The firm ASESORÍA LEGAL AMBIENTAL informs the natural persons who own the data that are processed on the occasion of the work carried out by the Firm, that these will be handled in accordance with the provisions of the Statutory Law on Protection of Personal Data Law 1581 of 2012 and Decree 1377 of 2013, and Circular No. 02 of 2015.

The main objective of the personal data protection policy is that people know the rights that assist them, identify the procedures and mechanisms provided by the firm ASESORÍA LEGAL AMBIENTAL to make them effective; Likewise, they may update, delete and revoke authorization of the treatment to which they will be subjected.

1. Main definitions

The expressions used in this policy will have the definitions used within the Law, as follows:

1. Authorization: It is the prior, express and informed consent of the owner to carry out the processing of their personal data.

2. Database: It is the organized set of personal data that are subject to treatment, in physical or digital medium.

3. Personal Data: It is any information of any kind, linked or that can be associated with one or more specific or determinable natural persons.

4. Public Data: It is the data that is not semi-private, private or sensitive. Public data, among others, are data relating to the marital status of individuals, their profession or trade and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, gazettes and official gazettes and duly enforceable judicial decisions that are not subject to reservation.

5. Sensitive Data: Data that affect the privacy of the owner or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations , human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.

6. Person in charge of the Treatment: Natural or legal person, public or private, that by itself or in association with others, carries out the processing of personal data on behalf of the Person Responsible for the Treatment.

7. Responsible for Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and the processing of personal data.

8. Owner of Personal Data: Natural or legal person to whom the information that rests in a Database refers, and who is the subject of the right to habeas data.

9. Transfer: The data transfer takes place when the person in charge and / or Person in Charge of the Treatment of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is Responsible for the Treatment and is within or out of the country.

10. Transmission: It is the activity of processing personal data by means of which they are communicated, internally or with third parties, within or outside the territory of the Republic of Colombia, when said communication is intended to carry out any Treatment activity by the recipient of the Personal Data.

11. Treatment of Personal Data: It is any systematic operation and procedure, electronic or not, that allows the collection, conservation, ordering, storage, modification, relationship, use, circulation, evaluation, blocking, destruction and in general, the processing of data personal data, as well as its transfer to third parties through communications, consultations, interconnections, assignments, data messages.

II. Beginning

The Managers, Managers and third parties to whom personal data is transferred must comply with the principles and rules established in the Law and in this policy. These principles are:

a) Principle of purpose: The Treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the owner;

b) Principle of freedom: Treatment can only be exercised with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent;

c) Principle of transparency: In the Treatment, the right of the Holder to obtain from the Treatment Manager or the person in charge of the treatment, at any time and without restrictions, information about the existence of data that concerns him;

d) Principle of access and restricted circulation: The treatment is subject to the limits derived from the nature of the personal data, from the provisions of this law and the Constitution. In this sense, the treatment can only be done by persons authorized by the owner and / or by the persons provided for in this law;

Personal data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties in accordance with this law;

e) Principle of confidentiality: All persons who intervene in the Processing of personal data that are not public are obliged to guarantee the reservation of the information, even after the end of their relationship with any of the tasks that comprise the treatment, being able to only supply or communicate personal data when this corresponds to the development of the activities authorized in this law and in the terms of the same.

III. Treatment and Purposes

The Personal Data processed by the Firm must be strictly submitted only to the purposes indicated below. Likewise, those in charge or third parties who have access to personal data by virtue of law or contract, will maintain the treatment within the following purposes:

1. Generate and maintain efficient and adequate communication of the information that is useful in the contractual links in which the owner of the Information is a party.

2. Manage all the information necessary to comply with tax obligations and commercial, corporate and accounting records.

3. Comply with internal processes regarding the administration of suppliers and contractors.

4. Develop the process of selection, evaluation, and employment relationship;

5. Support internal or external audit processes;

6. To comply with the contractual obligations contracted by the holders of the Information.

7. For archiving and updating processes of internal databases.

8. Inform internal modifications of any kind that arise in the development of the contractual links with the owner of the information.

9. Evaluate and examine the quality of the services offered by the owner of the Information.

10. Carry out internal studies on the habits of the owner of the information.

11. Send the information through a secure medium in Colombia and to other countries where there are “back-ups” or backups of the information due to contingency issues.

12. Transmit offers of products, services and general information that may be useful or appropriate.

13. Transmit the data that the national government and / or authorities require, in compliance with the tax, accounting and fiscal legislation, in general, the purpose established by law.

14. Send the modifications that may be presented in the adopted Information Treatment Policies.

15. Other administrative, commercial, advertising uses and in accordance with what was agreed with the owner of the information.

16. Regarding the use and treatment given to the personal data of employees and former employees, these, in addition to the aforementioned uses, are limited to the purely labor field and will eventually be shared with other companies or entities when this It is necessary to comply with the legal provisions in the labor regime and the protection of personal data.

IV. Rights of the Holder of Personal Data

In accordance with the Law, the holders of personal data have the following rights:

a) Know, update and rectify your personal data in front of those responsible for the treatment or those in charge of the treatment. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized;

b) Request proof of the authorization granted to the person responsible for the treatment, except when expressly excepted as a requirement for the Treatment, in accordance with the provisions of article 10 of Statutory Law 1581 of 2012.

c) Be informed by the person responsible for the treatment or the person in charge of the treatment, upon request, regarding the use that has been given to their personal data;

d) Present before the Superintendence of Industry and Commerce complaints for infractions to the provisions of this law and the other regulations that modify, add or complement it;

e) Revoke the authorization and / or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the treatment. The revocation and / or deletion will proceed when the Superintendency of Industry and Commerce has determined that in the treatment the person in charge or in charge has incurred in conduct contrary to this law and the Constitution;

f) Free access to your personal data that have been processed.

V. Procedures to exercise the rights of the holders of personal data

• Queries:
  

Once the identity of the owner has been verified, ASESORÍA LEGAL AMBIENTAL, will provide you with all the information about your personal data that is required by it.

The response to said query must be communicated to the applicant within a maximum term of ten (10) business days from the date of receipt. In the event that it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which a substantive response will be given to the query, which in no case may exceed the five (5) business days following the expiration of the first term. The answer and any query made by ASESORÍA LEGAL AMBIENTAL may be made electronically or in person.

• Claims:
  

The Holder or his successors in title who consider that the information contained in a database should be subject to correction, updating or deletion, or when they notice the alleged breach of any of the duties contained in this law, may file a claim with the person responsible for the treatment or the person in charge of the Treatment which will be processed under the following rules:

1. The claim will be formulated by means of a request addressed to the person responsible for the treatment or to the person in charge of the treatment, with the identification of the owner, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to enforce. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

In the event that whoever receives the claim is not competent to resolve it, it will transfer it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation.

2. Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database, within a term not exceeding two (2) business days. Said legend must be kept until the claim is decided.

3. The maximum term to attend the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

SAW. Validity

This Policy applies as of March 5, 2019. The personal data that is stored, used or transmitted will remain in our database, based on the criteria of temporality and necessity, for as long as is necessary for the purposes mentioned in this policy, for which they were collected.