Policy for the Treatment of Personal Data
I. RESPONSIBLE FOR THE TREATMENT:
The legal entity that directly or in association with others, makes decisions about database and the treatment given to them is:
Business name ARIAS SERNA Y SARAVIA S.A.S
Tax identification number 860062854-9
Address 84ª Street #10 - 33 10th floor, Bogotá
Phone: (601) 257 0266
Privacy officer Strategy and quality management
Email Asys-habeas@asys.com.co
Sitio Web www.asys.com.co
II. APPLICATION AND REGULATORY FRAMEWORK:
Based on article 15 of the Political Constitution of Colombia, on Law 1581 of 2012 and regulatory decrees 1377 of 2013 and 886 of 2014 – today contained in chapters 25 and 26 of Decree 1074 of 2015, which developed the framework general data protection in Colombia; ARIAS SERNA Y SARAVIA SAS, has implemented these Personal Data Processing Policies. All areas of the company and third parties who are entrusted with the processing of Personal data provided to ARIAS SERNA Y SARAVIA SAS will comply this policy, to respect all the rights and guarantees regarding the privacy of the owners about whom we process personal data and fully comply with the parameters established in the aforementioned regulations.
III. WORD GLOSSARY:
The following words contained in the Personal Data Processing Policies of ARIAS SERNA Y SARAVIA SAS should be understood in the following sense:
Notice of Privacy: It is the physical or electronic document, generated by ARIAS SERNA Y SARAVIA SAS to inform to the holder that these Personal Data Processing Policies will be applicable to him, how he can know its content, and what purpose will be given to its Personal information.
Database: It is the organized set of personal data subject to treatment, and includes physical electroniuc and automated files.
Personal Data: Any information linked or that can be associated with one or more specific or determinable natural persons.
Sensitive Data: It is the data that affects the privacy of the holder or whose improper use can generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data.
Responsible for the processing of personal data: They are the natural or legal persons who by themselves or in association with others, carry out the processing of personal data on behalf of ARIAS SERNA Y SARAVIA SAS.
ARIAS SERNA Y SARAVIA SAS acts as responsible for all personal data on which it directly decides what treatment it will give them according to the authorizations granted by the owners.
Owner of personal data: Natural person whose personal data is subject to treatment by ARIAS SERNA Y SARAVIA SAS.
The persons who may exercise the rights established in the law are:
1. The holder, who must sufficiently prove his identity by the different means made available by ARIAS SERNA Y SARAVIA SAS.
2. Their successors in title, who must prove said quality.
3. The representatives of the holders who are minors or through a proxy, prior accreditation of the representation or proxy.
4. By stipulation in favor of another or for another.
Treatment of personal data: It is any operation or set of operations on personal data carried out by ARIAS SERNA Y SARAVIA SAS or those in charge of treatment on behalf of the company, such as collection, storage, use, circulation, or deletion.
Transfer of personal data: It will happen when ARIAS SERNA Y SARAVIA SAS or his manager of treatment, send the personal data to a receiver who, in turn, is responsible for the Treatment and who may be located in Colombia or abroad.
Transmission of personal data: It is the communication of personal data to a person in charge of the treatment, inside or outside of Colombia, with the purpose of carrying out a treatment on behalf of ARIAS SERNA Y SARAVIA SAS.
Privacy Officer: It is the person designated by ARIAS SERNA Y SARAVIA SAS whose functions, among others, are the protection of the personal data of the owners, the surveillance and control of the application of this personal data processing policy and the processing of requests of the owners who want to exercise the rights referred to in law 1581 of 2013 and this document. The Privacy Officer may have other positions inside or outside ARIAS SERNA Y SARAVIA SAS if Finalihe fully complies with the functions entrusted by contract, the functions manual of the privacy officer or Law 1581 of 2012.
IV. PURPOSE OF THE PROCESSING OF PERSONAL DATA:
Purpose is understood as the objective for which the personal data has been collected. The treatment and the purpose given to the personal data by ARIAS SERNA Y SARAVIA SAS and/or those in charge must be those established in the respective authorization garanted by the Owner.
Some of the general purposes given to the personal data processed by ARIAS SERNA Y SARAVIA SAS, depending on the authorization granted by their owners are:
1. Suppliers:
a. Accounting, tax, and administrative management:
i. Building management.
ii. Consultancies, audits, advice, and related services.
iii. Management of charges and payments.
iv. Billing management.
v. Supplier management.
vi. Economic and accounting management.
vii. Fiscal management.
viii. Video surveillance.
ix. Security and control Access to buildings.
2. Customers:
a. Various purposes:
i. Customer loyalty.
ii. Customer Service.
iii. Historical, scientific, or statistical purpose.
b. Accounting, tax, and administrative management:
i. Consultancies, audits, advice, and related services.
ii. Administrative management.
iii. Customer management.
iv. Management of charges and payments.
v. Billing management.
vi. Economic and accounting management.
vii. Fiscal management.
c. Marketing:
d. Advertising and commercial prospecting:
i. Profile analysis.
ii. Opinion polls.
iii. Commercial prospecting.
iv. Own advertising.
v. Market segmentation.
vi. History of comercial relations.
e. Security:
i. Video surveillance.
Security and control Access to buildings.
3. Employees, candidates, former employees:
a. Human Resources:
i. Time control.
ii. Staff training.
iii. Payroll management.
iv. Personnel.
v. Prestaciones sociales.
vi. Prevención de riesgos laborales.
vii. Promoción y gestión de empleo.
viii. Promoción y selección de personal.
b. Seguridad:
i. Video surveillance.
Security and control Access to buildings.
V. RIGHTS OF PERSONAL DATA HOLDERS:
The Holders of the Personal Data registered in the Databases of ARIAS SERNA Y SARAVIA SAS, have the following rights:
a) Know, update, and rectify your personal data. These rights may be exercised, among others, against Personal data that is partial, inaccurate, incomplete, fragmented, misleading, or those whose Treatment is expressly prohibited or has not been authorized by it;
b) Request proof of the Authorization granted to ARIAS SERNA Y SARAVIA SAS except when expressly excepted as a requirement for Treatment, in accordance with the provisions of article 10 of Law 1581 of 2012
c) Be informed by ARIAS SERNA Y SARAVIA SAS or the Person in Charge of the Treatment, upon request, regarding the use that has been given to their Personal Data;
d) Access free of charge, at least every calendar month, to your personal data that has been subject to Processing.
e) Request ARIAS SERNA Y SARAVIA SAS the revocation of the authorization and/or the deletion of your Personal Data, by submitting a written claim in accordance with Art. 15 of Law 1581 of 2012 and with Title VI of the Treatment Policy of Personal Data, in the following cases:
1. When you consider that they are not being treated in accordance with the principles, duties and obligations provided for in Law 1581 of 2012.
2. When they are no longer necessary or relevant for the purpose for which they were collected.
3. When the period necessary for the fulfillment of the purposes for which they were collected has been exceeded.
The deletion implies the total or partial elimination of the personal information in accordance with the request of the owner in the records, files, databases or treatments carried out by ARIAS SERNA Y SARAVIA SAS.
The revocation of the authorization or deletion of personal data may be requested on all or part of the data that comprise the authorization granted that this document of information treatment policies deals with, but not with respect to the data regulated under Law 1266 of 2008 and/or any other rule that adds, modifies, or repeals it.
Exceptions to the Right to revoke the authorization and/or the deletion of Personal Data
It is important to clarify to the holders of personal data whose information is stored in the ARIAS SERNA Y SARAVIA SAS databases, that the right of cancellation is not absolute and ARIAS SERNA Y SARAVIA SAS may deny the exercise thereof when:
a) The owner has a legal or contractual duty to remain in the database.
b) The elimination of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
c) The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner.
Sensitive personal data:
In general terms, ARIAS SERNA Y SARAVIA SAS does not process sensitive personal data, however, in exceptional cases, it may process them if:
a) The holder has given his explicit authorization to said treatment, except in cases where the granting of said authorization is not required by law.
b) The Treatment is necessary to safeguard the vital interest of the owner and the latter is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.
c) The Treatment that refers to data that is necessary for the recognition, exercise or defense of a right in a judicial process.
e) The Treatment has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Holders must be adopted.
Rights of children and adolescents:
In general terms, ARIAS SERNA Y SARAVIA SAS does not process the personal data of Children and Adolescents, however, in exceptional cases, it may process them as long as:
1. It is data of a public nature.
2. The treatment carried out by ARIAS SERNA Y SARAVIA SAS responds to and respects the best interests of children and adolescents.
3. The treatment carried out by ARIAS SERNA Y SARAVIA SAS ensures respect for your fundamental rights.
Once the above requirements have been fulfilled, the legal representative of the children or adolescents will grant the authorization, after the minor has exercised his or her right to be heard, an opinion that will be valued considering the maturity, autonomy, and ability to understand the matter.
VI. INQUIRY AND COMPLAINT PROCEDURE:
1. Inquiry procedure:
1.1 Guaranteed rights:
Through this procedure, ARIAS SERNA Y SARAVIA SAS and/or the managers, guarantee the holders of personal data contained in their databases or their assignees, the right to consult all the information contained in their individual record or all that is linked to your identification as established in literal a) chapter V of these Personal Data Processing Policies.
1.2 Query manager:
The person responsible for dealing with these requests will be the Privacy Officer of ARIAS SERNA Y SARAVIA SAS who will receive and process the requests received, under the terms, deadlines and conditions established in Law 1581 of 2012 and in these policies.
1.3 Ways of receiving queries:
The Holder or his successors in title may send his query to the email address serviciosalcliente@asys.com.co or by submitting a written request at our offices located at Calle 84a No. 10 - 33 | 10th floor.
1.4 Response times to queries:
Requests received through the above means will be addressed within a maximum term of ten (10) business days from the date of receipt.
1.5 Extension of the response period:
In case of impossibility to attend the query within said term, the interested party will be informed before the expiration of 10 days, stating the reasons for the delay, and indicating the date on which his query will be attended, which in no case may exceed the five (5) business days following the expiration of the first installment.
2. Claims procedure:
2.1 Rights guaranteed through the claims procedure:
2.1.1 Correction or Update: ARIAS SERNA Y SARAVIA SAS and/or the Managers, guarantee the holders of personal data contained in their databases or their successors in title, the right to correct or update the personal data that rests in their databases, by presentation of a claim, when they consider that the parameters established by law or those indicated in literal a) chapter V of these Personal Data Processing Policies are met so that the request for Correction or Update is appropriate.
2.1.2 Revocation of authorization or Deletion of Personal Data: ARIAS SERNA Y SARAVIA SAS and/or the Managers, guarantee the holders of personal data contained in their databases or their successors in title, the right to Request the Revocation of the authorization or request the deletion of the information contained in your individual record or all that is linked to your identification when they consider that the parameters established by law or those indicated in literal e) chapter V of these Personal Data Processing Policies are met. Likewise, the right to file claims is guaranteed when they notice the alleged breach of Law 1581 of 2012 or of these Personal Data Processing Policies.
2.2 Responsible for claims handling:
The person responsible for dealing with the claims submitted by the owners will be the Privacy Officer of ARIAS SERNA Y SARAVIA SAS, who will receive and process the claims received, under the terms, deadlines and conditions established in Law 1581 of 2012 and in the present policies.
2.3 Ways of reception and legal requirements of claims:
The Holder or his successors in title may send their claim to the email address serviciosalcliente@asys.com.co or by filing in writing at our offices located at Calle 84ª No. 10 - 33 | 10th floor.
The submitted claims must contain at least the following information:
2.3.1 Holder identification;
2.3.2 Description of the facts giving rise to the claim;
2.3.3 Address of the holder and/or his heirs;
2.3.4 Documents that you want to assert.
2.4 Claims without compliance with legal requirements:
In the event that the claim is submitted without compliance with the above legal requirements, the claimant will be requested within five (5) days after receipt of the claim, to correct the faults and present the missing information or documents.
2.5 Withdrawal of the claim:
After two (2) months from the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn.
2.6 Reception of claims that do not correspond to the company:
When ARIAS SERNA Y SARAVIA SAS receives a claim addressed to another organization, it will transfer it to the appropriate party within a maximum period of two (2) business days and will inform the claimant of the situation.
2.7 Legend inclusion in the database:
Once the claim has been fully received, within a maximum term of two (2) business days counted from receipt, ARIAS SERNA Y SARAVIA SAS will include in the database where the personal data of the Holder is found, a legend that says, "claim in procedure" and the reason for it. Said legend must be kept until the claim is decided.
2.8 Response times to queries:
Requests received through the above means will be addressed within a maximum term of fifteen (15) business days from the date of receipt.
2.9 Extension of the response period:
In case of impossibility to attend the query within said term, the interested party will be informed before the expiration of 10 days, stating the reasons for the delay, and indicating the date on which his query will be attended, which in no case may exceed the eight (8) business days following the expiration of the first installment.
2.10 Personal data deletion procedure:
In the event that the deletion of the owner´s personal data of the database is appropriate in accordance with the claim presented, ARIAS SERNA Y SARAVIA SAS, must carry out the deletion in such a way that the deletion does not allow the recovery of the information, however, the holder must know in some cases certain information must remain in historical records for compliance with the legal duties of the organization, so its deletion will deal with the active treatment of the same and according to the request of the holder.
VII. INTERNATIONAL TRANSFER OF PERSONAL DATA:
When ARIAS SERNA Y SARAVIA SAS sends or transfers personal data of owners that rest in its databases to another country, it must have the authorization of the owner of the information that is transferred. Unless the law says otherwise, the existence of said authorization is necessary to carry out the international circulation of data. In this sense, those obliged to comply with this policy must verify that they have the prior, express and unequivocal authorization of the owner that allows the transmission of their personal data.
The international transfer of personal data will be made only to third parties with whom ARIAS SERNA Y SARAVIA SAS has a contractual, commercial and/or legal relationship.
VIII. ACCEPTANCE OF PERSONAL INFORMATION PROCESSING POLICIES:
The holders of the information that rests in the databases of ARIAS SERNA Y SARAVIA SAS accept the processing of their personal data, in accordance with the terms of this document and ARIAS SERNA Y SARAVIA SAS may continue processing the data for the purposes described, if they do not exercise their right to revoke or delete.
IX. PRIVACY OFFICER:
According to article 2.2.2.25.4.4 decree 1074 of 2015, all responsible and in charge must designate a person or area that "assumes the function of protection of personal data" and that will process the requests of the owners, for the exercise of the rights referred to in law 1581 of 2012.
The privacy officer function of ARIAS SERNA Y SARAVIA SAS, es is to ensure the effective implementation of the policies and procedures adopted by it to comply with the regulations, as well as the implementation of good data management practices. personnel within the company.
The privacy officer will have the task of structuring, designing, and managing the program that allows the organization to comply with the regulations on the protection of personal data, as well as establishing the controls of that program, its evaluation and permanent review.
X. NATIONAL REGISTRY DATABASE:
In accordance with Art. 25 of Law 1581 and its regulatory decrees, ARIAS SERNA Y SARAVIA SAS must register its databases together with this personal data treatment policy in the national registry of databases administered by the Superintendence of Industry and Commerce in accordance with the procedure stipulated by Circular 002 of 2015.
XI. SCOPE AND PURPOSE OF THE AUTHORIZATIONS GRANTED BY THE HOLDERS:
As a general rule, the time of the authorizations on the use of personal data, is understood as the term of the commercial relationship or of the link to the company and while the development of the company's corporate purpose is in force.
XII. VALIDITY OF PERSONAL DATA PROCESSING POLICIES AND DATABASE:
This personal data processing policy is in force as of September 1, 2022 with indefinite validity, which is the term stipulated in the Bogotá Chamber of Commerce for the development of the corporate purpose of the company and will be available to the owners in the Website: www.asys.com.co.
The validity period of the ARIAS SERNA Y SARAVIA SAS databases will be the same period stipulated in the Bogotá Chamber of Commerce for the development of the company's corporate purpose, which is indefinite.
Any substantial change in the personal data processing policies will be communicated in a timely manner to the data owners through the usual means of contact and/or through the website: www.asys.com.co.
LUIS FERNANDO SERNA
Manager
Version 01
September 2022