PERSONAL DATA PROCESSING POLICY
This Personal Data Processing Policy (the “Policy”) regulates the collection, storage, use, circulation and deletion of personal data carried out by Castrillón & Cárdenas Abogados Consultores S.A.S (the “responsible party”), in accordance with the provisions contained in the Statutory Law 1581 of 2012, and Decree 1074 of 2015, by means of which general provisions for the protection of personal data are issued.
1. Responsible party information
Company name: Castrillón & Cárdenas Abogados Consultores S.A.S.
Nit: 901.269.273 – 8
Address: Medellín Antioquia, Colombia.
Address: Cra. 25 No 1ª sur – 155. Platinum Superior Building. Office 752.
Pbx: (57 4) 349 33 10
2. Treatment to which the personal data will be submitted and its purpose.
Personal data is collected, stored, organized, used, circulated, transmitted, transferred, updated, rectified, deleted, erased and managed in accordance with the nature of the data and the purposes set forth in this Policy.
2.1. Processing of public and private personal data.
Castrillón & Cárdenas Lawyers Consultants S.A.S. accesses data of its clients and collaborators such as their names, ID numbers, e-mails, landline and cellular phones, among others. These data are collected for the following purposes:
2.1.1. Purposes for the processing of user data:
• Sending of commercial information of Castrillón & Cárdenas Lawyers Consultants S.A.S.
• Communications related to the service provided by Castrillón & Cárdenas Lawyers Consultants S.A.S.
2.1.2. Purposes for the processing of candidate data:
• Analysis of a candidate’s information in order to initiate an engagement process.
• Contact the candidate to express interest in initiating an engagement process.
• Verify the veracity and authenticity of the information provided in his résumé with the entities in which he has advanced his studies and held positions.
• Initiate the study of housing and security conditions to determine the admission to Castrillón & Cárdenas Lawyers Consultants S.A.S. as an employee.
• Send your data to allies and clients of Castrillón & Cárdenas Lawyers Consultants S.A.S. who are interested in contacting people with your profile, to explore a possible employment contract.
2.1.3. Purposes for the processing of customer data:
• Fulfillment of commercial obligations within the framework of contractual relations.
• Process and ensure compliance and delivery of products and / or services purchased by clients of Castrillón & Cárdenas Abogados Consultores S.A.S., as well as prepare the corresponding invoicing.
• Sending of advertisements about products and services of Castrillón & Cárdenas Abogados Consultores S.A.S.
• Offering of products of the different commercial lines of Castrillón & Cárdenas Abogados Consultores S.A.S.
• Communicate discounts, promotions and new product launches.
• To analyze and profile clients in order to define the services provided by Castrillón & Cárdenas Abogados Consultores S.A.S.
• Communicate the activities and events organized by Castrillón & Cárdenas Abogados Consultores S.A.S.
• Conduct market research and consumer habits, statistical analysis and customer behavior reports.
• Design and offer loyalty and benefit programs for customers.
• Sending satisfaction surveys or any other mechanism to evaluate the quality of the products and services provided by Castrillón & Cárdenas Abogados Consultores S.A.S.
2.1.4. Purposes for the processing of employee data:
• To comply with the Employer’s labor obligations, established in the labor legislation, the employment contract, the Internal Work Regulations, such as: affiliation to the Integral Social Security System and payment of contributions, affiliation to the Compensation Fund and payment of contributions, payment to the DIAN of the amounts withheld, issuing income and withholding certificates and labor certificates, and providing information to an entity or national authority that requires personal data, in accordance with the regulations in force.
• To make the necessary payments in the bank account indicated by the Worker or entities expressly indicated by the Worker.
• To contract life and/or medical insurance or for the granting of any other benefit derived from the labor relationship with the Employer, as the case may be.
• Notify family members in case of emergencies during working hours or in the course of work.
• Maintain the safety and health of workers in the workplace, in accordance with the standards applicable to the Occupational Safety and Health Management System (hereinafter “OSHMS”) and keep the documents indicated in Article 126.96.36.199.13 of Decree 1072 of 2015.
• Report instructions on the occasion of the employment contract.
• Evaluate the Worker’s job performance.
• Collect information and evidence in order to carry out labor disciplinary processes, if applicable.
• Store personal data in the Employer’s internal computer system.
• Circulate and consult the data among the persons specified in this Section, exclusively for the purposes provided herein.
• Use the information for procedures and documents related to the Worker’s employment relationship with the Employer.
2.1.5. Purposes for the processing of media data:
• Sending information related to closings or important transactions for the realization of notes.
• Sending information related to events, awards and/or activities of the firm.
• Sending invitations to cover events, cocktail parties, conferences, and social and/or academic activities of the firm.
• Communicating activities from which material can be extracted to publish interviews or opinion columns.
2.1.6. Purposes for the processing of supplier data:
• Organization of the registration of supplier information for the shipment of purchase orders.
• Investigation, verification and validation of the information provided by suppliers, with any information that Castrillón & Cárdenas Abogados Consultores S.A.S. legitimately has and international lists on the commission of crimes and money laundering.
• Communication, consolidation, organization, updating, control, accreditation, assurance, statistics, reporting, maintenance, interaction, and management of the actions, information and activities in which suppliers and contractors are related or linked to Castrillón & Cárdenas Abogados Consultores S.A.S.
• Preparation of reports on performance and compliance by suppliers.
2.2 Processing of sensitive data
Castrillón & Cárdenas Abogados Consultores S.A.S. may access and make use of sensitive data of its employees such as videos, photographs and fingerprints. Likewise, Castrillón & Cárdenas Abogados Consultores S.A.S. obtains information on the health status of its employees in compliance with legal obligations on occupational health. For these purposes, Castrillón & Cárdenas Abogados Consultores S.A.S. will apply the legal provisions on the treatment of sensitive data, including the following:
a) Obtain explicit authorization from the Data Subject for the processing, informing the optional nature of the same and the data that are considered sensitive. This authorization will be implemented in all collection of sensitive data, except in the following cases in which authorization is not required by law:
a. The Processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.
b. The Processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided that they refer exclusively to its members or to persons who maintain regular contacts by reason of their purpose. In these events, the data may not be provided to third parties without the authorization of the Data Controller.a las personas que mantengan contactos regulares por razón de su finalidad. En estos eventos, los datos no se podrán suministrar a terceros sin la autorización del Titular.
c. The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.
d. The processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted.
En los casos en que Castrillón & Cárdenas Abogados Consultores S.A.S. tenga acceso a datos sensibles, su tratamiento se realizará con las siguientes finalidades:
2.2.1. In the cases in which Castrillón & Cárdenas Abogados Consultores S.A.S. has access to sensitive data, its treatment will be carried out with the following purposes:
• Verify whether the applicant meets the physical requirements necessary to perform the position for which he/she is applying or was hired.
• To have the necessary information to attend any medical emergency that may arise during the provision of services in the facilities of Castrillón & Cárdenas Abogados Consultores S.A.S.
• Comply with safety and health standards at work and implement the SG-STS, and any other program, system and/or plan that seeks to protect the health of workers and people in the workplace.
2.2.2. Biometric data (fingerprints and photographs) of workers:
• Identify the personnel accessing Castrillón & Cárdenas Abogados Consultores S.A.S. facilities.
• Provide access to Castrillón & Cárdenas Abogados Consultores S.A.S. facilities.
• Verify the permanence of the worker in the facilities of Castrillón & Cárdenas Abogados Consultores S.A.S.
• Fulfillment of the legal obligations derived from the labor relationship, such as, to carry out all the necessary procedures for the registration of beneficiaries before the Social Security System, or any other activity derived from the applicable legislation.
• To provide the respective security in the training and activities that Castrillón & Cárdenas Abogados Consultores S.A.S. carries out for its employees.
• Publicize and disseminate the participation of Castrillón & Cárdenas Abogados Consultores S.A.S. workers in different activities, congresses and social events.
2.3. Video surveillance
Castrillón & Cárdenas Abogados Consultores S.A.S. uses various means of video surveillance installed in different parts of its facilities or offices.
The information collected will be used for security purposes of people, goods and facilities. This information can be used as evidence in any type of process before any type of authority and organization. Castrillón & Cárdenas Abogados Consultores S.A.S. will implement authorizations for obtaining this information that comply with the rules that regulate access to sensitive data.
2.4. Data processing of children and adolescents:
Castrillón & Cárdenas Abogados Consultores S.A.S. may process data of the children of candidates or employees who are under 18 years of age. This information is collected with the authorization of the parents or the persons legally empowered to do so, under the requirements set forth in the data protection regulation. For this reason, the purposes for which this data is collected are:
• Identification of a candidate’s children during visits and interviews at the candidate’s home.
• Fulfillment of legal obligations arising from the employment relationship, such as, performing all necessary procedures for the registration of beneficiaries, before the authorities, such as, before the Social Security System, or any other activity derived from the applicable legislation.
• Communicate to employees the welfare activities that Castrillón & Cárdenas Abogados Consultores S.A.S. has organized for their children.
• Communicate to employees the birth of children of Castrillón & Cárdenas Abogados Consultores S.A.S. employees.
3. Transfers and Transmissions of personal data.
Castrillón & Cárdenas Abogados Consultores S.A.S. transfers data of its clients and collaborators to international partners to any country where Castrillón & Cárdenas Abogados Consultores S.A.S. has operations, within the development of its business, legal advice and the development of the purposes indicated in section 2.1. of this Policy.
Likewise, Castrillón & Cárdenas Abogados Consultores S.A.S carries out transmissions of personal data of its clients and collaborators due to the fact that several service providers contracted by pen COLOMBIA are outside the country. Likewise, Castrillón & Cárdenas has Cloud services for the storage of this information, whose servers are located outside the country. Castrillón & Cárdenas Abogados Consultores S.A.S has implemented the necessary authorizations and transmission contracts for this purpose.
4. Rights you have as a Data Subject.
In accordance with the provisions of Article 8 of Law 1581 of 2012 and Decree 1074 of 2015 (Chapter 25), the Holder of the personal data has the following rights:
(a) To know, update and rectify their personal data against Castrillón & Cárdenas, in its capacity as Data Controller. This right may be exercised against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
b) Request proof of the authorization granted to Castrillón & Cárdenas Abogados Consultores S.A.S in its capacity as Data Controller, except when expressly excepted as a requirement for the Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012 (or in the rules that regulate, add, supplement, amend or repeal it), or when the continuity of the processing has occurred as provided in paragraph 4 of Article 188.8.131.52.2.7 of Decree 1074 of 2015.
c) Be informed by Castrillón & Cárdenas Abogados Consultores S.A.S. upon request, regarding the use made of their personal data.
d) File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012, once the consultation or complaint process has been exhausted before Castrillón & Cárdenas Abogados Consultores S.A.S.
e) To revoke the authorization and/or request the deletion of the data when the Processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that in the Processing the responsible or in charge have incurred in conducts contrary to the law and the Constitution.
f) Access free of charge to your personal data that have been subject to processing.
5. Area responsible for handling requests, queries and complaints
Castrillón & Cárdenas Abogados Consultores S.A.S, will be responsible for the attention of requests, consultations, claims, complaints or for the exercise of the rights of the Holder of the personal information.
6. Procedure for exercising the rights of the Data Subject.
6.1. Procedure for access and consultation
The Data Subject, or their successors in title, may consult the information contained in the databases in possession of Castrillón & Cárdenas Abogados Consultores S.A. S, for which they must communicate the corresponding request to the institutional e-mail; firstname.lastname@example.org, call (57 4) 3493310 or make these requests in writing, and file them at Cra 25 N. 1ª sur – 155 Office 752 from Monday to Friday from 8:00 AM to 1:00 PM or from 2:00 PM to 6:00 PM in the city of Medellín.
In order to prevent unauthorized third parties from accessing the personal information of the Data Subject, it will be necessary to previously establish the identification of the Data Subject. When the request is made by a person other than the Data Subject and it is not accredited that such person is acting on behalf of the Data Subject, it will be considered as not submitted.
The consultation will be answered within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend the consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.
6.2. Procedure for requesting updates, corrections, deletions, revocation of authorization or for filing claim
The Data Subject, or their assignees, who consider that the information contained in the database of Castrillón & Cárdenas Abogados Consultores S.A.S. should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in this law, may file a claim with Castrillón & Cárdenas Abogados Consultores S.A.S., which will be processed under the following rules, in accordance with Article 15 of Law 1581 of 2012:
a) The claim shall be formulated by means of a request that may be sent to the e-mail email@example.com or by filing a written communication from Monday to Friday from 8:00 AM to 1:00 PM or 2:00 PM to 6:00 PM, at Cra 25 N. 1ª sur – 155 Oficina 752, in the city of Medellín.
b) In order to prevent unauthorized third parties from accessing the personal information of the Data Subject, it will be necessary to previously establish the identification of the Data Subject. When the request is made by a person other than the Data Subject and it is not accredited that such person is acting on behalf of the Data Subject, it will be considered as not submitted.
c) The request must contain the following information:
(I) The identification of the Holder.
(II) Contact information (physical and/or electronic address and contact telephone numbers).
(III) The documents proving the identity of the Holder, or the representation of its representative.
(IV) A clear and precise description of the personal data with respect to which the Data Subject seeks to exercise any of the rights.
(V) The description of the facts that give rise to the claim.
(VI) The documents to be asserted.
(VII) Signature, identification number and fingerprint.
(VIII) Original filing.
(d) If the claim is incomplete, Castrillón & Cárdenas Abogados Consultores S.A.S. will require the interested party within five (5) days after receipt of the claim to
to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned.
e) If the area that receives the claim is not competent to resolve it, it will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.
f) Once the complete claim has been received, a legend will be included in the database stating “claim in process” and the reason for the claim, within a term no longer than two (2) business days. Said legend shall be maintained until the claim is decided.
g) The maximum term to address the claim shall be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
6.3. Data Suppression
The Data Subject has the right to request Castrillón & Cárdenas Abogados Consultores S.A.S. the suppression (deletion) of his/her personal data, especially when:
(a) He/she considers that the same are not being treated in accordance with the principles, duties and obligations set forth in Law 1581 of 2012.
b) They are no longer necessary or relevant for the purpose for which they were collected.
c) The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.
This suppression implies the total or partial elimination of the personal information as requested by the Data Subject in the records, files, databases or treatments carried out by Castrillón & Cárdenas Abogados Consultores S.A.S.
It is important to bear in mind that the right of cancellation is not absolute and the data controller may deny the exercise of this right when:
(I) The request for deletion of information will not proceed when the Data Subject has a legal or contractual duty to remain in the database.
(II) The deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
(III) The data is necessary to protect the legally protected interests of the Data Subject, to carry out an action in the public interest, or to comply with an obligation legally acquired by the Data Subject.
6.4. Revocation of the Authorization.
The Data Subject may revoke the consent to the Processing of his/her personal data at any time, as long as it is not prevented by a legal provision.
7. Information Security.
In development of the security principle, Castrillón & Cárdenas Abogados Consultores S.A.S. has adopted reasonable technical, administrative and human measures to protect the information of the Holders and prevent adulteration, loss, consultation, unauthorized or fraudulent use or access. Access to personal data is restricted to its Owners and Castrillón & Cárdenas Abogados Consultores S.A.S will not allow access to this information by third parties, except for an express request from the Owner of the data or persons legitimized in accordance with national regulations.adas de conformidad con la normatividad nacional.
8. Validity of the Policy.
The term of the authorizations on the use of personal data is understood as the term of the commercial relationship or the link to the service and during the exercise of the corporate purpose of the company, except in those cases in which the law provides a different term.