DATA PROCESSING POLICY

 

The present Personal Data Processing Policy (hereinafter the ” Policy” ) aims to implement the provisions contained in Law 1581 of 2012 and Decree 1074 of 2015, and other related regulations, as it refers exclusively to databases, files and information containing personal data susceptible to processing, and explains how ESCALAR VEINTE 18 SAS (hereinafter the ” VEINTE 18 SAS” ) collects, stores, uses, circulates and processes information that you provide to us through different means, as well as the purposes for which said personal information is used.

 

CONTACT DETAILS OF THE PERSON IN CHARGE – AREA RESPONSIBLE FOR HANDLING QUERIES, REQUESTS AND COMPLAINTS.

 

ESCALAR VEINTE 18 SAS , with Tax Identification Number 901163196-2 , located at Cra 9 # 80 – 45, Office 602, Bogotá DC (hereinafter, the “Data Controller”). For the purposes of this Policy, the area responsible for handling requests, queries, complaints and claims is the General Management, which may be contacted through the following service channels:

 

Address : Cra 9 # 80 – 45 office 602 Bogotá DC 

Telephone : 7423840

Email: habeasdata.v18@escalar.com.co

 

DATA PROCESSING AND PURPOSE

 

The Data Controller, with prior authorization from the data subjects (if required), may obtain information from natural persons (employees, clients, suppliers, etc.), who may choose to provide us with personal information in connection with a contractual, commercial, or service relationship with the Data Controller. The types of personal data we collect include public, semi-private, private, and financial data. Sensitive data or data from minors that are not public will not be collected unless required by current regulations to comply with our legal obligations and/or authorization from their parents or legal guardians exists, if required based on the nature of the personal data.


The personal data provided to the Data Controller will be collected, stored, used, analyzed, circulated, updated, and reported for the following purposes, as established in the respective authorization: 

 

  • Employees and partners


Data collected : VEINTE 18 SAS collects Personal Data from its employees, people interested in being employees, partners and people interested in being partners, it will be their summary when applying for a position within the company, as well as those generated by virtue of or on the occasion of the employment-commercial relationship or from the people whom VEINTE 18 SAS contacts to initiate a selection process, in accordance with the offer published on job boards.

 

In this sense, VEINTE 18 SAS may collect general and specific identification information from the employee and his/her family group (this may include Personal Data of Minors, with the understanding that they only collect their Public Data and/or information authorized by their parents or legal representatives for the benefit of the Minor), location information related to private activity, Financial Data, socioeconomic data, tax information, information on educational level and work history, general data related to affiliation and contributions to the comprehensive social security system, and personal data for access to VEINTE 18 SAS information systems.

 

Additionally, VEINTE 18 SAS may collect Sensitive Data, that is, biometric data (fingerprints, photos and images captured by security cameras) and those related to the health of the person in terms of the health status of the person, that is, orders and relationship of complementary laboratory tests, imaging, endoscopic, pathological, studies, as well as information that includes test results, laboratories, studies, medical diagnoses, general or specialized, psychological, psychiatric, medications and / or medical or therapeutic treatments of any kind, as well as information on vulnerable populations and those with disabilities.

 

The collection of Personal Data other than those indicated here is viable provided that the corresponding authorization has been granted by the employee or that the information is necessary to comply with legal obligations on the part of VEINTE 18 SAS.

 

Purposes of Processing : VEINTE 18 SAS uses the aforementioned Personal Data to (i) carry out internal administrative procedures, such as training, promotion and selection of personnel, promotion and employment management, inspection and control of social security and social protection, labor relations and working conditions, tax, economic and accounting management, administration of information systems (including user and password management), operational development, sending communications; (ii) comply with the internal purposes of the company required by applicable regulations, such as inspection and control of security and social protection, recognition and payment of pensions, subsidies and other economic benefits, payroll payment, document filing and retention, time control, management of temporary workers, prevention of occupational risks, as well as others stipulated in current labor regulations; (iii) be transmitted to third parties within and/or outside the Republic of Colombia, including human resources providers, such as banks, healthcare providers, and third parties with whom VEINTE 18 SAS employees have contracted for any benefit; (iv) to transfer Personal Data to entities that require it to comply with VEINTE 18 SAS’s legal obligations, such as Health Promotion Companies (EPS), Occupational Risk Administrators (ARL), DIAN, among others; (v) to offer products and services of VEINTE 18 SAS or another company in the construction and/or real estate sector, and opinion surveys; and (vi) for security monitoring and video surveillance purposes.

 

Regarding the Sensitive Data of employees, partners, and their minor family members, VEINTE 18 SAS will use this data solely to fulfill its legal labor obligations to its employees, such as the recognition and payment of medical disabilities, and benefits for minors, such as recreational benefits, among others.

 

In any case, the Personal Data collected from candidates or individuals contacted through job boards is used solely and exclusively for the purposes of being analyzed within the selection process carried out by VEINTE 18 SAS.

 

No person within VEINTE 18 SAS is authorized to treat the Personal Data of employees in any way other than that indicated here.

 

Transmission and/or Transfer : VEINTE 18 SAS may transmit the Personal Data of its employees to banks and financial institutions through which VEINTE 18 SAS makes payroll payments, as well as to third-party providers with whom it is necessary to share the personal information of employees in order to obtain benefits for the latter. Likewise, it may transmit the personal information of its employees to third parties located within and/or outside the Republic of Colombia, so that they may carry out any processing of the information that is expressly contained in the authorization.

 

Regarding the transfer of its employees’ personal data, VEINTE 18 SAS provides this information to Health Promotion Companies (EPS), Occupational Risk Administrators (ARL), DIAN (National Tax and Customs Directorate), SENA (National Service of Education), and other entities to which VEINTE 18 SAS must make contributions, request disability recognition, and/or send periodic information to comply with its legal obligations. All transfers are made in compliance with legal obligations.

 

No one within VEINTE 18 SAS is authorized to transfer employees’ Personal Data for purposes other than those related to compliance with legal obligations.

 

  • Suppliers

 

Data collected : VEINTE 18 SAS may collect Personal Data provided by its suppliers, that is, general identification information of the person, location data related to commercial or professional activity, Financial Data and tax information, data related to the economic activity of the person, as well as data related to affiliation and contributions to the comprehensive social security system, among others. 

 

VEINTE 18 SAS’s suppliers are primarily legal entities for which the right to habeas data is not invoked. However, the information collected may occasionally include personal data of supplier employees, who are covered by the right to habeas data. 

 

VEINTE 18 SAS does not collect sensitive data or data from minors from its suppliers or their employees. The collection of personal data other than that indicated here is feasible provided that the corresponding authorization has been granted or is required by an authority.

 

Purposes of the Treatment : VEINTE 18 SAS may use the Personal Data of its suppliers to (i) carry out internal administrative procedures, such as the management of collections and payments, billing, economic and accounting, fiscal, history of commercial relations, operational development, inspection and security control and protection; (ii) conduct commercial or statistical studies or research, offer products or services of VEINTE 18 SAS or third parties; (iii) initiate prejudicial or judicial collections; (iv) that the information be transferred to legal entities that require it by virtue of a legal mandate or to third parties located within and/or outside the Republic of Colombia so that they process it directly, for any of the purposes provided herein, such as clients of VEINTE 18 SAS for contact purposes, as well as to be transmitted to persons and/or entities within and/or outside the Republic of Colombia for any of the purposes provided in the authorization; (v) as an element of analysis to establish and maintain a contractual or commercial relationship, whatever its nature; (vi) that the Financial Data be consulted, supplied, reported, processed or disclosed; and (vii) to comply with its legal obligations, including, but not limited to, those related to SARLAFT and prevention of transnational bribery conduct, and document retention required by current legal regulations.

 

No person within VEINTE 18 SAS is authorized to treat Personal Data in any way other than that indicated here.

 

Transmission and/or Transfer : VEINTE 18 SAS transfers the Personal Data of its suppliers to public entities that require it by virtue of legal mandates, including, but not limited to, the National Tax and Customs Directorate –DIAN- SENA and/or FIC, for the purposes of information reports required by said entity. 

 

For its part, it may transmit these data to third parties located within and/or outside the Republic of Colombia, for any of the purposes set forth in the authorization, such as, for example, clients of VEINTE 18 SAS for contact purposes, banks and financial institutions for payment purposes, document management providers, among others.

 

No person within VEINTE 18 SAS is authorized to transfer Personal Data.

 

  • Clients and potential clients

 

Data collected : VEINTE 18 SAS may collect Personal Data provided by its clients and persons interested in becoming clients, that is, specific and general identification information, location data related to the commercial or professional and private activity of the persons, Financial Data, socioeconomic, tax, asset information and data related to the economic activity of the persons.

 

In some cases, VEINTE 18 SAS may collect Personal Data from its clients who are minors. In these cases, the collection and processing of such information must be previously and expressly authorized by their parents or legal guardians. Likewise, in some cases, VEINTE 18 SAS may have access to Sensitive Data related to its clients, i.e., information about vulnerable populations.

 

The collection of Personal Data other than that indicated here is feasible provided that the corresponding authorization has been granted by the Data Subject or is required by an authority.

 

Purposes of Processing : As provided for in the respective authorization, VEINTE 18 SAS may use the Personal Data of its clients to (i) carry out company operations, such as handling of PQRs, internal statistics, administrative procedures, client management, collection and payment management, invoicing, economic and accounting management, history of commercial relations, profile analysis and sending of communications, advertising and offering of its products and/or those of third parties in the construction and/or real estate sector, profile analysis, customer loyalty, commercial prospecting; (ii) initiate prejudicial or judicial collections; (iii) that the information be transmitted to entities located within and/or outside the Republic of Colombia, for any of the purposes set forth in the authorization, including, but not limited to, banks and financial entities for the purposes of offering payment facilities by the latter, as well as contractors and suppliers of VEINTE 18 SAS to manage modifications to its products; (iv) to transfer personal information to trust entities, public notaries, co-ownership of properties built by VEINTE 18 SAS, and construction and/or real estate companies, or that carry out similar or related activities, located within and/or outside the Republic of Colombia, so that they use the information for any of the purposes set forth in the respective authorization; (v) that the Financial Data be consulted, supplied, reported, processed or disclosed; (vi) as an element of analysis to establish and maintain a contractual or commercial relationship, regardless of its nature; (vii) as an analytical element for conducting market studies or commercial or statistical research; (viii) to comply with its legal obligations, including, but not limited to, those related to SARLAFT, prevention of transnational bribery, post-sale guarantees, and document retention required by current legal regulations; and (ix) for security monitoring and video surveillance purposes.

 

No one within VEINTE 18 SAS is authorized to treat the Personal Data of clients in any way other than that indicated here.

 

Transmission and/or Transfer : Upon prior authorization and request from the Owner, VEINTE 18 SAS transfers the Personal Data of its clients to public notaries (carrying out notarial procedures), trustees (granting payment facilities), co-ownership of constructed properties, and companies in the construction and/or real estate sector located within and/or outside the Republic of Colombia, for the purposes of offering the latter’s products and/or services, among others, as well as to legal entities that require it by virtue of a legal mandate, such as the National Tax and Customs Directorate – DIAN. 

 

For its part, it may transmit these data to third parties located within and/or outside the Republic of Colombia, for any of the purposes set forth in the authorization.

 

No one within VEINTE 18 SAS is authorized to transfer clients’ Personal Data without a legal mandate to do so.

 

  • Industrial safety 

     

Data collected : VEINTE 18 SAS collects Personal Data from its employees and suppliers, provided in the employment or service contract, referring to general and specific identification information of the employee or supplier, information

 

location information related to private activity, information related to the person’s economic activity, general data related to affiliation and contributions to the comprehensive social security system, and data on judicial and/or disciplinary records. 

 

Likewise, and for the purposes of this Database, VEINTE 18 SAS collects Sensitive Data, that is, biometric information, data related to a person’s health regarding the health status of the person in terms of orders and list of complementary laboratory, imaging, endoscopic, pathological tests, studies, as well as information that includes test results, laboratories, studies, general or specialized medical diagnoses, psychological, psychiatric, medications and/or medical or therapeutic treatments of any kind, as well as information on vulnerable populations and those with disabilities. This Database does not include personal information of Minors.

 

The collection of Personal Data other than that indicated here is feasible provided that the corresponding authorization has been granted by the employee or is required by an authority.

 

Purposes of Processing : VEINTE 18 SAS uses the aforementioned Personal Data for security monitoring purposes and to carry out inspections and control of social security and protection.

 

No person within VEINTE 18 SAS is authorized to treat the Personal Data of employees in any way other than that indicated here.

 

Transmission and/or Transfer : VEINTE 18 SAS transmits the information contained in the Industrial Security Database to some of its suppliers with whom it contracts to perform certain tasks related to industrial security management. In any case, VEINTE 18 SAS is authorized to transmit Personal Data to third parties located within and/or outside the Republic of Colombia, so that they may process the information expressly provided for in the authorization.

 

No one within VEINTE 18 SAS is authorized to transfer employees’ Personal Data for purposes other than those related to compliance with legal obligations.

 

RIGHTS OF THE HOLDERS

 

The owner of the personal data has the following rights vis-à-vis the Data Controller:

 

  1. 1. To know, update and rectify his or her personal data;
  2. 2. Request proof of the authorization granted;
  3. 3. Be informed by the Data Controller upon request, regarding the use that has been given to your personal data;
  4. 4. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and Decree 1074 of 2015, once you have exhausted the consultation or claim process with the Data Controller;
  5. 5. Revoke authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees; and
  6. 6. Access your personal data that has been processed free of charge.

 

PROCEDURE FOR EXERCISING THE RIGHTS TO HABEAS DATA.

 

Data subjects may exercise their rights to access, update, correct, revoke authorization, and request deletion of data by sending a communication to the address and department indicated in this Policy. This communication must contain at least the following:

  1. 1. The name, address of the owner, and means of contact to receive the response, such as telephone number, email address, and residential address.
  2. 2. Documents proving identity, kinship in the case of a third party, or representation of the person represented.
  3. 3. A clear and precise description of the personal data in respect of which the owner seeks to exercise any of the rights.
  4. 4. If applicable, other elements or documents that facilitate the location of the personal data. Once the communication has been received from the Data Controller, a response will be provided within the terms established in the applicable regulations.

 

Remember that our support channels where you can exercise your rights are:

 

Address : Cra 9 # 80 – 45 office 602 Bogotá DC 

Telephone : 7423840

Email: habeasdata.v18@escalar.com.co

 

MODIFICATION AND/OR UPDATE OF THE POLICY 

 

Any substantial change in the processing policies will be communicated in a timely manner to the data owners through the usual means of contact and/or through email sent to the contact addresses registered with VEINTE 18 SAS.

 

VALIDITY OF THE POLICY 

 

These policies are effective as of March 9, 2023, the date on which they were approved and published in the company’s offices, under record number 6.