Tabla de contenido
1. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA.
A. Informed consent of principle of freedom.
C. Purpose of the Data
D. Quality of Veracity of the data
F. Access or Restricted circulation
H. Data Security
J. Duty of information
K. Sensitive data protection.
2. RIGHTS OF DATA SUBJECTS
A. Right of access.
B. Right of update
C. Right of rectification.
D. Right of deletion or cancellation.
E. Right to revoke consent.
F. Right of opposition.
G. Right to complaint or to take action.
H. Right to grant authorization for the processing of personal data
3. GENERAL POLICY
B. Treatment to which data will be collected
C. Cases where authorization isn´t required.
D. Data related to human resource management.
E. Data processing during contractual relationship
F. Processing of data after termination of the contractual relationship.
G. Processing of personal data of customers and suppliers.
H. Recordings and filming.
The organization ITC WILCHES S.A.S. identified with the NIT: 830.020.775-6 accordance with the law 1581 of 2012 and its regulatory decree 1377 of 2013, which regulate the protection of personal data that establish the legal guarantees that should follow all the people in Colombia for the established treatment of this information. Developing the follow policies for the processing of personal data within the company.
For ITC WILCHES S.A.S is overriding ensure the confidentiality, integrity, freedom and transparency, veracity and availability of information from the databases of its shareholder, suppliers, customers, applicants, employees and former employees,
Guaranteeing availability in the technological infrastructure in the processing of personal data collected for legal, contractual, and commercial purposes.
For this purpose, ITC WILCHES S.A.S is committed to comply with the current regulation, searching always for effective mechanisms for the protection of the rights of holders in its personal data to which it gives treatment, will manage and develop measures containing security conditions appropriate to prevent adulteration, consultation, use of fraudulent access.
In the Data Processing Authorization requested in each case it will be indicated that they
can be transferred to entities that will Fulfill the function of managers in the terms established
by the law 1581 of 2012 or to the sources linked to the organization. ITC WILCHES S.A.S
Data Base Managers shall be fully entitled to this Data Protection Policy.
2. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA.
The protection of personal data in ITC WILCHES S.A.S is subdued to the following rules. Based on which the following internal processes related to the processing of personal data and its interpreted in a harmonic, integral and systematic way to solve the conflicts that bring forward this matter, consecrated principles in international rules, in the Colombian law and its jurisprudence of the constitutional court that has stablished the rights of the linked to personal data.
A. Informed consent of principle of freedom.
The processing of personal data from ITC WILCHES S.A.S, can only be done with the prior, express and informed consent of the holder, the personal data can’t be obtained, treated or disclosed without authorization of the holder, unless legal or judicial mandate that supplements the expressed consent of the holder.
The processing of personal data in Colombia is a standardized and regulated activity, for that reason the
business activities and recipients should be subject to the provisions of the law.
C. Purpose of data.
The processing of personal data must correspond to a legitimate purpose, according to the constitution and to the law,
that should be informed in advanced, concrete and precise the holder to express its signed consent.
D. Quality or Veracity of Data.
Personal data collected by ITC WILCHES S.A.S. Must be truthful, complete, accurate, verifiable, comprehensible and up to date, the processing of partial, fractional, incomplete or misleading data is forbidden
ITC WILCHES S.A.S guarantee the holder the right to know, in any moment, without restriction, any information or data of interest to the holder, in the same way to know who is responsible or/and in charge of the processing.
In addition, it guarantees that it only requests pertinent data, not excessive or disproportionate in relation to the purpose of the collection of the same.
F. Access or restricted circulation.
The personal data collected or treated by ITC WILCHES S.A.S will be used by the organization or its linked only for an authorized purpose guarantee
by the holder of its personal data. Therefore, they will only be ceded to third parties that need to provide some service to ITC WILCHES S.A.S and that they are giving the purpose to the personal data authorized. The holder, with his authorization, will allow ITC WILCHES S.A.S to transfer of his personal data for the purposes authorized by him to those in charge of the treatment or those related. The data in custody of ITC WILCHES S.A.S can’t be available on internet or other medium of massive dissemination, expecting that the access can be technically controllable and safe, and said access have for purpose giving a restricted knowledge that only holders or Third parties authorized in accordance with the provisions of the law and the principles governing the matter. Exceptions from the foregoing are events in which by express legal provision there must be disclosure of such data in mass media such as the Internet or the prior existence of authorization by the holder of the information.
Obtain in any moment and without restrictions any information or personal data that the holder has interest.
Spent the purpose for which the Personal Data was recollected, ITC WILCHES S.A.S. will end the use of it and thus assume the necessary measures to guarantee the removal of it. For that purpose, it would be considered the liabilities of commercial law for the conservation of commerce books and mailing of the merchant.
However, in case that it would be consider essential, the data can be preserved in the data base of ITC WILCHES S.A.S when needed so it is given fulfillment to the legal duty or judicial order, as well as when the treatment is limited to its conservation with historic or statistic purposes.
H. Security of the information.
ITC WILCHES S.A.S, as the responsible or the one in charge of the treatment of the personal data, depending the case, will adopt the measurements of physical security, technological and/or administrative that will be required to guarantee the attributes of integrity, authenticity and reliability of the personal information. ITC WILCHES S.A.S, corresponding the classification of the personal information that is being treated inside the company, will carry out measurements of security in a high, medium or low level depending the case, with the purpose to avoid adulteration, lost, leakage, query, use or access that is not authorized or fraudulent.
Every person that joins the treatment of data in ITC WILCHES S.A.S, has the professional commitment to save and keep the data hidden, otherwise there are legal exceptions. This commitment exits even after the end of the management that gave origin to the recollection and treatment of the information.
J. Duty of the information.
ITC WILCHES S.A.S report the owners of the information the protection regime of the data applied in the company, regarding the purpose and other principles that regulate the treatment of it. In the same way, inform the existence of the data base of personal character that safes the duties and what it is done with the data by the owners, process that is according to the law.
K. Protection of the sensitive information.
ITC WILCHES S.A.S will not recollect neither treat personal data linked with political ideologies, union affiliation, religious beliefs, sexual activity, ethnic origin and/or health information, without the authorization of the owner or by legal disposition.
3. Rights of the owner´s information
The owners of the information of personal character contained in the data base that rest in the information system of ITC WILCHES S.A.S, have the rights described by this chapter in warranty of fulfillment of the politic constitution of 1991 and the law.
The exercise of the rights will be run only by the owner of the information. In accordance with the legal layout that regulate the application of those. For the exercise of these rights the owner of the information can contact the company through telephone communication.
For the application of Habeas Data, written in the rights mentioned in the next paragraph, is to highlight that the data is exclusive power of the owner of it except if law interferes.
A. Right of Access.
This right empowers the owner of the information to obtain every data concerning to its personal details, whether they are partially or complete, in the same way know the purpose and treatment of it, also where the personal data base is and/or assignments authorized by themselves.
The access to the personal data that have been object of Treatment will guarantee without any payment once a month or any time that modifications are made to the treatment policies or the information that motivate new conferences. For conferences for which period is greater than one per month, the identity and charge the owner for the shipment, reproduction and if so, certification of the documents.
B. Right of actualization.
This right carries out the power of the owner of the data to request the modification of the information when this has changed.
C. Right of correction.
This right comprehends the power of the owner of the information to demand the modification of them, in the case that they are inexact, incomplete or inexistent.
D. Right of omission or cancellation.
The owner of the data has the right to cancel out their person data gathered by ITC WILCHES S.A.S, when they are excessive, they do not follow the rules. Except that the data has been completed by the law, or in a specific contractual framework.
E. Right of withdrawal of consent.
The owner of the data has the right to revoke the authorization that allows ITC WILCHES S.A.S to gather the information to make a treatment with a specific purpose. Except in the cases that the law establishes any exceptions and/or if a specific contractual framework is needed.
F. Right of opposition.
This right highlights the power of the owner of the data to oppose that the respective treatment of the data is carried out, except if the case does not follow the law or that the general interests are being infringed rather than the personal. ITC WILCHES S.A.S, based in the legitimate rights that the Owner of the Personal Data argues, will carry out a judgement of proportionality or weighing with the purpose of determining the preeminence or not of the right of the owner of the data over other rights.
G. Right to file complaints or take action.
The owner of the data has the right to present ITC WILCHES S.A.S complaints or any actions of accordance with the rights that rules him/her and concerns with the industry and commerce superintendence, or another entity. ITC WICLHES will give answer to the requirements that the authorities make in relation with these rights of the owners of the personal information.
H. Right to grant authorization for the treatment of personal data.
In developing of the principle mentioned, the owner of the information has the power to grant the authorization by any method that can be object of any further conference, to treat the personal data at ITC WILCHES S.A.S.
In a exceptional way, this Authorization cannot be required in the following cases:
* When the information is required or it must be given at a public or administrative entity fulfilling the legal management, or by judicial order.
* When the data is of public nature.
* In cases of medical emergency.
* When the treatment of the information, authorized by law, has a historic, statistic, or scientific purpose.
* When the personal information is related with the civil registration of the people
* In these cases, although the Owner´s Authorization is not required, other principles would be applied and legal disposal corresponding the personal data.
4. DUTIES OF THE MANAGERS OF THE TREATMENT
According to the article 17 of the law 1581 of 2012.The managers of the treatment will have to accomplish the following duties, without any prejudice of the other disposals last seen in the present law and in others that rule the activity:
* Guarantee the Owner, in any time, the complete and effective perform of the right of the habeas data.
* Request and keep, in the conditions foreseen in the law, a copy of the respective authorization given by the Owner.
* Report effectively the Owner about the purpose of the gathering and the right that help thanks to the authorization given.
* Keep the information under the necessary security conditions to prevent adulteration, lost, leakage, query, use or access that is not authorized or fraudulent
* Guarantee that the information provided to the Manager of the treatment is truthful, complete, exact, updated and compressible.
* Update the information, communication in an effective way to the manager of the treatment, every new data corresponding to what has been given and adopt any necessary method to maintain the information updated.
* Rectify the information when it is incorrect and communicate what is needed to the manager of the treatment.
* Supply the manager of treatment, depending the case, only data whose treatment was previously authorized regarding the present law system.
* Demand de manager of treatment in every moment, the respect towards the security and privacy conditions of the owner’s information.
* Process the inquires done in the respective terms according to the law.
* Adopt an internal manual of policies y procedures to guarantee the proper fulfillment of the present law, specially, for the attention of complaints. * Report the manager of the treatment when determined information is found in discussion by the Owner, once it is presented the complaint and the process hasn’t finished.
* By the request of the Owner, report the use of their data.Inform to the authority of protection of data when infringement of the codes of security is presented and there exist any risks in the administration of the information of the Owners.
* Supply the instructions and requirements that the superintendence of industry and commerce broadcast.