INFORMATION PROCESSING POLICY
Ecoeffy SAS, a Colombian commercial company, identified with tax identification number NIT 901.205.071 – 2 domiciled in the city of Bogotá D.C., located at the physical address Calle 148 No. 12 C – 69 of the same city and at the e-mail address [email protected] and telephone (+57) 302 4634835 informs the Owners of the Personal Data that are processed in any way by Ecoeffy of this privacy and information processing policy (the “Privacy Policy”).Policy“), thereby complying with Law 1581 of 2012 and Decree 1377 of 2013.
The main purpose of this Policy is to inform the Personal Data Holders of their rights, the procedures and mechanisms provided by Ecoeffy to enforce those rights of the Holders, and to inform them of the scope and purpose of the Processing to which the Personal Data will be subjected in the event that the Holder grants express, prior and informed authorization.
Definitions
Capitalized expressions used in this Policy shall have the meaning given to them herein or the meaning given to them by applicable law or case law, as such law or case law may be amended from time to time.
- “Authorization”: It is the prior, express and informed consent of the Data Subject to carry out the Processing of his/her Personal Data.
- “Database”: The organized set of Personal Data that are subject to Processing, electronic or not, whatever the modality of its formation, storage, organization and access.
- “Financial Data”: Any Personal Data referring to the birth, execution and extinction of monetary obligations, regardless of the nature of the contract that gives rise to them, whose Processing is governed by Law 1266 of 2008 or the rules that complement, modify or add to it.
- “Personal Data”: Any information of any kind, linked or that may be associated to one or several determined or determinable natural or legal persons.
- “Public Data”: Personal Data qualified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Among others, the data related to the marital status of persons, their profession or trade, their status as merchant or public servant and those that can be obtained without any reservation whatsoever, are public. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, duly executed court rulings that are not subject to confidentiality.
- “Sensitive Data: Personal Data that affects the privacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal union affiliations, racial or ethnic origin, political orientation, religious, moral or philosophical convictions, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life, and biometric data.
- “Data Processor”: The natural or legal person, public or private, that by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller.
- “Authorized”: is Ecoeffy and all persons under the responsibility of Ecoeffy, who by virtue of the Authorization and these Policies have the legitimacy to Process the Personal Data of the Data Subject. The Authorized includes the gender of the Entitlees.
- “Enabling”: It is the authorization expressly and in writing by contract or document that takes its place, granted by Ecoeffy to third parties, in compliance with the applicable law, for the Processing of Personal Data, turning such third parties into Data Processors of the Personal Data provided or made available.
- “Data Controller”: The natural or legal person, public or private, who by himself or in association with others, decides on the Database and/or the Processing of Personal Data.
- “Data Subject” of the Personal Data: The natural or legal person to whom the information contained in a Database refers, and who is the subject of the right of habeas data.
- “Transfer”: It is the Processing of Personal Data that involves the communication of the same within or outside the territory of the Republic of Colombia when its purpose is the performance of a Processing by the Processor on behalf of the Controller.
- “Transmission”: The Personal Data Processing activity by means of which the Personal Data is communicated, internally or with third parties, within or outside the territory of the Republic of Colombia, when such communication has as its purpose the performance of any Processing activity by the recipient of the Personal Data.
- “Processing of Personal Data”: It is any operation and systematic procedure, electronic or not, that allows the collection, conservation, ordering, storage, modification, relation, use, circulation, evaluation, blocking, destruction and in general, the processing of Personal Data, as well as its transfer to third parties through communications, consultations, interconnections, assignments, data messages.
Principles
Ecoeffy, in the development of its commercial activities will collect, use, store, transmit and perform various operations on the personal data of the Data Controllers. In all Processing of Personal Data carried out by Ecoeffy, the Controllers, Processors and/or third parties to whom Personal Data is transferred, must comply with the principles and rules established in the law and in this Policy, in order to guarantee the right to habeas data of the Data Subjects and to comply with Ecoeffy’s legal obligations. These principles are:
- Prior Authorization: Any Processing of Personal Data will be carried out once the prior, express and informed Authorization of the Data Subject has been obtained, unless the law establishes an exception to this rule. In the event that the Personal Data have been obtained prior to the law, Ecoeffy will seek ordinary and alternative means to summon the Data Controllers and obtain their retroactive authorization, following the provisions of Decree 1377 and concordant norms.
- Authorized Purpose: All Personal Data Processing activities must obey the purposes mentioned in this Policy or in the Authorization granted by the Data Subject, or in the specific documents where each type or process of Personal Data Processing is regulated. The purpose of the particular Processing of a Personal Data must be informed to the Data Subject at the time of obtaining his or her Authorization. Personal Data may not be processed for purposes other than those informed and consented to by the Data Subjects.
- Data Quality: Personal Data subject to Processing must be truthful, complete, accurate, updated, verifiable and understandable. When in possession of partial, incomplete, fractioned or misleading Personal Data, Ecoeffy shall refrain from processing them, or request the completeness or correction of the information from the owner.
- Delivery of information to the Data Subject: When requested by the Data Subject, Ecoeffy shall deliver the information about the existence of Personal Data concerning the applicant. This delivery of information will be carried out by the Ecoeffy unit in charge of personal data protection (see point 7 of this Policy).
- Restricted Circulation: Personal Data may only be processed by Ecoeffy personnel who are authorized to do so, or who, within their functions, are in charge of carrying out such activities. Personal Data may not be given to those who do not have Authorization or who have not been Authorized by Ecoeffy to carry out the Processing.
- Temporality: Ecoeffy will not use the holder’s information beyond the reasonable period of time required by the purpose for which the holder of the Personal Data was informed.
- Restricted Access: Except for expressly authorized Data, Ecoeffy may not make Personal Data available for access through the Internet or other mass media, unless technical and security measures are established to control access and restrict it only to Authorized persons.
- Confidentiality: Ecoeffy must always carry out the Processing by arranging the technical, human and administrative measures necessary to maintain the confidentiality of the data and to prevent it from being adulterated, modified, consulted, used, accessed, deleted, or known by unauthorized persons or by Authorized and unauthorized persons in a fraudulent manner, or that the Personal Data is lost. Any new project involving the Processing of Personal Data shall be consulted this Processing Policy to ensure compliance with this rule.
- Confidentiality and Further Processing: All Personal Data that is not Public Data must be treated by the Controllers as confidential, even if the contractual relationship or the link between the Data Subject and Ecoeffy has ended. Upon termination of such relationship, such Personal Data shall continue to be Processed in accordance with this Policy and the Law.
- Individuality: Ecoeffy will maintain separately the databases in which it is in charge from the databases in which it is responsible.
- Necessity: Personal Data may only be Processed for the time and to the extent that the purpose of the Processing justifies it.
Treatment and Purposes
The Personal Data processed by Ecoeffy shall be strictly subject to the purposes indicated below. Likewise, the persons in charge or third purposes:
- Manage all information necessary for compliance with Ecoeffy’s tax obligations and commercial, corporate and accounting records.
- Comply with Ecoeffy’s internal processes for supplier and contractor management.
- Fulfill the service contracts entered into with customers.
- To provide its services in accordance with the particular needs of Ecoeffy’s clients, in order to fulfill the service contracts entered into, including but not limited to verifying memberships and entitlements of individuals to whom Ecoeffy’s clients will provide their services, use Personal Data for marketing and/or commercialization of new services or products.
- The other purposes determined by the Controllers in the process of obtaining Personal Data for its Processing and that are communicated to the Data Controllers at the time of collecting the personal data.
- The control and prevention of fraud and money laundering, including but not limited to the consultation in restrictive lists, and all the necessary information required for SARLAFT.
- The process of archiving, updating systems, protection and custody of Ecoeffy’s information and databases.
- Processes within Ecoeffy for development or operational and/or system administration purposes.
- The transmission of data to third parties with whom contracts have been entered into for this purpose, for commercial, administrative, marketing and/or operational purposes, including but not limited to the issuance of cards, personalized certificates and certifications to third parties, in accordance with the legal provisions in force.
- Maintain and process by computer or other means, any type of information related to the client’s business in order to provide the relevant services and products.
- Other purposes determined by the Controllers in the process of obtaining Personal Data for processing, in order to comply with legal and regulatory obligations, as well as Ecoeffy’s policies.
Rights of the Data Subject
In accordance with the law, Personal Data Holders have the following rights:
- To know, update and rectify your Personal Data before Ecoeffy or the Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
- Request proof of the Authorization granted to Ecoeffy, unless the law indicates that such Authorization is not required.
- Submit requests to Ecoeffy or the Data Processor regarding the use that has been made of your Personal Data, and that they deliver such information.
- To file complaints before the Superintendence of Industry and Commerce for violations of the law.
- To revoke your Authorization and/or request the deletion of your Personal Data from Ecoeffy’s databases when the Superintendence of Industry and Commerce has determined through a definitive administrative act that Ecoeffy or the Data Processor has engaged in conduct contrary to the law or when there is no legal or contractual obligation to maintain the Personal Data in the database of the Responsible Party.
- Request access and access free of charge to your Personal Data that have been subject to Processing in accordance with Article 21 of Decree 1377 of 2013.
- To know the modifications to the terms of this Policy in a previous and efficient way before the implementation of the new modifications or, in its absence, of the new information treatment policy.
- Have easy access to the text of this Policy and its amendments.
- Access in an easy and simple way to the Personal Data under Ecoeffy’s control in order to effectively exercise the rights granted by law to the Data Controllers.
- To know the agency or person authorized by Ecoeffy to whom you may submit complaints, queries, claims and any other request regarding your Personal Data.
The Holders may exercise their legal rights and carry out the procedures established in this Policy, by presenting their citizenship card or original identification document. Minors may exercise their rights personally, or through their parents or the adults who have parental authority, who must prove it by means of the pertinent documentation. Likewise, the rights of the Holder may be exercised by the assignees who can prove such quality, the representative and/or attorney-in-fact of the Holder with the corresponding accreditation and those who have made a stipulation in favor of another or for another.
Personal Data Protection Officer
Ecoeffy has designated the management of [Servicio al Cliente] as Responsible for the reception and attention of requests, complaints, claims and queries of all kinds related to Personal Data. The person in charge of Customer Service will process inquiries and complaints regarding Personal Data in accordance with the Law and this policy.
Some of the particular functions of this area in relation to Personal Data are:
- Receive the requests from the Personal Data Holders, process and answer those that are based on the law or these Policies, such as: requests to update Personal Data; requests to know the Personal Data; requests to delete Personal Data when the Holder submits a copy of the decision of the Superintendence of Industry and Commerce in accordance with the provisions of the law, requests for information on the use given to their Personal Data, requests to update the Personal Data, requests for proof of the Authorization granted, when it has proceeded according to the law.
- To respond to Personal Data Holders on those requests that do not proceed in accordance with the Law.
The contact details of are:
Physical address: Calle 127ª #5c-46 in Bogotá, D.C.
E-mail address: [email protected]
Phone number: (+57) 302 4634835
Position of the contact person: [Analista de Servicio al Cliente]
Special provisions
Without prejudice to the generality of application of this privacy policy for Ecoeffy, in consideration of the services provided through the website the data subjects acknowledge and agree to
- That the personal data of representatives or natural persons that are provided to Ecoeffy will be treated as set forth in this Policy.
- That, in order to provide the service, Ecoeffy may request financial, accounting, tax, business or any other type of information from the owner of the data.
- That Ecoeffy will not use the information in the preceding paragraph for fraudulent or unfair competition purposes.
- That the specific conditions of the Service or of any confidentiality agreement to be entered into between Ecoeffy and the owner of the data, shall be established in documents between the parties.
- That, in any case, Ecoeffy undertakes not to disclose in any way any holder information for competitive or market impact purposes.
- That, when visitors leave comments on the site, we collect the data displayed in the comment form, as well as the visitor’s IP address and browser user agent string to assist in spam detection.
An anonymous string created from your email address (also called a hash) can be provided to the Gravatar service to see if you are using it. The privacy policy of the Gravatar service is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.
That, when the user upload images to the web, you should avoid uploading images with location data (GPS EXIF) included. Website visitors can download and extract any location data from the images on the website.
That, if the subscriber leaves a comment, the comment and its metadata are retained indefinitely. This is so that we can recognize and approve successive comments automatically, rather than keeping them in a moderation queue.
That, users who register on our website (if any), we also store the personal information they provide in their user profile. All users can view, edit or delete their personal information at any time (except that they cannot change their user name). Web administrators can also view and edit this information.
That, visitor comments may be reviewed by an automatic spam detection service.visitor comments may be reviewed by an automatic spam detection service.
That, if a user have an account or have left comments on this website, you may request to receive an export file of the personal data we hold about you, including any data you have provided to us. You may also request that we delete any personal information we have about you. This does not include any data that we are required to retain for administrative, legal or security purposes.
That, lhe articles on this site may include embedded content (e.g., videos, images, articles, etc.). Embedded content from other sites behaves in exactly the same way as if the visitor had visited the other site.
These sites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged into that site.
That, if a user requests a password reset, your IP address will be included in the reset email.
On the other hand, Ecoeffy, at the time of registration, will collect information from customers for the following purposes:
- Internal use; and
- To send regular newsletters to customers with industry news and updates.
Use of Cookies
If a user leaves a comment on our site, you can choose to save your name, email address and web address in cookies. This is for your convenience, so you don’t have to fill in your details again when you leave another comment. These cookies will have a duration of one year. If you have an account and log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie does not contain personal data and is deleted when the browser is closed.
When you log in, we will also set several cookies to store your login information and screen display options. Login cookies last for two days, and display options cookies last for one year. If you select “Remember me”, your access will last for two weeks. If you log out of your account, the login cookies will be deleted.
If you edit or publish an article an additional cookie will be saved in your browser. This cookie does not include personal data and simply indicates the ID of the article you have just edited. Expires after 1 day.
Procedures for exercising the rights of Personal Data Subjects
Inquiries: Ecoeffy will have mechanisms in place so that the Data Subject, his or her successors in title, his or her representatives and/or attorneys-in-fact, those who have stipulated in favor of or for another, and/or the representatives of minors who are Data Subjects, may make inquiries regarding the Personal Data of the Data Subject that is stored in Ecoeffy’s Databases.
These mechanisms may be physical, such as a window procedure, or electronic through the e-mail [email protected] or by telephone at the following hotlines: (+57) 302 4634835, in charge of receiving requests, complaints and claims on the telephones.
Whatever the means, Ecoeffy will keep proof of the consultation and its response.
- If the applicant has the capacity to formulate the consultation, in accordance with the accreditation criteria established in Law 1581 and Decree 1377, Ecoeffy will compile all the information about the Data Subject that is contained in the individual record of that person or that is linked to the identification of the Data Subject within Ecoeffy’s databases and will make it known to the applicant.
- The Responsible for answering the query will respond to the applicant as long as he/she has the right to do so because he/she is the Data Subject of the Personal Data, his/her assignee, proxy, representative, has been stipulated by or for another, or is the legal responsible in the case of minors.
- In the event that the request cannot be processed within ten (10) business days, the applicant will be contacted to communicate the reasons why the status of the request is being processed. For this purpose, the same or a similar means to the one used by the Data Subject to communicate his or her request will be used.
Claims: Ecoeffy has mechanisms for the Holder, their assignees, representative and/or attorneys-in-fact, those who stipulated by another or for another, and/or the representatives of minors Holders, to formulate claims with respect to. (i) Personal Data Processed by Ecoeffy that must be corrected, updated or deleted, or (ii) Ecoeffy’s alleged failure to comply with its legal duties.
These mechanisms may be physical, such as a window procedure, electronic through the e-mail [email protected] or by telephone at the service line (+57) 302 4634835, responsible for receiving requests, complaints and claims on the telephones.
- The claim must be filed by the Data Subject, their successors in title or representatives or accredited in accordance with Law 1581 and Decree 1377, as follows:
- You should contact Ecoeffy SAS by e-mail at [email protected] or physically at Calle 127ª #5c-46 in Bogotá, D.C.; or by telephone at (+57) 302 4634835.
- It must contain the name and identification document of the Holder.
- It must contain a description of the facts giving rise to the claim and the objective pursued (updating, correction or deletion, or fulfillment of duties).
- It should indicate the address and contact and identification data of the claimant.
- It must be accompanied by all documentation that the claimant wishes to assert.
- Ecoeffy will verify the identity of the Personal Data Holder, his representative and/or proxy, or the accreditation that there was a stipulation by or for another before attending to the claim. For this purpose, it may require the original identification document of the Holder, and the special or general powers of attorney or documents required, as the case may be.
- If the claim or additional documentation is incomplete, Ecoeffy will require the claimant for one time only to remedy the deficiencies. If the claimant does not submit the required documentation and information within ten (10) business days from the date of the initial claim, it will be understood that the claim has been withdrawn.
- If for any reason the person who receives the claim within Ecoeffy is not competent to resolve it, the Customer Service Analyst will transfer the claim and inform the claimant of such referral.
- Once the claim with the complete documentation has been received, a legend will be included in the Ecoeffy database where the Data Subject to Claim is stored, stating “claim in process” and the reason for the claim. This legend shall be maintained until the claim is decided.
Validity
This Policy is effective as of August 1, 2019. Personal Data that is stored, used or transmitted will remain in our Database, based on the criteria of temporality and necessity, for as long as it is necessary for the purposes mentioned in this Policy, for which it was collected.
[updated Aug. 1, 2019]
