
OPTIMY CALI NORTE SAS will refrain from using the information provided by the owners for marketing purposes other than its specific purpose and services.
4. PROCEDURE FOR ATTENDING QUERIES.
The owners, in the case of minor EMPLOYEES represented by their parents or guardians, may request OPTIMY CALI NORTE SAS to consult their personal data. This request must be made in writing addressed to CAMILO CEBALLOS, Legal Representative; specifying the type of data you wish to consult, name, surname, citizenship card, telephone number and email address to which the corresponding information will be sent.
OPTIMY CALI NORTE SAS will send the owner the information consulted, which will be made up of the list of all the information that is linked to the identification of the owner in the database. The query will be answered within a maximum period of fifteen (15) business days, counting from the day following the date of receipt thereof. When it is not possible to attend to the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case may exceed eight (8) business days following the expiration of the first term.
The query will be answered in writing and will not generate cost for the owner.
5. PROCEDURE FOR DELETION, CORRECTION OR UPDATE OF INFORMATION.
The owners may at any time request the deletion, correction or update of their personal data and/or revoke the authorization granted for their processing, by submitting a claim as follows:
• The claim will be made by physical communication or by email to the address OPTIMY CALI NORTE SAS@HOTMAIL.COM, addressed to OPTIMY CALI NORTE SAS with the identification of the owner, the description of the facts that give rise to the request, the address and accompanied by the documents that support the request if applicable.
• If the claim is incomplete, the owner will be required to correct the deficiencies within five (5) business days following receipt of the request. After two (2) months from the date of the request, without the owner presenting the required information, it will be understood that he or she has abandoned the claim.
• Once the complete claim is received, a legend will be included in the database that says “claim in process” and the reason for it, an activity that must be carried out within a period of no more than two (2) business days. Said legend must be maintained until the claim is decided.
• The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
XIII. TEMPORALITY OF THE PROCESSING OF PERSONAL DATA
In consideration of the condition of OPTIMY CALI NORTE SAS and in accordance with the principles and technological and administrative measures that are incorporated within the organization, the personal data referred to in this policy will be maintained and conserved indefinitely.
Information Contained in Automated Medium
It refers to all the databases that OPTIMY CALI NORTE SAS will have stored on its work equipment and in its external backup. Biweekly backup copies will be made of the most up-to-date information and they will be maintained for up to two years.
At least 24 copies of the latest information will be available in case it needs to be restored.
The removable hard drive will be under the exclusive custody of the Data Controller and outside the facilities.
Information Contained in Physical Medium
It refers to all the databases that OPTIMY CALI NORTE SAS will have stored in its Physical Files; which will be in custody within the facilities for up to 5 years.
It will be supported by a scanned digital file which will be subjected to automated information processing (previous section).
Once the physical information is kept for 5 years; It will be forwarded, stored in inventoried boxes and sent to the site designated for this purpose.
Once the 10 years of custody have expired, the company will proceed to apply what is established in the current national legislation applicable for this purpose.
XIV. EFFECTIVE DATE OF THIS PERSONAL DATA PROCESSING POLICY
The effective date of this policy will be January 31, 2020, the date of its official publication.
Sincerely,
NILSA PEÑA
Legal representative. OPTIMY CALI NORTE SAS