ESTRADA BROTHERS FOUNDRY S.A.S. In compliance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, issues the following policy that contains the regulatory framework and the procedure that develops information security for the processing of personal data within the company, which will be informed to all the owners of the data collected or that in the future are obtained in the exercise of commercial or labor activities. In this way, FUNDICIÓN ESTRADA HERMANOS S.A.S. states that it guarantees the rights of privacy, intimacy, good name and autonomy of the company, in the processing of personal data, and consequently all its actions will be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency, access and restricted circulation, security and confidentiality. As well as its employees and third-party contractors to observe, abide by and comply with the orders and instructions that the company gives in a particular way regarding personal data, whose disclosure or improper use may cause harm to the owners of the same.
I. IDENTIFICATION OF THE RESPONSIBLE FOR THE TREATMENT.
ESTRADA BROTHERS FOUNDRY S.A.S. is a company dedicated to the activity
ADDRESS AND ADDRESS: In the municipality of La Estrella, located at Carrera 50 # 97bsur121
EMAIL: gerencia@estradahermanos.com
PHONE: 6050729
II. LEGAL FRAMEWORK
Political Constitution, article 15. Law 1266 of 2008 Law 1581 of 2012 Regulatory Decrees 1727 of 2009 and 2952 of 2010, Partial Regulatory Decree 1377 of 2013 Judgments C - 1011 of 2008, and C - 748 of 2011, of the Constitutional Court
III. SCOPE OF APPLICATION The provisions contained in this policy will apply to the processing of personal data carried out in Colombian territory, or when the person in charge and/or in charge is located outside Colombian territory, by virtue of international treaties, contractual relationships, among others.
The principles and provisions contained in this personal information security policy will apply to any personal database that is in the custody of FUNDICIÓN ESTRADA HERMANOS S.A.S. either as the person in charge and/or as the person in charge of the treatment.
All organizational processes that involve the processing of personal data must be subject to the provisions of this policy.
OF DATA Pages:
IV. OBJECT
Through this policy, the rules applicable to the processing of personal data collected, processed and/or stored by FUNDICIÓN ESTRADA HERMANOS S.A.S. are adopted and established. in the development of its corporate purpose, either as the person responsible and/or in charge of the treatment.
The rules contained in this policy are issued in compliance with the provisions of Article 15 of the Political Constitution of Colombia and Law 1581 of 2012, regarding the guarantee of privacy of persons, exercise of habeas data and protection of personal data, in accordance with the right to information, so that these rights are proportionally regulated in FUNDICIÓN ESTRADA HERMANOS SAS and their violation can be prevented.
V. RECIPIENTS
This policy will apply and therefore will bind the following people:
1. Legal representative: It will be the Manager of FUNDICIÓN ESTRADA HERMANOS S.A.S. according to the period of validity.
2. Contractors and natural or legal persons who provide their services to FUNDICIÓN ESTRADA HERMANOS S.A.S. under any type of contractual modality, by virtue of which any treatment of personal data is carried out. This provision must be included in all contracts.
3. Those other people with whom there is a statutory, contractual legal relationship, among others.
4. Public and private persons as users of personal data.
5. Other persons established by law.
SAW. DEFINITIONS
For the purposes of this policy and in accordance with current regulations on the protection of personal data, the following definitions will be taken into account:
Personal database: It is any organized set of personal data, whatever the form or modality of its creation, storage, organization and access.
Automated database: It is the organized set of personal data that is created, processed and/or stored through computer programs or software.
Non-automated database: It is the organized set of personal data that is created, processed and/or stored manually, with the absence of computer programs or software.
Transfer of data: Treatment of data that involves its disclosure to a person other than the owner of the data or other tan who is qualified as assignee.
OF DATA Pages:
Custodian of the database: It is the natural person who has custody of the personal database within FUNDICIÓN ESTRADA HERMANOS S.A.S.
Personal data: It is any data and/or information that identifies a natural person or makes them identifiable. They can be numerical, alphabetic, graphic, visual, biometric, auditory, profile or any other type of data.
Sensitive personal data: It is a special category of personal data that is specially protected, since it is related to health, sex, political affiliation, race or ethnic origin, biometric fingerprints, among others, which are part of the person's intimate assets. and can be collected only with the express and informed consent of its owner and in the cases provided by law.
Sources accessible to the public: Refers to those databases containing personal data whose query can be made by any person, which may or may not include the payment of a consideration in exchange for the access service to such data. Telephone directories, industry or sectoral directories, among others, have this condition of sources accessible to the public, as long as the information is limited to personal data of a general nature or that contains generalities of law. The printed media, the official newspaper and other media will have this condition.
Habeas Data. Fundamental right of every person to know, update, rectify and/or cancel the information and personal data that have been collected from them and/or are processed in public or private databases, in accordance with the provisions of the law and other applicable regulations
Procedure for analysis and creation of information: It is the creation of information regarding a person, from the analysis and processing of personal data collected and authorized, for the purpose of analyzing and extracting profiles or behavioral habits, which generate added value on the information obtained from the owner of each personal data.
Dissociation procedure: It refers to all processing of personal data in such a way that the information obtained cannot be associated with an identified or identifiable person.
Principles for data processing: These are the fundamental rules, legal and/or jurisprudential, that inspire and guide the processing of personal data, from which actions and criteria are determined to solve the possible collision between the right privacy, habeas data and protection of personal data with the right to information.
Database owner: In the business processes of FUNDICIÓN ESTRADA HERMANOS S.A.S. The database is owned by the area that is responsible for processing them, manages them and has them under its control.
Responsible for the treatment: It is the natural or legal person, of a public or private nature, that collects the personal data and decides on the purpose, content and use of the database for its treatment.
OF DATA Pages:
Holder of the personal data: It is the natural person whose data is subject to treatment. Regarding legal persons, the name is preached as a constitutionally protected fundamental right.
Data processing: Any operation or set of operations and technical procedures of an automated nature or not that are carried out on personal data such as the collection, recording, storage, conservation, use, circulation, modification, blocking, cancellation, among others.
User: It is the natural or legal person who has an interest in the use of personal information.
Violation of personal data: It is the crime created by Law 1273 of 2009, contained in Article 269 F of the Colombian Penal Code. The criminal type is as follows: "Whoever, without being empowered to do so, for their own benefit or that of a third party, obtains, compiles, steals, offers, sells, exchanges, sends, buys, intercepts, discloses, modifies or uses personal codes , personal data contained in files, archives, databases or similar means, will incur a prison sentence of forty-eight (48) to ninety-six (96) months and a fine of 100 to 1000 current legal monthly minimum wages"
VII. BEGINNING
For the purposes of guaranteeing the protection of personal data, FUNDICIÓN ESTRADA HERMANOS S.A.S. will apply in a harmonious and comprehensive manner the principles enshrined in international standards, in Colombian laws and in the jurisprudence of the Constitutional Court that has developed the fundamental rights linked to personal data in addition to the following:
➢ Informed consent or principle of freedom.
The processing of personal data within FUNDICIÓN ESTRADA HERMANOS S.A.S. can only be done with consent or prior, express and informed by the owner. Personal data may not be obtained, processed or disclosed without the owner's authorization, except by legal or judicial mandate that replaces the owner's consent.
➢ Legality regarding data processing.
Data processing is a regulated activity, which must be subject to current legal provisions applicable to the subject.
➢ Purpose.
The personal data processing activity carried out by FUNDICIÓN ESTRADA HERMANOS S.A.S. or to which you have access, will obey a legitimate purpose in accordance with the Political Constitution of Colombia, which must be informed to the respective owner of the personal data.
OF DATA Pages:
➢ Quality or veracity of the data
The personal data collected by FUNDICIÓN ESTRADA HERMANOS S.A.S. they must be truthful, complete, accurate, verifiable, understandable and kept up to date. The treatment of partial, fragmented, incomplete or misleading data is prohibited.
➢ Transparency.
In the processing of personal data, the right of the owner to obtain and know from the person responsible and/or in charge of the treatment, at any time and without restrictions, information about the existence of data that concerns him or her will be guaranteed.
➢ Relevance of the data.
The personal data collected by FUNDICIÓN ESTRADA HERMANOS S.A.S. They must be adequate, pertinent and not excessive, taking into account the purpose of the treatment and/or the database. The collection of disproportionate personal data in relation to the purpose for which they are obtained is prohibited.
➢ Access and restricted circulation.
The personal data collected or processed by FUNDICIÓN ESTRADA HERMANOS S.A.S. They will be used by it only within the scope of the purpose and authorization granted by the owner of the personal data, therefore, they may not be accessed, transferred, assigned or communicated to third parties.
The personal data in the custody of FUNDICIÓN ESTRADA HERMANOS S.A.S. They may not be available on the internet or in any other means of mass dissemination, unless access is technically controllable and secure, the foregoing in order to provide restricted knowledge only to owners or authorized third parties in accordance with the provisions of the law.
➢ Temporality of the data.
Once the purpose for which the personal data was collected and/or processed has been exhausted, FUNDICIÓN ESTRADA HERMANOS S.A.S. It must cease its use and therefore it will adopt the pertinent security measures for this purpose.
➢ Data security.
ESTRADA BROTHERS FOUNDRY S.A.S. As the person in charge or in charge of the processing of personal data, as the case may be, it will adopt the physical, technological and/or administrative security measures that are necessary to guarantee the attributes of integrity, authenticity and reliability of the personal data. ESTRADA BROTHERS FOUNDRY S.A.S. According to the classification of the personal data, it will implement the security measures of high, medium or low level, applicable according to the case, in order to avoid adulteration, loss, leakage, consultation, use or unauthorized or fraudulent access.
➢ Confidentiality.
ESTRADA BROTHERS FOUNDRY S.A.S. and all the people involved in the
OF DATA Pages:
processing of personal data, they have the professional obligation to store and maintain the confidentiality of such data, an obligation that remains even after the contractual relationship has ended. ESTRADA BROTHERS FOUNDRY S.A.S. will implement, in its contractual relations, data protection clauses in this sense.
➢ Duty of information.
ESTRADA BROTHERS FOUNDRY S.A.S. will inform the holders of the personal data, as well as those responsible and in charge of the treatment, of the data protection regime adopted by the company, as well as the purpose and other principles that regulate the treatment of these data. It will also inform about the existence of the personal databases that it safeguards, the rights and the exercise of habeas data by the owners, proceeding with the registration required by law.
➢ Special protection of sensitive data.
ESTRADA BROTHERS FOUNDRY S.A.S. It will only collect personal data of a sensitive nature when it is necessary and pertinent for the development of its corporate purpose. In each case, you must obtain express authorization from the owner, or verify that your treatment originates and legitimizes within the framework of a contractual and/or commercial relationship, or comes from legal authorization. Sensitive personal information that may be obtained from a personnel selection process will be protected through high security measures.
VII. RIGHTS OF THE INFORMATION HOLDER
In accordance with the provisions of the current regulations applicable to data protection, the following are the rights of the holders of personal data:
➢ Right of access.
This right includes the power of the owner of the data to obtain all the information regarding their own personal data, whether partial or complete, the treatment applied to them, the purpose of the treatment, the location of the databases that contain their data and on the communications and/or assignments made with respect to them, whether they are authorized or not.
➢ Right to update.
This right includes the power of the owner of the data to update their personal data when they have had some variation.
➢ Right of rectification.
This right includes the power of the owner of the data to modify the data that turns out to be inaccurate, incomplete or non-existent.
➢ Right of cancellation.
OF DATA Pages:
This right includes the power of the owner of the data to cancel their personal data or delete them when they are excessive, not pertinent or the treatment is contrary to the regulations, except in those cases contemplated as exceptions by law or contractually agreed otherwise.
➢ Right to revoke consent.
The owner of the personal data has the right to revoke the consent or authorization that enables FUNDICIÓN ESTRADA HERMANOS S.A.S. for a treatment with a certain purpose, except in those cases contemplated as exceptions by law or contractually agreed otherwise.
➢ Right of opposition.
This right includes the power of the owner of the data to oppose the processing of their personal data, except in cases in which such right is not appropriate by legal provision or because it violates general interests superior to private interest. The legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. Based on the legitimate rights argued by the owner of the personal data, it will make the pertinent decision.
➢ Right to file complaints and claims or to take action.
The owner of the personal data has the right to submit to the Superintendency of Industry and Commerce, or the competent entity, complaints and claims, as well as the actions that may be pertinent, for the protection of their data. Prior to this, he must have exhausted the exercise of his right against FUNDICIÓN ESTRADA HERMANOS S.A.S. according to law 1581 of 2012.
➢ Right to grant authorization for data processing.
In development of the principle of informed consent, the owner of the data has the right to
grant his authorization, by any means that may be subject to subsequent consultation, to process his personal data at FUNDICIÓN ESTRADA HERMANOS S.A.S.
Exceptionally, this authorization will not be required in the following cases: When required by a public or administrative entity in compliance with its legal functions, or by court order.
When it comes to data of a public nature.
In cases of medical or health emergency.
When it is treatment of information authorized by law for historical, statistical or scientific purposes.
When it comes to personal data related to the civil registry of people. In these cases, although the authorization of the owner is not required, the other principles and legal provisions on the protection of personal data will apply.
➢ Free access to your personal data that has been processed, at least once every calendar month, and every time there are substantial changes to this policy that motivate new queries. These rights may be exercised by:
OF DATA Pages:
1. The holder, who must sufficiently prove his identity by the different means made available by FUNDICIÓN ESTRADA HERMANOS S.A.S.
2. The successors in title of the owner, who must prove such quality.
3. The representative and/or proxy of the holder, prior accreditation of the representation or power of attorney.
4. Other in favor or for which the owner has stipulated.
➢ Rights of children and adolescents
In the processing of personal data, respect for the prevailing rights of minors will be ensured. The processing of personal data of minors is prohibited, except for those data that are of a public nature, and in this case the processing must comply with the following parameters:
Law 1581 of 2012. Article 10. Cases in which authorization is not necessary. The authorization of the Holder will not be necessary in the case of:
✓ Information required by a public or administrative entity in the exercise of its legal functions or by court order;
✓ Data of a public nature;
✓ Cases of medical or health emergency;
✓ Treatment of information authorized by law for historical, statistical or scientific purposes;
✓ Data related to the Civil Registry of Persons.
Who accesses personal data without authorization Prior authorization must in any case comply with the provisions contained in this policy.
IX. DUTIES OF THE RECIPIENTS OF THIS STANDARD WITH RESPECT TO DATABASES OF A PERSONAL CHARACTER WHEN THEY HOLD THE QUALITY OF RESPONSIBLE AND IN CHARGE.
Duties for the data controller.
When FOUNDRY ESTRADA HERMANOS S.A.S. or any of the recipients of this rule, assumes the quality of responsible for the processing of personal data in their custody, must comply with the following duties, without prejudice to the other provisions provided by law and others that govern their activity:
✓ Guarantee the holder, at all times, the full and effective exercise of the right of Habeas Data.
✓ Request and keep, under the conditions set forth in this policy, a copy of the respective authorization granted by the owner.
Duly inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
OF DATA Pages:
✓ Guarantee that the information provided to the data processor is truthful, complete, accurate, up-to-date, verifiable and understandable.
✓ Update the information, promptly communicating to the person in charge of the treatment, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it is kept up to date.
✓ Rectify the information when it is incorrect and communicate what is pertinent to the person in charge of the treatment.
✓ Provide the person in charge of the treatment, as the case may be, only data whose treatment is previously authorized in accordance with the provisions of the law.
✓ Require the person in charge of the treatment at all times to respect the security and privacy conditions of the owner's information.
✓ Process queries and claims formulated in the terms indicated in this policy and in the law.
✓ Adopt internal procedures to guarantee adequate compliance with the law and, in particular, for dealing with queries and complaints. ESTRADA BROTHERS FOUNDRY S.A.S. fulfills this obligation through the adoption of this policy.
✓ Inform the person in charge of the treatment of the circumstance that certain information is under discussion by the owner, once the claim has been filed and the respective procedure has not been completed.
✓ Inform at the request of the holder about the use given to his data.
✓ Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the holders.
✓ Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
✓ Register in the database the legend "CLAIM OF HABEAS DATA IN PROCESS" in relation to the personal information that is discussed or questioned by the owners, in accordance with the way in which it is regulated by law.
✓ Insert in the database the legend "INFORMACIÓ NN sobre HABEAS DATA EN DISCUSIÓ N JUDICIAL" once notified by the competent authority about judicial processes related to the quality of the personal data.
✓ Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce or by another competent authority.
✓ Allow access to information only to people who can have access to it.
✓ Inform the Superintendence of Industry and Commerce when there are violations of the "Security Codes" and there are risks in the administration of the information of the holders.
Apply the security measures according to the classification of the personal data that it treats
ESTRADA BROTHERS FOUNDRY S.A.S.
Adopt disaster recovery procedures applicable to databases containing personal data.
OF DATA Pages:
✓ Adopt backup procedures or backup of the database that contains personal data.
✓ Periodically audit compliance with this policy by the recipients of the same.
✓ Securely manage databases containing personal data.
✓ Keep a central registry of the databases that contain personal data that includes the history since its creation, treatment of the information and cancellation of the database.
✓ Securely manage access to the personal databases contained in the information systems, in which it acts as the person in charge or in charge of the treatment.
✓ Have a procedure to manage security incidents regarding databases containing personal data.
✓ Regulate in contracts with third parties the Access to databases containing personal data
Duties of FUNDICIÓN ESTRADA HERMANOS S.A.S. as responsible and in charge
✓ Use personal data for the fulfillment of the purposes expressly authorized by the owner or by current regulations. In the treatment and protection of personal data.
✓ Request and keep a copy of the respective authorization granted by the owner for the processing of personal data.
✓ Duly inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
✓ Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
✓ Guarantee that the information is truthful, complete, exact, up-to-date, verifiable and understandable.
✓ Update the information in a timely manner, thus attending to all the news regarding the holder's data. Additionally, all necessary measures must be implemented so that the information is kept up to date.
✓ Rectify the information when it is incorrect and communicate what is pertinent.
✓ Respect the security and privacy conditions of the holder's information.
✓ Process queries and claims formulated in the terms indicated by law.
✓ Identify when certain information is under discussion by the holder.
✓ Inform at the request of the holder about the use given to their data.
✓ Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the holders. Comply with the requirements and instructions issued by the Superintendency of Industry and Commerce on the particular subject.
Use only data whose processing is previously authorized in accordance with the provisions of Law 1581 of 2012. Or ensure the proper use of the personal data of
OF DATA Pages:
children and adolescents, in those cases in which the processing of their data is authorized.
✓ Record in the database the legend "CLAIM OF HABEAS DATA IN PROCESS" in the manner in which it is regulated by law.
✓ Insert in the database the legend "INFORMATION ON HABEAS DATA UNDER JUDICIAL DISCUSSION" once notified by the competent authority about judicial processes related to the quality of personal data.
✓ Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce. Allow access to information only to people who can have access to it.
✓ Use the personal data of the owner only for those purposes for which it is duly empowered and respecting in all cases the current regulations on the protection of personal data.
X. HABEAS DATA PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF INFORMATION, ACCESS, UPDATING, RECTIFICATION, CANCELLATION AND OPPOSITION.
In development of the constitutional right of Habeas Data regarding the rights of access, updating, rectification, cancellation and opposition by the owner of personal data, or legally authorized interested party, that is, their successors in title and legal representatives, FUNDICIÓN ESTRADA HERMANOS S.A.S. adopts the following procedure:
Inquiries: The holders or their successors in title may consult the personal information of the holder that resides in FUNDICIÓN ESTRADA HERMANOS S.A.S. who will provide all the information contained in the individual record or that is linked to the identification of the Holder. Regarding the attention of requests for consultation of personal data FUNDICIÓN ESTRADA HERMANOS S.A.S. guarantees:
✓ Enable means of electronic communication or others that it considers pertinent.
✓ Establish forms, systems and other simplified methods, which must be informed in the privacy notice.
✓ Use the customer service or claims services that you have in operation.
✓ In any case, regardless of the mechanism implemented to attend consultation requests, they will be attended to within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend the query within said term, the interested party will be informed before the expiration of 10 days, stating the reasons for the delay and indicating the date on which his query will be attended, which in no case may exceed five (5) business days following the expiration of the first installment.
✓ Inquiries may be made to the email protecciondedatos@estradahermanos.com
Claims: The Holder or his successors in title who consider that the information contained in a database should be subject to correction, updating or deletion, or when advertan the alleged
OF DATA Pages:
breach of any of the duties contained in the law, they may file a claim with FUNDICIÓN ESTRADA HERMANOS S.A.S. which will be processed under the following guidelines:
1. The claim of the Holder will be formulated through a request addressed to FUNDICIÓN ESTRADA HERMANOS S.A.S. to the email protecciondedatos@estradahermanos.com or by written communication addressed to the legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. with the identification of the holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to assert. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim. In the event that the person receiving the claim is not competent to resolve it, he or she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.
2. Once the complete claim is received, it will be cataloged with the label "CLAIM OF HABEAS DATA IN PROCESS" and the reason for it, within a term not exceeding two (2) business days. Said label will remain until the claim is decided.
3. The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.
Request for updating and/or rectification: FUNDICIÓN ESTRADA HERMANOS S.A.S. will rectify and update, at the request of the holder, the information of the latter that turns out to be incomplete or inaccurate, in accordance with the procedure and the terms indicated above, for which the following will be taken into account:
1. The owner must submit the request to the email protecciondedatos@estradahermanos.com or in physical medium addressed to the legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. indicating the update and/or rectification to be carried out and will provide the documentation that supports your request.
2. ESTRADA BROTHERS FOUNDRY S.A.S. may enable mechanisms that facilitate the exercise of this right to the holder, as long as they benefit him. Consequently, electronic or other means that you consider pertinent may be enabled, which will be informed in the privacy notice and will be made available to interested parties on the website.
Request for data deletion: The owner of personal data has the right to request FUNDICIÓN ESTRADA HERMANOS S.A.S. its deletion (removal) in any of the following events:
1. Consider that they are not being treated in accordance with the principles, duties and obligations provided for in current regulations.
2. They are no longer necessary or relevant for the purpose for which they were collected.
OF DATA Pages:
3. The period necessary for the fulfillment of the purposes for which they were collected has been exceeded. This deletion implies the total or partial elimination of personal information in accordance with the request of the owner in the records, files, databases or
treatments carried out by FUNDICIÓN ESTRADA HERMANOS S.A.S. however, this right of the holder is not absolute and consequently FUNDICIÓN ESTRADA HERMANOS S.A.S. You can deny the exercise of the same when:
a) The owner has a legal or contractual duty to remain in the database.
b) The elimination of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
c) The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner.
XI. CENTRAL REGISTRY OF PERSONAL DATABASES.
ESTRADA BROTHERS FOUNDRY S.A.S. reserves, in the events contemplated in the law and in its statutes and internal regulations, the power to maintain and catalog certain information that rests in its databases or databases, as confidential in accordance with current regulations, its statutes and regulations, all of the above and in accordance with the fundamental and constitutional right, will proceed in accordance with the current regulations and the regulations issued for this purpose by the National Government, to register its databases, before the National Registry of Databases (RNBD) that will be administered by the Superintendency of and Industry and Commerce. The RNBD., is the public directory of databases subject to treatment that operate in the country; and that it will be freely consulted by citizens, in accordance with the regulations issued by the National Government for this purpose.
ESTRADA BROTHERS FOUNDRY S.A.S. as responsible for the processing of personal data in its custody, in the development of its activity, as well as with respect to those in which it has the quality of data processor, it will have a central registry in which it will relate each of the databases contained in their information systems and other company files.
The central registry of personal databases will allow:
✓ Register all personal databases contained in the information systems and other files of FUNDICIÓN ESTRADA HERMANOS S.A.S. Each base will be assigned a registration number.
✓ The registration of personal databases will indicate: (i) The type of personal data it contains;
(ii) The purpose and intended use of the database;
(iii) Identification of the person who at FUNDICIÓN ESTRADA HERMANOS S.A.S.
does the treatment of the database;
(iv) Treatment system used (automated or manual) in the database;
OF DATA Pages:
(v) Indication of the level and security measures that apply to the database by virtue of the type of personal data it contains;
(vi) Location of the database in the information systems of FUNDICIÓN ESTRADA HERMANOS S.A.S.
(vii) The group of people or interest group whose data is contained in the database;
(viii) The condition of FUNDICIÓN ESTRADA HERMANOS S.A.S. What
RESPONSIBLE for the treatment of the databases;
(ix) Authorization for communication or assignment of the database, if any;
(x) Origin of the data and procedure for obtaining consent;
(xi) The person responsible for FUNDICIÓN ESTRADA HERMANOS S.A.S. custodian
from the database;
(xii) The other requirements that are applicable according to the regulations of the law that may be issued.
✓ On a quarterly basis, for compliance and auditing purposes, the changes made in the personal databases in relation to the aforementioned requirements will be recorded. In the event that the databases have not undergone changes, this will be recorded by the custodian of the same.
✓ The occurrence and history of security incidents that occur against any of the personal databases guarded by FUNDICIÓN ESTRADA HERMANOS S.A.S. will be documented in this central registry.
✓ The registry will indicate the sanctions that may be imposed with respect to the use of the personal database, indicating its origin.
✓ The cancellation of the personal database will be registered indicating the reasons and the technical measures adopted by FUNDICIÓN ESTRADA HERMANOS S.A.S. to make the cancellation effective.
XII. TREATMENT OF PERSONAL DATA.
The operations that constitute the processing of personal data by FUNDICIÓN ESTRADA HERMANOS S.A.S. as responsible or in charge of them, they will be governed by the following parameters.
➢ Personal data related to human resource management.
ESTRADA BROTHERS FOUNDRY S.A.S. will treat the personal data of its employees, contractors, as well as those who apply for vacancies, in three moments: before, during and after the employment and/or service relationship.
Treatment before the employment relationship: FUNDICIÓN ESTRADA HERMANOS S.A.S. will inform, in advance, the people interested in participating in a selection process, the rules applicable to the processing of personal data provided by the interested party, as well as with respect to those that are known during the selection process; and you will obtain the required authorization to deliver said information to third parties and for any other purpose other than participating in this process.
OF DATA Pages:
Once the selection process is exhausted, the negative result will be reported and the personal data provided will be returned to the non-selected persons; when this is not possible, it will be destroyed, for which the owner will have been previously informed. The information obtained by FUNDICIÓN ESTRADA HERMANOS S.A.S. With respect to those who were not selected, specifically the results of the psycho-technical tests and interviews, they will be eliminated from their information systems, thus complying with the principle of purpose.
When contracting personnel selection processes with third parties, the contracts will regulate the treatment that must be given to the personal data provided by the interested parties, as well as the destination of the personal information obtained from the respective process in compliance with this policy. The personal data and information obtained from the selection process regarding the selected personnel to work at FUNDICIÓN ESTRADA HERMANOS S.A.S. They will be stored in specific files for this purpose, applying high security levels and measures to this information, due to the potential that such information contains sensitive data.
The purpose of the delivery of the data provided by those interested in the vacancies of FUNDICIÓN ESTRADA HERMANOS S.A.S. and the personal information obtained from the selection process is limited to participation in it; therefore, its use for different purposes is prohibited.
Data processing during the employment relationship: FUNDICIÓN ESTRADA HERMANOS S.A.S. will store the personal data and personal information obtained from the employee selection process in a folder identified with the name of each of these. The treatment and access to this information, in physical or digital format, will be appropriate in accordance with the procedures established by the legal representative.
The use of employee information for purposes other than the management of the contractual relationship is prohibited at FUNDICIÓN ESTRADA HERMANOS S.A.S. The different use of the data and personal information of the employees will only proceed by order of the competent authority, provided that such power resides in it. It will be up to the legal representative to evaluate the competence and effectiveness of the order of the competent authority, in order to prevent an unauthorized transfer of personal data.
Data processing after termination of the contractual relationship:
Once the employment relationship has ended, whatever the cause, FUNDICIÓN ESTRADA HERMANOS S.A.S. will proceed to store the personal data obtained from the selection process and documentation generated in the development of the employment relationship in a central file, subjecting such information to high security measures and levels, by virtue of the potential that the employment information may contain data sensitive.
ESTRADA BROTHERS FOUNDRY S.A.S. It is forbidden to transfer such information to third parties, since such fact may configure a deviation in the purpose for which the personal data was delivered by its owners.
The foregoing, except prior written authorization documenting the consent of the owner of the personal data.
OF DATA Pages:
➢ Treatment of personal data of suppliers:
ESTRADA BROTHERS FOUNDRY S.A.S. It will only request from its suppliers the data that is necessary, pertinent and not excessive for the purpose of selection, evaluation and execution of the corresponding contract. When FUNDICIÓN ESTRADA HERMANOS S.A.S. Due to its legal nature, the disclosure of data of the natural person supplier as a result of a selection process, this will be carried out with the provisions that comply with the provisions of this policy and that warn third parties about the purpose of the information that is disclosed. It will collect from its suppliers the personal data of its employees, which are necessary, pertinent and not excessive, which for security reasons must be analyzed and evaluated, taking into account the characteristics of the services contracted with the supplier. The personal data of employees of suppliers collected by FUNDICIÓN ESTRADA HERMANOS S.A.S. will have the sole purpose of verifying the suitability and competence of such employees; therefore, once this requirement has been verified, FUNDICIÓN ESTRADA HERMANOS S.A.S. may return such information to the provider, except when it is necessary to preserve this data.
When FOUNDRY ESTRADA HERMANOS S.A.S. deliver data from your employees to your suppliers, they must protect the personal data provided, in accordance with the provisions of this policy. For this purpose, the respective audit forecast will be included in the contract or document that legitimizes the delivery of personal data. ESTRADA BROTHERS FOUNDRY S.A.S. will verify that the requested data is necessary, pertinent and not excessive with respect to the purpose that supports the request for access to them.
➢ Treatment of personal data in contracting processes.
Third parties that in contracting processes, alliances and cooperation agreements with FUNDICIÓN ESTRADA HERMANOS S.A.S. access, use, process and/or store personal data of employees and associates of FUNDICIÓN ESTRADA HERMANOS S.A.S. and/or third parties related to said contractual processes, will adopt the provisions of this policy, as pertinent, as well as the security measures indicated by FUNDICIÓN ESTRADA HERMANOS S.A.S. depending on the type of personal data processed.
For this purpose, the respective verification forecast will be included in the contract or document that legitimizes the delivery of personal data. ESTRADA BROTHERS FOUNDRY S.A.S. will verify and control that the requested data is necessary, pertinent and not excessive with respect to the purpose of the treatment.
➢ Treatment collection of customer data.
It requires the free, prior, express and informed consent of the owner of the personal data for the treatment thereof, except in cases expressly authorized by law, namely:
to. Information required by a public or administrative entity in the exercise of its legal functions or by court order. b. Data of a public nature.
c. Cases of medical or health emergency.
OF DATA Pages:
d. Treatment of information authorized by law for historical, statistical or scientific purposes.
and. Data related to the Civil Registry of Persons Statement of authorization to FUNDICIÓN ESTRADA HERMANOS S.A.S. for the processing of personal data will be granted by:
✓ The holder, who must sufficiently prove his identity by the different means made available by FUNDICIÓN ESTRADA HERMANOS S.A.S. S.A.S.
✓ The successors in title of the owner, who must prove such quality.
✓ The representative and/or proxy of the holder, prior accreditation of the representation or power of attorney.
✓ Other in favor or for which the holder has stipulated.
Means to grant authorization FUNDICIÓN ESTRADA HERMANOS S.A.S. obtain the authorization through different means, including the physical document, email, Web page, or in any other format that in any case allows obtaining consent through unequivocal conduct through which it is concluded that if the same had not been provided by the owner or the person entitled to do so, the data had not been stored or captured in the database. The authorization will be requested by FUNDICIÓN ESTRADA HERMANOS S.A.S. prior to the processing of personal data. Proof of authorization FUNDICIÓN ESTRADA HERMANOS S.A.S. will keep proof of the authorization granted by the holders of the personal data for its treatment, for which it will use the mechanisms currently available to it, as well as adopt the necessary actions to maintain the record of the form and date and in the who got this. Consequently, FUNDICIÓN ESTRADA HERMANOS S.A.S. may establish physical files or electronic repositories made directly or through third parties hired for this purpose.
Revocation of authorization. The holders of personal data may at any time revoke the authorization granted to FUNDICIÓN ESTRADA HERMANOS S.A.S. for the processing of your personal data or request the deletion of the same, as long as it is not prevented by a legal or contractual provision. ESTRADA BROTHERS FOUNDRY S.A.S. will establish simple and free mechanisms that allow the owner to revoke their authorization or request the deletion of their personal data, at least by the same means by which they granted it. For the above, it must be taken into account that the revocation of consent can be expressed, on the one hand, in a total way in relation to the authorized purposes, and therefore FUNDICIÓN ESTRADA HERMANOS S.A.S. You must cease any data processing activity; and on the other partially in relation to certain types of treatment, in which case these will be the ones on which the treatment activities will cease, such as for marketing advertising purposes, among others. In the latter case, FUNDICIÓN ESTRADA HERMANOS S.A.S. may continue to process personal data for those purposes in relation to which the owner has not revoked their consent.
OF DATA Pages:
➢ Treatment of personal data of the community in general.
The collection of data from natural persons that FUNDICIÓN ESTRADA HERMANOS S.A.S. deals with the development of actions related to the community, whether it is a consequence of the development of its corporate purpose or any other activity, it will be subject to the provisions of this rule. For this purpose, previously FUNDICIÓN ESTRADA HERMANOS S.A.S. will inform and obtain the authorization of the owners of the data in the documents and instruments that it uses and that are related to these activities.
In each of the cases described above, the legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. that develops business processes in which personal data is involved, must consider in their action strategies the formulation of rules and procedures that allow compliance and enforcement of the provisions adopted herein, in addition to preventing possible legal sanctions.
XIII. NOTICE OF PRIVACY
The Privacy Notice is the physical document, electronic or in any other format, made available to the owner to inform him about the processing of his personal data. Through this document, the owner is informed of the information related to the existence of the information treatment policies of FUNDICIÓN ESTRADA HERMANOS S.A.S. and what do you know?
were applicable, the way to access them and the characteristics of the treatment that is intended to be given to personal data. The privacy notice must contain, at a minimum, the following information:
to. The identity, address and contact details of the data controller.
b. The type of treatment to which the data will be subjected and its purpose. c. The rights of the holder
d. The general mechanisms arranged by the person in charge so that the owner knows the information treatment policy and the substantial changes that occur in it. In all cases, he must inform the holder how to access or consult the information treatment policy.
and. The optional nature of the response regarding questions about sensitive data
XIV. GUARANTEES OF THE RIGHT OF ACCESS
To guarantee the right of access of the owner of the data, FUNDICIÓN ESTRADA HERMANOS S.A.S. will make available to the latter, after proof of identity, legitimacy, or personality of its representative, without cost or expense, in a detailed and detailed manner, the respective personal data through all types of means, including electronic means that
Pages:
allow the owner direct access to them. Said access must be offered without any limit and must allow the holder the possibility of knowing and updating them online.
XV. PROHIBITIONS.
In development of this personal information security policy of FUNDICIÓN ESTRADA HERMANOS S.A.S. The following prohibitions and sanctions are established as a consequence of its non-compliance.
ESTRADA BROTHERS FOUNDRY S.A.S. prohibits the access, use, management, assignment, communication, storage and any other processing of personal data of a sensitive nature without the authorization of the owner of the personal data and/or FUNDICIÓN ESTRADA HERMANOS S.A.S.
Incurring in this prohibition by the employees and/or legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. will carry the sanctions that may be applicable in accordance with the law.
Incurring this prohibition by suppliers who contract with FUNDICIÓN ESTRADA HERMANOS S.A.S. will give rise to the consequences provided for such purposes, without prejudice to the actions that may take place.
In contracts with suppliers, in which the contracted object is related to personal data, a provision will be agreed in relation to the damages that may be caused to FUNDICIÓN ESTRADA HERMANOS S.A.S. as a consequence of the imposition of fines, operational sanctions, among others, by the competent authorities and as a consequence of the reckless or negligent actions of the supplier.
ESTRADA BROTHERS FOUNDRY S.A.S. prohibits the transfer, communication or circulation of personal data, without the prior, written and express consent of the owner of the data or without the authorization of FUNDICIÓN ESTRADA HERMANOS S.A.S. The transfer or communication of personal data must be registered in the central registry of personal data of FUNDICIÓN ESTRADA HERMANOS S.A.S. and have the authorization of the database custodian.
ESTRADA BROTHERS FOUNDRY S.A.S. prohibits the access, use, transfer, communication, treatment, storage and any other treatment of personal data of a sensitive nature that could be identified in an audit procedure in application of the rule on the proper use of the company's computer resources and /or other regulations issued by FUNDICIÓN ESTRADA HERMANOS SAS for these purposes.
Sensitive data that could be identified in the audit process will be informed to the user of the computer resource, so that he proceeds to eliminate them; If this option is not possible, FUNDICIÓN ESTRADA HERMANOS S.A.S. will proceed to delete them safely.
ESTRADA BROTHERS FOUNDRY S.A.S. prohibits the recipients of this policy from any processing of personal data that may give rise to any of the conduct described in the computer crime law 1273 of 2009. Unless authorized by the owner of the data and/or FUNDICIÓN ESTRADA HERMANOS SAS depending on the case.
Pages:
ESTRADA BROTHERS FOUNDRY S.A.S. The processing of personal data of minor children and adolescents will only proceed with the express, prior and informed consent of their representatives and/or the persons who hold the representation of the minor, for the purposes required in relation to the exercise of their activity. and in any case, the prevailing rights that the Political Constitution recognizes must be ensured, in harmony with the Code of Childhood and Adolescence
XVI. INTERNATIONAL DATA TRANSFER.
The transfer of personal data to any person whose seat is in an unsafe country for data protection is prohibited. Safe countries are those that meet the standards set by the Superintendency of Industry and Commerce.
Exceptionally, international data transfers may be made by FUNDICIÓN ESTRADA HERMANOS S.A.S. when:
➢ The owner of the data has granted their prior, express and unequivocal authorization to carry out the transfer.
➢ The transfer is necessary for the execution of a contract between the holder and FUNDICIÓN ESTRADA HERMANOS S.A.S. as responsible and/or in charge of the treatment.
➢ In the case of bank and stock transfers in accordance with the legislation applicable to said transactions.
➢ In the case of data transfer within the framework of international treaties that are part of the Colombian legal system.
➢ Legally required transfers to safeguard a public interest.
At the time of an international transfer of personal data, prior to sending or receiving the same, FUNDICIÓN ESTRADA HERMANOS S.A.S. will sign the agreements that regulate in detail the obligations, charges and duties that arise for the parties involved.
The agreements or contracts that are concluded must comply with the provisions of this policy, as well as in the legislation and jurisprudence that is applicable in matters of personal data protection. It will correspond to the legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. Give a favorable opinion on the agreements or contracts that entail an international transfer of personal data, taking into account the applicable principles and collected in this policy as guidelines. Likewise, it will be up to you to make the pertinent inquiries before the Superintendence of Industry and Commerce to ensure the circumstance of "safe country" in relation to the territory of destination and/or origin of the data.
XVII. ROLES AND RESPONSIBILITIES IN COMPLIANCE WITH PERSONAL DATA PROTECTION.
Responsibility for the proper processing of personal data within FOUNDRY
ESTRADA HERMANOS S.A.S. is headed by assistant manager
(proteccióndedatos@estradahermanos.com) Consequently, you must handle the processes of
Pages:
Businesses that involve the processing of personal data must adopt the rules and procedures for the application and compliance with this policy, given their status as custodian of the personal information that is contained in the information systems of FUNDICIÓNE ESTRADA HERMANOS.
In case of doubt regarding the legal treatment of personal data, the legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. to indicate the guideline to follow, as the case may be.
XVIII. PERIOD OF PERSONAL DATA.
In the processing of personal data carried out by FUNDICIÓN ESTRADA HERMANOS S.A.S. the permanence of the data in its information systems will be determined by the purpose of said treatment. Consequently, having exhausted the purpose for which the data was collected, FUNDICIÓN ESTRADA HERMANOS S.A.S. will proceed to its destruction or return, as the case may be, or to preserve them in accordance with the provisions of the law, adopting the technical measures that prevent inappropriate treatment.
XIX. SECURITY MEASURES.
In the processing of personal data subject to regulation in this policy, FUNDICIÓN ESTRADA HERMANOS S.A.S. will adopt physical, logical and administrative security measures, which are classified as high, medium and low, according to the risk that may arise from the criticality of the personal data processed. In development of the principle of personal data security, FUNDICIÓN ESTRADA HERMANOS S.A.S. will adopt a general guideline on these measures, which will be mandatory compliance by the recipients of this rule.
XX. PROCEDURES AND SANCTIONS.
ESTRADA BROTHERS FOUNDRY S.A.S. communicates to the recipients of this policy the regime of sanctions provided for by Law 1581 of 2012 in its Article 23, which materializes the risks assumed for improper processing of personal data: “ARTICLE 23. Sanctions. The Superintendency of Industry and Commerce may impose the following sanctions on data controllers and data processors:
“a) Fines of a personal and institutional nature up to the equivalent of two thousand (2,000) legal monthly minimum wages in force at the time of the imposition of the sanction. The fines may be successive as long as the non-compliance that originated them persists.
“b) Suspension of the activities related to the Treatment for up to a term of six (6) months. Corrective measures to be adopted will be indicated in the act of suspension.
“c) Temporary closure of the operations related to the treatment once the term of suspension has elapsed without having adopted the corrective measures ordered by the Superintendence of Industry and Commerce.
OF DATA Pages:
“d) Immediate and definitive closure of the operation that involves the treatment of sensitive guys.”
The notification of any investigative procedure by any authority, related to the processing of personal data, must be communicated immediately to the legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. in order to take the measures tending to defend the actions of the entity and avoid the imposition of the sanctions provided for in Colombian legislation, in particular those consigned in Title VI, Chapter 3 of Law 1581 of 2012 described above.
Consequence of the risks assumed by FUNDICIÓN ESTRADA HERMANOS S.A.S. either as the person in charge and/or in charge of the processing of personal data, the breach of this policy by its recipients will give rise to the sanctions and/or measures contemplated in the applicable regulations.
XXI. DELIVERY OF PERSONAL DATA TO AUTHORITIES.
When the State authorities request FUNDICIÓN ESTRADA HERMANOS S.A.S. access and/or delivery of personal data contained in any of its databases, the legality of the request will be verified, the relevance of the data requested in relation to the purpose expressed by the authority, and the delivery of personal information requested, providing that it complies with all its attributes (authenticity, reliability and integrity), and noting the duty to protect these data, both to the official who makes the request, to the person who receives it, as well as to the entity for which they work. The authority that requires the personal information will be warned about the security measures that apply to the personal data provided and the risks that its improper use and inadequate treatment entails.
XXII. RESTRICTIONS ON THE USE OF THIS POLICY.
This personal data protection policy is for the exclusive use of FUNDICIÓN ESTRADA HERMANOS S.A.S. therefore, its copying, reproduction, distribution, transfer, publication, translation and any other use by a person other than FUNDICIÓN ESTRADA HERMANOS S.A.S. is prohibited. in attention to respect for the intellectual property held by its creators, as well as for reasons of information security.
This policy has been updated by the legal representative of FUNDICIÓN ESTRADA HERMANOS S.A.S. on January 18, two twenty-two (2022).
Legal representative
