Personal Data Processing Policy

I´l Artigiano Orfebres, has decided to voluntarily adopt this Policy, which this Artigiano Orfebres, has decided to voluntarily adopt this Policy, which establishes the organization conditions, obligations of those involved and intervening in the treatment and use of personal information, operating regime, and procedures applicable to the processing of personal data that in the development of its functions have to request, use, store, correct, assign or delete. The foregoing has been resolved, in order to fully comply with the provisions of the Political Constitution of Colombia and Law 1581 of 2012, as well as the other rules that regulate and complement the treatment for the Protection of Personal Data in Colombia.

I´l Artigiano Orfebres, is the Responsible for the processing of Personal Data and in compliance with the provisions of article 13 of Regulatory Decree 1377 of 2013, adopts and makes public to all interested parties this Policy that contains all the essential, simple elements and insurance for compliance with the legislation corresponding to the Protection of Personal Data.

The entity responsible for the processing of personal data is I´l Artigiano Orfebres, a private entity, identified with the NIT. 805020926, with address at calle 4 Oeste # 3-28, Cali, Valle del Cauca, Colombia.

 

  1. DEFINITIONS
  • Privacy notice: Verbal or written communication generated by the person in charge, addressed to the owner for the processing of their personal data, through which they are informs about the existence of the information treatment policies that will be applicable, the way to access them and the purposes of the treatment that is intended to give personal data.
  • Authorization: Prior, express and informed consent of the owner of the personal data to carry out the processing of personal data.
  • Database: Organized set of personal data that are subject to Treatment.
  • Personal data: Any information linked to or that may be associated with one or more specific or determinable natural persons. Therefore, “personal data” should be understood as information related to a natural person (person individually considered).
  • Public data: It is the data that is not semi-private, private or sensitive. Public data, among others, are data related to people’s marital status, their profession or trade and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, gazettes and official gazettes, and duly enforced judicial decisions that are not subject to reserve. It will also be understood that all the data contained in the public records will have this same nature.
  • Public personal data: All personal information that is free and open to the public in general.
  • Private personal data: All personal information that has restricted knowledge, and in principle private to the general public.
  • Sensitive data: Data that affects the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations, of human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data.
  • Person in charge of the treatment: I´l Artigiano Orfebres, acts as person in charge of the treatment of personal data in the cases, that by itself or in association with others, carries out the treatment of personal data on behalf of a person in charge of the treatment.
  • Responsible for the treatment: I´l Artigiano Orfebres, acts as the person responsible for the processing of personal data against all personal data on which it decides directly, in compliance with its own legally recognized functions.
  • Owner: Natural person whose personal data are subject to Treatment:
    • By the Holder, who must sufficiently prove his identity by the different means made available to him by the person in charge.
    • By their successors, who must prove such quality.
    • By the representative and / or attorney-in-fact of the Holder, prior accreditation of the representation or power of attorney.
    • By stipulation in favor of another or for another.

 

  • Transfer: The transfer of data takes place when the person in charge and / or person in charge of the processing of personal data, located in Colombia, sends the information or personal data to a receiver, who in turn is responsible for the treatment and is inside or outside from the country.
  • Transmission: Processing of personal data that implies the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a treatment by the person in charge on behalf of the person in charge.
  • Treatment: Any operation or set of operations that I´l Artigiano Orfebres, performs on personal data such as collection, processing, advertising, storage, use, circulation or deletion. The foregoing will only apply exclusively to natural persons.
  • Data protection officer: It is the person within I´l Artigiano Orfebres, whose function is to monitor and control the application of the Personal Data Protection Policy.
  • The previous definition refers to a role or function to be performed by an official designated by I´l Artigiano Orfebres
  1. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

I´l Artigiano Orfebres is committed to maintaining the freedom, integrity, transparency, confidentiality, veracity and availability of the personal data of its shareholders, workers and candidates for vacancies, suppliers of goods and services and / or contractors, clients and any other natural person who maintains your data in our databases and files. I´l Artigiano Orfebres, guarantees the application of the general principles for the treatment of this type of data, contemplated in Law 1581 and regulatory decrees, which are:

2.1. Principle of access and restricted circulation

Treatment is subject to the limits derived from the nature of the personal data, the provisions of this Policy, the Law, and the Constitution. In this sense, the treatment can only be done by persons authorized by the Holder and / or by the persons provided by law.

Personal data, except those of a public nature, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge to the Holders or authorized third parties. For these purposes, the obligation of I´l Artigiano Orfebres will be of means and not of result.

2.2. Principle of confidentiality

All persons who intervene in the processing of personal data, who are not public, are obliged to guarantee the reservation of the information, even after the end of their relationship with any of the tasks that includes the treatment, being able to only supply or Communicate personal data when this corresponds to the development of the activities authorized in the Law and in the terms of the same.

Consequently, they undertake to keep and keep strictly confidential and not reveal to third parties, the personal, accounting, technical, commercial or any other information provided in the execution and exercise of functions other than those of the registry. All people who currently work or are linked in the future for this purpose, in the administration and management of databases, must subscribe an additional document or other to their employment or service provision contract in order to ensure such commitment. This obligation persists and is maintained even after the end of your relationship with any of the tasks that the Treatment comprises.

2.3. Purpose principle

The processing of personal data that I´l Artigiano Orfebres, carries out, obeys the legitimate purpose in accordance with the Political Constitution, Law 1581 of 2012 and Decree 1377 of 2013.

2.4. Principle of legality

The Processing of Personal Data is a regulated activity that is governed by Statutory Law 1581 of 2012, Decree 1377 of 2013 and other regulations that complement, modify or repeal them.

2.5. Principle of freedom

I´l Artigiano Orfebres, can treat and assign the personal data that are stored in its databases, without the prior consent of the owner, as long as they come from public records, or that, although they are not contained in They are of a public nature or are found in databases excluded by law (eg journalistic, statistical and for research). In all other cases, I´l Artigiano Orfebres must obtain the prior, express and informed consent of the Holder at the time of processing their personal data.

2.6. Safety principle

I´l Artigiano Orfebres, as responsible and / or in charge of the processing of personal data, provides the technical, human and administrative measures that are necessary to grant security to the records, avoiding their adulteration, loss, consultation, use or access not authorized or fraudulent.

2.7. Principle of transparency

I´l Artigiano Orfebres, guarantees to the natural persons holders of personal data, that they will be able to obtain at any time, free of charge and without restrictions, information about the existence of data that concern them and that are stored in the databases of I´ l Artigiano Orfebres, under the parameters established in article 21 of Regulatory Decree 1377 of 2013.

2.8. Principle of truthfulness or quality

I´l Artigiano Orfebres, guarantees that the information contained in databases other than those from public records, which are subject to treatment; They will be truthful, complete, accurate, up-to-date, verifiable and understandable. The veracity and quality of the personal data that have been captured by means of public records is guaranteed by each of the holders thereof, being exempted from any type of responsibility I´l Artigiano Orfebres, regarding its quality.

  1. PROCESSING OF PERSONAL DATA

3.1. Treatment of public data

I´l Artigiano Orfebres, warns that, without prior authorization from the Holder, personal data of a public nature and those contained in public records are processed. This situation does not imply that the necessary measures are not adopted to guarantee compliance with the other principles and obligations contemplated in Law 1581 of 2012 and other regulations that regulate this matter by I´l Artigiano Orfebres

3.2. Sensitive data processing

I´l Artigiano Orfebres, only processes sensitive personal data for what is strictly necessary, requesting prior and express consent from the owners (legal representatives, attorneys-in-fact, successors in title) and informing them about the exclusive purpose for their treatment.

I´l Artigiano Orfebres, uses and treats data classified as sensitive, when:

The treatment has been expressly authorized by the Owner of the sensitive data, except in cases where, by law, the granting of said authorization is not required.

The Treatment is necessary to safeguard the vital interest of the holder and he is physically or legally incapacitated. In these events, legal representatives must grant authorization.

The Treatment refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process;

The Treatment has a historical, statistical or scientific purpose or, within the framework of improvement processes; The latter, as long as the measures leading to the suppression of the identity of the Holders are adopted or the data is dissociated, that is, the sensitive data is separated from the identity of the holder and is not identifiable or the person cannot be identified Owner of the data or sensitive data.

In addition to the above, I´l Artigiano Orfebres, complies with the following obligations:

Inform the owner that because it is sensitive data, he is not obliged to authorize its treatment.

Inform the owner explicitly and in advance, in addition to the general authorization requirements for the collection of any type of personal data, which data subject to Treatment is of a sensitive nature and the purpose of the treatment, and obtain express consent.

Do not condition any activity on the owner providing sensitive personal data (unless there is a legal or contractual cause to do so).

3.3. Processing of data of minors

I´l Artigiano Orfebres, only treats personal data of minors when these are of a public nature or come from the information provided by employees or contractors, at the time of their employment relationship or provision of services. I´l Artigiano Orfebres The above, In accordance with the provisions of article 7 of Law 1581 of 2012 and, when the treatment complies with the following parameters and requirements:

  • That responds to and respects the best interests of children and adolescents.
  • That the respect of their fundamental rights is ensured.
  • Once the above requirements have been met, I´l Artigiano Orfebres, will require the legal representative or guardian of the child or adolescent, the authorization of the minor, prior to the minor giving his opinion regarding the treatment that will be given to his data, an opinion that It will be valued taking into account the maturity, autonomy and capacity to understand the matter, as indicated by the Law.
  • I´l Artigiano Orfebres, and any person involved in the processing of the personal data of children and adolescents, will ensure their proper use. In compliance with the foregoing, the principles and obligations established in Law 1581 of 2012 and Decree 1377 of 2013 are applied and developed.
  1. RIGHTS OF THE HOLDERS

I´l Artigiano Orfebres, recognizes and guarantees the holders of personal data the following rights:

Access, know, update and rectify your personal data in front of I´l Artigiano Orfebres, in its capacity as responsible for the processing of personal data.

Request proof of the existence of the authorization granted to I´l Artigiano Orfebres, except in cases in which the Law exempts the authorization.

Receive information from I´l Artigiano Orfebres, upon request, regarding the use that has been made of your personal data.

File complaints for violations of the provisions of current regulations before the Superintendency of Industry and Commerce (SIC).

Modify and revoke the authorization and / or request the deletion of personal data, when the treatment does not respect the principles, rights and constitutional and legal guarantees in force. This right to revoke the authorization is not absolute as long as there is a legal or contractual obligation that limits this

To have knowledge and free access to your personal data that have been processed.

Note: These rights are only recognized and guaranteed on the personal data of natural persons that are stored in databases other than public records.

  1. PRIVACY NOTICE.

I´l Artigiano Orfebres, in accordance with article 14 of Decree 1377 of 2013, informs all owners of the personal information contained in its databases the purposes applicable to the treatment of the information defined for each of the interest groups of the company, namely: Shareholders, workers and candidates for vacancies, suppliers or contractors, prospects of clients and clients. The holders of the information through their consent, freely, expressly, informed and unequivocally accept that their personal data be processed by I´l Artigiano Orfebres, to carry out the purposes indicated below, this, without prejudice that at any time they can effectively exercise their right to habeas data so that their rights of access, rectification, deletion and proof of authorization are guaranteed:

  • Purposes applicable to all holders of personal data

The purposes of the treatment of personal data described below will apply to all holders of personal data who have granted their prior, express and informed authorization to I´l Artigiano Orfebres: Inform about substantial changes in the POLICY adopted by the company ; establish and manage the pre-contractual and contractual commercial, labor, civil and any other that arises by virtue of the fulfillment of a legal or contractual obligation in charge of the company; respond to requests, queries, claims or complaints made by the holders of personal information through any of the channels enabled for this purpose, transfer or transmit your personal data to entities or judicial or administrative authorities, when these are required in relation to its object and necessary for the fulfillment of its functions and inform about substantial changes in this POLICY.

  • Purposes applicable to shareholders

Regarding the natural persons who are data owners who in turn are shareholders and administrators of I´l Artigiano Orfebres, inform that the processing of their personal data will be carried out as established by the Colombian Commercial Code and the other norms that regulate in the same matter. Therefore, the purposes to be applied to the shareholders’ personal data will be the following: Identify them as a shareholder of I´l Artigiano Orfebres; allow the exercise of the duties and rights derived from the quality of shareholder and administrators of I´l Artigiano Orfebres, and collect, register and update their personal data in order to inform, communicate, organize, control, attend, accredit the activities in in relation to his condition as a shareholder of I´l Artigiano Orfebres

  • Purposes applicable to workers and candidates for vacancies

Establish and manage the recruitment, selection and hiring process carried out by I´l Artigiano Orfebres; develop a correct management of the contractual relationship that unites the owner of the personal data with I´l Artigiano Orfebres; send communications within the entity related to your employment relationship or not; manage personal data so that I´l Artigiano Orfebres, as an employer, correctly comply with its obligations, among others, matters related to social benefits, contributions, withholdings, taxes, as well as in the case of contributions to other entities where the worker you have previously authorized the treatment; manage the personal data of the owner and those of his family nucleus to carry out affiliation procedures with health providers -EPS-, family compensation funds, labor risk administrators -ARL- and other necessary so that I´l Artigiano Orfebres, fulfill your duty as an employer; have the worker’s personal data for a correct assignment of their work tools (including IT tools such as email, computers, mobile phones, access to databases, etc.); have the personal data of the owners to incorporate them correctly in the files and work histories; monitor and use the images that are captured through video surveillance systems in order to control and oversee the development and performance of work activities in the space or workplace; respond to the worker to requests for the issuance of certificates, certificates and other documents requested from I´l Artigiano Orfebres as a cause of the contractual labor relationship; process personal data to carry out, directly or through a third party, when required, performance tests, skills and abilities, home visits, psychosocial evaluations, and all others generated by virtue of their employment relationship and manage personal data to make the correct payment of the payroll, including the realization of discounts for payments to third parties that the worker has previously authorized.

  •  

Regarding the candidates for vacant positions, I´l Artigiano Orfebres; informs that the personal data collected during the selection process will be stored in a physical and / or digital file or folder and will be identified with the name of each candidate; the folder or file may be accessed by the Human Resources management, or by whoever has been delegated or in charge of the selection process and pre-contractual management.

  • Purposes applicable to suppliers or contractors of goods and services

 

  • Purposes applicable to prospects of clients and clients of home public services

The data of our clients (natural persons and legal representatives of legal persons) which are captured through physical or electronic forms, will be used for the purposes determined below, which are considered necessary to be able to correctly manage the contractual relationship with I´l Artigiano Orfebres: Identify you as a customer of the products offered by DNSS SAS, compare the personal information provided with public databases, central and risk prevention systems, specialized companies, references and contacts in order to carry out confirmation activities to properly sell the products offered by I´l Artigiano Orfebres; provide technical and commercial assistance and respond to your queries regarding activities related to your status as a prospect or client of I´l Artigiano Orfebres; carry out billing, clarification tasks and manage the collection of its obligations against I´l Artigiano Orfebres; transmit or transfer your personal data to third parties outside the country (even where there are no data protection regulations) when necessary for the fulfillment of the obligations in charge of I´l Artigiano Orfebres; develop market expansion strategies, policy studies aimed at expanding demand, carrying out commercial and marketing campaigns and activities; process your data in order to carry out loyalty activities, determine satisfaction levels, send commercial communications; These activities may be carried out through any means of communication, electronic (email, social networks such as FACEBOOK, TWITTER, INSTAGRAM, LINKEDIN, etc., instant messaging services such as WHATSAPP, TELEGRAM, etc.) or physical, known or by meet.

 

  1. DUTIES OF I´l Artigiano Orfebres IN RELATION TO THE PROCESSING OF PERSONAL DATA

I´l Artigiano Orfebres, is aware that personal data are the property of the people to whom they refer and only they can decide on them. Likewise, I´l Artigiano Orfebres clarifies that it will make use of said data, only in compliance with the purposes for which it is duly empowered and previously authorized by the owner, or by Law in compliance with its regulated public functions; and at all times respects the current regulations on Protection of Personal Data.

I´l Artigiano Orfebres, as Responsible or Responsible for the processing of personal data, complies with the duties and obligations set forth in article 17 and 18 of Law 1581 of 2012, and rules that regulate or modify it, namely:

  1. a) Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data;
  2. b) Request and keep, under the conditions set forth in this law, a copy of the respective authorization granted by the Holder;
  3. c) Properly inform the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted;
  4. d) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
  5. e) Guarantee that the information provided to the Treatment Manager is true, complete, accurate, updated, verifiable and understandable;
  6. f) Update the information, communicating in a timely manner to the Person in Charge of Treatment, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it is kept updated;
  7. g) Rectify the information when it is incorrect and communicate the pertinent to the Person in Charge of Treatment;
  8. h) Provide the Treatment Manager, as the case may be, only data whose Treatment is previously authorized in accordance with the provisions of this law;
  9. i) Require the Treatment Manager, at all times, to respect the security and privacy conditions of the Owner’s information;
  10. j) To process the queries and claims formulated in the terms indicated in this law;
  11. k) Adopt an internal manual of policies and procedures to guarantee adequate compliance with this law and especially, for the attention of queries and claims;
  12. l) Inform the Treatment Manager when certain information is under discussion by the Holder, once the claim has been submitted and the respective procedure has not been completed;
  13. m) Inform at the request of the Owner about the use given to their data;
  14. n) Inform the data protection authority (Superintendency of Industry and Commerce – Delegation of Data Protection -) when there are violations of the security codes and there are risks in the administration of the information of the Holders.
  15. o) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

Duty of secrecy and confidentiality

I´l Artigiano Orfebres, guarantees and requires that any person who intervenes in any phase of the treatment of private, sensitive or minor personal data, the professional secrecy, regarding them and the duty to keep them, obligations that will still subsist after ending its contractual relationship with I´l Artigiano Orfebres

Failure to comply with the duty of secrecy will be sanctioned in accordance with the provisions of the Internal Work Manual and current legislation.

  1. INFORMATION PROCESSING POLICIES

7.1. General information on authorization

In the case of data other than those of a public nature, defined in numeral 2 of article 3 of Regulatory Decree 1377 of 2013, I´l Artigiano Orfebres, will request prior authorization for the processing of personal data by any means that allows it to be used as a test. Depending on the case, said authorization can be part of a larger document, such as a contract, or a specific document (format, form, other, etc.).

In the case of private personal data corresponding to natural persons, the description of the purpose of the data processing will be reported through the same specific or attached document. I´l Artigiano Orfebres, will inform the owner of the data the following:

The treatment to which your personal data will be subjected and the specific purpose thereof.

The time for which your personal data will be processed.

The rights that assist you as the owner.

The website, email, physical address and other communication channels through which you can make inquiries and / or complaints to the Responsible or Person in Charge of the treatment.

7.2. Right of access

I´l Artigiano Orfebres, guarantees the right of access according to Law 1581 of 2012, only to the Holders of private personal data that correspond to natural persons, after accreditation of the identity of the holder, legitimacy, or personality of their representative, putting At the disposal of the latter, at no cost or expense, in a detailed and detailed manner, the respective personal data processed, through any means of communication, including electronic ones that allow direct access to the owner. Said access is subject to the limits established in article 21 of Regulatory Decree 1377 of 2013.

7.3. Of the right of consultation

The holders of personal data may consult the personal information that resides in any database of I´l Artigiano Orfebres Consequently, I´l Artigiano Orfebres, guarantees the right of consultation in accordance with the provisions of Law 1581 of 2012 exclusively on the private, sensitive personal data and of minors corresponding to natural persons, supplying to the Holders of these personal data the information contained in each one of the corresponding databases and that are under the control of I´l Artigiano Orfebres

I´l Artigiano Orfebres, will establish the authentication measures that allow the safe identification of the owner of the personal data that makes the query or request. This obligation does not apply to the databases of public registers managed by I´l Artigiano Orfebres

With regard to the attention of requests to consult personal data other than those contained in the databases of public records, I´l Artigiano Orfebres, guarantees:

Enable electronic means of communication or others that it considers pertinent and safe;

Establish forms, systems and other methods that will be reported in the Privacy Notice;

Use the customer service or claims services that are in operation.

Regardless of the mechanism implemented for handling consultation requests, they will be processed within a maximum term of ten (10) business days from the date of receipt. In the event that a request for consultation cannot be answered within the aforementioned term, the interested party will be informed before the expiration of the term of the reasons for which no response has been given to their consultation, which in no case may exceed the five (5) business days following the expiration of the first term.

7.4. Of the right to claim

The Owner of private personal data that corresponds to a natural person and considers that the information contained or stored in a database that does not correspond to the public records of I´l Artigiano Orfebres, may be subject to correction, updating or deletion, or when they notice the alleged breach of any of the duties and principles contained in the regulations on Personal Data Protection. In this sense, they may file a claim with the person in charge of the treatment of I´l Artigiano Orfebres

I´l Artigiano Orfebres, has the necessary authentication measures that allow the safe identification of the owner of the personal data making the claim.

The claim may be submitted by the owner, taking into account the information indicated in article 15 of Law 1581 of 2012.

If the claim is incomplete, the owner may complete it within five (5) business days after receipt of the claim, to correct the faults or errors. After two (2) months from the date of the request, without the applicant submitting the requested information, it will be understood that he has withdrawn from the claim.

In case of receiving a claim that is not the competence of I´l Artigiano Orfebres, to resolve it, it will be transferred to the corresponding person within a maximum term of two (2) business days and the interested party will be informed of the situation.

Once I´l Artigiano Orfebres has received the complete claim, a legend that says “claim in process” and the reason for it will be included in the database, within a term not exceeding two (2) business days. Said legend will be kept until the claim is decided. The maximum term to resolve the claim is fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to attend the claim within said term, I´l Artigiano Orfebres will inform the interested party of the reasons for the delay and the date on which their claim will be attended, which in no case may exceed the following eight (8) business days at the expiration of the first term.

Note: In the case of data contained in the databases of public registries, the procedure for processing the right to claim will be governed by the terms and opportunities established in the General Process Code.

7.5. Of the right to rectification and updating of data

I´l Artigiano Orfebres undertakes to rectify and update at the request of the Holder, the personal information that corresponds to natural persons, which is incomplete or inaccurate, in accordance with the procedure and the terms indicated above. The foregoing, as long as it is not data contained in public records, which will be governed by special regulations. In this regard, I´l Artigiano Orfebres, will take into account the following:

In requests for rectification and updating of personal data, the Holder must indicate the corrections to be made and provide the documentation that supports his request.

I´l Artigiano Orfebres, has full freedom to enable mechanisms that facilitate the exercise of this right, as long as they benefit the Holder of the personal data. Consequently, electronic or other means that I´l Artigiano Orfebres deems pertinent and safe may be enabled.

I´l Artigiano Orfebres, may establish forms, formats, systems and other methods, which will be informed in the Privacy Notice and which will be made available to interested parties on the website or offices of I´l Artigiano Orfebres

Note: In the case of data contained in the databases of public registries, the data update procedure will be carried out on the opportunities, forms and with the procedures expressly authorized by the legal and regulatory provisions and in the sole circular of the Superintendency of Industry and Commerce.

7.6. Of the right to the deletion of data.

The Holder of personal data has the right at all times, to request I´l Artigiano Orfebres, the suppression (elimination) of his personal data, as long as it is not data contained in public records, which are They will be governed by special regulations. For the rest of the data, the following assumptions will be taken into account:

That they are not being treated in accordance with the principles, duties and obligations provided for in the current regulations on Protection of Personal Data.

That they are no longer necessary or relevant for the purpose for which they were collected.

That the period necessary to fulfill the purposes for which they were collected has been exceeded.

This deletion implies the elimination or safe deletion, total or partial, of the personal information in accordance with the request by the owner in the registers, files, databases or treatments carried out by I´l Artigiano Orfebres

The right of deletion is not an absolute right, and I´l Artigiano Orfebres, as the person responsible for the processing of personal data, may deny or limit the exercise of the same when:

The owner of the data has a legal or contractual duty to remain in the database.

The elimination of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner.

The data is data of a public nature and corresponds to public records, which are intended to be publicized.

Note: In the case of data contained in the databases of public records, I´l Artigiano Orfebres has the obligation to keep them as public under the conditions and terms established in the legal and regulatory norms.

7.7. Of the right to revoke the authorization

Any owner of personal data that corresponds to natural persons, can revoke at any time, the consent to the treatment of these, as long as it is not prevented by a legal or contractual provision. For this, I´l Artigiano Orfebres has established simple and free mechanisms that allow the holder to revoke their consent.

In cases where the revocation of the authorization is possible, it will be attended under the following two modalities:

Total: Regarding the totality of consented purposes, that is, that I´l Artigiano Orfebres must completely stop treating the data of the Personal Data Holder.

Partial: On certain consented purposes, such as for advertising or market research purposes. In this case, I´l Artigiano Orfebres must partially suspend the processing of the owner’s data. Then, other purposes of the treatment are maintained that the Responsible, in accordance with the authorization granted, can carry out and with which the owner agrees.

The right of revocation is not an absolute right and I´l Artigiano Orfebres, as the person responsible for the processing of personal data, may deny or limit its exercise when:

The owner of the data has a legal or contractual duty to remain in the database.

The revocation of the authorization of the treatment obstructs judicial or administrative actions linked to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner.

The data is data of a public nature and corresponds to public records, which are intended to be publicized.

7.8. Data protection in contracts.

In employment contracts, I´l Artigiano Orfebres has included clauses in order to authorize in a prior and general way the processing of personal data related to the execution of the contract, which includes the authorization to collect, modify or correct, at future times , personal data of the Holder corresponding to natural persons. It has also included the authorization for some of the personal data, if any, to be delivered or transferred to third parties with whom I´l Artigiano Orfebres, has contracts for the provision of services, for the performance of outsourced tasks. In these clauses, mention is made of this Policy and its location, for proper consultation.

In contracts for the provision of external services that involve data processing, I´l Artigiano Orfebres will carry out the transmission with the Data Processor and their contracts will include clauses that specify the purposes, means, applicable security measures and treatments authorized by I´l Artigiano Orfebres, and will precisely delimit the use that these third parties can give to them, as well as the obligations and duties established in Law 1581 of 2012 and Regulatory Decree 1377 of 2013, including the necessary security measures that guarantee at all times the confidentiality, integrity and availability of the personal information commissioned for its treatment.

For its part, I´l Artigiano Orfebres, when receiving data from third parties and acting as Person in Charge of the processing of personal data, verifies that the purpose, or purposes, of the treatments authorized by the owner or permitted for legal reasons, contractual or jurisprudential are in force and that the content of the purpose is related to the cause for which said personal information is to be received from the third party, as only in this way will it be empowered to receive and process said personal data.

7.9. Transfer of personal data to third countries

The transfer of personal data to third countries will only be carried out when there is a corresponding authorization from the owner and prior authorization from the SIC Personal Data Delegation if it is carried out to one of the countries that is not contemplated in external circular 05 of August 2017.

An international transfer is considered any treatment that involves a transmission of data outside of Colombian territory, whether a transfer of data is made, or if it was intended to provide a service to the person in charge outside of Colombia.

Likewise, prior authorization must be obtained from the Delegate for the Protection of Personal Data of the Superintendency of Industry and Commerce, when international data transfers are planned to countries that do not provide a certain level of protection. This authorization may only be granted if adequate guarantees are obtained, such as contracts based on the standard clauses approved by the SIC, or the Binding Corporate Rules.

The international transfer of data may be carried out at the request of I´l Artigiano Orfebres, establishing the purpose, the groups of interested parties or holders of the personal information, the data subject to transfer and the documentation that incorporates the guarantees required to obtain authorization; containing a description of the specific security measures that will be adopted, both by I´l Artigiano Orfebres, as well as by the person in charge of the data at their destination.

I´l Artigiano Orfebres, will not request authorization when the international transfer of data is covered by any of the exceptions provided for in the Law and its Regulatory Decree. An example of this is the consent of the affected party to the transfer, the transfer is necessary to establish the contractual relationship between the affected party and the person responsible for the Database and the transfer refers to a monetary transaction.

7.10. Applicable general rules.

I´l Artigiano Orfebres, has established the following general rules for the protection of personal, sensitive and minor data, such as the care of databases, electronic files and personal information:

I´l Artigiano Orfebres, guarantees the authenticity, confidentiality and integrity of the information under its responsibility.

I´l Artigiano Orfebres adopted all the necessary and possible technical measures to guarantee the protection and control of the existing database and under its control.

In cases where the infrastructure depends on a third party, it will be ensured that both the availability of the information and the care of personal, sensitive and minor data is a fundamental objective.

I´l Artigiano Orfebres, will carry out audits and controls periodically to guarantee the correct implementation of Law 1581 of 2012 and its regulatory decrees.

It is the responsibility of the officials of I´l Artigiano Orfebres, to immediately report to the Superintendency of Industry and Commerce – Delegation of Personal Data – any incident of information leakage, computer damage, violation of personal data, data commercialization, use of personal data of children or adolescents, identity theft, security incidents, violation of security codes or any type of conduct that may violate a person’s privacy or generate any type of discrimination.

The education and training of officials, suppliers, contractors, will be a fundamental duty and complement to this Policy.

DNSS S.A.S must identify and promote the authorizations of the holders, privacy notices, notices on the website, awareness campaigns, claim legends and other procedures to comply with Law 1581 of 2012 and Decree 1377 of 2013.

  1. PROCEDURE FOR THE INFORMATION HOLDERS TO EXERCISE THE RIGHTS TO KNOW, UPDATE, RECTIFY AND DELETE INFORMATION AND REVOKE THE AUTHORIZATION.

I´l Artigiano Orfebres, guarantees that the procedure of the exercise of the right of Habeas Data (access, rectify, cancel and request proof of authorization of the treatment) promoted by the holders of personal data will be carried out in the terms and conditions established in Law 1581 protection of personal data, its regulatory decrees and this POLICY FOR THE TREATMENT OF PERSONAL DATA. To exercise your right to habeas data you may direct your query or claim to any of the channels enabled by I´l Artigiano Orfebres, which are identified below: email administracion@soniaheilbron.com or to the company’s address located at the Calle 4 Oeste # 3-28 of the city of Santiago de Cali, Valle del Cauca, Colombia.

The rights of access, update, rectification, deletion and revocation of the authorization of personal data are very personal and may only be exercised by the Holder. However, the Holder may act through a legal representative or attorney-in-fact when he is in a situation of incapacity or minority of age facts that make it impossible for him to exercise them personally, in which case it will be necessary for the legal representative or attorney-in-fact to prove such condition.

No value or fee will be required for the exercise of the rights of access, updating, rectification, deletion or revocation of the authorization in the case of personal data of natural persons that are not part of the public records. (The provisions of article 21 of Regulatory Decree 1377 of 2013 will be taken into account)

In order to facilitate the exercise of these rights, I´l Artigiano Orfebres, makes available to the interested parties, the physical or electronic formats suitable for this purpose.

Once the terms indicated by Law 1581 of 2012 and the other norms that regulate or complement it have been fulfilled and exhausted, the Holder who is denied, totally or partially, the exercise of the rights of access, update, rectification, deletion and revocation , by I´l Artigiano Orfebres, may inform the National Authority for the Protection of Personal Data (Superintendence of Industry and Commerce – Delegation of Personal Data Protection -) the denial or disagreement with the right exercised.

  1. THE NATIONAL REGISTRY OF DATABASES

In accordance with Decree 090 of 2018, I´l Artigiano Orfebres is not obliged to register its databases and this Policy in the National Registry of databases administered by the Superintendency of Industry and Commerce.

  1. SECURITY MEASURES APPLIED TO DATABASES AND ARCHIVES.

I´l Artigiano Orfebres, in order to comply with the security principle enshrined in article 4 literal g) of Law 1581, has internal information security mechanisms to prevent its adulteration, loss, consultation, use or access unauthorized or fraudulent, which are mandatory for the recipients of these policies.

I´l Artigiano Orfebres and its related and / or related companies, by signing the corresponding transmission contracts, has required those in charge of the treatment with whom it works to implement the necessary security measures to guarantee the security and confidentiality of information in the processing of personal data.

It is the obligation of the recipients of these policies to inform I´l Artigiano Orfebres any suspicion that may involve a violation of the security measures adopted by the organization to protect the Personal Data entrusted to it, as well as any inappropriate Treatment thereof, a may be aware of this situation.

In these cases, I´l Artigiano Orfebres will notify the Colombian data protection authority of the situation and will proceed to manage the respective security incident regarding Personal Data, in order to establish the legal repercussions of the same, be these at the level criminal, labor, disciplinary or civil.

  1. VALIDITY

Personal data will be processed for as long as is reasonable and necessary for the purpose for which the data is collected. Once the purpose or purposes of the treatment have been fulfilled, and without prejudice to legal regulations that provide otherwise, I´l Artigiano Orfebres will proceed to suspend the personal data in its possession unless there is a legal or contractual obligation that requires its conservation.

This Policy is effective as of December 2019.

Policy updates: I´l Artigiano Orfebres, may modify the terms and conditions of this policy as part of our effort to comply with the obligations established by Law 1581 of 2012, the regulatory decrees and other norms that complement, modify or repeal this policy, in order to reflect any changes in our operations or functions. In cases where this occurs, the new policy will be published on the organization’s website.

  1. CONTACT INFORMATION

If you have any questions about this policy, contact I´l Artigiano Orfebres, or send your inquiry directly through any of the following communication channels:

Email: you can contact via email to administracion@soniaheilbron.com

Main Address Office: You can go to the offices of the main address located at Calle 4 Oeste # 3-28, Santiago de Cali – Valle del Cauca.

  1. REFERENCE TO OTHER DOCUMENTS

This Personal Data Protection Manual has been prepared in accordance with the following standards and documents:

Political Constitution of Colombia

Law 1581 of 2012.

Decree 1377 of 2013.

Law 1273 of 2009.

I´l Artigiano Orfebres Privacy Notices

Data protection clauses of I´l Artigiano Orfebres

the organizational conditions, obligations of those involved and intervening in the treatment and use of personal information, operating regime, and procedures applicable to the processing of personal data that in the development of their functions have to request, use, store, correct, assign or delete. The foregoing has been resolved, in order to fully comply with the provisions of the Political Constitution of Colombia and Law 1581 of 2012, as well as the other rules that regulate and complement the treatment for the Protection of Personal Data in Colombia.

I´l Artigiano Orfebres, is the Responsible for the processing of Personal Data and in compliance with the provisions of article 13 of Regulatory Decree 1377 of 2013, adopts and makes public to all interested parties this Policy that contains all the essential, simple elements and insurance for compliance with the legislation corresponding to the Protection of Personal Data.

The entity responsible for the processing of personal data is I´l Artigiano Orfebres, a private entity, identified with the NIT. 805020926, with address at calle 4 Oeste 3-28, Cali, Valle del Cauca, Colombia.