Information Processing Policy of DATASAE LTDA

This is an English translation of the Spanish original. In the event of any discrepancy, the Spanish version shall prevail.

In compliance with the provisions of Law 1581 of 2012 “which sets forth general provisions for the protection of personal data” and Regulatory Decree 1377 of 2013 “which partially regulates Law 1581 of 2012”, DATASAE LTDA publishes this policy, which contains the guidelines it applies to the processing of the personal data of its customers, suppliers and employees.

1. Data Controller

DATASAE LTDA, identified with Tax ID (NIT) 805.026.692-1, domiciled in the city of Cali, Colombia, with notification address in Cali at Cr 100 5 169 Torre A Oficina 617, Centro Comercial Unicentro, email comercial@datasae.com and mobile phone +57 312 351 4068.

2. Processing of Personal Data

For the processing, collection, storage, use, circulation, deletion, among others, of personal data of natural persons by DATASAE LTDA, prior and informed authorization must be obtained from the Data Subject (the natural person whose personal data is processed) or from whoever is entitled in accordance with Article 20 of Decree 1377 of 2013. Such authorization may be granted in writing, orally, or through unequivocal conduct of the Data Subject that reasonably allows the conclusion that authorization was granted, and that may be subsequently consulted by the Data Subject or by whoever is entitled to exercise the Data Subject’s rights under the law.

For the purposes of this policy, the following terms shall have the meanings indicated below, taken from Law 1581 of 2012 and Decree 1377 of 2013:

Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of personal data.
Database: Organized set of personal data subject to Processing.
Personal data: Any information linked or that may be associated with one or more determined or determinable natural persons.
Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person’s marital status, profession or trade, and status as a merchant or public servant.
Data Processor: Natural or legal person, public or private, who by itself or in association with others, processes personal data on behalf of the Data Controller.
Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the Processing of the data.
Data Subject: Natural person whose personal data is subject to Processing.
Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
Privacy notice: Verbal or written communication generated by the Data Controller and addressed to the Data Subject for the Processing of their personal data, informing them of the existence of the information Processing policies that will apply, how to access them, and the purposes of the intended Processing of the personal data.
Sensitive data: Data that affects the privacy of the Data Subject or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or organizations promoting the interests of any political party or guaranteeing the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data.

DATASAE LTDA collects personal data in the course of the following activities:

Registration of supplier information.
Collection of information through the website.
Collection of information through marketing programs.
Personnel selection and payroll information management.
Agreements with financial or other entities.
Collection of information in customer service activities.

During these activities, or any others involving the collection of personal data, the reporting, disclosure, use, consultation, deletion or suppression, forwarding, administration, access, retention, storage, archiving, analysis, copying, processing and inclusion of such personal data in its databases on its servers, DATASAE LTDA shall comply with Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other related regulations in the Processing of third-party personal data, for which it will obtain prior authorization from the Data Subject. Before sharing personal data with third parties, allies, contractors or suppliers, DATASAE LTDA shall ensure that it has previously obtained the Data Subject’s authorization for such use. Accordingly, it may only share personal data with third parties when it has the proper authorization of the Data Subject.

The uses to which DATASAE LTDA puts the personal data it collects in the performance of its corporate purpose include:

Responding to requests from authorities.
Internal management for the registration of its customers.
Credit risk analysis, statistical analysis or security analysis of its customers or users.
Sending correspondence, emails or contacting its customers, suppliers and employees by telephone.
Updating its databases.
Personnel selection, contract administration, management of employment relationships and compliance with the obligations arising from them, granting benefits to its employees directly or through third parties, as well as allowing employees access to the company’s IT resources.
Reporting to and consulting legally constituted credit bureaus in Colombia, mainly Datacrédito.
Collection or commercial activities.

3. Database Retention Period

The databases of DATASAE LTDA shall remain in force for as long as the purpose or purposes of the processing in each database are maintained, or for the period required under accounting, commercial, tax, labor or any other applicable regulations, and in consideration of the administrative, accounting, tax, legal and historical aspects of the information stored therein, up to a maximum of fifty years. Consequently, and provided this does not contravene any regulation in force, once the purpose or purposes of the data processing have been fulfilled, DATASAE LTDA will delete the data. Notwithstanding the foregoing, personal data shall be retained when required to comply with a legal or contractual obligation.

4. Rights of Data Subjects

In accordance with the law, DATASAE LTDA acts as Data Controller in all cases in which it collects, stores, uses, circulates, deletes, transfers or transmits Data Subjects’ data in any of its activities as a company, whether directly or through third parties.

The rights granted by law to the Data Subject are the following:

To know, update and rectify their personal data. This right may be exercised, among others, regarding partial, inaccurate, incomplete, fragmented or misleading data, or data whose Processing is expressly prohibited or has not been authorized.
To request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for Processing in accordance with Article 10 of Law 1581 of 2012.
To be informed by the Data Controller or the Data Processor, upon request, of the use given to their personal data.
To file complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) for violations of this law and any regulations that amend, add to or complement it.
To revoke the authorization and/or request the deletion of the data when the Processing does not respect constitutional and legal principles, rights and guarantees. Revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that the Data Controller or Data Processor has engaged in conduct contrary to this law and the Constitution.
To access, free of charge, their personal data that has been subject to Processing.

5. Processing of Sensitive Data and Personal Data of Children and Adolescents

The Processing of sensitive data and of data belonging to children and adolescents is prohibited. Notwithstanding the foregoing, DATASAE LTDA processes data of this type in the following cases, solely and exclusively with the prior and express authorization of the Data Subject:

Sensitive data: DATASAE LTDA processes sensitive data as permitted by Article 6 of Law 1581 of 2012, collected from its employees for the sole and exclusive purpose of managing the employment relationship with the company and complying with the legal, contractual and/or collective-agreement obligations arising from it, both during and after such relationship. The foregoing is without prejudice to the authorizations that Data Subjects may grant under Article 6 of Decree 1377 of 2013.

Such data is managed in the databases of the human resources department of DATASAE LTDA.

For the Processing of sensitive data, DATASAE LTDA shall:

Inform the Data Subject that, as the data is sensitive, they are not obliged to authorize its Processing.
Inform the Data Subject explicitly and in advance, in addition to the general requirements of authorization for the collection of any type of personal data, which of the data to be processed are sensitive and the purpose of the processing, and obtain their express consent.
Not condition any activity on the provision of sensitive personal data.

The Processing of this type of data shall be permitted provided that it responds to and respects the best interests of children and adolescents and ensures respect for their fundamental rights.

Once the above requirements are met, DATASAE LTDA shall obtain authorization from the legal representative of the child or adolescent for the collection, storage, sending to third parties and use of the data for the purposes stated above, after the minor has exercised their right to be heard, an opinion that shall be weighed taking into account their maturity, autonomy and capacity to understand the matter.

6. Handling of Inquiries, Requests and Complaints

DATASAE LTDA shall allow the Data Subject free access to their information whenever required to make inquiries, and shall guarantee Data Subjects the right to file complaints and requests for correction, updating or deletion of personal data.

DATASAE LTDA may receive the aforementioned requests regarding Personal Data from:

The Data Subject.
The successors in title, legal representatives or attorneys-in-fact of the Data Subjects.
Public or administrative entities in the exercise of their legal functions.
Judicial order, and third parties authorized by the Data Subject or by law.
Stipulation in favor of or on behalf of another.

DATASAE LTDA will receive inquiries, requests and complaints in writing at its address Cr 100 5 169 Torre A Oficina 617, Centro Comercial Unicentro, orally by telephone at 4851132, and through its website www.datasae.com via the “Contact Us” link.

Inquiries about personal data shall be answered by DATASAE LTDA within a maximum of ten (10) business days from the date of receipt. When it is not possible to answer the inquiry within that period, the Data Subject or their successors shall be informed of the reasons for the delay and the date on which the inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first period. If the inquiry is made by telephone, the Data Subject shall be informed that it must be submitted in writing in order to keep a record of it.

The handling of these inquiries and complaints shall be free of charge, except in cases expressly provided for by law. Requests for deletion of information and revocation of authorization shall not proceed when the Data Subject has a legal or contractual duty to remain in the databases of DATASAE LTDA.

The department of DATASAE LTDA responsible for personal data protection, which will process requests, inquiries and complaints related to Habeas Data, is Customer Service.

7. Receipt of Requests and Inquiries

By physical mail or email: The Data Subject or other persons permitted by law may submit inquiries, requests or complaints using any format or through a letter addressed to the company, sent by physical mail to Cr 100 5 169 Torre A Oficina 617, Centro Comercial Unicentro, or by email to comercial@datasae.com. Response times shall be ten (10) business days for inquiries and fifteen (15) business days for complaints.
By telephone: Inquiries, requests and complaints received through this channel will be processed by the company and answered in writing to the notification address provided by the Data Subject. Response times shall be ten (10) business days for inquiries and fifteen (15) business days for complaints.
Request to access, update and rectify personal data: This shall proceed regarding partial, inaccurate, incomplete, fragmented or misleading data, or data whose processing is expressly prohibited or has not been authorized by the Data Subject. The Data Subject’s request must be sent by physical mail to Cr 100 5 169 Torre A Oficina 617, Centro Comercial Unicentro, or by email to comercial@datasae.com. Response times shall be ten (10) business days for inquiries and fifteen (15) business days for complaints.
Request to revoke authorization and/or delete data: This shall proceed at the request of the Data Subject (except where the law expressly provides that it does not) or when so determined by the Superintendence of Industry and Commerce, after verifying non-compliance by DATASAE LTDA with constitutional and legal principles, rights and guarantees. The Data Subject’s request must be sent by physical mail to Cr 100 5 169 Torre A Oficina 617, Centro Comercial Unicentro, or by email to comercial@datasae.com. Response times shall be ten (10) business days for inquiries and fifteen (15) business days for complaints.
Complaints for inaccuracy or breach of obligations: The Data Subject or their successors who consider that the information contained in a database should be corrected, updated or deleted, or who consider that any of the duties set forth in Law 1581 of 2012 has been breached, may file a complaint with DATASAE LTDA by physical mail to Cr 100 5 169 Torre A Oficina 617, Centro Comercial Unicentro, or by email to comercial@datasae.com. Such complaint shall be processed according to the following rules:
1. The complaint shall be submitted through a request addressed to DATASAE LTDA, including the identification of the Data Subject, a description of the facts giving rise to the complaint, the address, and any supporting documents. If the complaint is incomplete, the interested party will be asked to correct it within five (5) days of receipt. If two (2) months elapse from the date of the request without the applicant submitting the required information, the complaint shall be deemed withdrawn. If the recipient of the complaint is not competent to resolve it, it shall forward it to the appropriate party within a maximum of two (2) business days and inform the interested party.
2. Once the complete complaint has been received, a note reading “complaint in process” and the reason for it shall be added to the database within no more than two (2) business days. This note shall remain until the complaint is resolved.
3. The maximum period to address the complaint shall be fifteen (15) business days from the day following its receipt. When it is not possible to address the complaint within that period, the interested party shall be informed of the reasons for the delay and the date on which the complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the first period.
When a complaint exists, DATASAE LTDA shall inform any third parties with whom it has shared the personal data subject to the complaint that the complaint exists and is in process.

In addition, it shall add to the database the note “information under judicial dispute” once notified by the competent authority of judicial proceedings related to the quality of the personal data. While the information is being disputed by its Data Subject before the authority, DATASAE LTDA may not share it with third parties.

8. Updates to this Policy

DATASAE LTDA reserves the right to update this Policy as required by its internal procedures and the exercise of its activities. When updated, it shall inform the Data Subjects of the data contained in its databases through appropriate means prior to its implementation.

9. Effective Date of the Policy

This policy was published on August 30, 2013.

10. Last Update

This policy was last updated on November 20, 2018.