Policy manual and treatment of personal data

Law 1266 of 2008
Law 1581 of 2012
Regulatory Decree 1377 of 2013

INTRODUCTION
POLICIES FOR PERSONAL DATA AND HABEAS DATA PROCESSING
PHAX MARKETING COMPANY S.A.
N.I.T. 800.113.011-9

PHAX MARKETING COMPANY S.A. committed to the values ​​of respect, submission to legality, confidentiality, availability, integrity and proper handling of information and especially with the conviction in the guarantee of fundamental rights through the present elaboration and proposal, aims to comply Law 1266 of 2008 and Law 1581 of 2012, regulated by decree 1377 of 2013, among which the need to adopt a Manual of Policies and Procedures that guarantee compliance with the aforementioned Law, based on the consultations and claims arising from the owner of personal data.

 

In literals d) and e) of Article 3 of Law 1581 of 2012, the person in charge and responsible for the treatment is mentioned, having COMERCIALIZADORA PHAX SA fulfilled these two qualities simultaneously, and in many of the databases that are managed, is responsible for all the information about personal data and is obliged to preserve them as granted in this Law.

Current technologies must allow Companies and / or Entities the management, exploitation and efficient storage of personal information that is used for the fulfillment of their corporate and business objectives, only for the purposes in which they are linked and for this reason COMERCIALIZADORA PHAX SA’s main purpose will be:

A.- Distribution and confection of masculine and feminine clothes.
B.- Investments in other companies.
C.- The acquisition of shares, shares of social interest in companies of any nature or species, aimed at obtaining dividends or participations.

D.- The acquisition or construction of all kinds of urban or rural real estate, with the purpose of obtaining profits derived from its exploitation, lease or administration.

E.- Provision of personal services within the professional activity of each partner.
F.- Provide staffing for companies.

G.- To sum up, the performance of any operation, act or contract, not included in the preceding bullets, but directly related to the activities described therein and not precluded by the Law.

 

To achieve the fulfillment of the purposes set forth in this article, the company may enter into all types of business, such as purchase-sale, lease, mandate, franchises, loan, current accounts, supply, consignment, deposit, mortgage, pledge, transaction, transportation, insurance, money order, acceptance, endorsement, negotiation, collection and discharge of securities, etc.. This list is not restrictive. To get social enterprise fulfillment, the company can execute any other act or contract, with the simple intervention of the competent organism.

 

In general, Phax can exercise all the rights and fulfill all the obligations derived from its existence and activity. As for the conclusion of the company contract, it is expressly stipulated that COMERCIALIZADORA PHAX SA, may create new companies of any kind or enter as a member or shareholder to those already established, when the activity of one or the other is equal, similar, related or complementary to those that constitute its purpose or social enterprise or when, in spite of not meeting these conditions, the association clearly agrees with its interests, all this in the opinion of the competent executive body.

 

The above activities may be carried out through physical mail, email, landline, website, cell phone or mobile device, text message, fax, social networks, surveys or through any other widely known means of communication, giving compliance with the provisions of current regulations.

 

PHAX TRADING COMPANY S.A. may treat the personal data provided by its customers, Suppliers and other Third Parties for the purposes of: (i) verifying compliance with the Entity's policies regarding the selection and contracting of suppliers; (ii) verify the adequate compliance with the obligations; (iii) satisfy the legitimate interests derived from the relationship that is established or projected to be established; (iv) provide or obtain commercial and / or financial references; (v) administer and operate the contracted product or service, which includes, among other aspects, the management and accounting record of the operations that take place during the validity of any legal relationship, as well as all those that are carried out for the termination, closing or liquidation thereof; (vi) document the existing relationship and verify the execution and fulfillment of the respective contract; (vii) verify and confirm the identity and contact; (viii) send commercial information about the products and / or services that COMERCIALIZADORA PHAX S.A. lends in development of its social purpose; (ix) adopt measures to prevent illicit activities; and (x) deliver the personal data of its employees, suppliers, associates, suppliers and third parties to entities located in Colombia or abroad, whether public or private, provided that: They are companies or entities with which COMERCIALIZADORA PHAX S.A. is related by shareholding links, subsidiary or operated; or the delivery of personal data has the purpose of structuring, designing and implementing offers of products or services, or in general proposals of additional value to which COMERCIALIZADORA PHAX S.A. is not able to offer autonomously, or it has the purpose of facilitating the development of the corporate purpose of COMERCIALIZADORA PHAX S.A. through the outsourcing of its processes, such as physical or digital file, collection, risk management, software development, customers contact, suppliers, associates, providers, operators, people with whom it has agreements and contracts, markets investigation,, development of statistical analysis, development of  social, marketing and business strategies, social impact studies, establishment of new care channels, and other related purposes.

 

Similarly, the personal data of customers, employees, service providers, suppliers, individuals with whom you have alliances established in contracts and / or agreements, operated, distributors, third parties and in general, any natural person owner of personal data that appear registered in the databases will be used by COMERCIALIZADORA PHAX SA in order to adequately advance all its processes in execution of the provision of its services directed to the community and to comply in this way with this manual and with Law 1266 of 2008, Statutory Law 1581 of 2012 and its regulatory decrees.

 

III. DEFINITIONS

 

For the purposes of this policy, the definitions established by current regulations are listed below:

 

* Authorization: Prior, express and informed consent of the Holder to carry out the processing of personal data.

 

* Database: Organized set of personal data that is subjected to treatment.

 

* Personal Data: Any information linked or that may be associated with one or several natural persons determined or determinable.

 

* Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, perform the processing of personal data on behalf of the controller.

 

* Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the treatment of the data.

 

* Owner: Natural person whose personal data are subject to treatment.

 

* Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

 

* Privacy notice: Verbal or written communication generated by COMERCIALIZADORA PHAX S.A. directed to the owner of personal data, which informs you of the existence of the information processing policies that will be applicable to you, the way to access them and the purposes of the treatment that is intended to give personal data.

 

* Public data: It is related to people civil status, their profession or occupation and their quality of merchant or public servant; which are not subject to protection.

 

* Sensitive data: Sensitive data is the one that affects the owner’s privacy of whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights or that promotes the interests of any political party or that guarantee rights, as well as data related to health, sexual life, and biometric data.

 

* Transfer: Data Transfers takes place when COMERCIALIZADORA PHAX S.A., located in Colombia, sends the information or personal data to a receiver, who in turn is responsible for the treatment and is inside or outside the country.

 

* Transmission: Treatment of personal data that involves the communication of them within or outside the territory.

  1. RIGHTS OF CHILDREN, GIRLS AND ADOLESCENTS.

 

In the treatment, respect for the prevailing rights of children and adolescents will be ensured.

 

The processing of personal data of children and adolescents is prohibited, except for public nature data, or authorization is obtained from their representative.

 

COMERCIALIZADORA PHAX SA, will act with the utmost diligence and care in the children and adolescents treatment, when obtaining the data for regulation and registration in subjects related to social security and compensation funds requested by their parents in quality of employees of COMERCIALIZADORA PHAX SA

 

It is a State and educational entities of all kinds’  task to provide information and train legal representatives and tutors on the possible risks faced by children and adolescents regarding improper treatment of their personal data, and to provide knowledge about the responsible and safe use by children and adolescents of their personal data, their right to privacy and protection of their personal information.

 

  1. PRINCIPLES

 

In accordance to the Law, COMERCIALIZADORA PHAX S.A., will act in all compilation, handling and deletion of personal data according to the principles that must be followed in personal data processing and protection of the HABEAS DATA Act, these are:

 

* Legality: For personal data processing, COMERCIALIZADORA PHAX S.A. shall be subjected to the regulations of the Law.

 

* Purpose: COMERCIALIZADORA PHAX S.A. will inform the owner the purpose of the treatment given to personal data, which must be legitimate in accordance with the Constitution and the Law.

 

* Freedom: Personal data processing will only be exercised by COMERCIALIZADORA PHAX S.A. with the prior, express and informed consent of the owner; or by legal or judicial mandate.

 

* Veracity or Quality: The information subjected to personal data processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractionated or misleading data is prohibited.

 

* Transparency: COMERCIALIZADORA PHAX S.A. guarantees the owner the right to obtain information about the existence of their data at any time and without restrictions.

 

* Access and Restricted Circulation: The treatment that COMERCIALIZADORA PHAX S.A. gives the personal data, will be subjected to the regulations established in the Law and the Constitution. Personal data may not be available on the Internet or other media, except for those of a public nature or those in which their access is technically controllable to provide restricted knowledge to the owner or authorized third parties.

 

* Security: The information subjected to treatment by COMERCIALIZADORA PHAX S.A., will be protected through the use of technical, human and administrative measures that grant security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

 

* Confidentiality: People involved in the processing of not public nature personal data, are required to guarantee the reservation of the information provided, even after the end of your relationship with any of the tasks involved in the treatment.

 

  1. HOLDER’S NAME

 

For the purposes of this policy, They will be considered as so by COMERCIALIZADORA PHAX SA personal data owners, distributors, employees, service providers, customers, users, suppliers and any natural person who owns the personal data that appear registered in the databases

 

In the case of minors (children and adolescents), their legal representatives will have the right to authorize or not the processing of their personal data. In the treatment of these data, respect for the prevailing rights of minors such as privacy and protection of personal information will be ensured.

 

VII. AUTHORIZATION

 

For the processing of personal data by COMERCIALIZADORA PHAX S.A., prior, informed and express authorization of the owner is required, which must be obtained by any written, physical or electronic means that may be subjected to further consultation, notwithstanding the exceptions provided in the Law.

 

PHAX TRADING COMPANY S.A. must clearly and expressly inform the purpose of collected personal data when requesting the holder’s authorization, the treatment submitted to personal data, the owner’s right and means through which he can exercise them .

 

For the purposes of protection of the Habeas Data Act, COMERCIALIZADORA PHAX S.A., will have owner’s prior authorization and notification, in order to be reported to CIFIN, DATACREDITO and PROCREDITO Entities.

 

Personal data information may be provided by COMERCIALIZADORA PHAX S.A. the owner, his successors, legal representative and / or attorney, or third parties authorized by COMERCIALIZADORA PHAX S.A or by law, as well as public or administrative entities in the exercise of legal functions or by court order.

 

PHAX TRADING COMPANY S.A. may continue with the processing of the data contained in its databases for the purpose indicated in this policy, without prejudice to owner’s faculty to exercise his right at any time and request his data’s deletion.

 

VIII. RIGHTS

 

Personal data owner and / or the holder of the credit obligation acquired with COMERCIALIZADORA PHAX S.A., will be entitled to:

 

* Know, update and rectify his personal data in front of COMERCIALIZADORA PHAX S.A. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized.

 

* Request from COMERCIALIZADORA PHAX S.A. proof of the authorization granted for the processing of his personal data, except for the exceptions regarded in the Law.

 

* Be informed by COMERCIALIZADORA PHAX S.A. upon request, on the use that is given to his personal data.

 

* Submit inquiries to COMERCIALIZADORA PHAX S.A. and file complaints with the entity responsible for the protection of personal data.

 

* Request the repeal and / or deletion of your personal data when COMERCIALIZADORA PHAX S.A. incur in any conduct contrary to the Law and the Constitution. Free and unlimited access to personal data subjected to treatment.

 

  1. ASSIGNMENT

 

Personal data owner must keep his information updated and guarantee COMERCIALIZADORA PHAX S.A., its veracity at all times. PHAX TRADING COMPANY S.A. will not be liable, in any case, for any type of liability arising from the inaccuracy of the information provided by the owner.

 

  1. RESPONSIBLE AND PERSON IN CHARGE FOR THE PROCESSING OF PERSONAL DATA

 

PHAX TRADING COMPANY S.A. will be responsible for the processing of personal data.

 

The administrative area will be the one in charge of processing personal data, on behalf of COMERCIALIZADORA PHAX. S.A., who will be provided with information on each employee, provider, operator, associate, customer, supplier and in general of any natural person from whom personal information was collected and remains in a database.

 

The official in charge of said area will keep a report of the database and will be in charge of the following functions:

 

* Know this policy and give it application in what corresponds to them.

 

* Send a communication by e-mail to each manager, employee or person who has handled some type of personal data of the Company members, in the sense that they inform the department in charge, the name and mail of the users who have personal information.

 

* Elaborate, direct, order and / or delegate to others the measures establishment that should be taken in commercial contracts or forms that deal with credits or personal data.

 

* Elaborate, direct, commission and / or delegate to others measures establishment that should be taken in consideration in labor contracts.

 

* Inform the owner about the purpose of data collection and ensure the exercise of the rights that assist him under the authorization granted.

 

* Guarantee that the information is true, complete, accurate, updated, verifiable and understandable.

 

* Rectify the holder's information when it is incorrect.

 

* Use only personal data that has been obtained by authorization, unless they do not require it.

 

* Respect the information security and privacy conditions of the owner.

 

* Update, rectify or delete personal data within five (5) business days from receipt.

 

* Allow access to information only to authorized persons.

 

* Comply with the instructions and requirements issued by the competent administrative authority.

 

* Sign confidentiality agreements with those who handle information related to the processing of personal data.

 

*  Timely process inquiries and complaints made by the owners of personal data.

 

* Others established in the Law.

 

* ​​COMERCIALIZADORA PHAX S.A. administrative area must ensure that each  new worker is acquainted with this Policy and the documents that complement it when they join the corporation. COMERCIALIZADORA PHAX SA will also make all contractual and legal adjustments so that employees, managers, suppliers, related contractors and other third parties in contracts ensure compliance with confidentiality agreements, contractual clauses and other documents, as well as looking for obtaining express authorization from each owner for the handling of personal data.

 

* COMERCIALIZADORA PHAX S.A. workers are responsible for reporting any incident regarding information leakage, computer damage, violation of personal data, data commercialization, use of children or adolescents personal data without the corresponding authorization, identity theft, or behavior that may violate the privacy of a person, or has indications that they are being used for criminal and / or unauthorized purposes.

 

  1. PERSONAL DATA COLLECTION AND HANDLING

 

This policy will be applicable in cases where COMERCIALIZADORA PHAX S.A. request the completion of linking requests, surveys or forms by telephone, digital or face-to-face, as well as the event attendance sheets, without prejudice to the particular conditions that apply in each case.

 

From the moment in which the personal data holder authorizes COMERCIALIZADORA PHAX S.A. the collection and processing of his personal data, these may be used in the development of its business and work activities.

 

PHAX TRADING COMPANY S.A.  may use the owner personal data such as his email address, physical email address and / or landline or cell phone number to send advertising related to its products and services offer, and contact him for events and other activities.

 

In any case, depending on the activity carried out, COMERCIALIZADORA PHAX S.A. will communicate the owner of the personal data the mechanisms at his disposal to know, update, modify and delete his data, as well as to revoke the authorization granted.in a clear manner.

 

XII. PRIVACY, CONFIDENTIALITY AND SECURITY OF PERSONAL DATA

 

COMERCIALIZADORA PHAX S.A.. guarantees information, privacy, confidentiality and security of the data delivered by holders, avoiding adulteration, loss, consultation, use or unauthorized or fraudulent access by third parties.

 

COMERCIALIZADORA PHAX S.A. Applying the principle of autonomy, it reserves the right to maintain and catalog as confidential the information that lies in their databases.

 

COMERCIALIZADORA PHAX S.A. will adopt the necessary technical, human and administrative measures to grant security to the personal data, avoiding its adulteration, loss, consultation, use or unauthorized or fraudulent access.

 

COMERCIALIZADORA PHAX S.A. states that some of its portals may contain links to third-party websites, over which it has no management or control, for that reason, is not responsible for the content, privacy policies, security and / or handling of personal data that they are established in them, being the holder’s obligation to know the policies related to the protection and the treatment of his information in the respective portal.

 

On COMERCIALIZADORA PHAX S.A.’s website, instructions will be established under absolute security so that each user interacts with them and submit their requests to COMERCIALIZADORA PHAX S.A., on any type of correction, modification and / or deletion.

 

XIII. AREA OF APPLICATION

 

Policies will be applicable to the databases under COMERCIALIZADORA PHAX S.A administration or are likely to be known by the latter by virtue of commercial relations or in the development of its corporate purpose that must be applied to the other entities part of the company to which it belongs, commercial alliances, conventions or advertising events  COMERCIALIZADORA PHAX SA as of its operators. In the first case, COMERCIALIZADORA PHAX S.A. will act as responsible, in other cases may have the status of manager or responsible, depending on whether it receives the databases from itself or from a third party.

 

Likewise, it will be applicable when the data processing takes place in Colombian territory. As well as, when the person in charge or the person in charge of the treatment does not reside in Colombia, but by virtue of international norms or treaties the Colombian legislation is applicable.

 

XIV. RIGHT OF HABEAS DATA.

 

Art.15 of the C.P. establishes the right that all persons have to know, update and rectify the information that has been collected about them in databases or files from both public and private entities.

 

Likewise, and in accordance with the C-748 of 2011 of the Constitutional Court, this right includes other powers such as authorizing treatment, including new data, excluding or deleting them from a database or file.

 

This right was developed in a jurisprudential manner from 1991 to 2008, in which the Special Law of Habeas Data was issued, which regulates what has been termed as "financial habeas data", understood as the right that has Every individual to know, update and rectify their personal commercial, credit, and financial information contained in public or private information centers, whose function is to collect, process and circulate these data in order to determine the level of financial risk of its owner . This special law considers as the holder of the information both natural and legal persons.

 

Subsequently, on October 17, 2012, Law 1581 "General of Protection of Personal Data" was issued, which develops the right of Habeas Data from a broader perspective than the financial and credit mentioned above. In such a way, that any owner of personal data has the power to control the information that of itself has been collected in any database or file, managed by private or public entities. Under this General Law, the natural person is the owner.

 

XV NATIONAL REGISTER OF POLICIES AND / OR DATABASES

 

It is the public database directory subjected to treatment that operate in the country, and will be freely available to citizens.

 

PHAX TRADING COMPANY S.A. will record its policies and / or databases for the competent administrative authority, at the time and place it establishes.

 

XVI. HOLDERS RIGHTS

 

  1. a) Go to COMERCIALIZADORA PHAX S.A., through the established channels, which are indicated in the data privacy notice, in order to know, update and rectify your personal data. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized. b) Request authorization proof granted to COMERCIALIZADORA PHAX S.A. except when, in accordance with the Law, the treatment that is being carried out does not require it. c) Be informed by COMERCIALIZADORA PHAX S.A. regarding the use given to personal data collected upon request of the owner, presented through the channels provided for such purposes. d) Submit complaints to the Superintendence of Industry and Commerce for infractions of Law 1581 of 2012 and its regulatory decrees. e) Revoke authorization, in those cases that are not framed under Law 1266 of 2008, and / or request data deletion when principles, rights and constitutional and legal guarantees are not respected. f) Access to your personal data free of charge through the channels provided by COMERCIALIZADORA PHAX S.A.

COMERCIALIZADORA PHAX S.A., will inform about the channels and procedures provided so that the holder can exercise his rights effectively through data privacy notice.

 

XVII. CHANNELS OF SUPPLY OF INFORMATION

 

COMERCIALIZADORA PHAX S.A establishes the following communication channels with the holders:

Website: www.phax.com.co

Email: finanzas@phax.com.co

Physical post: Cra. 51 # 5A sur - 20- MEDELLÍN, ANTIOQUIA, COLOMBIA.

Telephone line: (4) 3600660

XVIII. CONSULTATIONS AND CLAIMS

 

The queries and claims made to COMERCIALIZADORA PHAX S.A. should be directed to the email: finanzas@phax.com.co. In case of additional information, the interested party may call (4) 360 06 60 or go to Carrera 51 No 5 A Sur 20 MEDELLÍN, ANTIOQUIA, COLOMBIA.

XIX CONSULTATIONS

 

Queries made by the owner of the personal data or his successors, will be handled by COMERCIALIZADORA PHAX SA, within a maximum term of ten (10) business days from the receipt of the respective request, which may be extended for five (5) business days maximum, having COMERCIALIZADORA PHAX SA informed the interested party in advance.

 

  1. CLAIMS

 

The owner or his successors who consider that the information contained in the database of COMERCIALIZADORA PHAX S.A. must be subject to correction, update or deletion, or when they notice the alleged breach of any of the duties contained in the Law or in this policy, may submit a claim, which will be processed under the following rules:

* The claim will be formulated by means of a request addressed to the administrative area, with the identification of the owner, the description of the facts that give rise to the claim, the address, and the attached documents that are required.

* The maximum term to attend the claim will be fifteen (15) business days from the day following the date of receipt, which may be extended for a maximum term of eight (8) business days, when it is not possible respond to the claim within said term, the administrative area having to inform the interested party of the reasons for the delay.

* If the claim is incomplete, the interested party will be required within five (5) business days following receipt of the claim to correct the faults. If after two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been abandoned.

* In case the person who receives the claim is not competent to resolve it, he / she will transfer it to the assigned area within a maximum term of two (2) business days and will inform the interested party of the situation.

* Before going to the entity in charge of monitoring compliance with the rules on protection of personal data, the owner must initially process his claim with COMERCIALIZADORA PHAX S.A. through the means and channels provided for that purpose.

 

XXI. LEVEL OF SECURITY MEASURES APPLIED TO TREATMENT.

 

COMERCIALIZADORA PHAX S.A has an area that ensures compliance with the required requirements in terms of information security.

It has been established that clauses that clearly establish the duty of the latter to guarantee the security and privacy of the owner's information are included in the contracts concluded with the managers.

XXII. APPLICABLE LEGISLATION

 

* Political Constitution of Colombia, articles 15 and 20.

* Law 527 of 1999

* Law 1266 of 2008.

* Law 1273 of 2009.

* Statutory Law 1581 of October 17, 2012.

* Regulatory Decrees 1727 of 2009,2952 of 2010, 1377 of 2013 and 886 of May 13 of 2014

* Judgment C-748 of 2011 of the Constitutional Court

XXIII. ENTRY INTO EFFECT AND MODIFICATION

 

This policy is modified from March 1, 2017 and will be valid while COMERCIALIZADORA PHAX S.A. exercise its corporate purpose in Colombia, or until the Law provides otherwise

This policy may be modified at any time and unilaterally by COMERCIALIZADORA PHAX S.A., and must duly inform the owners of the personal data, such modifications.

The policies, as instructed by the Superintendence of Industry and Commerce, will be published in accordance with the provisions of said Entity.