PERSONAL DATA PROCESSING POLICY COMARBEL SAS

1 reach

This Personal Data Protection Policy will apply to all Databases and / or Files that contain Personal Data that are subject to Treatment by COMARBEL SAS. Considered responsible for the processing of Personal Data.

2. Identification of the Person Responsible for the Processing of Personal Data

COMARBEL SAS. Entity domiciled at Carrera 92 No. 17B - 24 of the city of Bogotá DC, Colombia.
Email Comarbel@comarbel.com, Telephone +57 (1) 4324510 in the city of Bogotá.

3. Definitions

Authorization: Prior, express and informed consent of the Holder to carry out the Processing of Personal Data.
Notice of Privacy: Verbal or written communication generated by the Responsible Party, addressed to the Owner for the Treatment of their Personal Data, through which they are informed about the existence of the Information Treatment Policies that will be applicable, the way to access them and the purposes of the Treatment that is intended to give the personal data.
Database: Organized set of Personal Data that is subject to Treatment.
Customers: Natural or legal person, public or private with whom COMARBEL SAS. has a business relationship. It includes stores, supermarkets, mini markets, among others.
Personal Data: Any information linked or that may be associated with one or more specific or determinable natural persons. Some examples of personal data are the following: name, citizenship card, address, email, telephone number, marital status, health data, fingerprint, salary, assets, financial statements, etc.
Sensitive data: Information that affects the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data, among others, the capture of still or moving images, fingerprints , photos, iris, voice, facial or palm recognition, etc.
Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, carries out the Processing of Personal Data on behalf of the Person Responsible for the Treatment. In the events in which the Responsible Party does not act as the Manager of the Database, it will be expressly identified who will be the Manager.
Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the Database and / or the Treatment of the data.
Claim: Request from the Data Owner or the persons authorized by it or by the Law to correct, update or delete their personal data or to revoke the authorization in the cases established by the Law.
Terms and Conditions: general framework in which the conditions for the participants of promotional or related activities are established.
Headline: Natural person whose Personal Data are subject to Treatment.
Transfer: The data transfer takes place when the Responsible and / or Person in Charge of the Treatment of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is Responsible for the Treatment and is inside or outside the country. .
Transmission: Treatment of Personal Data that implies the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a Treatment by the Manager on behalf of the Responsible.
Treatment: Any operation or set of operations on Personal Data, such as the collection, storage, use, circulation or deletion.

4. Principles Applicable to the Processing of Personal Data

For the Treatment of Personal Data, COMARBEL SAS. will apply the principles mentioned below, which constitute the rules to be followed in the collection, handling, use, treatment, storage and exchange of personal data:

• Legality: The processing of personal data will be carried out in accordance with the applicable legal provisions (Statutory Law 1581 of 2012 and its regulatory decrees).
• Purpose: The personal data collected will be used for a specific and explicit purpose which must be informed to the Owner or permitted by Law. The Owner will be informed clearly, sufficiently and in advance about the purpose of the information provided.
• Liberty: The collection of Personal Data may only be exercised with the prior, express and informed authorization of the Holder.
• Truthfulness or Quality: The information subject to the Processing of Personal Data must be truthful, complete, exact, updated, verifiable and understandable.
• Transparency: In the Processing of Personal Data, the right of the Holder to obtain at any time and without restrictions, information about the existence of data concerning him is guaranteed.
• Access and restricted circulation: The processing of personal data may only be carried out by the persons authorized by the Holder and / or by the persons provided for in the Law.
• Safety: The Personal Data subject to Treatment will be handled adopting all the security measures that are necessary to avoid its loss, adulteration, consultation, use or unauthorized or fraudulent access.
• Confidentiality: All officials working in COMARBEL SAS. They are obliged to keep confidentiality about the personal information to which they have access during their work in COMARBEL SAS.

5. Treatment and Purposes to which the Personal Data processed by THE COMPANY will be submitted

COMARBEL SAS., Acting as Responsible for the Processing of Personal Data, for the proper development of its commercial activities, as well as for the strengthening of its relationships with third parties, collects, stores, uses, circulates and deletes Personal Data corresponding to natural persons with whom it has or It has had a relationship, such as, without the enumeration implying limitation, workers and relatives of these, shareholders, clients, distributors, suppliers, creditors and debtors, for the following purposes or purposes:

5.1. General purposes for the processing of Personal Data

Allow the participation of the Holders in marketing and promotional activities (including participation in contests, raffles and sweepstakes) carried out by COMARBEL SAS .;
Evaluate the quality of the service, carry out market studies on consumption habits and statistical analysis for internal uses;
Control access to COMARBEL SAS offices and establish security measures, including the establishment of video-monitored areas;
Respond to queries, requests, complaints and claims that are made by the Holders and control bodies and transmit the Personal Data to the other authorities that by virtue of the applicable law must receive the Personal Data;
To eventually contact, via email, or by any other means, natural persons with whom he has or has had a relationship, such as, without the enumeration implying limitation, workers and relatives of these, shareholders, consumers, clients, distributors, suppliers , creditors and debtors, for the aforementioned purposes.
Transfer the information collected to different areas of COMARBEL SAS and its related companies in Colombia and abroad when it is necessary for the development of their operations (collection of portfolio and administrative collections, treasury, accounting, among others);
For the attention of judicial or administrative requirements and the fulfillment of judicial or legal mandates;
Register your personal data in the information systems of COMARBEL SAS and in its commercial and operational databases;
Any other activity of a similar nature to those described above that is necessary to develop the corporate purpose of COMARBEL SAS.

5.2. Regarding the personal data of our Clients and Consumers:

To fulfill the obligations contracted by COMARBEL SAS with its Clients and Consumers at the time of acquiring our products;
Send information about changes in the conditions of the products offered by COMARBEL SAS;
Send information about offers related to our products that you offer COMARBEL SAS and its related companies;
To strengthen relations with its Consumers and Clients, by sending relevant information, taking orders and evaluating the quality of the service;
For the determination of pending obligations, the consultation of financial information and credit history and the report to information centers of unfulfilled obligations, with respect to its debtors;
To improve, promote and develop its products and those of its related companies worldwide;
Train sellers and agents in basic aspects of commercial management of the products offered by COMARBEL SAS;
Allow companies linked to COMARBEL SAS, with which it has entered into contracts that include provisions to guarantee the security and proper treatment of the personal data processed, contact the Holder with the purpose of offering goods or services of interest;
Control access to the offices of COMARBEL SAS and establish security measures, including the establishment of video-surveillance zones;
Use the different services through the websites of COMARBEL SAS, including content and format downloads;

5.3. Regarding the personal data of our employees:

Manage and operate, directly or through third parties, the personnel selection and hiring processes, including the evaluation and qualification of the participants and the verification of work and personal references, and the performance of safety studies;
Develop the activities of Human Resources management within COMARBEL SAS, such as payroll, affiliations to entities of the general social security system, occupational health and welfare activities, exercise of the employer's sanctioning power, among others;
Make the necessary payments derived from the execution of the employment contract and / or its termination, and the other social benefits that may be applicable in accordance with the applicable law;
Contract employment benefits with third parties, such as life insurance, medical expenses, among others;
Notify authorized contacts in case of emergencies during working hours or during the development of the same;
Coordinate the professional development of employees, the access of employees to the employer's computer resources and provide support for their use;
Plan business activities;

5.4. Regarding Supplier Data:

To invite them to participate in selection processes and events organized or sponsored by COMARBEL SAS;
For the evaluation of the fulfillment of its obligations;
To register in the systems of COMARBEL SAS;
To process your payments and verify outstanding balances;

5.5. Regarding the personal data of our shareholders:

For the recognition, protection and exercise of the rights of the shareholders of COMARBEL SAS;
For the payment of dividends;
To eventually contact, via email, or by any other means, the shareholders for the aforementioned purposes;

6. Rights of the Holders of Personal Data

The natural persons whose Personal Data are subject to Treatment by COMARBEL SAS, have the following rights, which they can exercise at any time:

6.1 Know the Personal Data on which COMARBEL SAS is performing the Treatment. Similarly, the Owner may request at any time that their data be updated or rectified, for example, if they find that their data is partial, inaccurate, incomplete, fractioned, misleading, or those whose Treatment is expressly prohibited or not. has been authorized.

6.2 Request proof of authorization granted to COMARBEL SAS for the Treatment of your Personal Data.

6.3 Be informed by COMARBEL SAS, upon request, regarding the use that it has given to your Personal Data.

6.4 Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of the Law on Protection of Personal Data.

6.5 Request to COMARBEL SAS the deletion of your Personal Data and / or revoke the authorization granted for the Treatment thereof, by submitting a claim, in accordance with the procedures established in numeral 13 of this Policy. However, the request for the deletion of the information and the revocation of the authorization will not proceed when the Holder of the information has a legal or contractual duty to remain in the Database and / or Files, nor while the relationship between the Holder and COMARBEL SAS, by virtue of which your data was collected.

6.6 Free access to your Personal Data that have been subject to Treatment.

The rights of the Holders may be exercised by the following persons:
• By the Holder;
• By their successors, who must prove such quality;
• By the representative and / or attorney-in-fact of the Holder, prior accreditation of the representation or power of attorney;
• By stipulation in favor of another or for another.

7. Duties of COMARBEL SAS as Responsible for the Processing of Personal Data

COMARBEL SAS keep in mind that the Personal Data are the property of the people to whom they refer and only they can decide on them. In that sense, COMARBEL SAS will use the Personal Data collected only for the purposes for which it is duly empowered and respecting, in any case, current regulations on the Protection of Personal Data.
COMARBEL SAS will attend to the duties provided for those Responsible for Treatment, contained in article 17 of Law 1581 of 2012 and the other rules that regulate, modify or replace it.

8. Area Responsible for the Implementation and Observance of this Policy

The Management area of COMARBEL SAS is in charge of the development, implementation, training and observance of this Policy. For this purpose, all the officials who carry out the Processing of Personal Data in the different areas of COMARBEL SASThey are obliged to report these Databases to the Management area and to transfer to it immediately, all the requests, complaints or claims that they receive from the Personal Data Holders.

The Management area of COMARBEL SAS has been designated by COMARBEL SAS as an area responsible for the attention of requests, queries, complaints and claims before which the Holder of the information may exercise their rights to know, update, rectify and delete the data and revoke the authorization. This area is located at the address: Carrera 92 No. 17 B - 24 of the city of Bogotá DC, Colombia, and can be contacted via email: Comarbel@comarbel.com.

9. Authorization

COMARBEL SAS will request prior, express and informed authorization to the Holders of the Personal Data on which the Treatment is required.
This manifestation of the will of the Holder can be given through different mechanisms made available by COMARBEL SAS, such as:

• In writing, filling out an authorization form for the Processing of Personal Data determined by COMARBEL SAS.
• Orally, through a telephone conversation or by videoconference.
• Through unequivocal behaviors that allow to conclude that you granted your authorization, through your express acceptance of the Terms and Conditions of an activity within which the authorization of the participants is required for the Treatment of their Personal Data.
IMPORTANT: In no case COMARBEL SAS will assimilate the Owner's silence to unequivocal conduct.

10. Special Provisions for the Processing of Personal Data.

10.1 Processing of Personal Data of a Sensitive Nature

The Processing of Personal Data of a sensitive nature is prohibited by law, unless there is express, prior and informed authorization from the Holder, among other exceptions enshrined in the Article 6 of Law 1581 of 2012.
In this case, in addition to complying with the requirements established for authorization, COMARBEL SAS will inform the Holder:

• that, as it is sensitive data, it is not obliged to authorize its Treatment.
• Which of the data that will be processed are sensitive and the purpose of the Treatment.

Further, COMARBEL SAS will treat the sensitive data collected under security and confidentiality standards corresponding to its nature. For this purpose, COMARBEL SAS has implemented administrative, technical and legal measures contained in its Policies and Procedures Manual, which are mandatory for its employees and, as applicable, its suppliers, related companies and commercial allies.

10.2 Processing of Personal Data of Children and Adolescents

As provided by the Article 7 of Law 1581 of 2012 and the Article 12 of Decree 1377 of 2013, COMARBEL SAS It will only carry out the Treatment, corresponding to children and adolescents, as long as this Treatment responds to and respects the best interests of children and adolescents and ensures respect for their fundamental rights.
Once the above requirements have been met, COMARBEL SAS must obtain the Authorization of the legal representative of the child or adolescent, prior to the exercise of the minor's right to be heard, an opinion that will be valued taking into account maturity, autonomy and ability to understand the matter.

11. Procedure for Attention and Response to Requests, Queries, Complaints and Claims from Personal Data Holders

Holders of Personal Data processed by COMARBEL SAS They have the right to access their Personal Data and the details of said Treatment, as well as to rectify and update them if they are inaccurate or request their elimination when they consider that they are excessive or unnecessary for the purposes that justified their obtaining or oppose the Treatment of the same for specific purposes.

The ways that have been implemented to guarantee the exercise of these rights through the presentation of the respective request are:

• Communication addressed to the Management, in the direction Carrera 92 No. 17 B - 24, Bogotá DC Colombia.
• Request submitted to email: comarbel.comarbel.com
• Application submitted through phone +57 (1) 4324510 to the Management area.

These channels may be used by holders of personal data, or third parties authorized by law to act on their behalf, in order to exercise the following rights:

11.1 Procedure for making requests and inquiries

(i) The Holder may consult their personal data at any time. For this purpose, you may submit a request indicating the information you want to know, through any of the mechanisms indicated above.

(ii) The Holder or his successors in title must prove their identity, that of their representative, the representation or stipulation in favor of another or for another. When the request is made by a person other than the Owner and it is not proven that it acts on his behalf, it will be deemed not submitted.

(iii) The query and / or request must contain at least the name and contact address of the Holder or any other means to receive the response, as well as a clear and precise description of the personal data with respect to which the Holder seeks to exercise the right of consultation and / or petition.

(iv) If the query and / or request made by the Data Owner is incomplete, COMARBEL SAS will require the interested party within five (5) days after receiving the query and / or request to correct the faults. After two (2) months have elapsed from the date of the request, without the applicant submitting the required information, it will be understood that he has desisted from his inquiry.

(v) Requests and / or inquiries will be attended by COMARBEL SAS within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend to the request or consultation within said term, this fact will be informed to the applicant, stating the reasons for the delay and indicating the date on which the request for consultation will be attended, which in no case may exceed five (5 ) business days following the expiration of the first term.

11.2 Procedure for making complaints and claims
In accordance with the provisions of Article 14 of Law 1581 of 2012, when the Holder or his successors in title consider that the information processed by COMARBEL SAS must be subject to correction, update or deletion, or when it must be revoked due to the alleged breach of any of the duties contained in the Law, they may submit a request to COMARBEL SAS, which will be processed under the following rules:

(i) The Holder or his successors in title must prove their identity, that of their representative, the representation or stipulation in favor of another or for another. When the request is made by a person other than the Owner and it is not proven that it acts on his behalf, it will be deemed not submitted.

(ii) The request for rectification, update, deletion or revocation must be submitted through the means enabled by THE COMPANY indicated in this document and contain, at least, the following information:

• The name and domicile address of the Holder or any other means to receive the answer.
• The documents that prove the identity of the applicant and, if applicable, that of his representative with the respective authorization.
• The clear and precise description of the personal data with respect to which the Holder seeks to exercise any of the rights and the specific request.

(iii) If the application is submitted incomplete, COMARBEL SAS must require the interested party within five (5) days following receipt to correct the faults.
After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that they have withdrawn their application.

(iv) In the event that the person who receives the request is not competent to resolve it, it will transfer to the area of the Management of COMARBEL SAS within a maximum term of two (2) business days and will inform the interested party of the situation.

(v) Once the request is received, a legend that says “claim in process” and the reason for it will be included in the Database, within a term not exceeding two (2) business days. This legend must be maintained until it is decided.

(vi) The maximum term to attend to this request will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend it within said term, the interested party will be informed about the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. .

12. Information Obtained Passively

When the services contained within the COMARBEL SAS websites are used, it may collect information passively through information management technologies, such as "cookies", through which information about the hardware is collected. and the computer software, IP address, browser type, operating system, domain name, access time and the addresses of the websites of origin; Through the use of these tools, no personal data is directly collected from users. Information will also be collected about the pages that the person visits most frequently on these websites in order to know their browsing habits. However, the user of the COMARBEL SAS websites has the possibility of configuring the operation of "cookies", in accordance with the options of their internet browser.

13. Security of Personal Data

COMARBEL SAS, in strict application of the Principle of Security in the Treatment of Personal Data, will provide the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. The obligation and responsibility of COMARBEL SAS it limits itself to having the appropriate means for this purpose. COMARBEL SAS does not guarantee the total security of your information nor is it responsible for any consequence derived from technical failures or improper entry by third parties to the Database or file in which the Personal Data subject to Treatment by COMARBEL SAS and its Managers. COMARBEL SAS will require the service providers that it contracts to adopt and comply with the appropriate technical, human and administrative measures for the protection of Personal Data in relation to which said providers act as Managers.

14. Transfer, Transmission and Disclosure of Personal Data

COMARBEL SAS may disclose to its related companies worldwide, the Personal Data on which it performs the Treatment, for its use and Treatment in accordance with this Personal Data Protection Policy.

Equally COMARBEL SAS may deliver the Personal Data to third parties not linked to COMARBEL SAS when:

• In the case of contractors in the execution of contracts for the development of the activities of COMARBEL SAS;
• By transfer to any title of any business line to which the information relates.

In any case, when COMARBEL SAS wishes to send or transmit data to one or more Managers located within or outside the territory of the Republic of Colombia, will establish contractual clauses or enter into a personal data transmission contract in which, among others, the following is agreed:

(i) The scope and purposes of the treatment.
(ii) The activities that the Person in Charge will carry out on behalf of COMARBEL SAS.
(iii) The obligations that the Person in Charge must fulfill with respect to the Data Owner and COMARBEL SAS.
(iv) The duty of the Person in Charge to treat the data in accordance with the authorized purpose for the same and observing the principles established in Colombian Law and this policy.
(v) The obligation of the Person in Charge to adequately protect personal data and databases as well as to keep confidentiality regarding the treatment of transmitted data.
(vi) A description of the specific security measures that will be adopted by both COMARBEL SAS as per the Data Manager at your destination.

COMARBEL SAS will not request authorization when the international transfer of data is covered by any of the exceptions provided in the Law and its Regulatory Decrees.

15. Applicable Legislation

This Personal Data Protection Policy, the Privacy Notice, and the Authorization Form Annex that is part of this Policy, are governed by the provisions of current legislation on the protection of Personal Data referred to in Article 15 of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013, Decree 1727 of 2009 and other regulations that modify, repeal or replace them.

16. Validity

This Personal Data Protection Policy is in force since April 18, 2017.

Advice on your project

Write to us:

Call us

Cra. 92 No 17B - 24

+57 1 432 4510