POLICY AND PROCEDURE FOR THE TREATMENT OF PERSONAL DATA

ACOLCEX S.A.S. CUSTOMS BROKER

BOGOTÁ, D.C. MARCH 2016

 

In compliance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, ACOLCEX S.A.S. CUSTOMS BROKER adopts the following policy in order to inform clients, suppliers, employees, and third parties in general of the applicable policy for the protection of personal data and information contained in the corporate database.

 

In this way, ACOLCEX S.A.S. CUSTOMS BROKER states that it guarantees the rights of privacy, intimacy, good reputation, and autonomy in the processing of personal data, and therefore all its actions will be governed by the principles of purpose, legality, freedom, truthfulness, transparency, security, access, restricted circulation, and confidentiality.

 

GENERAL INFORMATION

1.1 Identification of the Data Controller

1. a) Entity Name: ACOLCEX S.A.S. CUSTOMS AGENCY
2. b) Address: The company is located in the city of Bogotá, at Calle 53 No. 22 - 64 Of. 503.
3. c) Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
4. d) Phone: (57-1) 2111690

 

1.2 OBJECTIVE OF THE POLICY

The purpose of this policy is to adopt the procedure for the treatment of personal data in order to protect the constitutional right that all individuals have to know, update, and rectify the information collected about them in databases or files owned by ACOLCEX S.A.S. CUSTOMS BROKER or whose processing has been entrusted to ACOLCEX S.A.S. CUSTOMS BROKER, and other constitutional rights, freedoms, and guarantees in accordance with Law 1581 of 2012 and its Regulatory Decree 1377 of 2013.

 

ACOLCEX S.A.S. CUSTOMS BROKER is committed to respecting the rights of its users. Therefore, it adopts this policy manual, which is mandatory for application in all activities involving the processing of personal data.

These policies must be strictly complied with by all employees of ACOLCEX S.A.S. CUSTOMS BROKER in the performance of their duties, as well as by contractors and third parties working on behalf of ACOLCEX S.A.S. CUSTOMS BROKER.

 

1.3 SCOPE OF APPLICATION

These terms and conditions apply to data collected in-person, non-in-person, and/or virtually registered in any database of ACOLCEX S.A.S. CUSTOMS BROKER.

ACOLCEX S.A.S. CUSTOMS BROKER is directly responsible for the processing of personal data; however, it reserves the right to delegate such processing to a third party.

ACOLCEX S.A.S. CUSTOMS BROKER requires the third party to comply with and implement appropriate guidelines and procedures for the protection of personal data and strict confidentiality thereof.

 

1.4 DEFINITIONS

For the purpose of better understanding the application of this manual, and in accordance with the provisions of Article 3 of Law 1581 of 2012, the following definitions are provided:

Authorization: Prior, express, and informed consent from the data subject to carry out the processing of personal data.

Privacy Notice: Verbal communication, physical document, electronic, or in any other format generated by the data controller made available to the data subject for the processing of their personal data. The Privacy Notice informs the data subject about the existence of the information processing policies that apply to them, how to access them, and the characteristics of the processing that will be applied to personal data.

Database: An organized set of personal data that is subject to processing.

Personal Data: Any information linked or that can be associated with one or more specific or determinable natural persons. Personal data should be understood as information related to an individual person.

Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, information related to the civil status of individuals, their profession or occupation, and their status as a merchant or public servant. By nature, public data can be found, among other places, in public records, public documents, official gazettes and bulletins, and duly executed court judgments that are not subject to confidentiality.

Public Personal Data: All personal information that is freely and openly available to the general public.

Private Personal Data: Personal information that has restricted access and is generally private to the general public.

Semi-Private Data: Data that is neither intimate, confidential, nor public, and whose knowledge or disclosure may be of interest not only to the data subject but also to a certain sector or group of individuals or to society in general.

Sensitive Data: Data that affects the privacy of the data subject or whose misuse can lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations, or promoting the interests of any political party, as well as data related to health, sexual life, and biometric data, including but not limited to still or moving images, fingerprints, photographs, iris scans, voice recognition, facial recognition, or palm prints, etc.

Data Processor: A natural or legal person, public or private, who, on their own or in association with others, processes personal data on behalf of the data controller.

Data Controller: Natural or legal person, public or private, who, on their own or in association with others, decides on the database and/or the processing of data.

Data Subject: Natural person whose personal data is subject to processing.

Transfer: Data transfer occurs when the data controller and/or data processor, located in Colombia, sends information or personal data to a recipient, who in turn is responsible for processing and may be located within or outside the country.

Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when it aims to carry out processing on behalf of the data controller.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

  

2 PRINCIPLES

2.1 Principle of Purpose

The processing of all personal data collected by ACOLCEX S.A.S. CUSTOMS BROKER is carried out in accordance with the objectives established by the law and the purpose based on the nature and economic activity of the company.

 

2.2 Principle of Legality

The Processing of Personal Data is a regulated activity governed by Statutory Law 1581 of 2012, Decree 1377 of 2013, and other regulations that complement, modify, or repeal them.

 

2.3 Principle of Freedom

ACOLCEX S.A.S. CUSTOMS BROKER may process and disclose personal data stored in its databases without the prior consent of the data subject, provided that such data come from public records or, although not contained in them, are of a public nature or are found in databases excluded by law. In all other cases, ACOLCEX S.A.S. CUSTOMS BROKER must obtain the prior, express, and informed consent of the data subject when processing their personal data.

 

2.4 Principle of Truthfulness

ACOLCEX S.A.S. CUSTOMS BROKER ensures that the information contained in its databases subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited. When the accuracy and quality of personal data captured through public records are guaranteed by each of the data subjects, ACOLCEX S.A.S. CUSTOMS BROKER is exempt from any responsibility regarding its quality.

 

2.5 Principle of Transparency

The data subject can, at any time, obtain from ACOLCEX S.A.S. CUSTOMS BROKER, free of charge and without restrictions, information about the existence of data concerning them.

 

2.6 Principle of Security

ACOLCEX S.A.S. CUSTOMS BROKER will provide the technical, human, and administrative measures necessary to ensure the security of records, preventing their tampering, loss, consultation, use, or unauthorized or fraudulent access.

 

2.7 Principle of Restricted Access and Circulation

The processing of personal data is subject to limits derived from the nature of such data, legal provisions, and the Constitution. Consequently, processing can only be carried out by individuals authorized by the data subject and/or persons provided for by law. Personal data, except for public information, cannot be made available on the internet or other means of mass disclosure or communication unless access is technically controllable to provide restricted knowledge only to data subjects or third parties authorized by law.

 

2.8 Principle of Confidentiality

All individuals at ACOLCEX who manage, handle, update, or have access to information of any kind found in databases are obligated to ensure the confidentiality of the information. They commit to preserving and maintaining all information they come to know in the execution and exercise of their duties strictly confidential and not to disclose it to third parties, except when it involves activities expressly authorized by data protection laws. This obligation persists and will be maintained even after their relationship with any of the tasks related to processing has ended.

 

3 AUTHORIZATIONS

3.1 AUTHORIZATION

The collection, storage, use, circulation, or deletion of personal data by ACOLCEX S.A.S. CUSTOMS BROKER requires the free, prior, express, and informed consent of the data subject. ACOLCEX S.A.S. CUSTOMS BROKER, as the data controller, has established the necessary mechanisms to obtain the authorization of the data subjects, ensuring in all cases that it is possible to verify the granting of such authorization.

 

3.2 FORM AND MECHANISMS TO GRANT AUTHORIZATION

ACOLCEX S.A.S. CUSTOMS BROKER has implemented mechanisms through technical means that facilitate the automated expression of consent by the data subject. Authorization can be documented in a physical document, electronic form, data message, via telephone, internet, websites, or in any other format that allows for subsequent consultation. Those obliged to comply with this policy must obtain the prior, express, and informed authorization from the data subject to collect and process their personal data. This obligation is not necessary when the information is required by a public or administrative entity in the exercise of its legal functions or by a judicial order, when dealing with data of a public nature, cases of medical or health emergencies, information processing authorized by law for historical, statistical, or scientific purposes, and data related to the Civil Registry of Persons. ACOLCEX S.A.S. CUSTOMS BROKER must retain proof of compliance with the provisions herein and provide a copy of it upon the data subject's request. The data subject acknowledges that ACOLCEX S.A.S. CUSTOMS BROKER may provide this information to affiliated or allied entities, as well as to judicial or administrative entities and other state entities that, in the exercise of their functions, request such information. The data subject also accepts that they may be subject to internal or external audit processes conducted by companies responsible for this type of control, subject to the confidentiality of the information.

 

3.3 PRIVACY NOTICE

The Privacy Notice is the physical, electronic, or any other format document made available to the data subject for the processing of their personal data. Through this document, the data subject is informed about the existence of information processing policies that apply to them, how to access them, and the characteristics of the processing intended for their personal data.

 

4 PROCESSING

4.1 PUBLIC DATA

ACOLCEX S.A.S. CUSTOMS BROKER notes that it processes personal data of a public nature without prior authorization from the data subject. This situation does not imply that necessary measures are not taken to ensure compliance with the other principles and obligations provided for in Law 1581 of 2012 and other regulations governing this matter.

  

4.2 SENSITIVE DATA

For the management of Sensitive Data, ACOLCEX S.A.S. CUSTOMS BROKER will restrict the processing of sensitive personal data to the strictly necessary and will request prior and express consent from the data subjects, especially when dealing with new data, informing them of the exclusive purpose of their processing.

For the processing of sensitive data, ACOLCEX S.A.S. CUSTOMS BROKER will comply with the following obligations:

1. Inform the data subject that, as it involves Sensitive Data, they are not obligated to authorize its processing.
2. Inform the data subject which of the data is Sensitive and the purpose of the processing.
3. ACOLCEX S.A.S. CUSTOMS BROKER does not condition any activity on the data subject providing Sensitive Data.

 

5 RIGHTS AND RESPONSIBILITIES

5.1 RIGHTS OF THE DATA SUBJECT

In accordance with Article 8 of Law 1581 of 2012, the data subject is informed of the rights offered by data protection laws, which are listed below and guaranteed by ACOLCEX S.A.S. CUSTOMS AGENCY through the defined procedures:

 

1. Know, update, and rectify their personal data.
2. Request proof of the authorization granted to the entity.
3. Be informed by the entity, upon request, about the use it has made of their personal data.
4. File complaints with the Superintendency of Industry and Commerce for violations of Law 1581 of 2012 and other regulations that modify, add, or complement it.
5. Revoke the authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that the entity has engaged in conduct contrary to the law and the Constitution.
6. Access their personal data that have been subject to processing free of charge.  

 

5.2 RESPONSABILITIES OF AGENCY OF CUSTOMS ACOLCEX S.A.S. IN THE PROCESSING OF PERSONAL DATA

In accordance with the provisions of Article 17 of Law 1581 of 2012, ACOLCEX S.A.S. CUSTOMS BROKER commits to permanently comply with the following duties related to the processing of personal data:

 

1. Ensure that the data subject can fully and effectively exercise the right to habeas data at all times.
2. Request and retain, under the conditions established by this law, a copy of the respective authorization granted by the data subject.
3. Properly inform the data subject about the purpose of the collection and the rights they have by virtue of the granted authorization.
4. Maintain information under the necessary security conditions to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
5. Ensure that the information provided to the data processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
6. Update the information by promptly communicating any changes regarding the data previously provided to the data processor and take other necessary measures to keep the information supplied to them up to date.
7. Rectify the information when it is incorrect and communicate the relevant changes to the data processor.
8. Provide the data processor, as applicable, only with data whose processing has been previously authorized in accordance with the provisions of the law.
9. Demand that the data processor always respects the security and privacy conditions of the data subject's information.
10. Handle queries and complaints in the terms established in this manual.
11. Inform the data processor when certain information is under dispute by the data subject once a complaint has been filed, and the respective process has not yet concluded.
12. Notify the data protection authority when security breaches occur and there are risks in the management of data subject information.
13. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

 

 5.3 AUTHORIZATION AND CONSENT OF THE DATA SUBJECT

ACOLCEX CUSTOMS BROKER requires the free, prior, express, and informed consent of the data subject for the processing of their personal data, except in cases expressly authorized by law, namely:

1. a) Information required by a public or administrative entity in the exercise of its legal functions or by a judicial order.
2. b) Public data.
3. c) Cases of medical or health emergencies.
4. d) Processing of information authorized by law for historical, statistical, or scientific purposes.
5. e) Data related to the Civil Registry of Persons.

5.4 STATEMENT OF AUTHORIZATION

Authorization for the processing of personal data by ACOLCEX S.A.S. CUSTOMS BROKER will be granted by:

1. a) The data subject, who must sufficiently prove their identity through various means made available by ACOLCEX CUSTOMS BROKER.
2. b) The heirs of the data subject, who must prove their status.
3. c) The legal representative and/or attorney-in-fact of the data subject, subject to proof of representation or power of attorney.
4. d) Another person in favor of whom the data subject has stipulated.

5.4.1 METHODS TO GRANT AUTHORIZATION

ACOLCEX will obtain authorization through various means, including physical documents, electronic forms, data messages, the internet, websites, or in any other format that in any case allows for the obtaining of consent through unequivocal conduct that leads to the conclusion that, had it not been carried out by the data subject or the person authorized for this purpose, the data would not have been stored or captured in the database. Authorization will be requested by ACOLCEX prior to the processing of personal data. Proof of authorization ACOLCEX will retain proof of authorization granted by the data subjects for the processing of their personal data, using the mechanisms available to it at present and taking the necessary actions to keep a record of the manner and date on which it was obtained. Consequently, ACOLCEX may establish physical files or electronic repositories directly or through third parties contracted for this purpose.

 

6 ACCESS, CONSULTATION, CLAIMS, UPDATES, AND DELETION

6.1 RIGHT OF ACCESS

ACOLCEX S.A.S. CUSTOMS BROKER guarantees the right of access to information that concerns the data subject only in accordance with Law 1581 of 2012. In this way, ACOLCEX S.A.S. CUSTOMS BROKER must ensure the data subject's right of access in three ways:

1. The first implies that the data subject can become aware of the actual existence of the processing to which their personal data is subject.
2. The second allows the data subject to access their personal data in the possession of the controller.
3. The third implies the right to know the essential circumstances of the processing, which translates into ACOLCEX S.A.S. CUSTOMS BROKER duty to inform the data subject about the type of personal data processed and each and every one of the purposes that justify the processing.

6.2 CONSULTATION

In accordance with Article 14 of Law 1581 of 2012, data subjects or their heirs may consult the personal information of the data subject that is held in any database and whose processing is the responsibility of ACOLCEX S.A.S. CUSTOMS BROKER

Therefore, ACOLCEX S.A.S. CUSTOMS BROKER guarantees the right to consultation, providing data subjects with all the information contained in the individual record or related to the data subject's identification.

For the handling of requests for consultation of personal data, ACOLCEX S.A.S. CUSTOMS BROKER guarantees:

1. Enabling electronic communication or other means it deems pertinent.
2. Establishing forms, systems, and other simplified methods, which must be informed in the privacy notice.
3. Using customer service or complaint services that are in operation.

In any case, regardless of the mechanism implemented for handling consultation requests, they will be processed within a maximum period of ten (10) business days from the date of receipt. If it is not possible to respond to the consultation within this period, the interested party will be informed before the expiration of the 10 days, stating the reasons for the delay and specifying the date on which the consultation will be addressed, which in no case may exceed five (5) business days following the expiration of the initial deadline.

 

6.2.1 Requirements for Consultation

A communication must be sent, either physical or electronic, which must include at least the request date, a photocopy of the identification document, contact address (physical or electronic), and phone number for notification purposes. If applicable, the representative of the data subject must provide an authenticated document confirming their representation.

To exercise this right electronically, the data subject may submit the query via the email address designated by ACOLCEX S.A.S. CUSTOMS BROKER (This email address is being protected from spambots. You need JavaScript enabled to view it.), attaching the aforementioned information.

 

6.3 CLAIMS

The Data Subject who believes that the information contained in a database should be corrected, updated, or deleted, or who notices the alleged non-compliance with any of the duties contained in applicable legislation.

 

6.3.1 Requirements for Making Claims

Data subjects may file a claim with ACOLCEX S.A.S. CUSTOMS BROKER following the procedure outlined below:

 

• The claim will be formulated through a written document or electronically, including the identification of the Data Subject, a description of the facts that give rise to the claim, the address, phone number, and contact place, and any accompanying documents to support the claim.
• If the claim is incomplete, the interested party will be required, within five (5) days from the receipt of the claim, to rectify the deficiencies.
• If, after two (2) months from the date of the requirement, the applicant has not provided the requested information, it will be considered that they have withdrawn the claim.
• If the recipient of the claim is not competent to resolve it, they will forward it to the appropriate party within a maximum of two (2) business days and inform the interested party of the situation.
• Once the complete claim is received, a note will be added to the database stating "claim in progress" and the reason for it, within a term not exceeding two (2) business days.
• This note must be maintained until the claim is resolved. The maximum term for addressing the claim will be fifteen (15) business days, starting from the day following its receipt.
• If it is not possible to address the claim within this term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which, in no case, may exceed eight (8) business days following the expiration of the initial term.
• The Data Subject may only file a complaint with the Superintendence of Industry and Commerce once they have exhausted the consultation or claim process with the Data Controller or Data Processor.

ACOLCEX S.A.S. CUSTOMS BROKER undertakes to rectify and update, at the request of the Data Subject, the personal information corresponding to natural persons that is incomplete or inaccurate, in accordance with the procedure and terms mentioned above. This applies unless it concerns data contained in public records, which are governed by special regulations. For this, ACOLCEX S.A.S. CUSTOMS BROKER acts based on the following:

1. In requests for the rectification and updating of personal data, the Data Subject must specify the corrections to be made and provide supporting documentation for their request.
2. ACOLCEX S.A.S. CUSTOMS BROKER has the freedom to implement mechanisms that facilitate the exercise of this right, as long as they benefit the Data Subject. Consequently, electronic means or others that AGENCIA DE ADUANAS ACOLCEX S.A.S. deems appropriate and secure may be enabled.
3. ACOLCEX S.A.S. CUSTOMS BROKER may establish forms, formats, systems, and other methods, which will be disclosed in the Privacy Notice and made available to interested parties on the website or offices of AGENCIA DE ADUANAS ACOLCEX S.A.S.

6.4 DATA ERASURE

The Data Subject has the right, at all times, to request ACOLCEX S.A.S. CUSTOMS BROKER to delete (eliminate) their personal data when:

2012. They believe that their data is not being processed in accordance with the principles, duties, and obligations established in Law 1581 of 2012.
2013. The data is no longer necessary or relevant for the purpose for which it was collected.
2014. The period required for fulfilling the purposes for which it was collected has expired. This erasure entails the total or partial elimination of personal information as requested by the Data Subject in the records, files, databases, or processes carried out by ACOLCEX S.A.S. CUSTOMS BROKER.

It is important to note that the right to erasure is not absolute, and the Data Controller may deny its exercise when:

1. a) The Data Subject has a legal or contractual duty to remain in the database.
2. b) The deletion of data obstructs judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative penalties.
3. c) The data is necessary to protect legally protected interests of the Data Subject, to perform an action for the public interest, or to comply with a legal obligation acquired by the Data Subject.
4. d) If the erasure of personal data is deemed appropriate, AGENCIA DE ADUANAS ACOLCEX S.A.S. must carry out the deletion in such a way that it does not allow for the recovery of the information.

 

6.5 REVOCATION OF CONSENT

Data Subjects have the right to revoke their consent to the processing of their personal data at any time, provided that it is not prevented by a legal or contractual provision. To do so, ACOLCEX S.A.S. CUSTOMS BROKER must establish simple and free mechanisms that allow the Data Subject to revoke their consent, at least through the same means by which it was granted.

It should be noted that there are two ways in which the revocation of consent can occur:

1. The first can be for all the consented purposes, meaning that ACOLCEX S.A.S. CUSTOMS BROKER must completely stop processing the Data Subject's data.
2. The second can occur for specific types of processing, such as advertising or market research purposes.

With the second option, which is the partial revocation of consent, other purposes of processing that the Data Controller can carry out in accordance with the granted authorization and with which the Data Subject agrees are preserved.

Therefore, it will be necessary for the Data Subject, when submitting the revocation request, to specify whether the revocation they intend to make is total or partial. In the second scenario, they should indicate which processing they disagree with.

There will be cases where consent, due to its necessary nature in the relationship between the Data Subject and the Data Controller for the fulfillment of a contract or due to a legal requirement, cannot be revoked.

The mechanisms or procedures established by ACOLCEX S.A.S. CUSTOMS BROKER to address requests for the revocation of consent must not exceed the timeframes provided for addressing complaints as indicated in Article 15 of Law 1581 of 2012.

 

7 FINAL PROVISIONS

ACOLCEX S.A.S. CUSTOMS BROKER designates the administrative department or its equivalent to fulfill the function of protecting personal data.

If you have any questions about this policy, please contact AGENCIA DE ADUANAS ACOLCEX S.A.S. or send your inquiry directly or through the following communication channels.

 

Phone: +57 601 7451252

Email: This email address is being protected from spambots. You need JavaScript enabled to view it. 

 

8 EFFECTIVE DATE

 

This policy comes into effect as of March 29, 2016.