\n
\n
\n EXSIS DIGITAL ANGELS S.A.S. USERS’ DATA HANDLING,\n PROTECTION AND PRIVACY POLICY Due to the commercial acivity\n executed by EXSIS Digital Angels in compliance with Decree\n 1377 from year 2013, the data handling, protection and privacy\n policy that Exsis Digital Angels implements is\n established.\n
\n
\n
I. IDENTIFICATION
\n
\n
\n COMPANY NAME: EXSIS DIGITAL ANGELS S.A.S. (hereinafter\n EXSIS), company with pure colombian capital and funds, which\n belongs to the Colombian common regime and dedicated to offering\n software solutions that allow to meet needs and expectations when\n handling customers’ data handling, utilizing the lastest\n technology and advances guaranteeing quality both in products\n creation and services.\n
\n
\n
\n DOMICILE: Bogota.\n
\n ADDRESS: Street 145 # 48-16, Bogota D.C.\n
\n E-MAIL: habeasdata@exsis.com.co\n
\n PERSON IN CHARGE, CONTACT NUMBER: 4846750 Ext. 1021\n
\n
\n II. LEGAL FRAMEWORK\n
\n
\n Political constitution, 15th article.\n
\n The 1266 Act from year 2008\n
\n The 1581 Act from year 2012\n
\n 1727 and 2952 Regulatory decrees from years 2009 and 2010\n
\n 1377 Partial Regulatory decree from year 2013\n
\n
\n
\n
III. DEFINITIONS
\n
\n
\n AUTHORIZATION: The\n holder’s previous, explicit and informed approval or permission to\n carry out the data handling its protection and privacy.\n
\n PRIVACY NOTICE: verbal\n or written communication generated by the temporary responsible\n person directed towards the holder for data handling, protection\n and privacy, by which the existence of applicable data handling,\n protection and privacy policies are informed, how to access these\n policies and the purposes of data handling, protection and privacy\n that is intended for personal data privacy.\n
\n DATABASE: dataset that\n is composed of personal data subject to data handling.\n
\n
\n SUCCESSOR: a person who\n takes over the rights of another because of death or inheritance\n (heir).\n
\n
\n PERSONAL DATA: any\n piece of information involved with one person or several\n determined individuals or determinable people able to join a\n natural or juridical person.
\n
\n PUBLIC DATA: it is the\n data that is not semi-private, private or sensitive. Public data\n is considered to be, amongst others, data related to people’s\n marital status, profession or job, quality as merchant or public\n servant. By nature, public data can be contained, amongst others,\n in public records or documents, official legal bulletins, gazetes\n and legal decisions properly executed that are not subject to\n legal reserve.
\n
\n SENSITIVE DATA: is any\n data that affects the holder’s intimacy, political orientation,\n religious or philosophical beliefs, participation in trade unions,\n social, human rights, or organizations that support political\n parties’ interests, or those who guarantee rights and political\n opposition, as well as, those related to health, sexual life and\n biometric data.
\n
\n MANDATORY DATA: It is\n understood as the holders’ personal mandatory data to continue\n with the company’s operation. The mandatory in essence data should\n be provided by the data holders or legitimate ones, who can exert\n these rights.\n
\n
\n \n TEMPORARY RESPONSIBLE PERSON FOR DATA PRIVACY:\n \n a natural, juridical, public or private person, who on her or his\n own or together with others, executes personal data handling on\n behalf of the responsible person for data privacy.\n
\n
\n DATA PRIVACY ACT: It is\n all the regulation involved with the 1581 act from year 2012 and\n its regulatory Decrees, regulations and ammendments that modify,\n complement or substitute regulations.\n
\n
\n HABEAS DATA: is the\n right that any person has to know, to update and to change\n information that has been gathered or collected in the databases\n and files from public and private entities.\n
\n
\n \n RESPONSIBLE PERSON FOR DATA PRIVACY:\n \n a natural or juridical, public or private person who on his or her\n own or together with others, decides about the database and/or\n about data handling or its privacy.\n
\n
\n HOLDER: is a natural\n person whose personal data is subject to data Handling.\n
\n
\n DATA HANDLING: are any\n operations or set of operations about personal data, such as\n collection, gathering, usage, distribution or deletion.\n
\n
\n TRANSFERENCE: Data\n transference occurs when the temporary or responsible person for\n personal data privacy, located in Colombia, submits data or\n personal data to a recipient, who is also responsible for personal\n data handling and located in Colombia or abroad.\n
\n
\n TRANSMISSION: Data\n handling or Data privacy that conveys communication of Data\n handling or Data privacy within Colombia’s national territory or\n abroad when the purpose is to have date managed by the temporary\n responsible person on behalf of the responsible person for data\n privacy.\n
\n
\n
\n
IV. PRINCIPLES
\n
\n
\n For the development, interpretation and law enforcement from the\n 1581 act from year 2012 by which general dispositions are dictated\n for the personal data privacy and the regulations that complement,\n modify and change this act, the following governing principles\n will be applied in a harmonic and integral way:\n
\n
\n
\n \n a) PRINCIPLE OF LEGALITY:\n \n data privacy is a regulated activity that must stick to what is\n established in the law and other dispositions related to it.\n
\n
\n \n b) PRINCIPLE OF PURPOSE:\n \n the data privacy must follow a legitimate purpose in compliance\n with the Constitution and Laws, and must be notified to the\n holder.
\n
\n Regarding personal data collection, EXSIS will only collect data\n that is pertinent and reasonable for the purpose that it was meant\n to be collected or gathered. The holder needs to be notified of\n the reason why and purpose for which the information is being\n required and the specific usage that this information will have.\n
\n
\n \n c) PRINCIPLE OF FREEDOM:\n \n Privacy data and its handling can only be exerted with previous,\n expressed and informed approval or permission from the holder.\n Personal data will not be obtained or disclosed without previous\n authorization, or in absence of legal or judicial order affecting\n the permission.
\n
\n \n d) PRINCIPLE OF VERACITY OR QUALITY:\n \n data subject to privacy and data handling must be reliable,\n complete, exact, updated, verifiable and understandable.\n Incomplete, parcial, fragmented or misleading data handling is\n prohibited.
\n
\n \n e) PRINCIPLE OF TRANSPARENCY:\n \n with data handling the holder’s right must be guaranteed to obtain\n information about the existence of data that he or she is\n interested in, in any moment and with no restraints by the person\n who is responsible for data privacy or the temporary person in\n charge.\n
\n
\n \n f) PRINCIPLE OF ACCESS AND RESTRICTED CIRCULATION:\n \n the data handling sticks to the limits that derive from the nature\n of personal data, Law dispositions and the Constitution. In this\n way, data handling can only be executed by individuals who are\n authorized by the holder or individuals allowed by Law. Personal\n data, except for public data, will not be available on the\n internet nor any other means of advertisement or massive\n communication, unless the access is technically controlled to\n offer a restricted access of information only for the holders or a\n third person authorized by law.
\n
\n \n g) PRINCIPLE OF SAFETY:\n \n data subject to EXSIS handling, needs to be handled with the\n technical, human and administrative measures that are necessary to\n provide security to the records preventing adulteration, loss,\n consultation, use or unauthorized or fraudulent use or access from\n happening.
\n
\n \n h) PRINCIPLE OF CONFIDENTIALITY:\n \n EXSIS is obligued to guarantee the reserve of data, even after\n finishing its relation with any of the tasks that handling\n requires, being only able to supply or communicate personal data\n when it corresponds to the development of legal activities.\n
\n
\n
\n
V. RIGHTS
\n
\n
\n EXSIS is committed to protecting the privacy and guaranteeing the\n habeas data rights, so that customers are able to know, update and\n modify personal data handled by EXSIS. For this reason, in\n compliance with the 1581 act from year 2012 and the 1377 Decree\n from year 2013, it is stated how the holder counts on the below\n rights:\n
\n
\n
\n a) To know, to update and to modify his or her personal details\n before EXSIS or its managers, in its responsible for private data\n handling condition. This right can be exerted, amongst others,\n when Partial, inaccurate, incomplete, fragmented, misleading\n personal data or those prohibited or those ones that have not been\n authorized occur.
\n
\n b) To request proof of authorization granted to EXSIS, unless\n there exists a legal disposition that indicates the authorization\n is unnecessary or that it has been validated according to the 10th\n article of the 1377 Decree.
\n
\n c) To request petitions to EXSIS regarding the personal data use\n and to receive such information.
\n
\n d) To file a complaint before the superintendence of industry and\n commerce for infractions related to the 1581 act from year 2012\n and the 1377 Decree from year 2013.
\n
\n e) To revoke his or her authorization and/or to request personal\n data deletion from EXSIS databases, only if a legal duty does not\n exist (when the user has has bought an article or service there\n are legal and tax obligations to have a the record of purchase for\n the bought items, hence this information must remain on the EXSIS\n record of sales, this, with foundation on the 60th article C.Co)\n or a an EXSIS holder contractual type of obligation, under which\n the holder has no right to request his or her personal data\n deletion or to revoke his or her authorization for data handling.\n If there are no legal or contractual pending duties and EXSIS has\n not deleted the holder’s personal data from its database or has\n not revoked the authorization from whom is legitimate to do so\n within the legal terms, the holder will be able to go before the\n superintendence of Industry and Commerce to demand the revocation\n of authorization and/or the personal data deletion.
\n
\n f) To request and gain free access to his or her personal data\n that has been subject to data handling.
\n
\n These Policies guarantee that any provided piece of information\n will be kept private and secure. To certify this, we provide in\n this document the details of which data we obtained and the way we\n used it. We never gather data without previous, explicit and\n informed approval or permission, unless personal data was under\n handling process by EXSIS before the 1377 Decree from year 2013\n was issued and the procedure in the 10th article from that\n mentioned Decree has been implemented. This document is an\n integral part of EXSIS Terms and conditions. By the acceptance of\n these Terms and conditions you accept you have been informed about\n our Policy.\n
\n
\n
VI. DUTIES
\n
\n
\n according to the data handling and data protection policy, in this\n document, the duties for which EXSIS is responsible are the\n following ones, subject to legal dispositions contained in the\n law.\n
\n
\n
\n a) To guarantee the holder, at any time, the full and effective\n exercise of the habeas data right.
\n
\n b) To request and to keep the corresponding holder’s granted\n authorization copy.
\n
\n c) To inform accurately the holder about the data collection\n purpose and rights in favor due to the granted authorization.\n
\n
\n d) To keep the data under the necessary security conditions to\n prevent adulteration, loss, consultation, use or unauthorized or\n fraudulent access from happening.\n
\n
\n e) To guarantee that the data is realiable, complete, precise,\n updated, verifiable and understandable.\n
\n
\n f) To update data, taking care of the customers’ requests about\n the holder’s data. Additionally, all possible measures must be\n implemented, so that data remains up-to-date.\n
\n
\n g) To correct data when it is incorrect and to communicate it.\n
\n
\n h) To respect the holder’s data privacy and security conditions.\n
\n
\n i) To process requests and filed claims within legal the terms\n specified by law.\n
\n
\n j) To identify when specific information is under discussion by\n the holder.\n
\n
\n k) To inform upon holder’s request about the use of his or her\n data.\n
\n
\n l) To inform the data protection authority when a breaching of the\n law codes occurs or should risks exists in the holder’s data\n handling procedure.\n
\n
\n m) To comply with the requirements and instructions that the\n Superintendence of Industry and Commerce resolves on a particular\n matter.\n
\n
\n n) To use only data whose handling is previously authorized in\n compliance with the 1581 act from year 2012.\n
\n
\n o) EXSIS will utilize the holder’s personal data only for the\n purposes it is entitled and respecting in all cases valid laws and\n regulations about data protection.
\n
\n
\n
VII. MINORS
\n
\n
\n Our services are only available for those individuals who have\n capacity to hire or to be hired. Therefore, those who do not\n comply with this requirement will need to avoid providing personal\n data to be included in our databases. Although this can be done\n with the parent’s help or tutors, according to what is written in\n our Terms and conditions, the tutor or legal representative of the\n minor will grant authorization once the child has exerted his or\n her right to be listened and his or her opinion has been valuated\n according to his or her maturity, autonomy and capacity to take\n care of this issue. Minors’ Personal data must respect the overall\n interest of children, girls and adolescents and protect their\n fundamental rights. In compliance with the 1377 Decree from year\n 2013, EXSIS will not handle minors’ sentitive personal data,\n defined by the 1581 act from year 2012 as those which affect the\n holder’s intimacy or those whose improper use can generate\n discrimination, such as those that disclose trade union\n affiliations, racial or ethnic origin, political orientation,\n religious, moral or philosophical beliefs, the affiliation to\n trade unions, social or human rights organizations that promote\n political parties that guarantee rights and guarantee political\n parties opposition, as well as data related to health, sexual\n life, and biometric data.\n
\n
\n
\n VIII. HOLDER’S AUTHORIZATION AND ACKNOWLEDGEMENT\n
\n
\n
\n Subject to legal exceptions, the holder’s data handling requires\n previous, informed authorization from the holder, and this\n authorization will have to be obtained through any means that can\n be consulted later.\n
\n
\n
\n IX. PERSONAL DATA REQUEST PROCEDURE\n
\n
\n
\n EXSIS will inform in advance to the holders about the required\n personal data and the reason why the information is needed,\n understanding that the above mentioned purpose will always be\n related to EXSIS economic activity. Regarding the authorization\n obtention, EXSIS will gather data related to personal data in a\n strictly manner using the assigned forms and texts for this\n activity.
\n
\n In the documents, formats and/or texts that EXSIS assigns for the\n task the following will always be included:\n
\n
\n a. The mention of the personal data policy, in this document, and\n its location on the corporate website.\n
\n
\n b. Contact information regarding the responsible person for the\n data handling.\n
\n
\n c. A space for the holder’s signature or, in any particular case\n the legal representative, or legitimate third person for the\n exercise of the rights.\n
\n
\n
\n
\n PERSONAL DATA REQUEST FOR EMPLOYEES AND/OR CONTRACTORS:\n
\n
\n
\n EXSIS will implement a text, format and/or authorization in the\n labor and/or independent contracts, in order to authorize in\n advance and in expressed way the data privacy handling related to\n the execution of the corresponding contract, which will include\n the authorization to gather, modify or correct the holder’s\n personal data.
\n
\n The text, form and/or authorization will also include the\n authorization with the clarification that some of the data could\n be delivered to a third party with which EXSIS has a relation or\n outsourced tasks, which in any case will limit the use they give\n to the data.\n
\n
\n
\n X. MEANS AND DECLARATION TO GRANT THE HOLDER’S AUTHORIZATION\n
\n
\n
\n EXSIS, according to legal terms, generated a notification which\n communicates that holders can exert their “personal data handling”\n rights over the website www.exsis.co and the e-mail\n habeasdata@exsis.com.co.\n
\n
\n
\n XI. EVENTS WHEN THE HOLDER’S PERSONAL DATA AUTHORIZATION IS\n UNNECESSARY\n
\n
\n
\n The holder’s authorization information will not be necessary in\n the following cases:\n
\n
\n
\n a) Data required by a public or administrative entity in exercise\n of legal functions or by judicial requirement.\n
\n b) Data of public nature.\n
\n c) Medical or sanitary urgency cases.\n
\n d) Data handling authorized by law for historical, statistical or\n scientific purposes. Data related to people’s civil registration.\n
\n
\n
\n XII. LEGITIMIZATION FOR THE HOLDER’S RIGHT EXERCISE\n
\n
\n
\n The holder’s rights established in the Law will be exerted by the\n following individuals:
\n a) By the holder, who will have to credit his or her identity in a\n sufficient manner throughout the possible means that EXSIS offers\n to him or her\n
\n b) By the holder’s successors, who will have to credit such\n quality.\n
\n c) By the representative and/or holder’s power of attorney,\n previous to the full accreditation of the representation or the\n power of attorney.\n
\n d) By stipulation in favor of someone or for someone.\n
\n
\n
\n XIII. PROCEDURE THAT DATA WILL UNDERGO AND ITS PURPOSE\n
\n
\n
\n The employees and customer’s mandatory personal data handling will\n be framed in the legality in order to provide an excellent service\n and to make more effective, agile and safer operations that users\n execute, EXSIS will gather the holder’s personal data only for the\n following purposes:\n
\n
\n
\n a) To make EXSIS transactions more effective and safer
\n
\n b) To comply with customers and users’ service agreements, in\n compliance with the objectives to provide offers, sales, and EXSIS\n services or products.\n
\n
\n c) To complement the data and, in general, to move forward the\n necessary activities to manage requests, complaints and claims\n filed by EXISIS customers or users and by third parties, to\n redirect them to responsible areas to provide the corresponding\n responses.\n
\n
\n d) To send information and EXSIS commercial proposals about\n products, as well as to have marketing and/or services\n commercialization activities and/or products that EXSIS could\n possibly offer.\n
\n
\n e) To conduct market research, statistics, surveys, market trends\n analysis, satisfaction surveys about services provided by EXSIS.\n
\n
\n f) For personal data transmission to a third party with whom\n agreement were made with this intention for commercial,\n administrative and/or operational purposes.\n
\n
\n g) To manage all necessary data for EXSIS tax, commercial records,\n corporate and accounting obligations compliance.\n
\n
\n h) To be able to proceed with billing/invoicing and EXSIS cash\n collections.\n
\n
\n i) To send information or messages about new products and/or\n services, to show the current advertisement or promotion, banners,\n EXSIS news and any other information we think is convenient.\n
\n
\n j) To share personal data with service companies or outsourcing\n companies that contribute to facilitate operations with EXSIS,\n including, payment methods, insurance or payment management\n intermediaries. EXSIS will do its best to create third parties’\n policies with similar standars to those contained in this\n document, using agreements and contracts both with signatures.\n
\n
\n k) To provide the holder’s personal data to entities involved with\n conflicts resolution that are qualified to do so.\n
\n
\n
\n In case of sensitive personal data, it will be possible to use the\n data handling when:\n
\n
\n
\n a) The Holder has given explicit authorization for the data\n handling, except for cases where the authorization is unnecessary\n by law;
\n
\n b) Data handling is necessary to safeguard the holder’s vital\n interest and when the holder is physically or juridically\n handicapped. In these events, the legal representatives will have\n to grant their authorization;\n
\n
\n c) The handling happens during the legitimate activities\n guaranteed by a foundation, ONG, association or any other\n non-profit organism, whose political, philosophical, religious\n intention or trade union intention, only if they refer exclusively\n to their members or to people who maintain regular contact due to\n the intention. In this case, data will not be given to a third\n person without the holder’s authorization;\n
\n
\n d) The data handling refers to data that is necessary for the\n acknoledgement, exercise or defense of a right in a judicial\n process;\n
\n
\n e) The handling has a historical, statistical or scientific\n purpose. In this case measures need to be taken to end up with the\n holder’s identity deletion.\n
\n
\n
\n XIV. INDIVIDUALS TO WHOM DATA CAN BE GIVEN\n
\n
\n
\n The information that complies with the established conditions by\n law can be provided to the following individuals:\n
\n a) To the holders, their successors (if they are missing) or their\n legal representatives.\n
\n b) To public or administrative entities in exercise of their legal\n functions or by judicial order.\n
\n c) To a third person authorized by the holder or by the law.\n
\n
\n
\n XV. RESPONSIBLE PERSON OR AREA FOR REQUESTS AND CLAIMS SERVICE\n
\n
\n
\n EXSIS has assigned as the responsible area to take care of\n compliance of this policies within the company - the configuration\n management area- with support of the juridical direction,\n functional areas that coordinate and handle the holder’s personal\n data and data security professionals.\n
\n
\n
\n This department will be ready to resolve requests, inquiries and\n claims from the holders and to update, modify, delete personal\n data over the e-mail habeasdata@exsis.com.co\n
\n
\n
\n XVI. PROCEDURE TO TAKE CARE OF CONSULTATIONS, CLAIMS AND REQUESTS\n
\n
\n
\n EXSIS has a Manual of complaints and claims (PR_003 Complaints and\n Claims), the above mentioned document specifies the procedure that\n is demanded to resolve issues.\n
\n
\n
\n a) consultations:\n
\n
\n The Holders or their successors will be able to consult the\n holder’s personal data which EXSIS has, EXSIS will give all data\n contained in individual records that is linked to the holder’s\n identification.
\n The consultation will be sent through the e-mail\n habeasdata@exsis.com.co The consultation will be taken care of\n with a deadline of twenty-four (24) hours from its receiption\n date. When it woul not be possible to respond within thee above\n mentioned term, the interested party will be informed, expressing\n the reasons of the delay and indicating the resolution date for\n the consultation, which needs to be provided not later than within\n five (5) working days from the first expiration date.\n
\n
\n b) Claims:
\n
\n The Holder or his or her successors who consider the data\n contained in a database must be object of correction, update or\n deletion, or when they warn a possible non compliance of any of\n the legal duties they will be able to file a claim before EXSIS\n which will be handled with following the rules below:
\n
\n i. The holder’s claim will be done directly to EXSIS and the claim\n should be sent to the e-mail habeasdata@exsis.com.co with the\n holder’s identity, the facts description which originated the\n claim, the address, and with all necessary support documentation.\n If the claim is incomplete, the interested party will be required\n to provide complete information within twenty-four (24) hours. two\n (2) months later after the requirement, without providing the\n required data, is understood as cancelation of the right to claim.\n
\n
\n ii. if the claim receiver is not competent to resolve it, it will\n transfer the claim to a competent person in a maximum term of two\n (2) working days and he or she will inform about the situation to\n the interested party.\n
\n
\n iii. Once the e-mail is received in the e-mail address\n habeasdata@exsis.com.co with complete information about the claim,\n it will be flagged with \"claim in process\" and the reason why it\n occurred in not later than two (2) working days. The above\n mentioned tag will be there until it gets a final resolution.\n
\n
\n iv. The maximum deadline to take care of the claim will be fifteen\n (15) working days from the day of reception. If it was not\n possible to take care of the claim within the above mentioned\n term, the the interested party will be informed of the delay and\n the reasons for this to happen and date to look into the claim,\n which cannot exceed eight (8) working days from the first\n expiration date.\n
\n
\n \n c) Request of update, modification and data suppression.\n \n
\n
\n EXSIS will modify and update, upon holder’s request, data which is\n incomplete or inaccurate, according to the procedure and the terms\n in this document, for this the holder will send the request to the\n e-mail habeasdata@exsis.com.co indica- ting the update,\n modification and data suppression and will provide support\n documentation for his request.\n
\n
\n \n d) Revocation of the authorization and/or data suppression\n \n
\n
\n The holders’ personal data can revoke the personal data handling\n authorization at any moment, and any time only if a legal\n disposition does not prevent it from happening, for this EXSIS\n will provide the holder with the e-mail habeasdata@ exsis.com.co.\n
\n
\n If the respective legal term is due, EXSIS, according to the case,\n has not deleted the personal data, the Holder will request the\n Supervision of Industry and Commerce to revoke the authorization\n and/or the personal data suppression. In this situation the\n procedure described in the 22nd article of the 1581 Act from year\n 2012 will be applied.\n
\n
\n
\n
\n XVII. VALIDITY OF THE POLICIES FOR THE HOLDER’S PERSONAL DATA\n HANDLING\n
\n
\n
\n The Policy is available to the Holders of Data from the 1st of\n July year 2013 and can be consulted on the website \"www.exsis.co\"\n
\n
\n Any substantial modification to the policy about the responsible\n person or purposes of data handling will be notified before\n implementing any changes to the Holders using the web page\n \"www.exsis.co\" or any other efficient mechanism for this purpose.\n
\n
\n\t\t\t \n