Data protection policy
- PERSONAL DATA PROTECTION POLICY
Statutory law 1581 of 2012 developed “the constitutional right that all persons have to know, update and rectify the information that has been collected about them in databases or files, and the other rights, liberties and constitutional guarantees referred to Article 15 of the Political Constitution; as well as the right to information enshrined in Article 20 of the same.
“This constitutional right is known as HABEAS DATA, and gives citizens the ability to decide and control the information that others have about them, that is, the Law 1581 of 2012 enshrines the mechanisms and guarantees that allow the full exercise of the right of Habeas Data.
In compliance with the provisions of Law 1581 of 2012, partially regulated by Decree 1377 of 2013 and Decree 886 of 2014, EQUITEL SA, As the person in charge of processing the personal data of its customers, suppliers and Members, it adopts the following policies and procedures to guarantee that the collection and processing of personal data that it complies with current legal provisions.
- CHAPTER I. – GENERAL PROVISIONS
Article 1. Scope of Application. This document applies to the treatment of personal data obtained and managed by EQUITEL S.A. ORGANIZATION. It also applies to the processing of personal data obtained by its companies CUMMINS DE LOS ANDES S.A., LAP TECHNOLOGIES S.A., INGENERGIA S.A., EQUITEL S.A., GAF INTERNATIONAL S.A., in its capacity as centralizer and administrator of all its databases.
Article 2. Object. Its purpose is to protect and guarantee “the constitutional right that all persons have to know, update and rectify the information that has been collected about them in databases or files, and the other rights, liberties and constitutional guarantees referred to in the Article 15 of the Political Constitution; as well as the right to information enshrined in article 20 thereof “.
Article 3. Definitions. To apply the provisions of this policy, it is understood as:
a) Authorization: Prior, express and informed consent of the Holder to carry out the processing of personal data.
b) Database: Organized set of personal data that is subject to processing.
c) Personal data: Any information linked to or associated with one or several natural persons determined or determinable.
d) Responsible for the Treatment: Natural or legal person, public or private, which by itself or in association with others, performs the processing of personal data on behalf of the Treatment Manager.
e) Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the treatment of the data.
f) Owner: Natural person whose personal data is subject to Treatment.
g) Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
h) Privacy notice: Verbal or written communication generated by the Responsible, addressed to the Owner for the Processing of their personal data, by means of which they are informed about the existence of the Information Treatment policies that will be applicable to them, the form to access them and the purposes of the treatment that is intended to give personal data.
i) Public data: It is the data that is not semi-private, private or sensitive. They are considered public data, among others, the data relative to the civil status of the people, to their profession or trade and to their quality of merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, gazettes and official bulletins and judicial sentences duly executed that are not subject to reservation.
j) Sensitive data: Sensitive data are those that affect the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, belonging to trade unions, social organizations, human rights organizations or those that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
k) Transfer: The transfer of data takes place when the person in charge and / or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a receiver, who in turn is responsible for the processing and is within or out of the country.
l) Transmission: Processing of personal data that involves the communication of the same inside or outside the territory of the Republic of Colombia when it has for its object the realization of a Treatment by the Manager on behalf of the Responsible.
Article 4. Principles for the processing of personal data. EQUITEL S.A., In the development, interpretation and application of the present policy, will apply, in a harmonic and integral way, the following principles:
– Principle of legality in the matter of data processing: The treatment referred to in this law is a regulated activity that must be subject to what is established in it and in the other provisions that develop it.
– Principle of purpose: The Treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Holder.
– Principle of freedom: The Treatment can only be exercised with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves consent.
– Principle of truth or quality: The information subject to Treatment must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.
– Principle of transparency: In the Treatment, the right of the Holder to obtain from the Person in Charge of the Treatment or the Person in Charge of the Treatment, at any time and without restrictions, information about the existence of data that concerns him must be guaranteed – Principle of access and circulation restricted: The Treatment is subject to the limits that derive from the nature of personal data, the provisions of this law and the Constitution. In this sense, the Treatment can only be done by persons authorized by the Holder and / or by the persons provided for in this law.
– Personal data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless the access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties in accordance with this law.
– Principle of security: The information subject to Treatment by the Person in Charge of the Treatment or Responsible for the Treatment to which the present law refers, shall be handled with the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration loss, consultation, use or unauthorized or fraudulent access.
– Principle of confidentiality: All persons involved in the processing of personal data that do not have the nature of public are obliged to guarantee the reservation of information, even after the end of their relationship with any of the tasks involved in the treatment, being able to only perform supply or communication of personal data when this corresponds to the development of the activities authorized in this law and in the terms thereof.
- CHAPTER II. – AUTHORIZATION
Article 5. Authorization. The collection, storage, use, circulation or deletion of personal data by EQUITEL S.A. requires the free, prior, express and informed consent of the holder of the same. EQUITEL S.A., in its condition of being responsible for the processing of personal data contained in its databases, has provided the necessary mechanisms to obtain the authorization of the holders guaranteeing in any case that it is possible to verify the granting of said authorization.
Article 6. Form and mechanisms for granting authorization. The authorization can be recorded in a physical, electronic document, in an audio file or in any other format that guarantees its subsequent consultation. The content of the authorization granted for the collection and treatment of the data will be issued by EQUITEL S.A. and will be made available to the Owner prior to the processing of their personal data, in accordance with what is established by Law 1581 of 2012.
With the consented authorization procedure, it is guaranteed that the owner of the personal data has been informed, both the fact that your personal information will be collected and used for certain and known purposes, and that you have the option of knowing any alteration to the themselves and the specific use that has been made of them.
The foregoing in order for the Owner to make informed decisions regarding their personal data and have control over the use made of their personal information. The authorization that in any case will be requested from EQUITEL S.A. o The Companies to the owner of the data is a statement that informs about:
a) Who collects the data,
b) What data collects,
c) For what data collects,
d) How to exercise rights of access, correction, update or deletion of personal data provided,
e) If sensitive data is collected, and possibility of not making them known.
Article 7. Proof of authorization. EQUITEL S.A. will adopt measures to keep records of when and how it obtained authorization from the holders of personal data for the treatment thereof.
Article 8. Privacy notice. The privacy notice defined in literal h of article 3 of this manual will be made available to the owner of the information by EQUITEL S.A. and at least contain: (i) The full identification of the person responsible for the processing of personal data; (ii) The type of treatment to which the data will be submitted and the purpose thereof, and (iii) The general mechanisms that EQUITEL S.A. so that the owner of the information accesses, knows, rectifies and consults the policy of treatment of the information adopted by EQUITEL S.A.
PRIVACY NOTICE that EQUITEL S.A. has defined for the effect.The EQUITEL ORGANIZATION S.A. it will keep the model of the privacy notice that was transmitted to the owners while the personal data is processed and the obligations deriving from it endure. For the storage of the model, the EQUITEL S.A. ORGANIZATION You may use computer, electronic or any other technology.
- CHAPTER III. – RIGHTS AND DUTIES
Article 9. Rights of the Holders of the Information. In accordance with the provisions of article 8 of Law 1581 of 2012, the holder of personal data has the following rights:
a) Know, update and rectify your personal data against EQUITEL S.A., in its capacity as Responsible and Manager of the Treatment.
b) Request proof of the authorization granted to EQUITEL S.A., in its capacity as Responsible and Manager of the Treatment.
c) To be informed by EQUITEL S.A., upon request, regarding the use it has given to their personal data.
d) Submit to the Superintendency of Industry and Commerce complaints for infringements of the provisions of Law 1581 of 2012, once the process of consultation or claim has been exhausted before the Responsible for Treatment.
e) Revoke the authorization and / or request the deletion of the data when the Treatment does not respect the principles, rights and constitutional and legal guarantees.
f) Access, free of charge, your personal data that has been processed.
Article 10. Duties in relation to the processing of personal data. EQUITEL S.A. keep in mind, at all times, that personal data are the property of the natural persons to whom they refer and that only they can decide on them. In this sense, it will use them only for those purposes for which it is duly empowered in the authorization obtained at the time of collecting the data, and respecting at all times the mandates of the Constitution, Law 1581 of 2012 on data protection personal and Decree 1377 of 2013 that regulates it. In accordance with the provisions of article 17 of Law 1581 of 2012, EQUITEL S.A. undertakes to comply permanently with the following duties in relation to the processing of personal data:
a) Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.
b) Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
c) Perform timely, that is, in the terms provided in articles 14 and 15 of Law 1581 of 2012, updating, rectification or deletion of data.
d) Process inquiries and claims made by the Holders in the terms set forth in article 14 of Law 1581 of 2012.
e) Insert in the database the legend “information in judicial discussion” once notified by the competent authority about judicial processes related to the quality or details of the person data.
f) Refrain from circulating information that is being disputed by the Owner and whose blockade has been ordered by the Superintendence of Industry and Commerce.
g) Allow access to information only to people who may have access to it.
h) Inform the Superintendence of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the Owners.
i) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
- CHAPTER IV. – ACCESS, CONSULTATION AND CLAIM PROCEDURES
Law 1581 of 2012 gives all natural persons rights and guarantees that seek to provide them with tools to protect their personal data and the use that is given to them. Every right that claims to be effective must have a known and efficient mechanism through which it can be enforced. Next EQUITEL S.A. it presents you with the rights you can assert before us, in your capacity as the owner of the information, and the mechanisms that we have at your disposal for it.
Article 11. Right of Access. The power of disposition or decision held by the Holder over the information of which he owns implies the right to access and know if his personal information is being processed, as well as its scope. EQUITEL S.A. guarantees to the Holder his right of access in the following way:
a) The owner of the information may know, if requested, if indeed their data (s) are (are) being processed (s) by EQUITEL SA.
b ) The Holder may have access to their personal data held by the person in charge.
c) EQUITEL SA and / or The Companies will inform the Holder, at the time of obtaining their information, about the type of personal data processed and each and every one of the purposes that justify the Treatment.
PARAGRAPH: EQUITEL S.A. guarantee the right of access, prior accreditation of the identity of the Owner or personality of its representative, making available to him, free of charge, the detail of your personal data through physical or electronic means that allow direct access of the Owner to they, so that the Holder can make effective their right to rectify, correct or request the deletion of all or part of their data.
Article 12. Consultations. In accordance with the provisions of Article 14 of Law 1581 of 2012, the holders or their successors in title may consult the personal information of the Holder that rests in any database. Consequently, EQUITEL S.A. will guarantee the right of consultation, providing them with all the information contained in the individual record or that is linked to the identification of the Holder. For the attention of requests of consultation of personal data EQUITEL S.A. guarantees: Have your customer service line 018000117676 enabled, as well as the email account mbuitrago@equitel.com.co and others that you consider pertinent at the time and that will be effectively announced through modifications to your Privacy Notice.
In any case, regardless of the mechanism implemented for the attention of requests for consultation, these will be attended within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend the consultation within said term, the interested party will be informed before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.
Article 13. Claims In accordance with the provision of article 14 of Law 1581 of 2012, the Holder or his successors in title who consider that the information contained in a database must be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, may submit a claim to the Treatment Manager, which will be processed under The following rules:
1) The claim will be formulated by means of a request addressed to the Treatment Manager or to the In charge of the Treatment, with the identification of the Holder, the description of the facts that will give rise to the claim, the address, and including the documents that support the claim. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the information required, it will be understood that you have withdrawn the claim. In case EQUITEL S.A. lest competent to solve it, will transfer to whom it corresponds in a maximum term of two (2) business days and inform the interested party of the situation.
2) Once the complete claim has been received, it will be included in a term not greater than two (2) days Skillful, in the database, a legend that says “claim in process” and the reason for it. This legend must be maintained until the claim is decided. 3) The maximum term to attend the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is possible to report the term, the interested party must be informed before the expiration of said period of the reasons for the delay and the date on which your claim will be handled, which is not case may exceed the eight (8) business days following the expiration of the first term.
Article 14. Deletion of data. The Holder has the right, at all times, to request the EQUITEL S.A. the elimination of your personal data when:
– You consider that they are not being treated in accordance with the principles, duties and obligations provided for in Law 1581 of 2012.
– They have ceased to be necessary or relevant for the purpose for which they were collected. MOSQUERA Av Troncal Occidente No 29-88E. KM 2.5 via Bogotá – Mosquera. Tel. (1) 294 84 44 BARRANQUILLA Calle 110 # 4 – 76 MEDELLÍN Cra 52 # 10 – 184 Tel. (4) 255 42 00 IBAGUÉ Km 22 via Ibagué – Espinal Tel. (8) 269 05 73/69/70 VILLAVICENCIO Km 1 via Puerto López, Ocoa Tel. (8) 684 98 44/77 www.equitel.com.co
– The period necessary to fulfill the purposes for which they were collected has been exceeded
– This elimination implies the total elimination or partial of the personal information in accordance with the request by the Owner in the records, files, databases or treatments performed by EQUITEL SA It is important to bear in mind that the right to cancel is not absolute and the person responsible can deny the exercise of the same in the following cases:
– The request for suppression of the information will not proceed when the Holder has the legal or contractual duty to remain in the database.
– It is not possible to eliminate the data by the order of a judicial or administrative authority with competence in the National Territory.
– The data are necessary to protect the legally protected interests of the Holder, or to guarantee the fulfillment of an obligation legally acquired by the Holder.
Artículo 15. Implementation of procedures to guarantee the right to submit inquiries and complaints. At any time and for free, the Owner or his representative may request EQUITEL S.A. information about the use of your personal data, rectification, updating or deletion of these, previous accreditation of your identity. The rights mentioned herein may only be exercised by: (i) The Holder or his successors in title, after proof of identity. (ii) Your representative, after accreditation of the representation.
When the request is made by a person other than the Holder and it is not proven that it acts on behalf of the Holder, in order to protect the data of the persons, EQUITEL S.A. will take the claim for not presented. All requests must be submitted through the means provided by EQUITEL S.A., indicated in the Privacy Notice, and contain, at least, the following information:
– The name and address of the Holder, or any other means, such as an email, which allows the response to be communicated.
– The documents that prove the identity or personality of the representative.
– The clear and precise description of the personal data regarding which the Owner intends to exercise their rights.
– EQUITEL SA guarantees that the means made available to the holders of the information allow a response in the terms established by Law 1581 of 2012.
– Every time EQUITEL S.A. make available a new tool to facilitate the exercise of your rights by the holders of information or modify existing ones, it will inform you through its website and in its Privacy Notice.
Article 16. Revocation of the authorization. The holders of personal data may revoke the consent to the processing of their personal data at any time, as long as it is not prevented by a legal provision. The owner of the information must clearly request if the revocation of his authorization is about the totality of the purposes consented initially, that is, that EQUITEL S.A. must cease to deal completely with the data of the Holder, or if the revocation of their consent falls on certain types of treatment, such as for advertising or market research purposes. With the second modality, that is, the partial revocation of the consent, other purposes of the treatment are kept safe that the Responsible, in accordance with the authorization granted, can carry out and with which the Holder agrees. In view of the foregoing, it will be necessary that the Owner, at the time of raising the request for revocation of consent to EQUITEL S.A., indicate in this if the revocation that intends to perform is total or partial. In the second case, it must be indicated with which treatment the Holder is not satisfied.
- CHAPTER V. – SECURITY OF INFORMATION
Artículo 17. Security measures. In development of the principle of security established in Law 1581 of 2012, the EQUITEL S.A. ORGANIZATION will adopt the technical, human resource and administrative measures that are necessary to grant security to the data avoiding its adulteration, loss, consultation, use or unauthorized or fraudulent access.
Artículo 18. Implementation of security measures. EQUITEL S.A. it will maintain mandatory compliance protocols for its collaborators with access to personal data and information systems. The procedure must consider, at least, the following aspects:
– Detailed specification of the databases to which it applies.
– Measures, norms, procedures, rules and standards aimed at guaranteeing the level of security required by Law 1581 of 2012.
– Functions and obligations of the staff.
– Structure of the bases of personal data and description of the information systems that deal with them.
– Procedure for notification, management and response to incidents.
– Procedures that guarantee the conservation of the authorizations extended by the holders of the information.
– Periodic checks that must be carried out to verify compliance with the provisions of the security procedure implemente.
– Measures to be adopted when a support or document is to be transported, discarded or reused.
– The procedure must be kept up-to-date at all times and must be reviewed whenever there are relevant changes in the information system or its organization.
– The content of the procedure must be adapted at all times to the current provisions on the security of personal data.
- CHAPTER VI. – FINAL PROVISIONS
Artículo 19. EQUITEL S.A. designates as responsible for processing the requests, queries and claims of the owners of the information, the EQUITEL S.A. DATABASES. and of the Companies, to MILTON ANDRÉS BRUITRAGO RICO of the ORGANIZACIÓN EQUITEL S.A., e-mail mbuitrago@equitel.com.co to whom all the requests must be addressed and who in any case will be in charge of obtaining the information and the necessary management inside the EQUITEL S.A. ORGANIZATION to respond to the Holders who so request.
Artículo 20. Applicable legislation. This document was prepared in accordance with the mandates of the Political Constitution of Colombia (articles 15 and 20), Law 1581 of 2012 “by which general provisions for the protection of personal data are issued” and Decree 1377 of 2013 ” by which Law 1581 of 2012 is partially regulated. ” Article 21. Validity. This document applies as of July 1.