INTRODUCTION
Accepting and complying with article 15 of the Political Constitution, as well as the provisions of Law 1581 of 2012 and Regulatory Decree 1377 of 2013, Severa Agencia SAS adopts and applies this policy for the treatment of personal data, which writes the mechanisms through which Severa Agencia SAS guarantees proper handling of the personal data collected in its databases, in order to allow the holders to exercise the right of habeas data.
The purpose of the personal data protection policy is to implement the procedures for the collection and processing of personal data in accordance with the provisions of the law, as well as to generate an organized scheme to safeguard the personal data of its owners. In the same way, it discloses the vision of how Severa Agencia SAS uses the personal information of the holders, the mechanisms to protect it and the options that the holders have to control their personal information and protect their privacy.
1. OBJETIVES
General objetive:
The objective of this policy is to comply with the legal, constitutional and jurisprudential provisions concerning the development of the constitutional right that all persons have to know, update and rectify the information that has been collected about them in databases or files, related to the article 15 of the Political Constitution, as well as the right to information enshrined in article 20 of this.
Specific objetives:
Establish the procedures, rules and criteria applicable to the processing of personal data collected by Severa Agencia SAS, in accordance with the guidelines established in the applicable regulatory framework. Inform the owners of the rights that assist the treatment that Severa Agencia SAS must give to personal data, the mechanisms to urge compliance with the duties at the head of the person responsible for the treatment. Define the necessary terms for the correct application of the aforementioned policies, along with the principles on which the collection and processing of personal data is based.
2. APPLICATION
This policy will not apply to:
3. SCOPE
The personal data processing policy applies to all direct workers of Severa Agencia SAS and workers on mission, at their homes or in any other location, independent contractors, clients and suppliers of products and services that support the operation, as well as for all the owners that are part of the Severa Agencia SAS databases.
4. IDENTIFICATION OF THE CONTROLLER
5. DEFINITIOS
Authorization: prior, express and informed consent of the owner to carry out the processing of personal data or use of his image or work.
Privacy notice: physical, electronic or any other format document, generated by the data controller that is made available to the owner for the processing of their personal data. Through this, the owner of the information is informed of the existence of the applicable policies for the processing of their personal data, together with the way to access them and the characteristics of the processing of personal data.
Database: organized set of personal data that is subject to treatment.
Personal data: any information linked or that can be associated with one or more specific or determinable natural persons, such as name and surname, identity document, age, address, region, country, city, postal code, landline telephone number, telephone number, etc. mobile phone, address, email address, advertising preferences, consumer preferences, channel preferences, complaints and claims, service news, basic and personal data, contact data, demographic data, taste data, preferences and habits.
Sensitive data: sensitive data is understood to be those that affect the privacy of the owner or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, organizations social, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data. This type of data enjoys confidentiality that can only be lifted by the owner or, exceptionally, in any of the circumstances strictly provided for by law.
Processor: natural or legal person, public or private, that by itself or in association with others, performs the processing of personal data on behalf of the controller.
Habeas data: constitutional action that can be exercised by any person included in a data registry to access it and collect the information that affects them, as well as to request its elimination or correction if such information is false or out of date.
Responsible for the treatment: natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the treatment of the data.
Owner: natural person whose personal data is processed.
Treatment: any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion of data, in any known or future technology.
6. PRINCIPLES
The principles set forth below constitute the general parameters through which the provisions of this policy will be applied, referring to the personal data of those who are applicable to the processing of their data:
a. Principle of purpose: the processing of personal data by Severa Agencia SAS must obey a legitimate purpose, which must be informed to the owner.
b. Principle of freedom: the processing of personal data may only be exercised with the prior, express and informed consent of the owner of the information. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate that relieves consent.
c. Principle of veracity or quality: the information subject to treatment must be truthful, complete, exact, updated, verifiable and understandable. The processing of partial, incomplete, fractional or misleading data is prohibited.
e. Principle of access and restricted circulation: personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to authorized owners or third parties.
f. Security principle: the information subject to treatment by Severa Agencia SAS must be handled with the technical, human and administrative measures that are necessary, to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized access or fraudulent.
g. Principle of confidentiality: all persons involved in the processing of personal data that are not public in nature, are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that comprise the treatment.
7. TREATMENT AND PURPOSES OF DATABASES
Severa Agencia SAS carries out the processing of personal data, as data controller, in the development of its corporate purpose and the ordinary course of its business, within the following purposes and those related or consequent:
a. Administer and manage the information of the shareholders of Severa Agencia SAS for the recognition, protection and exercise of their rights.
b. Carry out studies on consumer habits and/or brand research.
c. Develop business relationships with third parties.
d. Make contact by any means (email, telephone, cell phone, chat, text message, or at the registered address) in order to optimize and improve the marketing of Severa Agencia SAS products.
e. Facilitate the correct execution in the provision of services.
f. Guarantee the management of the service, its optimization and statistics.
g. Transmit and/or transfer personal data to third parties and strategic allies, in accordance with the principles, guidelines and guarantees established by law, in order to generate added value for the owner.
h. Manage basic tasks of administration and management of customer service, marketing and billing.
i. Inform by any means and maintain efficient communication with the owners about news, products, promotions and services related to the products and events marketed by Severa Agencia SAS, as well as products and services promoted directly by strategic allies of Severa Agencia SAS, which generate added value for the owner.
j. Provide the services and/or products of Severa Agencia SAS.
k. Make reports with the different administrative authorities of national control and surveillance, police or judicial authorities, financial entities and / or insurance companies.
l. Transmit and/or transfer to strategic allies and third countries the data provided, for the execution of activities related to the services and products purchased, always respecting the guarantees and guidelines of the data protection law.
m. Transmit them (inside or outside Colombia and without regard to the country of destination) to third parties who act as data processors and who provide Severa Agencia SAS, and/or authorized entities, technological, logistical, administrative, distribution, commercial mail services. , customer service center and / or any other service required by Severa Agencia SAS and / or authorized entities, for the development of activities, which will be subject to what is described in this policy.
n. Comply with the internal processes of the companies regarding the administration of suppliers and contractors.
o. Comply with service contracts entered into with customers.
p. Fulfill contractual obligations, for which the information may be transmitted and/or transferred to third parties, such as financial institutions, notaries, OFAC5 and terrorism lists, lawyers, etc.
o. Celebrate alliances with third parties, in order to transmit or transfer personal data so that they can process the data, always respecting the guarantees and guidelines of the personal data protection law.
r. Comply with the obligations contracted with our customers, suppliers and employees.
s. Support internal or external audit processes.
t. Comply with obligations contracted with the owner and any other purpose that results in the development of the contract or the relationship that exists between the owner and Severa Agencia SAS.
u. The other purposes that Severa Agencia SAS in its capacity as responsible for the processing of personal data determines, in order to comply with legal and regulatory obligations, as well as the internal policies of the companies and that are communicated to the owners through the present policy.
8. AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA AND PROJECT ADMINISTRATION
The treatment of personal data and administration of work by Severa Agencia SAS will be carried out once the prior, free, express and informed authorization of the owner has been obtained or in the cases required by law. Severa Agencia SAS has arranged the necessary mechanisms to obtain the authorization of the owners, their successors in title or legitimate representatives. The authorization by the owner may be recorded in a physical, electronic document or any other format that allows a reasonable conclusion that the owner granted it.
8.1 Proof of authorization
The authorization of the holders may be given when it is stated in writing, orally or through unequivocal behavior of the holder, which allows a reasonable conclusion that the authorization was granted. However, in no case can silence be assimilated to unequivocal conduct. Severa Agencia SAS will keep proof of the authorization granted by the owners of the personal data or works for the treatment of these. Severa Agencia SAS, in its capacity as the person in charge, will have the necessary means to maintain the technical and technological records of when and how the authorization was obtained from the owner of the information for the treatment of these.
8.2 Authorization of sensitive personal data
The processing of sensitive data referred to in article 5 of Law 1581 of 2012 is prohibited, except for the cases expressly indicated in article 6 thereof. In the processing of sensitive personal data, when said processing is possible in accordance with the provisions of article 6 of Law 1581 of 2012, the following obligations must be met:
a. Inform the owner that because it is sensitive data, he is not obliged to authorize its treatment.
b. Inform the owner explicitly and in advance, in addition to the general requirements of the authorization for the collection of any type of personal data, which of the data that will be processed are sensitive and the purpose of the treatment, as well as obtain their express consent.
No activity may be conditioned to the owner providing sensitive personal data.
8.3 Authorization for data processing of minors
When it comes to the collection and treatment of minors, the following requirements must be met:
a. The authorization must be granted by persons who are empowered to represent them. The representative of minors must guarantee their right to be heard and value their opinion of the treatment taking into account their maturity, autonomy and ability to understand the matter.
b. It should be reported that it is optional to answer questions about children.
c. The treatment must respect the best interests of minors and ensure respect for their fundamental rights. The owner must be explicitly and previously informed which of the data that will be processed are sensitive and its purpose.
8.4 Cases where authorization is not required
In accordance with the provisions of current regulations and concordant jurisprudence, authorization will not be required for the processing of personal data of an exclusively public nature. Likewise, those subject to some degree of confidentiality may be disclosed to a public authority, as appropriate in each case, after verification of compliance with the legal requirements for this purpose.
According to the provisions of article 10 of Law 1581 of 2012, it will not be necessary to obtain authorization for the processing of personal data in the following cases:
a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
b. Data of a public nature.
c. Cases of medical or health urgency.
d. Treatment of information authorized by law for historical, statistical or scientific purposes.
e. Data related to the civil registry of people.
As developed by constitutional jurisprudence, personal data is divided into different categories according to the protection standards required and the level of confidentiality that must be guaranteed, as follows: public, semi-private, private and sensitive. In accordance with said classification, different requirements are required for its treatment and disclosure to a public authority, be it judicial or administrative. Severa Agencia SAS treats the data in accordance with the standards applicable to each class and opposes the pertinent reservation in each case.
8.5 Validity of authorization
Personal data will be processed by Severa Agencia SAS for as long as the owner is alive and the authorization will cease when the owner exercises their right to revoke it, as described in literal e, of number 13 of this document.
Additionally, the authorization of personal data will end with:
a. The death of the owner.
b. The dissolution of Severa Agencia SAS.
9. PRIVACY NOTICE
The privacy notice is a physical, electronic or any other format document, through which the owner of the data is informed about the existence of policies that will be applicable to him, as well as the way in which they can access them and the characteristics of the treatment that will be given to personal data.
9.1 Content of the privacy notice
The privacy notice must contain the following:
a. Name or business name and contact details of the data controller.
b. The treatment to which the data will be subjected and the purpose of this.
c. The rights that assist the owner.
d. The mechanisms provided by Severa Agencia SAS so that the owner is aware of the personal data processing policy and the substantial changes that occur in it or in the corresponding privacy notice. In all cases, you must inform the owner how to access or consult the personal data processing policy.
e. The indication that as the owner you can access this policy.
The privacy notice is published on the page www.severa.com.co, and at the link: https://drive.google.com/file/d/1xW4uqmefLY68q82ZLat06riNl3c03j6M/view?usp=sharing
https://drive.google.com/file/d/1xW4u
qmefLY68q82ZLat06riNl3c03j6M
/view?usp=sharing
10. DUTIES OF SEVERA AGENCIA SAS AS RESPONSIBLE FOR TREATMENT
Severa Agencia SAS must strictly comply with the following duties, without prejudice to the other provisions set forth in the applicable regulatory framework:
a. Guarantee the owner, at all times, the full and effective exercise of the right of habeas data.
b. Request and keep, under the conditions provided in the applicable regulatory framework, a copy of the respective authorization granted by the owner.
c. Duly inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
d. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or access or authorized or fraudulent.
e. Guarantee that the information provided to the person in charge of the treatment will be true, complete, exact, updated, verifiable and understandable.
f. Timely update, rectify or delete the data, in the terms established in this policy and in the applicable regulatory framework.
g. Register in the database the legend «claim in process» in the manner in which it is regulated in this Manual and in the applicable regulatory framework.
h. Insert in the database the legend «information under judicial discussion» once notified by the competent authority about judicial processes related to the quality of personal data.
i. Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce (SIC).
j. Allow access to information only to people who can have access to it, in accordance with the provisions of this policy.
k. Respect at all times the security and privacy conditions of the owner’s information.
l. Process queries and claims formulated in the terms indicated in this policy and in the applicable regulatory framework.
m. Inform, at the request of the owner, about the use given to their data.
n. Inform the Superintendence of Industry and Commerce when there are violations of security codes and there are risks in the administration of the information of the holders
o. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
11. DUTIES OF SEVERA AGENCIA SAS AS PROCESSOR OF TREATMENT
If Severa Agencia SAS carries out data processing on behalf of another entity or organization (data controller) it must comply with the following duties:
a. Establish that the data controller is authorized to provide Severa Agencia SAS with the personal data that it will process as manager.
b. Guarantee the owner, at all times, the full and effective exercise of the right of habeas data.
c. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
d. Timely update, rectify or delete the data.
e. Update the information reported by those responsible for treatment within five (5) business days from its receipt..
f. Process the queries and claims made by the owners in the terms indicated in this policy.
g. Register in the database the legend «claim in process» in the manner established in this policy.
h. Insert in the database the legend «information under judicial discussion» once notified by the competent authority about judicial processes related to the quality of personal data.
i. Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce.
j. Allow access to information only to persons authorized by the owner or empowered by law for that purpose.
k. Inform the Superintendence of Industry and Commerce when there are violations of security codes and there are risks in the administration of the information of the holders.
l. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
12. RESPONSIBLE PERSON AND SERVICE CHANNELS
Severa Agencia SAS will have a person in charge of responding to requests, queries and claims from the owners to exercise their rights to know, update, rectify, and delete their data and revoke their authorization. For the above, the holder must contact the email info@severa.com.co and/or the telephone line 3135039716.
13. RIGHTS OF HOLDERS
The owner may exercise the following rights:
a. Know, update and rectify your personal data in front of Severa Agencia SAS or those in charge of the treatment. This right may be exercised, among others, against partial, inaccurate, incomplete, divided, misleading data or those whose treatment is expressly prohibited or has not been authorized.
b. Request proof of the authorization granted to Severa Agencia SAS, except when expressly excepted as a requirement for treatment, in accordance with the provisions of article 10 of law 1581 of 2012.
c. Be informed by Severa Agencia SAS or the person in charge of the treatment, upon request, regarding the use that has been given to your personal data.
d. Submit complaints to the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
e. Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the treatment. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that Severa Agencia SAS or person in charge has engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
f. Free access to your personal data that has been processed.
14. PROCEDURE TO EXERCISE THE RIGHTS IN THE HEAD OF THE HOLDERS
In the event that you wish to exercise your rights, the owner must send an email to the contact address established in number 12 of this Privacy Policy.
14.1 Petitions, Queries or Claims
In accordance with article 14 of Law 1581 of 2012, the owners or their successors in title may consult the personal information of the owner that rests in any database. Based on this, this right is guaranteed by providing all the information contained in the individual record or that is linked to the identification of the owner.
Depending on the nature of the personal database, the query will be managed by the area responsible for attending to it within Severa Agencia SAS.
Severa Agencia SAS must keep proof of the query and its response.
14.3 Procedural requirement
The owner or successor in title may only file a complaint with the Superintendency of Industry and Commerce once the consultation or claim process with Severa Agencia SAS has been exhausted.
14.4 Revocation of authorization
In accordance with the provisions of the law, in the event that the treatment does not respect the principles, rights and constitutional and legal guarantees, the owners or their representatives (as is the case of parents who exercise parental authority of an infant or adolescent) may request the revocation of the authorization granted for their treatment, unless such revocation is prevented by legal or contractual provision, indicating in that case, the specific reasons based on which they consider that the situation is occurring. of no with respect to the aforementioned scopes.
Severa Agencia SAS, being the person in charge or the person in charge of the treatment, as the case may be, must confirm having received the request for authorization revocation, including its date of receipt. The same may be objected to if, in the opinion of Severa Agencia SAS, the assumption indicated by the owner is not presented, or if such revocation implies an affectation for the monitoring or fulfillment of rights or obligations by the entity and with respect to the owner, if in which he must inform him in writing so that he can take the measures before the authorities he deems pertinent.
The request for revocation of the authorization can be total or partial. It will be total when the revocation of all the purposes consented to through the authorization is requested. It will be partial when the revocation of some purposes is requested depending on the revocation request. This qualifier must be clearly expressed in the authorization revocation request.
15.INFORMATION SECURITY
In development of the security principle established in Law 1581 of 2012, Severa Agencia SAS will implement additional technical, human and administrative measures, if required, that are necessary to grant security to the records, by means of which their adulteration, loss will be avoided. , consultation, use or unauthorized or fraudulent access.
16. TRANSMISSION OF PERSONAL DATA
With the authorization granted by any of the means provided for this purpose, the owner authorizes Severa Agencia SAS to carry out national and international transmissions of personal data to a manager, to allow the manager to carry out the treatment on behalf of Severa Agencia SAS. These transmissions will not require the owner to be informed or have additional express consent.
17. INTERNATIONAL TRANSFER OF PERSONAL DATA
The transfer of personal data of any kind to countries that do not provide adequate levels of data protection is prohibited. It is understood that a country offers an adequate level of data protection when it complies with the standards set by the Superintendence of Industry and Commerce on the matter, which in no case may be less than those required by the regulatory framework applicable to this policy. processing of personal data.
Notwithstanding the foregoing, in accordance with the provisions of the applicable regulatory framework, the transfer of personal data to third countries may be carried out in the following situations:
a. The information in respect of which the owner has granted his express and unequivocal authorization for the transfer.
b. An exchange of medical data is required, when required by the treatment of the owner for reasons of health or public hygiene.
c. In the case of bank or stock transfers, in accordance with the legislation that is applicable to such transactions.
d. These are transfers agreed within the framework of international treaties to which Colombia is a party, based on the principle of reciprocity.
e. These are necessary transfers for the execution of a contract between the owner and the companies, or for the execution of pre-contractual measures as long as the authorization of the owner is obtained.
f. In the case of transfers legally required to safeguard the public interest or for the recognition, exercise or defense of a right in a judicial process. Severa Agencia SAS must carry out the necessary consultations with the Superintendence of Industry and Commerce in order for that entity to issue the declaration of conformity regarding the international transfer of personal data, in cases not provided for in this section of this policy.
18. PROCESSING OF PERSONAL DATA THROUGH COOKIES
Cookies are files that collect information through web pages, about the browsing habits of a user or his team. Eventually they could form a database in accordance with the legal definition of Law 1581 of 2012 by collecting personal data according to the following characteristics:
● They refer to exclusive and typical aspects of a natural person.
● They allow the person to be identified, to a greater or lesser extent, thanks to the overview that is achieved with it and with other data.
● Its ownership resides exclusively with the owner of the same, a situation that is not altered by obtaining it by a third party legally or illegally.
● Your treatment is subject to special rules (principles) regarding its collection, administration and disclosure. Given the above, Severa Agencia SAS must abide by the regulations on data protection in force in Colombia, especially the application of the guiding principles for the administration of data of legality, purpose, freedom, veracity or quality, transparency, access and restricted circulation. , security and confidentiality enshrined in article 4 of Law 1581 of 2012.
19. ACCEPTANCE AND APPLICABILITY
All the owners of the information accept the processing of their personal data in accordance with the terms described in this policy.
In this sense, all the personal data that Severa Agencia SAS has collected and collects as data controller, will be processed in accordance with the purposes and parameters described in this policy. The personal data that they have previously collected must adhere to the stipulations described therein.
20. DATABASE VALIDITY PERIOD
The databases to which Severa Agencia SAS will process, as well as the duly authorized personal data incorporated into them, will be valid for the period necessary to fulfill their purposes. Once this period has expired, Severa Agencia SAS will proceed to eliminate the database or the data of the owners, as appropriate.
22. TERM
This personal data processing policy is effective from the date of its publication, without prejudice to the fact that Severa Agencia SAS periodically updates the policy. Any substantial change or modification of this policy will be communicated by Severa Agencia SAS to the owners by publishing the changes on the page www.severa.com.co, and at the link: https://drive.google.com/file/d/1xW4uqmefLY68q82ZLat06riNl3c03j6M/view?usp=sharing
https://drive.google.com/file/d/1xW4u
qmefLY68q82ZLat06riNl3c03j6M
/view?usp=sharing
This Privacy Policy is in force as of February 9, 2021.
