NEXSA, identified with Colombian Tax ID (NIT) 900 162 320 – 1, domiciled in the city of Bogotá D.C., Colombia, referred to hereafter in this data processing policy as "NEXSA," aims to inform Data Subjects that we guarantee the constitutional right and other legal and general provisions for the protection of data collected in the databases or files that NEXSA has obtained for the purposes described herein.
Provided that the Data Subject grants prior express authorization for the processing of their information, this Policy will apply to their Personal Data registered with NEXSA that is subject to special processing.
The provisions of this policy are intended to inform Data Subjects of the rights available to them and the manner in which NEXSA applies the special processing of information within NEXSA's database.
Pursuant to Law 1581 of October 17, 2012, the Colombian National Congress issued General Provisions for the management and Protection of Personal Data, including the framework of rights held by data subjects and the obligations of those responsible for and in charge of processing such data, establishing a general framework for the Protection of Personal Data in Colombia. In turn, on June 27, 2013, the National Government issued Decree 1377 of 2013, regulating the above-mentioned Law in order to facilitate its implementation with respect to matters such as the Data Subject's authorization, the Processing Policies of Data Controllers and Processors, the exercise of data subjects' rights, Personal Data Transfers, and Demonstrated Accountability regarding the Processing of Personal Data.
In order to guarantee the right to personal data protection in the course of its business activities, NEXSA will obtain, handle, collect, transmit, and carry out various operations on Data Subjects' information; it is likewise the duty of NEXSA's designated staff and/or officers in charge to comply with the law and with the principles and rules of this policy, described below:
With prior Express Authorization regarding the handling of personal data, NEXSA is automatically authorized to manage such information, and for every Data Subject with whom NEXSA has had any type of relationship, NEXSA will reach out using the necessary means in order to obtain retroactive authorization in accordance with Decree 1377 and other applicable regulations.
Any activity involving the Handling of Personal Data must comply with the purposes described in this Policy or with the express authorization granted by the Data Subject, or with any other binding document establishing a special Personal Data Processing policy.
The Data Subject must provide timely, accurate, clear, truthful, and verifiable information. Should the Data Subject provide erroneous, incomplete, or non-existent information, NEXSA is entitled to decline to establish a business relationship. ✓ Providing Information to the Data Subject:
When requested by the Data Subject, NEXSA shall provide information regarding the existence of Personal Data related to the requester. This information will be provided by the department NEXSA has designated for personal data protection.
NEXSA will designate authorized personnel for handling Personal Data; personnel without such authorization may not handle the information nor are they permitted to carry out personal data processing.
Information collected by NEXSA from the Data Subject shall only be processed for the length of time reasonably required by its intended purpose.
NEXSA has a duty to guarantee the confidentiality of Personal Data Processing in order to prevent such information from being used, altered, accessed, or compromised by unauthorized persons.
Even after a contractual relationship or the connection between the Data Subject and NEXSA has ended, the data must continue to be handled confidentially by personnel designated by NEXSA, in accordance with this policy and the law, even for data that is not public.
A natural person or legal entity.
As Data Processor, NEXSA will keep separate the databases for which it acts as Controller.
Personal Data may only be Processed for as long as, and to the extent that, the purpose of its Processing justifies.
The handling of information processed by NEXSA belongs to the Data Subjects, such as its clients, employees, and suppliers. By providing personal information to NEXSA, you are expressing your approval of the data processing described in this document. Minors seeking to establish a business or employment relationship with NEXSA must be legally represented by their parents or guardians, who will express, on the minor's behalf, acceptance of these policies and of the processing of minors' personal data. NEXSA and the persons in charge, or the Data Subjects who are governed by these policies under law or contract, will process data for the following purposes:
✓ Carrying out the administrative procedures NEXSA uses to register or update its database as it relates to a Data Subject.
✓ Obtaining information about your commercial conduct.
✓ Executing and fulfilling contracts entered into.
✓ Monitoring and preventing fraud and money laundering.
✓ Handling accounting and financial information.
✓ Handling tax-related information.
✓ Preventing and monitoring money laundering and terrorism financing.
✓ Carrying out job postings and selection processes.
✓ Informing employees about workplace communications, changes at NEXSA, and internal activities.
✓ Carrying out and fulfilling agreements entered into between NEXSA and any Data Subject.
✓ Establishing contact for commercial purposes with our clients and suppliers.
✓ Promoting our services and website.
✓ Communicating the Data Subject's information for administrative, operational, and commercial purposes in accordance with this policy and applicable legal regulations.
✓ Sending notices or communications to NEXSA's shareholders.
✓ Complying with legal and regulatory provisions through the collection of personal information for processing; NEXSA undertakes to fulfill any other responsibilities arising from this activity.
✓ When requested by a government entity.
✓ As a result of the commercialization of our brand.
Information is considered sensitive when it originates from occupational health medical processes, sexual orientation, information obtained from minors, or from organizations of any kind or sexual orientation. Such information will receive special protection from NEXSA in accordance with the parameters set out in Regulatory Decree 1377 of 2013 and Law 1581 of 2012. The processing of minors' personal data will only take place with the prior authorization of their legal representatives, for the purpose of establishing contractual, employment, or commercial relationships. Through this process, NEXSA seeks to protect and respect the fundamental rights of minors and adolescents.
In accordance with Law 1581 of 2012 and the authorizations granted by Data Subjects, NEXSA will carry out operations, or sets of operations, that include the collection, storage, use, circulation, and/or deletion of data. This Data Processing will be carried out exclusively for the purposes authorized and set out in NEXSA's Policies. Personal Data Processing will likewise be carried out whenever there is a legal or contractual obligation to do so. All information collected by NEXSA in its database is kept in software with restricted access that is not publicly available nor accessible to unauthorized persons. Our database will not be sold or subjected to any type of marketing activity.
In the Processing of Personal Data, NEXSA will at all times respect the rights of Data Subjects, which are:
✓ To know, update, and correct their data before NEXSA or Data Processors. This right may be exercised, among other cases, regarding data that is partial, inaccurate, incomplete, fragmented, misleading, or whose Processing is expressly prohibited or has not been authorized.
✓ To be informed by NEXSA, or the Data Processor, upon request, about the use given to their data.
✓ To file complaints with the Competent Authority regarding violations of the law and other regulations that amend, add to, or complement it.
✓ To revoke the authorization and/or request deletion of the data when the Processing fails to respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Competent Authority has determined that NEXSA or the Data Processors have engaged in conduct contrary to the law and the Constitution in the course of Processing. Revocation will proceed provided there is no legal or contractual obligation to retain the personal data.
✓ To access, free of charge, the Personal Data that has been Processed.
✓ To file complaints regarding violations of the law with the Superintendency of Industry and Commerce.
✓ To submit requests to NEXSA regarding the processing of their personal data.
✓ To have their personal information suspended from NEXSA's database, or to request its revocation, when the Superintendency of Industry and Commerce establishes, through a final administrative act, that NEXSA or the personnel in charge have engaged in conduct contrary to this policy or the law in the processing of information.
✓ In accordance with Article 21 of Decree 1377 of 2013, to have free access to their Personal Data that has been processed by NEXSA.
✓ To be informed of any changes to the terms of this Policy in a timely and effective manner prior to their implementation, or of any new data processing policy adopted in its place.
✓ To be informed of the department or person designated by NEXSA to handle all matters relating to complaints, inquiries, claims, or any other matter concerning their personal information.
For Data Subjects to exercise the right to carry out the procedure established in this policy with respect to their Personal Data in our database, they must submit a document requesting their information and present their original citizenship card or any other identification document. Minors must do so through their legal representative or through anyone who can prove such status with the relevant documentation.
The department responsible for receiving requests from Data Subjects and responding to those based on these policies or the law — such as requests to update data or to learn about Personal Data, as well as requests, inquiries, and claims made by Data Subjects under NEXSA's Processing, to exercise their rights to know, update, correct, and delete data, or revoke authorization — should be directed to: Sandra Vargas. NEXSA's contact details:
Address: Calle 98 No. 10 – 32, Office 501
Phone: +57 1 8058580 - 8058581
Email: protecciondedatos@nexsa.net
✓ To guarantee the Data Subject's full and effective exercise of their rights at all times.
✓ To request and retain a copy of the corresponding authorization granted by the Data Subject.
✓ To duly inform the Data Subject of the purpose of the collection and the rights afforded to them by virtue of the authorization granted.
✓ To store information under the security conditions necessary to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
✓ To ensure that the information provided to the Data Processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
✓ To keep information current by promptly communicating to the Data Processor any changes regarding data previously provided, and to take any other necessary measures to keep the information provided up-to-date.
✓ To correct information when it is inaccurate and communicate the relevant details to the Data Processor.
✓ To provide the Data Processor, as applicable, only with data whose Processing has been previously authorized in accordance with this policy.
✓ To require the Representative of the data collection system to respect, at all times, the security and privacy conditions of the Data Subject's information.
✓ To process inquiries, claims, and requests in accordance with the terms set out in the law or in this policy.
✓ To implement an internal Manual of policies and procedures to ensure proper compliance with Law 1581 of 2012, particularly for handling inquiries, claims, and requests.
✓ To inform the Data Processor when certain information is under dispute by the Data Subject, once the request has been filed and the corresponding process has not yet concluded.
✓ To inform the Data Subject, upon request, about the use given to their data.
✓ To notify the data protection authority when security breaches occur and there are risks in the administration of Data Subjects' information.
✓ To comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
Depending on their relationship with NEXSA, data subjects may exercise their rights to update, correct, and delete information. Requests may be submitted in person through the front desk, or by email at protecciondedatos@nexsa.net. NEXSA will keep proof of the request and its response in accordance with the individual record of each person identified in our database.
NEXSA will have ten (10) business days to process and respond to requests submitted by Data Subjects, counted from the date of filing. If NEXSA cannot respond within this timeframe, it must notify the requester of the reasons for the delay through the same channel used to originally submit the request, and will then have an additional five (5) business days to respond.
When Personal Data processed by NEXSA needs to be corrected, updated, or deleted, or in the event of an alleged failure by NEXSA to comply with the law, NEXSA has mechanisms in place for Data Subjects, their legal representatives, attorneys-in-fact, or successors to file claims in accordance with Law 1581 and Decree 1377, as follows:
I. Claims may be filed by email at protecciondedatos@nexsa.net or through a written document filed in person at Calle 98 No. 10 – 32, Office 501.
II. The email or document must include the Data Subject's name and identification, and a description of the facts giving rise to the request for "update, correction, deletion, or compliance with duties."
III. The email or document must include a physical notification address and any supporting documentation the requester wishes to submit.
IV. To process the claim, NEXSA will initially have five (5) business days to verify the requester's identity, or the documents proving their status as representative, attorney-in-fact, or successor.
V. If the claim or documentation lacks veracity or is incomplete, NEXSA must notify the requester once, within the five (5) business days following receipt of the claim. If the requester fails to submit the documentation or prove their identity within one (1) month of the date the initial notice was received, the claim will be considered withdrawn.
VI. Once the request is received and the veracity of the identity or completeness of the documents is confirmed, it will be entered into NEXSA's Database.
VII. A folder titled "claim in process" will be attached where the Data Subject's documentation is kept, along with the purpose of the request, the initial deadlines, and the date on which the request was resolved.
VIII. NEXSA will have fifteen (15) business days, counted from the date the information was confirmed, to resolve the request.
This policy has been in effect since September 1, 2016. Personal data stored, used, or transmitted will remain in our Database for as long as necessary for the purposes described in this policy.
Any material change to this policy will be communicated to data subjects in a clear and effective manner prior to its implementation.
Nexsa S.A.S.