Personal Data Treatment Policy
PI – 01
These are the terms and conditions of the Personal Data Treatment Policy used by La Tour S.A. (hereinafter, denominated the “Company”), with its clients, vendors and contractors, as well as the security and confidentiality of such information.
a. Name: La Tour S.A.
b. Domicile and address: Km 1.5 Road to Cristo Rey, El Mameyal, Cali; Panamerican Avenue # 3-150 Jamundí.
c. Email address: firstname.lastname@example.org
d. Website: www.la-tour.com
e. Telephone: +57 (2) 8879009 Ext. 111
f. Opening hours: Monday – Friday 8:00 a.m. to 4:30 p.m.
3. Legal Framework
a. Political Constitution, Article 15.
b. Act 1266 of 2008.
c. Act 1581 of 2012.
d. Regulatory Decrees.
Definitions applied in Act 1581 of 2012, or those which may complement, substitute or amend such definitions.
For compliance of its mission, the Company has collected and will continue collecting personal data of the interacting Party (hereinafter denominated the “Holder”) while performing businesses, given the previous consent has been provided by the Holder. Unless the Holder indicates otherwise, the Holder authorizes the Company to save, process and use such personal data in a partial or total manner, for purposes expressed by the law, and herein.
The Holder’s authorization will not be necessary in case of:
a. Information being required by legal mandate, or an order of the competent authorities.
b. Information already being of public domain.
c. Cases of medical or health emergencies.
d. Treatment of data authorized by the Law for historical, statistical or scientific purposes.
e. Data related to Individuals’ Civil Registry.
6. Data Treatment purposes
Personal data of the Holder shall be collected, saved, used, distributed, shared and processed for: (a) development of the Company’s social object, (b) compliance of laws applicable to vendors, clients and contractors, including without limitation, the tax authorities, (c) compliance of all contractual commitments, (e) offering and provision of information regarding a commercial or technical interest on our products and/or services, (f) evaluation of job applications, (g) management of labor contracts with employees, in compliance with applicable laws, (h) guaranteeing the physical security of the facilities and personnel who enter the Company.
All information collected in the security points, whether documents or recordings of the video-surveillance system, will be exclusively used to support personnel and assets’ security in the Company’s environment.
Following is the type of personal data we process:
· Name of the person and/or company
· CC ID No. and/or NIT
· Company job position
· Company email address
· Cell phone or land line No.
· Other data of the contact, for commercial purposes
7. Holder’s rights
The Holder of the information may authorize or reject the use of his/her personal data, as well as the right to request access, updating, correction, removal of the information, as well as being aware of treatment given to his/her personal data.
The Holder may request the Company to delete (eliminate) its personal data, in any of the following cases:
· Considering personal data is not being treated according to principles, duties and obligations established in applicable standards.
· Data is not longer necessary or pertinent, or the period necessary for its obtention has been exceeded.
However, this Holder’s right is not absolute, and the Company can refuse the above, whenever:
· The Holder has the legal or contractual duty to remain in the database.
· Elimination of the data hinders judicial or administrative processes related to fiscal obligations, investigations and prosecution of crimes, or updating of administrative sanctions.
· Data is necessary to ensure the Holder’s legally protected interests; to act in favor of public interest or to comply with a legally acquired obligation of the Holder.
The legally established rights of the Holder can be exercised by the following persons:
a. The Holder, who shall sufficiently prove its identity through the different available methods.
b. The Holder’s successors, who shall show proof of their capacity.
c. The Holder’s representative and/or proxy, who shall produce written proof of the legal representation or power-of-attorney.
d. By provision in favor of another party, or for another party.
8. Liabilities of the Company
The Company, when responsible for Personal Data Treatment, shall comply with the following duties:
a. Request and maintain a copy of the respective authorizations granted by the Holder.
b. Duly inform the Holder about the purpose of the data collection and the Holder’s rights in virtue of the granted authorization.
c. Maintain the information under the necessary security conditions in order to avoid unauthorized tampering, loss, consultation, or fraudulent access or use of the information.
d. Demand Holder’s information security and privacy from the person in charge of personal data treatment.
e. Process Holder’s requests according to personal data treatment procedures established by the Company.
f. Inform data protection authorities whenever security codes are breached and the Holder’s data management is at risk.
g. The Company shall provide the registration of treated databases to the Superintendence of Industry and Commerce.
La Tour S.A. shall not transfer or transmit the information internationally.
When authorization from the Holder is required, it shall be obtained by any means which can be verified afterwards, such as written, verbal or virtual communications, or by unequivocal behaviors.
The Company will maintain the registration of such authorizations in a proper manner, guaranteeing and respecting principles of data privacy and confidentiality.
In case of sensitive information treatments, the following shall be taken into consideration:
a) For the treatment of sensitive information, the Holder is not obliged to give his/her authorization or consent.
b) The type of sensitive data to be requested shall be explicitly and previously informed, as well as the purpose of the data treatment.
c) Authorizations to treat sensitive data shall be given previously, in an express and clear manner.
10. Security and Confidentiality
To guarantee information’s best privacy and confidentiality, the Company has taken the necessary measures. Therefore, the Company has competent officials, who have been duly trained and authorized to offer data treatment, as well as state-of-the-art technology to support its processes. These technological measures, plus physical security which protects its facilities, provide reasonable protection according to the state of science and the annual budget of the Company, although they are not infallible. Any confidentiality breach or attempt detected by the Company will be immediately reported to the competent authorities.
11. Duration and Term
This policy is written and approved on February 23, 2017, its Effective Date.
As a general rule, the term of personal data treatment authorizations is deemed to extend as long as the commercial relation or service provision, the social object of the Company, or legal requirements are in effect.
The Company reserves the right to amend this Personal Data Treatment Policy at any time, without giving previous notice and at the Company’s own discretion. Any change will be informed and published in a timely manner, on the Company´s Web page, at www.la-tour.com.