INFORMATION PRIVACY POLICY

INFORMATION PROCESSING POLICY

 

 

Ecoeffy SAS, a non-profit entity, identified with tax identification number NIT 901.286.016 – 3 domiciled in the city Bogotá D.C., located at the physical address Calle 148 No. 12 C – 69 of the same city and at the email address [email protected]ético.org and telephone (+57) 302 4634835 makes known to the Holders of Personal Data that are treated in any way by Ecoeffy this policy of treatment of information (the ” Policy“), thereby complying with Law 1581 of 2012 and Decree 1377 of 2013.

 

The main purpose of this Policy is to inform the Personal Data Subjects of the rights that assist them, the procedures and mechanisms provided by Ecoeffy to enforce those rights of the Holders, and to make them aware of the scope and purpose of the Processing to which the Personal Data will be subject in case the Owner grants its express, prior and informed authorization.

 

1. Definitions

 

Expressions used in capital letters in this Policy shall have the meaning given herein or the meaning given to them by applicable law or jurisprudence, as such law or jurisprudence is amended from time to time.

 

• “Authorization”: It is the prior, express and informed consent of the Owner to carry out the Processing of your Personal Data.

 

• “Database”: It is the organized set of Personal Data that are the subject of Processing, electronic or not, whatever the modality of its formation, storage, organization and access.

 

• “Financial Data”: It is any Personal Data concerning the birth, execution and extinguishment of monetary obligations, regardless of the nature of the contract that gives them origin, the Treatment of which is governed by Law 1266 of 2008 or the rules that complement, modify or add it.

 

• “Personal Data”: It is any information of any kind, linked to or that may be associated with one or more specific or determinable natural or legal persons.

 

• “Public Data: Personal Data qualified as such according to the law or the Political Constitution and that which is not semi-private, private or sensitive. Public data includes, among others, data relating to the marital status of individuals, their profession or trade, their status as a merchant or public servant, and data that can be obtained without any reservation whatsoever. By their nature, public data may be contained, inter alia, in public records, public documents, official gazettes and bulletins, duly executed court judgments that are not subject to confidentiality.

 

• “Sensitive Data”: It is the Personal Data that affects the privacy of the Holder or whose misuse may lead to its discrimination, such as those that reveal trade union affiliations, racial or ethnic origin, political orientation, religious, moral or philosophical convictions , membership of trade unions, social, human rights organizations or that promotes the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.

 

• “Treatment Officer”: It is the natural or legal person, public or private, who by itself or in partnership with others, performs the Processing of Personal Data on behalf of the Data Controller.

 

• “Authorized”: It is Ecoeffy and all persons under the responsibility of Efinetic, who by virtue of the Authorization and these Policies have legitimacy to process the Personal Data of the Owner. The Authorized includes the enabled genre.

 

• “Enablement”: It is the legitimacy that expressly and in writing by contract or document that makes its own, granted by Ecoeffy to third parties, in compliance with the applicable law, for the processing of Personal Data, making such third parties Data Processors Personal Data delivered or made available.

 

• “Data Controller”: It is the natural or legal person, public or private, who by itself or in partnership with others, decides on the Database and / or the Processing of Personal Data.

 

• “Title” of the Personal Data: It is the natural or legal person to whom the information that rests in a database is referred to, and who is the subject of the right to habeas data.

 

• “Transfer”: It is the Processing of Personal Data that involves the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a Processing by the Processor on behalf of the Responsible.

 

• “Transmission”: It is the activity of Processing of Personal Data through which the same, internally or with third parties, inside or outside the territory of the Republic of Colombia, is when such communication is intended to carry out any activity Treatment by the Recipient of Personal Data.

 

• “Processing of Personal Data”: It is any systematic operation and procedure, electronic or not, that allows the collection, preservation, ordering, storage, modification, relationship, use, circulation, evaluation, blocking, destruction and in general, the processing of Data Personal, as well as its transfer to third parties through communications, queries, interconnections, assignments, data messages.

 

2. Principles

 

Efintic, in the development of its business activities will collect, use, store, transmit and carry out various operations on the personal data of the Holders. In any Processing of Personal Data performed by Efinticic, the Responsible, Processors and/or third parties to whom Personal Data is transferred, shall comply with the principles and rules established in the law and this Policy, in order to ensure the right to habeas dates back to the Holders and comply with the obligations of Law of Efinetic. These principles are:

 

• Prior Authorization: All Processing of Personal Data will be carried out once the prior, express and informed Authorization of the Data Subject has been obtained, unless the law establishes an exception to this rule. In the event that the Personal Data have been obtained prior to the law, Ecoeffy will seek the ordinary and alternative means to summon the Data Subjects and obtain their retroactive authorization, following the provisions of Decree 1377 and concordant regulations. In the event that the Personal Data have been obtained prior to the law, Ecoeffy will seek the ordinary and alternative means to summon the Data Controllers and obtain their retroactive authorization, following the provisions of Decree 1377 and the concordant norms.

 

• Authorized Purpose: Any Personal Data Processing activity must obey the purposes mentioned in this Policy or in the Authorization granted by the Personal Data Subject, or in the specific documents where each type or process of Personal Data Processing is regulated. The purpose of the particular Processing of a Personal Data must be informed to the Personal Data Subject at the time of obtaining his or her Authorization. Personal Data may not be processed outside the purposes informed and consented to by the Data Controllers.

 

• Data Quality: The Personal Data subject to Processing must be truthful, complete, accurate, updated, verifiable and understandable. When in possession of partial, incomplete, fractioned or misleading Personal Data, Ecoeffy shall refrain from processing them, or request the holder to complete or correct the information.

 

• Delivery of information to the Data Subject: When requested by the Data Subject, Ecoeffy shall deliver the information about the existence of Personal Data concerning the applicant. This delivery of information shall be carried out by the Ecoeffy unit in charge of the protection of personal data (see point 7 of this Policy).

 

• Restricted Circulation: Personal Data may only be Processed by Ecoeffy personnel who are authorized to do so, or who are in charge of carrying out such activities as part of their duties. Personal Data may not be given to those who do not have Authorization or who have not been Authorized by Ecoeffy to carry out the Processing.

 

• Temporary: Ecoeffy will not use the owner’s information beyond the reasonable period of time required by the purpose that was informed to the Owner of the Personal Data.

 

• Restricted access: Except for the Expressly Authorized Data, Ecoeffy may not make Personal Data available for access via the Internet or other massive means of communication, unless technical and security measures are established to control access and restrict ingestate only to Authorized Persons.

 

• Confidentiality: Ecoeffy must always carry out the Processing by providing the technical, human and administrative measures necessary to maintain the confidentiality of the data and to prevent it from being adulterated, modified, consulted, used, accessed, deleted, or known by unauthorized persons or by Authorized and unauthorized persons in a fraudulent manner, or that the Personal Data is lost. Any new project involving the Processing of Personal Data must consult this Processing Policy to ensure compliance with this rule. Any new project involving the Processing of Personal Data shall be consulted this Processing Policy to ensure compliance with this rule.

 

• Confidentiality and Further Processing: All Personal Data that is not Public Data must be treated by the Controllers as confidential, even if the contractual relationship or the link between the Data Subject and Ecoeffy has ended. Upon termination of such relationship, such Personal Data must continue to be treated in accordance with this Policy and the Law.

 

• Individuality: Ecoeffy will separately maintain the databases in which it has the quality of The Database Manager in which it is Responsible.

 

• Need: Personal Data may only be processed during time and to the extent justified by the purpose of its Processing.

 

3. Treatment and Purposes

 

The Personal Data processed by Ecoeffy shall be strictly subject to the purposes indicated below. Likewise, the Processors or third parties who have access to the Personal Data by virtue of law or contract, shall maintain the Processing within the following purposes:

 

• Manage all the information necessary for the fulfillment of the tax obligations and commercial, corporate and accounting records of Efinetic

 

• Comply with Ecoeffy’s internal supplier and contractor management processes.

 

• Comply with service contracts concluded with customers.

 

• To provide its services in accordance with the particular needs of Efinetic customers, in order to comply with service contracts concluded, including but not limited to verification of the affiliations and rights of individuals to whom the Ecoeffy customers will provide their services, use Personal Data for marketing and/or marketing of new services or products.

 

• The other purposes determined by the Controllers in the process of obtaining Personal Data for their Processing and that are communicated to the Owners at the time of the collection of the personal data.

 

• The control and prevention of fraud and money laundering, including but not limited to consultation in restrictive lists, and all necessary information required for SARLAFT.

 

• The process of archiving, updating systems, protection and custody of information and databases of Efinetic.

 

• Processes within Ecoeffy for development or operational purposes and/or system administration.

 

• The transmission of data to third parties with whom contracts have been concluded for this purpose, for commercial, administrative, marketing and/or operational purposes, including but not limited to the issuance of cards, personalized certificates and certifications to third parties, in accordance with the legal provisions in force.

 

• Maintain and process by computer or other means, any information related to the customer’s business in order to provide the relevant services and products.

 

• The other purposes determined by the Controllers in processes of obtaining Personal Data for their Processing, in order to comply with legal and regulatory obligations, as well as the policies of Efinetic.

 

4. Rights of the Holder of Personal Data

 

According to the law, Personal Data Subjects have the following rights:

 

• To know, update and rectify your Personal Data against Ecoeffy or the persons in charge of its processing. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading, or those whose treatment is expressly prohibited or has not been authorized.

 

• Request proof of the Authorization granted to Efinetic, unless the law indicates that such Authorization is not necessary.

 

• Submit requests to Ecoeffy or the Data Processor regarding your use of your Personal Data, and for them to provide such information to you.

 

• File complaints about violations of the law with the Superintendency of Industry and Commerce.

 

• Revoke your Authorization and/or request the deletion of your Personal Data from Ecoeffy’s databases when the Superintendency of Industry and Commerce has determined by definitive administrative act that in the Treatment of Ecoeffy or the Processor of the Processing has engaged in conduct contrary to the law or when there is no legal or contractual obligation to keep the Personal Data in the database of the Responsible.

 

• Request free access and access to your Personal Data that have been processed in accordance with Article 21 of Decree 1377 of 2013.

 

• Know the modifications to the terms of this Policy in a pre- and efficient manner to the implementation of the new modifications or, failing that, the new information processing policy.

 

• Have easy access to the text of this Policy and its modifications.

 

• Easily and easily access Personal Data under Ecoeffy’s control to effectively exercise the rights granted by law to Holders.

 

• Know the unit or person empowered by Ecoeffy against whom you may file complaints, inquiries, complaints and any other requests about your Personal Data.

 

The Holders may exercise their legal rights and carry out the procedures established in this Policy, by presenting their citizenship card or original identification document. Minors may exercise their rights personally, or through their parents or adults who hold parental authority, who must prove it through the relevant documentation. Likewise, the rights of the Holder may be exercised by the assignees who can prove such quality, the representative and/or attorney-in-fact of the holder with the corresponding accreditation and those who have made a stipulation in favor of another or for another.

 

5. Responsible for Personal Data Protection

 

Ecoeffy has designated the management of [Servicio al Cliente] as Responsible for the reception and attention of requests, complaints, claims and queries of all kinds related to Personal Data. The person in charge of Customer Service will process queries and complaints regarding Personal Data in accordance with the Law and this policy.

 

Some of the particular functions of this area in relation to Personal Data are:

 

• Receive requests from Personal Data Subjects, process and respond to those based on law or these Policies, such as: requests for updating Personal Data; requests to know the Personal Data; requests for the deletion of Personal Data when the Owner submits a copy of the decision of the Superintendency of Industry and Commerce in accordance with the provisions of the law, requests for information about the use given to their Personal Data, requests for updating of Personal Data, requests for proof of the Authorization granted, where it has proceeded according to the law.

 

• Respond to The Holders of Personal Data on those requests that do not proceed in accordance with the Law.

 

The contact details are:

 

Physical address: Calle 148 No. 13 C – 69 in Bogotá, D.C. Email address: [email protected] Telephone number: (+57) 302 4634835 Position of the contact person:

[Analista de Servicio al Cliente]

 

6. Special provisions

 

Without prejudice to the general application of this privacy policy for Efinticic, in consideration of the services provided through the website the data subjects recognize and accept

 

• That the personal data of representatives or natural persons that are provided to Ecoeffy will have the processing set out in this Policy.

 

• That, for the provision of the service, Ecoeffy may request financial, accounting, tax, business or other information from the owner of the data.

 

• That Ecoeffy will not use the information from the above numeral for fraudulent or unfair competition purposes.

 

• That the specific conditions of the Service or any confidentiality agreement sunders between Ecoeffy and the data subject, will be established in documents between the parties.

 

• That, in any case, Ecoeffy undertakes not to disclose in any way owner information for competitive purposes or of impact on the market.

 

On the other hand, Efinetic, at the time of registration, will collect customer information for the following purposes:

 

• Internal use; And

 

• To send regular newsletters to customers with news and news from the sector.

 

7. Procedures for exercising the rights of Personal Data Subjects

 

Consultations: Ecoeffy will have mechanisms for the Holder, its prosecists, its representatives and/or proxy, those to whom it has been stipulated in favor of another or for another, and/or representatives of minors Holders, to consult with respect to what are the Personal Data of the Owner who rest sits on the Efinetic Databases.

 

These mechanisms may be physical as a window process, or electronic through the mail [email protected] or by telephone on the hotlines: (+57) 302 4634835, responsible for receiving requests, complaints and complaints on phones.

 

Whatever the means, Ecoeffy will keep proof of the query and its response.

 

• If the applicant has the capacity to make the consultation, in accordance with the accreditation criteria established in Law 1581 and Decree 1377, Ecoeffy will collect all the information about the Holder that is contained in the individual register of that person or that is linked to the identification of the Holder within Ecoeffy’s databases and will be made known to the applicant.

 

• The Person Responsible for attending the consultation will respond to the applicant provided that he/she is entitled to it because he is the Personal Data Subject, his causator, proxy, representative, has been stipulated by another or for another, or is the legal responsible in the case of minors.

 

• In the event that the request cannot be answered within ten (10) working days, the applicant will be contacted to communicate the reasons why the status of the request is being processed. For this purpose, the same or a similar means will be used as the one used by the Holder to communicate his/her request.

 

Claims: Ecoeffy has mechanisms for the Data Subject, his or her successors in title, representative and/or attorneys-in-fact, those who stipulated by another or for another, and/or the representatives of minors Data Subjects, to formulate claims with respect to. (i) Personal Data processed by Ecoeffy that must be corrected, updated or deleted, or (ii) the alleged breach of Ecoeffy’s legal duties.

 

These mechanisms may be physical as a window process, electronic through the mail [email protected] or by telephone on the hotline (+57) 302 4634835, responsible for receiving requests, complaints and complaints on phones.

 

• The claim must be filed by the Holder, its proboriginals or representatives or accredited in accordance with Law 1581 and Decree 1377, as follows:

 

• You must go to the Ecoeffy SAS electronically to the address [email protected] or physically to the address Calle 148 No. 12 C – 69 in Bogota, D.C.; telephone on the hotline (+57) 302 4634835.
• It must contain the name and identification document of the Holder.
• It shall contain a description of the facts giving rise to the claim and the objective pursued (update, correction or deletion, or fulfillment of duties).
• You must provide the address and contact details and identification of the claimant.
• All documentation that the complainant wishes to assert must be accompanied by all documentation.
• Ecoeffy before attending the claim will verify the identity of the Personal Data Holder, its representative and/or proxy, or the accreditation that there was a stipulation by or for another. For this purpose, Ecoeffy may require the original citizenship card or identification document of the Data Subject, and the special or general powers of attorney or documents required, as the case may be.

 

• If the claim or additional documentation is incomplete, Ecoeffy will require the claimant for one time only to remedy the deficiencies. If the claimant does not submit the required documentation and information within ten (10) business days from the date of the initial claim, it will be understood that the claim has been withdrawn.

 

• If by any fact the person receiving the claim within Ecoeffy is not competent to resolve it, he will transfer customer service analyst, and inform the complainant of such referral.

 

• Once the claim is received with the complete documentation, a legend will be included in the Ecoeffy Database where the Data Subject to Claim is stored, stating “claim in process” and the reason for the claim. This legend must be maintained until the claim is decided.

 

8. Effect

 

This Policy is effective as of August 1, 2019. The Personal Data that is stored, used or transmitted will remain in our Database, based on the criteria of temporality and necessity, for as long as it is necessary for the purposes mentioned in this Policy, for which they were collected.

 

[updated august 1, 2019]