Personal Data Processing Policy.

Todosistemas STI guidelines for protecting the personal data of data subjects, pursuant to Ley 1581 de 2012 (Law 1581 of 2012).

01Purpose and scope of the policy

TODOSISTEMAS STI (hereinafter the “Company”), in order to strictly comply with current regulations on the protection of Personal Data, as set forth in Ley 1266 de 2008 (Law 1266 of 2008), Ley 1581 de 2012 (Law 1581 of 2012), Decreto 1074 de 2015 (Decree 1074 of 2015) and other provisions that amend, add to or supplement them, hereby presents the Processing Policy on Personal Data Protection (hereinafter the “Policy”) of TODOSISTEMAS STI, which sets forth general provisions for the protection of information related to, or that may be associated with, one or more identified or identifiable natural persons (the “Personal Data”), by virtue of the prior authorization granted by the Data Subjects.

This Policy shall apply to all Processing carried out in the territory of the Republic of Colombia by TODOSISTEMAS STI and, where applicable, by those third parties with whom the performance of all or part of any activity relating to, or connected with, the Processing of Personal Data is agreed.

In this Personal Data Processing Policy, TODOSISTEMAS STI sets out the general corporate guidelines taken into account to protect the Personal Data of Data Subjects, the purposes of the Processing of information, the rights of Data Subjects, the area responsible for handling complaints and claims, and the procedures that must be followed to access, update, rectify and delete information.

TODOSISTEMAS STI, in compliance with the constitutional right of Habeas Data enshrined in Article 15 of the Constitución Política (Political Constitution), only collects and Processes Personal Data when previously authorized by the Data Subject, implementing for such purpose clear measures on the confidentiality and privacy of Personal Data. In cases where an Authorization for the Processing of Personal Data is not required, the Company shall also implement the necessary measures to Process the information in accordance with current provisions.

02Definitions

For the purposes of this Policy, the definitions set forth in Ley 1581 de 2012 and Decreto 1074 de 2015 shall be taken into account, as transcribed below:

  • a) Personal Data: Any information linked to or that may be associated with one or more identified or identifiable natural persons.
  • b) Data Subject: The natural person whose Personal Data is subject to Processing.
  • c) Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use may give rise to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions or social or human rights organizations, or that promotes the interests of any political party or guarantees the rights and guarantees of opposition political parties, as well as data relating to health and sex life, and biometric data.
  • d) Data Processor: The natural or legal person, public or private, that, by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller.
  • e) Personal Data Processing Policy: Refers to this document.
  • f) Registro Nacional de Bases de Datos (National Database Registry): The public directory of databases subject to Processing operated by the Superintendencia de Industria y Comercio (Superintendence of Industry and Commerce, SIC).
  • g) Data Controller: The natural or legal person, public or private, that, by itself or in association with others, decides on the Database and/or the Processing of Personal Data. In this case, it is TODOSISTEMAS STI.
  • h) Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion, as well as its Transfer and/or Transmission to third parties through communications, queries, interconnections, assignments and data messages.
  • i) Transfer: A Transfer of Personal Data takes place when the Data Controller and/or Data Processor, located in Colombia, sends the Personal Data to a recipient that is in turn a Data Controller and is located inside or outside the country.
  • j) Transmission: Processing of Personal Data that involves communicating such data to a third party inside or outside the territory of the Republic of Colombia, when the purpose of such communication is for the Processor to carry out Processing in the name and on behalf of the Controller, in order to fulfill the latter’s purposes.

03Principles

In accordance with Article 4 of Ley 1581 de 2012, the principles governing the Processing of Personal Data by TODOSISTEMAS STI are:

  • a) Principle of legality in the Processing of Personal Data: The Processing of Personal Data is a regulated activity that must be subject to the provisions of Ley 1581 de 2012, Decreto 1074 de 2015 and any other provisions that develop, add to or amend them.
  • b) Principle of purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the Law, which must be disclosed to the Data Subject.
  • c) Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal Data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that dispenses with consent.
  • d) Principle of truthfulness or quality: Information subject to Processing must be truthful, complete, accurate, up to date, verifiable and understandable. The Processing of partial, incomplete, fragmented or misleading data is prohibited.
  • e) Principle of transparency: Processing must guarantee the right of the Data Subject to obtain from the Controller or the Processor, at any time and without restrictions, information about the existence of data concerning them.
  • f) Principle of restricted access and circulation: Processing is subject to the limits arising from the nature of the Personal Data. Accordingly, Processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for in Ley 1581 de 2012.
  • g) Principle of security: Information subject to Processing by the Data Controller or Data Processor must be handled with the technical, human and administrative measures necessary to provide security to the records, preventing their alteration, loss, consultation, use or unauthorized or fraudulent access.
  • h) Principle of confidentiality: All persons involved in the Processing of Personal Data that is not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks involved in Processing has ended, and may only supply or communicate Personal Data when this corresponds to the performance of the activities authorized by Ley 1581 de 2012 and under its terms.

04Purposes of the processing of information

The Personal Data collected by TODOSISTEMAS STI is included in a Database to which authorized personnel of TODOSISTEMAS STI have access in the exercise of their duties, it being understood that under no circumstances is the Processing of information authorized for purposes other than those described herein and communicated directly to the Data Subject no later than at the time of collection.

The purposes of the collection and Processing of the Personal Data of the clients and potential clients of TODOSISTEMAS STI shall be the following:

  • Management of the contracting process for the products or services that TODOSISTEMAS STI requires from suppliers to carry out its activities, in accordance with current regulations.
  • Supervising and monitoring the correct and proper performance of our contractual relationship.
  • Managing the administrative, accounting, financial, operational and logistical aspects associated with the fulfillment of both parties’ obligations.
  • Administrative and tax procedures and formalities.
  • Invoicing tasks and the operations aimed at making them effective.
  • Economic and accounting management.
  • Record of commercial relationships.
  • Verification of legal, technical and financial requirements.
  • Tax and collection matters.
  • Opinion surveys.
  • Verifying commercial and reputational background, as well as any relationship risks associated with Money Laundering and Terrorist Financing.
  • Any other purposes intended to develop the commercial relationship between TODOSISTEMAS STI and the Supplier that are inherent to the nature of this type of relationship, without prejudice to the right, under Ley 1581 de 2012, to request, modify, delete and/or correct the information reported as the data subject of the personal data provided.

The purposes of the collection and Processing of the Personal Data of visitors, authorized personnel and authorized contractors shall be the following:

  • Having the necessary information in the event of an emergency inside the Company’s facilities.
  • Protecting the security of the facilities of TODOSISTEMAS STI.
  • Identifying and keeping records of the entry and exit of equipment, vehicles, visitors, authorized personnel, authorized contractors or natural persons, and carrying out other physical security activities.

The purposes of the collection and Processing of the Personal Data of the Company’s employees, as well as its contractors, shall be the following:

  • Hiring, performance of duties or provision of services, resignation or termination, depending on the type of contractual relationship established with TODOSISTEMAS STI (including, among others, employees, former employees, clients, interns and job applicants).
  • Conducting audits and managing our systems and databases.
  • Contacting Data Subjects to send information related to the contractual relationship and obligations with employees.
  • Accessing, storing and processing all information provided by Data Subjects in one or more databases, in the format deemed most appropriate.
  • Fulfilling the obligations undertaken in its capacity as Data Controller toward the Data Subject of the information, in relation to the payment of salaries, social benefits and other compensation set forth in the employment contract or as provided by law and the contract.
  • Developing the Sistema de Gestión de Seguridad y Salud en el Trabajo (Occupational Health and Safety Management System) based on medical and occupational health information from the time of hiring, as well as during the performance and completion of assigned activities.
  • Developing education, training and coaching programs according to the employee’s position.
  • Performing the contracts entered into with the data subjects of the personal data.
  • Managing, maintaining, developing and controlling the existing contractual relationship between the parties, responding to their requests for information, as well as managing their claims and processing their requests for termination of the contract and for revocation of the authorization for the processing of personal data.
  • Managing inquiries made by the data subjects of the information.
  • Managing information associated with the possible occurrence of events or circumstances that involve ethical or disciplinary control procedures in accordance with the applicable internal regulations and other applicable legal provisions.
  • Generating backup copies and files of the information on the equipment provided by TODOSISTEMAS STI.
  • Ordering, cataloging, classifying, dividing or separating the information provided by data subjects.
  • Offering corporate well-being programs and planning company activities for the data subject and their beneficiaries.
  • Meeting legal requirements and information requests from the administrative, social security and judicial authorities that regulate, supervise or oversee the activities and operations of TODOSISTEMAS STI, subject to due process.
  • Complying with the Reglamento Interno de Trabajo (Internal Work Regulations), as well as the internal policies of TODOSISTEMAS STI.
  • Verifying the information contained in the CV provided to TODOSISTEMAS STI.
  • Preventing fraud or misuse of our services.
  • Enabling the creation of cases or users in the information systems of TODOSISTEMAS STI associated with the hiring of employees, as well as for the performance of strategic, administrative, commercial and accounting functions.
  • Recording information on the family members of the Company’s employees in order to comply with the duties established by Law, as well as to include them in the well-being activities or benefits provided by the Company.
  • Controlling access to the Company’s facilities.
  • Collecting data to fulfill the duties incumbent upon the Company as Controller of the information and personal data.
  • Meeting legal obligations, such as those related to the prevention of money laundering and terrorist financing.
  • Verifying, corroborating, checking, validating, investigating or comparing the information provided by data subjects with any information legitimately available to it.
  • The information provided by the Data Subject shall only be used for the purposes set forth herein. Once the need for the Processing of Personal Data ceases, such data shall be deleted from the databases of TODOSISTEMAS STI.

The information provided by the Data Subject shall only be used for the purposes set forth herein. Once the need for the Processing of Personal Data ceases, such data shall be deleted from the databases of TODOSISTEMAS STI.

05Rights of data subjects

  • To access, update and rectify their personal data held by TODOSISTEMAS STI as Data Controller and Data Processor. This right may be exercised, among other cases, with respect to partial, inaccurate, incomplete, fragmented or misleading data, or data whose Processing is expressly prohibited or has not been authorized.
  • To request proof of the authorization granted to TODOSISTEMAS STI as Data Controller and Data Processor, except where it is expressly exempted as a requirement for Processing, in accordance with Article 10 of Ley 1581 de 2012.
  • To be informed by TODOSISTEMAS STI as Data Controller and Data Processor of personal data, upon request, of the use that TODOSISTEMAS STI has made of the Data Subject’s personal data.
  • To file complaints with the Superintendencia de Industria y Comercio for violations of the provisions of Ley 1581 de 2012 and other regulations that amend, add to or supplement it.
  • To revoke the authorization and request the deletion of personal data when the Processing does not respect constitutional and legal principles, rights and guarantees. Revocation and deletion shall proceed when the Superintendencia de Industria y Comercio has determined that, in the Processing, the Controller or Processor has engaged in conduct contrary to Ley 1581 de 2012 and the Constitution.
  • To access, free of charge, their personal data that has been subject to Processing.
  • The data subject may always request that the sender of commercial or advertising messages stop sending them that type of information.
  • Data subjects may at any time request the deletion of their personal data and/or revoke the authorization granted for its Processing, through the following channels:

In accordance with Article 2.2.2.25.4.1 of Decreto 1074 de 2015, the aforementioned Rights may be exercised by:

  • The Data Subject, who must sufficiently prove their identity through the various means made available by the controller.
  • Their successors in title, who must prove such status.
  • The representative and/or attorney-in-fact of the Data Subject, upon proof of such representation or power of attorney.

06Duties of the controller of personal data processing

In accordance with Art. 17 of Ley 1581 de 2012, the Data Controller shall have the following duties:

  • a) To guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data;
  • b) To request and keep a copy of the respective authorization granted by the Data Subject;
  • c) To duly inform the Data Subject of the purpose of the collection and of the rights they have by virtue of the authorization granted;
  • d) To keep the information under the security conditions necessary to prevent its alteration, loss, consultation, use or unauthorized or fraudulent access;
  • e) To guarantee that the information provided to the Data Processor is truthful, complete, accurate, up to date, verifiable and understandable;
  • f) To update the information, promptly informing the Data Processor of all changes regarding the data previously provided, and to adopt any other measures necessary to keep the information provided to the Processor up to date;
  • g) To rectify the information when it is incorrect and communicate the relevant information to the Data Processor;
  • h) To provide the Data Processor, as applicable, only with data whose Processing has been previously authorized;
  • i) To require the Data Processor at all times to respect the security and privacy conditions of the Data Subject’s information;
  • j) To handle the inquiries and claims made under the terms set forth in this Policy;
  • k) To adopt an internal manual of policies and procedures to ensure proper compliance with Personal Data protection regulations and, in particular, for handling inquiries and claims.
  • l) To inform the Data Processor when certain information is under dispute by the Data Subject, once the claim has been filed and the respective procedure has not been completed;
  • m) To inform the Data Subject, upon request, of the use made of their data;
  • n) To inform the data protection authority of any breaches of security codes and of any risks in the management of Data Subjects’ information;
  • o) To comply with the instructions and requirements issued by the Superintendencia de Industria y Comercio.

07Authorization, processing and storage of personal data

As of the entry into force of this Policy, TODOSISTEMAS STI, at the time of collecting Personal Data, shall request prior authorization from the Data Subjects, informing them of the specific purposes of the Processing for which such consent is obtained, unless one of the exceptions set forth for this purpose in Article 10 of Ley 1581 de 2012 applies.

TODOSISTEMAS STI shall carry out the Processing of the Personal Data that the Data Subject voluntarily provides. In general, the Company shall collect, store, use, circulate, transmit and transfer the Personal Data it Processes. This information may be used only by TODOSISTEMAS STI, its employees, consultants, advisors, affiliates of the business group, and commercial and strategic partners expressly authorized by the Company who require access to this information. In any case, TODOSISTEMAS STI, upon request of the Data Subject, shall provide them with complete information on the authorized persons and/or third parties that carry out Processing of their Personal Data.

TODOSISTEMAS STI shall keep proof of such authorizations in an appropriate manner, respecting the principles of confidentiality and privacy of information.

08Data protection

In accordance with the provisions of Ley 1581 de 2012 (Personal Data Protection Law), partially regulated by Decreto 1377 de 2013 (Decree 1377 of 2013), which seek to develop the constitutional right of all persons to access, update and rectify the information collected about them, you are hereby informed that, prior to the issuance of Decreto 1377 de 2013, and for the purpose of maintaining constant communication, personal data has been collected from stakeholder groups identified as strategic allies, shareholders, employees, clients, clients’ users, suppliers and related parties, which is held in the databases and physical files of TODOSISTEMAS STI.

The data we currently hold is stored in our own magnetic and physical files, safeguarded through the use of information security tools, such as access control and backup procedures and protocols, among others, in order to prevent and control unauthorized access to the stored personal data.

Through this notice, you are informed that your data is used for the purposes inherent to our corporate purpose and that we are responsible for its handling and processing; therefore, in all cases, we always request authorization to retain and continue processing it in order to continue our relationships and keep you informed of our changes and services.

In view of the foregoing, and in keeping with our interest in protecting your privacy, we inform you that data subjects once again have the opportunity to authorize or withhold authorization for us to continue processing their personal data, and that they may at all times exercise their rights to access, update, rectify or request the deletion of their personal data by sending their communication to mercadeo@todosistemassti.co, indicating whether or not they authorize the processing of their data.

09Restrictions on use of the service

The use of the services of TODOSISTEMAS STI to infringe the rights of third parties is prohibited, in accordance with Ley 1273 de 2009 (Law 1273 of 2009), Ley 1581 de 2012, Decreto 1377 de 2013 and Decreto 886 de 2014 (Decree 886 of 2014), and other regulations that amend or supplement them. The use of the services for unlawful purposes is prohibited.

10Data of minors

TODOSISTEMAS STI has no commercial and/or contractual relationships with minors; therefore, no processing of minors’ data is carried out.

11Information for users

Users and/or clients acknowledge that the performance of the service of TODOSISTEMAS STI entails risks inherent to technology, which are assumed upon acceptance of these terms and conditions. Notwithstanding the foregoing, TODOSISTEMAS STI makes its best efforts to minimize the presence of such risks, without guaranteeing their elimination in the performance of the service.

12Indemnity of Todosistemas STI

Users and/or clients agree to hold TODOSISTEMAS STI harmless from any possible claim, lawsuit, fine, penalty, sanction, indemnification and/or compensation. Improper processing of information shall be the sole responsibility of the users/clients. The indemnity owed by users/clients includes any court costs and/or legal fees incurred. In any event in which an act or omission by TODOSISTEMAS STI contrary to these terms and conditions is proven and results in indemnification to users/clients, such indemnification shall only be made up to a maximum of the amount paid by the user/client for contracting the services of TODOSISTEMAS STI.

13Regulatory provisions

In accordance with the Colombian legal framework for personal data protection, specifically Ley Estatutaria 1581 de 2012 (Statutory Law 1581 of 2012) and Decretos Reglamentarios 1377 de 2013 and 886 de 2014 (Regulatory Decrees 1377 of 2013 and 886 of 2014), TODOSISTEMAS STI communicates its personal data processing policies, in accordance with the provisions enacted on the matter: Article 15 of the Constitución Política de Colombia (Political Constitution of Colombia) protects the rights to privacy, good name and habeas data. From this constitutional provision derive the other regulations governing data protection in Colombia. Ley Estatutaria 1581 of October 17, 2012 establishes the minimum conditions for the legitimate processing of data subjects’ personal data. It also sets forth the principles under which information must be managed, imposing clear obligations on organizations. Ley 1581 was regulated by Decretos 1377 de 2013 and 886 de 2014, which defined specific aspects regarding the collection of personal data, the content of the privacy policy and the Registro Nacional de Bases de Datos (National Database Registry), among other matters addressed. Accordingly, TODOSISTEMAS STI shares its processing policies with all personal data subjects, in compliance with Article 13 of Decreto 1377 de 2013.

14Scope of application of the policy

This information processing policy is the result of the strategies and commitment within the framework of the administrative, operational, commercial, accounting, financial and customer service management of TODOSISTEMAS STI.

15Procedures to be followed by data subjects to exercise their rights over personal data

The Data Subject of the Personal Data may exercise their rights over the Personal Data provided through the customer service area, designated within the Company to handle petitions, inquiries and claims regarding Personal Data. The Data Subject may exercise the rights listed above as set out below:

16Structure for handling data subject requests

Data Subjects or their successors in title who consider that the information contained in a database of this organization should be subject to consultation, correction, updating or deletion, or who notice an alleged breach of any of the duties contained in Ley 1581 de 2012, may file a claim with TODOSISTEMAS STI through any of the communication channels described above, which must contain the following information:

  • Name and identification of the Data Subject.
  • A precise and complete description of the facts giving rise to the claim.
  • The physical or electronic address to which the response is to be sent and updates on the status of the procedure provided.
  • The documents and other evidence to be relied upon.

17Procedure for submitting inquiries

The Data Subject of the Personal Data, their successors in title, representatives and/or attorneys-in-fact may submit inquiries about the Personal Data held in the Databases of TODOSISTEMAS STI, in accordance with the following rules:

  • a) The request shall be reviewed to verify the identity of the Data Subject. If the request is made by a person other than the Data Subject and it is not proven that such person is acting on the Data Subject’s behalf in accordance with current laws, the request shall be rejected.
  • b) All inquiries shall be answered within a maximum term of ten (10) business days from the date of receipt of each one. When it is not possible to answer the inquiry within that term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first term.

18Procedure for filing claims for the updating, correction, deletion and revocation of authorization

The Data Subject, or their successors in title, who consider that the information contained in the Databases of TODOSISTEMAS STI should be corrected, updated or deleted, or who notice an alleged breach of any of the duties, may file a claim in accordance with the following rules:

  • a) The request shall be reviewed to verify the identity of the Data Subject. If the request is made by a person other than the Data Subject and it is not proven that such person is acting on the Data Subject’s behalf in accordance with current laws, the request shall be rejected.
  • b) The claim must contain the following information: (i) The identification of the Data Subject; (ii) Contact details (physical and/or electronic address and contact telephone numbers); (iii) The documents proving the identity of the Data Subject, or the representation; (iv) A clear and precise description of the Personal Data with respect to which the Data Subject seeks to exercise any of the rights; (v) A description of the facts giving rise to the claim; (vi) The documents to be relied upon; (vii) Signature and identification number.
  • c) If the claim is incomplete, TODOSISTEMAS STI shall require the interested party, within five (5) days following receipt of the claim, to remedy the deficiencies. If two (2) months elapse from the date of the request without the applicant submitting the required information, the claim shall be deemed withdrawn.
  • d) If the area receiving the claim is not competent to resolve it, it shall forward it to the appropriate party within a maximum term of two (2) business days and inform the interested party of the situation.
  • e) Once the complete claim has been received, a legend reading “claim in process” and the reason for it shall be included in the database within a term not exceeding two (2) business days. Such legend must remain until the claim is decided.
  • f) The maximum term to address the claim shall be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within that term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
  • g) The Data Subject has the right, at all times, to request the deletion of their Personal Data. Deletion entails the total or partial elimination of the Personal Data from the Databases, as requested by the Data Subject. The right to deletion is not absolute, and TODOSISTEMAS STI may refuse its exercise in the following events: (i) The Data Subject has a legal or contractual duty to remain in the Database, or the Controller has a legal or contractual obligation that requires it to retain the Personal Data; (ii) The deletion of the Personal Data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions; (iii) The Personal Data is necessary to protect the legally protected interests of the Data Subject, to carry out an action in the public interest, or to fulfill an obligation legally acquired by the Data Subject or the Controller.

If TODOSISTEMAS STI is not competent to resolve the request submitted, it shall forward it to the appropriate party within a maximum term of two (2) business days and inform the interested party of the situation.

If the inquiry, claim, request, correction, update or revocation of personal data is incomplete, TODOSISTEMAS STI shall require the interested party, within five (5) days following its receipt, to remedy the deficiencies. If two (2) months elapse from the date of the request without the petitioner submitting the requested information, it shall be deemed to have been withdrawn.

19Disclosure of the policy

TODOSISTEMAS STI makes this information processing policy available to all its data subjects by displaying it in the terms and conditions of use of the services and products and of access to the information.

20Relationships with third parties

Third parties that provide services to TODOSISTEMAS STI and that have a direct or indirect relationship with the processing of personal data must comply with this personal information processing policy, and must declare under oath that they will comply with the guidelines established in Ley 1581 de 2012 and other regulatory provisions, guaranteeing respect for the human dignity of data subjects. Notwithstanding the foregoing, the contractual relationships with each third party shall establish the obligations governing the provision of the service.

21Effective date and retention period of the databases

Let it be published and complied with

This policy is effective as of February 23, 2023

The Personal Data included in the Databases subject to Processing shall remain and be processed based on the criterion of temporality for the contractual term of the product or service, for the period during which the purpose for which they were collected persists, plus the term established by law.

This Policy may be modified by TODOSISTEMAS STI whenever required without prior notice, provided that the modifications are not substantial. Only modifications regarding the purposes of the Processing and the details of the Data Controller, or any other substantial modification, shall be communicated in advance to the Data Subjects.

Ready to digitize your operation?

Tell us what you need and we’ll show you how we solve it. No beating around the bush.

Book a demo Chat with us on WhatsApp