1.     LEGAL REGULATIONS AND SCOPE OF APPLICATION: This Personal Data Processing Policy is prepared in accordance with the provisions of the Political Constitution, Law 1581 of 2012, its regulatory decrees and other complementary provisions and will be applied without distinction jointly or individually. by KARROT COLOMBIA S.A.S., a company identified with NIT 901726090-8 (“KARROT”), regarding the collection, storage, use, circulation, deletion and all those activities that constitute processing of personal data.

 

2.     DEFINITIONS: For the purposes of the execution of this policy and in accordance with legal regulations, the following definitions will be applicable:

 

a.     Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data;

 

b.     Privacy notice: Physical, electronic document or any other format generated by the Controller that is made available to the Owner for the processing of their personal data. In the Privacy Notice, the Owner is informed of the information regarding the existence of the information processing policies that will be applicable, the way to access them and the purpose of the treatment that is intended to be given to personal data;

 

c.     Database: Organized set of personal data that is subject to Processing;

 

d.     Personal data: Any information linked or that can be associated with one or several specific or determinable natural persons;

 

e.     Public data: It is the data classified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Public are, among others, data relating to the marital status of people, their profession or trade, their status as a merchant or public servant and those that can be obtained without any reservation. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins;

 

f.      Private data: It is the data that, due to its intimate or reserved nature, is only relevant to the owner;

 

g.     Sensitive data: Sensitive data is understood to be data that affects the privacy of the Owner or whose improper use may lead to discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data;

 

h.     Data Processor: Natural or legal person, public or private, who, by themselves or in association with others, carries out the Processing of personal data on behalf of the Data Controller;

 

i.       Responsible for the Treatment: Natural or legal person, public or private, who alone or in association with others, decides on the database and/or the Processing of the data;

 

j.       Owner: Natural person whose personal data is the subject of Treatment;

 

k.     Treatment: Any operation or set of operations on personal data, such as their collection, storage, use, circulation or deletion.

 

3.     PURPOSE FOR WHICH THE COLLECTION OF PERSONAL DATA AND THE PROCESSING OF THESE IS CARRIED OUT: KARROT may use personal data to:

 

a.     Execute the contractual and commercial relationship with its users, clients, suppliers and workers;

 

b.     Provide the services and/or products required by its users;

 

c.     Inform about new products or services and/or changes in them;

 

d.     Evaluate the quality of the service;

 

e.     Conduct internal research on consumer habits;

 

f.      Send to physical, electronic, cell phone or mobile device, via text messages (SMS and/or MMS) or through any other analog and/or digital means of communication created or to be created, commercial, advertising or promotional information about the products and/or services, own or third parties, events and/or promotions of a commercial nature or not, in order to promote, invite, direct, execute, inform and, in general, carry out campaigns, promotions or contests of commercial or advertising nature, advanced by KARROT and/or by third parties;

 

g.     Develop the selection, evaluation, and job placement process;

 

h.     Support internal or external audit processes;

 

i.       Register the information of employees and/or pensioners (active and inactive) in the KARROT databases;

 

j.       Provide, share, send or deliver your personal data to affiliated, linked, or subordinate companies of KARROT located in Colombia or any other country in the event that said companies require the information for the purposes indicated here.

 

k.     Evaluate the background and suitability of KARROT users, directly or indirectly.

 

l.       Provide benefits to users that KARROT unilaterally determines.

 

m.    Make “know your customer” evaluations that are determined for the creation of users. These evaluations may include a review of databases from the attorney general’s office, prosecutor’s office, restrictive lists, press media, among others.

 

Regarding the data (i) collected directly at the KARROT security points, (ii) taken from the documents that people provide to the security personnel and (iii) obtained from the video recordings that are made inside or outside the facilities of KARROT, these will be used for security purposes of the people, assets and facilities of KARROT and may be used as evidence in any type of process.

 

If personal data is provided, said information will be used only for the purposes indicated here and, therefore, KARROT will not proceed to sell, license, transmit, or disclose it, unless:

 

a.     There is express authorization to do so;

 

b.     It is necessary to allow contractors or agents to provide the entrusted services;

 

c.     It is necessary in order to provide services and/or products of KARROT or third parties;

 

d.     It is necessary to disclose it to entities that provide marketing services on behalf of KARROT or to other entities with which there are joint market agreements;

 

e.     The information is related to a merger, consolidation, acquisition, divestiture, or other corporate restructuring process;

 

f.      That is required or permitted by law.

 

KARROT may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is actually outsourced to third parties or personal information is provided to third-party service providers, KARROT warns said third parties about the need to protect said personal information with appropriate security measures.

 

4.     PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA: The processing of personal data at KARROT will be governed by the following principles:

 

a.     Principle of purpose: The Processing of the personal data collected must obey a legitimate purpose, which must be informed to the Owner;

 

b.     Principle of freedom: Treatment can only be carried out with the prior, express and informed consent of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that requires consent;

 

c.     Principle of truthfulness or quality: The information subject to Treatment must be truthful, complete, exact, updated, verifiable and understandable. The Processing of partial, incomplete, fragmented or misleading data will not be carried out;

 

d.     Principle of transparency: In the Treatment, the right of the Owner to obtain from KARROT at any time and without restrictions, information about the existence of data that concerns him or her must be guaranteed;

 

e.     Principle of restricted access and circulation: Treatment is subject to the limits derived from the nature of the personal data, the provisions of this law and the Constitution. Personal data, except public information, and the provisions of the authorization granted by the data owner, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only. to the Owners or authorized third parties;

 

f.      Security principle: The information subject to Processing by KARROT must be protected through the use of technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, unauthorized use or access or fraudulent;

 

g.     Principle of confidentiality: All persons involved in the Processing of personal data are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks included in the Processing has ended.

 

First Paragraph: In the event that sensitive personal data is collected, the Owner may refuse to authorize the Treatment of it.

 

5.     RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA: In accordance with Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, the following information is set out regarding the person responsible for the processing of personal data:

 

a.     Company name of the person responsible for the treatment: KARROT COLOMBIA S.A.S.

 

b.     Email of the person responsible for the treatment: contacto.colombia@karrotpos.com

 

c.     Period of validity of the database: All information collected about users will be stored by the person responsible for data processing (KARROT) for a period of 5 years, counted from the same day on which the information is provided. After five (5) years it will be deleted by the person responsible for data processing.

 

6.     RIGHTS OF THE HOLDERS OF PERSONAL DATA SUBJECT TO PROCESSING BY KARROT: The Holders of personal data themselves or through their representative and/or attorney or their successor in title may exercise the following rights, with respect to personal data that are object of treatment by KARROT:

 

a.     Right of access, by virtue of which you may access personal data that is under the control of KARROT, for the purposes of consulting it free of charge at least once every calendar month, and whenever there are substantial modifications to the Data Processing Policies. the information that motivates new queries;

 

b.     Right to update, rectify and delete, by virtue of which you may request the updating, rectification and/or deletion of the personal data being processed, in such a way that the purposes of the processing are satisfied;

 

c.     Right to request proof of authorization, except in events in which, according to current legal regulations, authorization is not required to carry out the treatment;

 

d.     Right to be informed regarding the use of personal data;

 

e.     Right to file complaints with the Superintendency of Industry and Commerce for violations of the provisions of current regulations on the processing of personal data;

 

f.      Right to require compliance with orders issued by the Superintendency of Industry and Commerce.

 

7.     MINOR AND SENSITIVE DATA: In the event that data from minors is received, KARROT will follow the parameters established by the regulations. It is made clear that the handling of minors’ data will always be done for their benefit and in all cases with respect for the best interests of children and adolescents and their fundamental rights. KARROT, as far as possible, does not process Sensitive Data, however, if required, they have established the possibility so that the Data Owner does not have to respond to questions or circumstances that may involve this category of data.

 

First Paragraph: For the purposes of exercising the rights described above, both the Owner and the person who represents him or her must demonstrate their identity and, if applicable, the capacity by virtue of which they represent the Owner.

 

Second Paragraph: The rights of minors will be exercised through the people who are authorized to represent them, who will be the guarantor of the defense of their rights.

 

8.     DUTIES OF KARROT: All those obliged to comply with this Policy must keep in mind that KARROT is obliged to comply with the duties imposed by Law in this regard. Consequently, the following obligations must be met:

 

a.     Duties when acting as responsible:

 

                                      i.     Request and keep, under the conditions provided in this Policy, a copy of the respective authorization granted by the Owner.

 

                                     ii.     Inform the Owner clearly and sufficiently about the purpose of the collection and the rights granted to him by virtue of the authorization granted.

 

                                    iii.     Inform at the request of the Owner about the use given to his personal data.

 

                                    iv.     Process queries and claims made in the terms indicated in this Policy.

 

                                     v.     Ensure that the principles of truthfulness, quality, security and confidentiality are adhered to in the terms established in the following Policy.

 

                                    vi.     Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

 

                                   vii.     Update information when necessary.

 

                                  viii.     Rectify personal data when appropriate.

 

b.     Duties when acting as Personal Data Processors. If KARROT carries out data processing on behalf of another entity or organization (Controller), it must comply with the following duties:

 

                                      i.     Establish that the Data Controller is authorized to provide the personal data that will be processed as Processor.

 

                                     ii.     Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.

 

                                    iii.     Preserve the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

 

                                    iv.     Timely update, rectify or delete the data.

 

                                     v.     Update the information reported by the Data Controllers within five (5) business days from receipt.

 

                                    vi.     Process queries and claims made by the owners in the terms indicated in this Policy.

 

                                   vii.     Register in the database the legend “claim in process” in the manner established in this Policy.

 

                                  viii.     Insert in the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data.

 

                                    ix.     Refrain from circulating information that is being controversial by the Owner and whose blocking has been ordered by the Superintendency of Industry and Commerce.

 

                                     x.     Allow access to the information only to people authorized by the Owner or empowered by law for this purpose.

 

                                    xi.     Inform the Superintendence of Industry and Commerce when violations of security codes occur and there are risks in the administration of the owners’ information.

 

                                   xii.     Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

 

c.     Duties when you carry out the treatment through a Processor.

 

                                      i.     Provide the Data Processor only with personal data whose processing is previously authorized. For the purposes of the national or international transmission of data, a contract for the transmission of personal data must be signed or contractual clauses agreed upon as established in article 25 of decree 1377 of 2013.

 

                                     ii.     Guarantee that the information provided to the Data Processor is true, complete, accurate, updated, verifiable and understandable.

 

                                    iii.     Communicate in a timely manner to the Data Processor all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it remains updated.

 

                                    iv.     Inform the Data Processor in a timely manner of the rectifications made to the personal data so that he or she can proceed to make the pertinent adjustments.

 

                                     v.     Demand that the Data Processor, at all times, respect the security and privacy conditions of the Owner’s information.

 

                                    vi.     Inform the Data Processor when certain information is under discussion by the Owner, once the claim has been submitted and the respective process has not been completed.

 

d.     Duties regarding the Superintendence of Industry and Commerce.

 

                                      i.     Inform you of possible violations of security codes and the existence of risks in the administration of the Owners’ information.

 

                                     ii.     Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

 

9.     REQUEST FOR AUTHORIZATION FROM THE OWNER OF THE PERSONAL DATA: In advance and/or at the time of collecting the personal data, KARROT will request the Owner of the data for Authorization to carry out its collection and Processing, indicating the purpose for which the data is requested. data, using for these purposes automated technical means, written or oral, that allow preserving proof of the Authorization and/or the unequivocal conduct described in article 7 of Decree 1377 of 2013. Said Authorization will be requested for the time that is reasonable and necessary to satisfy the needs that gave rise to the request for the data and, in any case, in compliance with the legal provisions that govern the matter.

 

10.  PRIVACY NOTICE: In the event that KARROT is unable to make this information processing policy available to the owner of the personal data, it will publish the Privacy Notice attached to this document, the text of which will be kept for later consultation. by the Owner of the data and/or the Superintendency of Industry and Commerce.

 

11.  TEMPORARY LIMITATIONS ON THE PROCESSING OF PERSONAL DATA. KARROT may only collect, store, use or circulate personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the Treatment, taking into account the provisions applicable to the matter in question and the administrative and accounting aspects. , fiscal, legal and historical information. Once the purpose(s) of the processing have been fulfilled and without prejudice to legal regulations that provide otherwise, they will proceed to delete the personal data in their possession. Notwithstanding the foregoing, personal data must be preserved when required to comply with a legal or contractual obligation, including the preservation of personal data for the purposes of making tax exogenous reports, or any tax obligation arising from the applicable law. Likewise, the data will be preserved as long as there are balances in favor of money in favor of the owners or KARROT, as they are tied to a current contractual obligation.

 

12.  12. AREA RESPONSIBLE AND PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF THE OWNERS OF THE PERSONAL DATA: The administrative area of KARROT will be responsible for addressing the requests, complaints and claims formulated by the owner of the data in the exercise of the rights contemplated in the Article 6 of this Policy, except for that described in literal e). For these purposes, the owner of the personal data or whoever represents it may send their request, complaint or claim to the KARROT offices or through the website or mobile application.

 

The request, complaint or claim must contain (i) the identification of the Owner, (ii) the description of the facts that give rise to the claim, (iii) the way to contact the Owner, and (iv) the documents that you want to make. to worth. If the claim is incomplete, the interested party will be required within five (5) business days following receipt of the claim to correct the deficiencies. After two (2) months from the date of the request, without the applicant presenting the required information, it will be understood that he has withdrawn the claim.

 

In the event that the person receiving the claim is not competent to resolve it, she will forward it to the appropriate person within a maximum period of two (2) business days and will inform the interested party of the situation. Once the complete claim is received, a legend that says “claim in process” and the reason for this will be included in the database within a period of no more than two (2) business days. Said legend must be maintained until the claim is decided. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

 

13.  SECURITY MEASURES: In development of the security principle established in Law 1581 of 2012, KARROT will adopt the technical, human and administrative measures that are necessary to provide security to the records, preventing their adulteration, loss, consultation, use or unauthorized access. authorized or fraudulent. The personnel who process personal data will execute the established protocols in order to guarantee the security of the information.

 

14.  AUTHORIZATION FOR CONSULTATION AND REPORTS. The User declares that the information that he has provided on the Platform and during the commercial relationship is true and gives his express and irrevocable consent to the Provider to:

 

a.     Consult, at any time, in any risk center or database, such as the information center of financial entities in Colombia or DataCrédito or any other financial and credit information operator, all the relevant information to carry out risk studies. credit at any of its stages and for carrying out marketing campaigns and offering products.

 

b.     Report to any risk center or database, such as the information center of financial entities in Colombia or DataCrédito or to any risk information center, data on compliance or non-compliance with their credit, commercial or service obligations or their legal duties of patrimonial content, and their location and contact data, in accordance with the limits provided in Law 1266 of 2008.

 

c.     Provide any risk center or database, such as the information center of financial entities in Colombia or DataCrédito or any other risk information center with data related to your credit applications, as well as others related to your commercial relationships, financial and generally socioeconomic information that the User has provided.

 

15.  LAW AND JURISDICTION: Any interpretation, judicial or administrative action derived from the processing of personal data will be subject to the personal protection regulations established in the Republic of Colombia and the competent administrative or jurisdictional authorities for the resolution of any concern, complaint or demand on them will be those of the Republic of Colombia.

 

16.  EFFECTIVE DATE: This Personal Data Policy comes into effect upon its publication on its website.

 

NOTICE OF PRIVACY

 

PURPOSE FOR WHICH THE COLLECTION OF PERSONAL DATA AND THE PROCESSING OF THESE IS CARRIED OUT: KARROT COLOMBIA S.A.S. may use personal data to:

 

a.     Execute the contractual and commercial relationship with its users, clients, suppliers and workers;

 

b.     Provide the services and/or products required by its users;

 

c.     Inform about new products or services and/or changes in them;

 

d.     Evaluate the quality of the service;

 

e.     Conduct internal research on consumer habits;

 

f.    Send to physical, electronic, cell phone or mobile device, via text messages (SMS and/or MMS) or through any other analog and/or digital means of communication created or to be created, commercial, advertising or promotional information about the products and/or services, own or third parties, events and/or promotions of a commercial nature or not, in order to promote, invite, direct, execute, inform and, in general, carry out campaigns, promotions or contests of commercial or advertising nature, advanced by KARROT and/or by third parties;

 

g.     Develop the selection, evaluation, and job placement process;

 

h.     Support internal or external audit processes;

 

i.       Register the information of employees and/or pensioners (active and inactive) in the KARROT databases;

 

j.       Provide, share, send or deliver your personal data to affiliated, linked, or subordinate companies of KARROT located in Colombia or any other country in the event that said companies require the information for the purposes indicated here.

 

k.     Evaluate the background and suitability of KARROT users, directly or indirectly.

 

l.       Provide benefits to users that KARROT unilaterally determines.

 

m.    Make “know your customer” evaluations that are determined for the creation of users. These evaluations may include a review of databases from the attorney general’s office, prosecutor’s office, restrictive lists, press media, among others.

 

Regarding the data (i) collected directly at the KARROT security points, (ii) taken from the documents that people provide to the security personnel and (iii) obtained from the video recordings that are made inside or outside the facilities of KARROT, these will be used for security purposes of the people, assets and facilities of KARROT and may be used as evidence in any type of process.

 

If personal data is provided, said information will be used only for the purposes indicated here and, therefore, KARROT will not proceed to sell, license, transmit, or disclose it, unless:

 

g.     There is express authorization to do so;

 

h.     It is necessary to allow contractors or agents to provide the entrusted services;

 

i.       It is necessary in order to provide services and/or products of KARROT or third parties;

 

j.       It is necessary to disclose it to entities that provide marketing services on behalf of KARROT or to other entities with which there are joint market agreements;

 

k.     The information is related to a merger, consolidation, acquisition, divestiture, or other corporate restructuring process;

 

l.       That is required or permitted by law.

 

KARROT may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is actually outsourced to third parties or personal information is provided to third-party service providers, KARROT warns said third parties about the need to protect said personal information with appropriate security measures.

 

RIGHTS OF THE HOLDERS OF PERSONAL DATA SUBJECT TO PROCESSING BY KARROT: The Holders of personal data themselves or through their representative and/or attorney or their successor in title may exercise the following rights, with respect to personal data that are object of treatment by KARROT:

 

a.     Right of access, by virtue of which you may access personal data that is under the control of KARROT, for the purposes of consulting it free of charge at least once every calendar month, and whenever there are substantial modifications to the Data Processing Policies. the information that motivates new queries;

 

b.     Right to update, rectify and delete, by virtue of which you may request the updating, rectification and/or deletion of the personal data being processed, in such a way that the purposes of the processing are satisfied;

 

c.     Right to request proof of authorization, except in events in which, according to current legal regulations, authorization is not required to carry out the treatment;

 

d.     Right to be informed regarding the use of personal data;

 

e.     Right to file complaints with the Superintendency of Industry and Commerce for violations of the provisions of current regulations on the processing of personal data;

 

f.      Right to require compliance with orders issued by the Superintendency of Industry and Commerce.

 

PERSONAL DATA PROCESSING POLICY: It can be consulted at the physical facilities of KARROT COLOMBIA SAS and on its website.

 

The ADMINISTRATIVE AREA of KARROT SAS will be responsible for addressing the requests, complaints and claims made by the data owner in exercise of the rights contemplated in section 6 of the Personal Data Processing Policy, with the exception of that described in its literal e). For these purposes, the owner of the personal data or whoever represents it may send their request, complaint or claim through the website.