.png)
1. OBJECT.The purpose of this manual is to define the guidelines for the implementation, monitoring, support and continuous improvement of Shepha Realty's Personal Data Protection Program.
2. APPLICABLE LEGISLATION.This manual was prepared taking into account the provisions contained in articles 15 and 20 of the Political Constitution, Law 1581 of 2012 "By which general provisions are issued for the protection of personal data".
3. SCOPE. Services and solutions IP SAS, identified with NIT 900.345.534-7, with main address in the city of Bogotá at Diag. 77B # 119A 73 Poblado Sevilla, hereinafter referred to as "S&S IP SAS", in the role of responsible or in charge of the processing of personal data, is committed to the proper processing of the data of its employees, customers, suppliers and the third parties. Therefore, in this document the procedures and activities that involve the processing of personal data are articulated, which are aligned with the rules and guidelines that regulate it.
4. INFORMATION SECURITY. "S&S IP SAS" strives to protect its users as well as ourselves from unauthorized access or any unauthorized modification, disclosure or destruction of the information we hold.
Data transmission over the Internet or any wireless network cannot be guaranteed to be 100% secure. As a result, while we try to protect your personal information, we cannot ensure or warrant the security of any information you transmit to “S&S IP SAS”, so you do so at your own risk.
In particular:
• We encrypt some of our web services using the SSL (Secure Sockets Layer) security protocol, technology to protect any confidential information that is transferred between users and websites, or between two systems.
• We have certain controls over our information systems that allow us to maintain a better quality of your information.
• We review our information collection, storage, and processing practices, including our physical security measures, to protect against unauthorized access to systems.
• We restrict access to the personal information we hold about our customers and/or users, to employees and contractors who need to know such information in order to process it for us, and who are subject to strict contractual confidentiality obligations and may be sanctioned or terminated if do not meet these obligations.
5. STORAGE OF YOUR PERSONAL DATA. Said data remains stored on external servers that are being guarded permanently through the use of optimal information security tools, reasonably accepted in the industry and access control procedures, among others, in order to prevent unauthorized access. .
6. GENERAL PROVISIONS FOR OBTAINING THE AUTHORIZATION. All capture, collection, use and storage of personal data carried out by "S&S IP SAS" in the development of its activities, and for those purposes set forth in the Personal Data Protection Policy, requires free, prior, express consent from the owners. , unequivocal and informed.
For this purpose, "S&S IP SAS" has made available to the holders the authorization for the processing of their personal data in the various scenarios in which the data is captured, both physically and digitally, through coverage in models of authorizations or privacy notices where the owner is informed about the capture of their personal data, the treatment to which they will be subjected, including the purposes, their rights, the channels for exercising their rights and the information related to the Privacy Policy. Personal information.
In all cases, obtaining the authorization will be carried out under the different modalities established by law, taking into account the nature of each of the information capture channels, and the way in which it is obtained, that is, whether it is through a written channel, a verbal one or through unequivocal conduct.
It is important to take into consideration that in all cases the "S&S IP SAS" must safeguard the authorizations obtained for the processing of personal data, since this is part of the tests required by the Superintendency of Industry and Commerce. Thus, the physical formats where there are authorizations, the record of calls or the web forms in which traceability is given on the acceptance of the treatment must be kept. Document retention of authorizations will be aligned with the Document Retention Tables of S&S IP SAS according to the type of document that contains them or to which they are associated.
6.1 Content of privacy notices. In accordance with the regulatory provisions, the privacy notices through which the authorization of the owners is obtained must have the following elements:
a) Name or company name and contact details of the data controller
b) The Treatment to which the data will be submitted and its purpose.
c) The rights that assist the holder.
d) The mechanisms provided by the person in charge so that the owner knows the information processing policy. e) In all cases, you must inform the Holder how to access or consult the Information Treatment policy
6.2 Authorization in Formats. The personal data processing authorization models can be processed through web formats or physical documents.
6.2.1 Authorization in Web Formats. The areas that, in the exercise of their functions, or because they carry out initiatives that involve the collection of personal data through web forms, must take into account the following aspects necessary for its capture:
a) Request only those personal data necessary in accordance with the purpose of the treatment.
b) Relate in the format, a privacy notice that incorporates the authorization of the treatment by the owner.
c) The sending of the information through the form must be conditioned to the prior acceptance of the data processing authorization.
d) Validate that all the treatment purposes associated with the capture of personal data are found in the privacy notice.
e) Validate that the platform that supports the web form has the technical, operational and security capacity to store the authorizations, and to be able to trace them. Preferably, the date on which the authorization was obtained should be included.
6.2.2 Authorization in physical formats. The areas that carry out initiatives that involve the collection of personal data through physical forms must take into account the following aspects:
a) Request only those personal data necessary in accordance with the purpose of the capture.
b) Relate in the format, a privacy notice that includes the authorization of data processing.
c) In order for "S&S IP SAS" to process the data captured in the form, the owner must give authorization. In the event that the holder has not authorized, it must be analyzed independently.
d) Validate that all the processing purposes associated with the capture of the requested data are found in the privacy notice. PERSONAL DATA PROTECTION PROCEDURES MANUAL
e) Guarantee the custody of the forms with their respective authorizations.
6.3 Authorization to take images (video and photographs)
6.3.1 Authorization for events. In order to comply with the legal provisions for the processing of private data such as the image, "S&S IP SAS" will have privacy notices at the entrance of the auditoriums or places intended for such activities.
Notwithstanding the foregoing, the promoting area of the event must ensure proper compliance with the guidelines established on the protection of personal data, for which, at the beginning of each presentation, an informative slide on the capture of the image and the purposes must be included. of treatment.
6.3.2 Authorization for private activities. Among the activities carried out by "S&S IP SAS", there are those in which third parties participate, whose image can be captured by video or photography. The area in charge of data processing will manage the owner's authorization for the use of his image, guaranteeing its safekeeping.
It is important to mention that the image of the employees does not require additional authorization, since "S&S IP SAS" has coverage in the contracts, respectively.
Finally, in each case, the analysis must be carried out on the image that "S&S IP SAS" will keep, since, if it has copyright implications, the author's consent must also be obtained to make use of it.
6.4 Custody of the authorization. Each area of "S&S IP SAS" that actively processes personal data must guarantee the custody and storage of the authorization for data processing. Likewise, they must be made available to the Superintendence of Industry and Commerce in the event that it requires it.
7. RECEIPT OF YOUR INFORMATION / USE OF YOUR INFORMATION.
7.1. The private information of users and/or clients is, in principle, intended for the provision of the service for which it was linked.
7.2. When you submit a support request and/or claim, we may ask you for personal information.
7.3. We may ask you for personal information at other times, and you are free to provide it or not.
7.4. We may automatically receive and record information in our server logs from your browser, including your IP address, your computer name, the type and version of your web browser, referral addresses and so on. We can also record the visits you make to any of the websites or applications to which you enter that are owned by "S&S IP SAS".
7.5. In general, we will not disclose your personal information to unaffiliated third parties without your express consent.
7.6. There may be circumstances where we may need to disclose personal information about a user and/or customer. These reasons are: Employing other companies to perform functions on our behalf, such as fulfilling orders, providing customer service, sending email and correspondence, processing credit card payments, processing currency conversions, contracting of servers located inside or outside the Country (Colombia), or other functions necessary for our business.
7.7. The obligations included in these practices on the care or handling that "S&S IP SAS" must give to the personal information of its clients and/or users do not apply when the information is required by a public or administrative entity in the exercise of its legal functions. or by court order.
7.8. The Information provided by Clients and/or Users may be used by "S&S IP SAS" in accordance with the provisions of these practices and in order to: (i) Provide required services and products; (ii) Inform about new products or services that are related or not to the one contracted or acquired by the client; (iii) Comply with obligations contracted with our clients; (iv) Report changes to our products or services; (v) Evaluate the quality of the service, (vi) Carry out internal studies on consumption habits, (vii) Send to physical mail, email, cell phone or mobile device, – via text messages (SMS and/or MMS) commercial information, advertising or promotional information about the products and/or services, events and/or promotions of a commercial or non-commercial nature, in order to promote, invite, direct, execute, inform and, in general, carry out campaigns, promotions or contests of a commercial or advertising nature. (viii) Sharing, including the transfer and transmission of your personal data to third countries for the purposes related to the operation.
7.9. In the event of a sale of most of the company's assets, customer and/or user information may be transferred to the buyer as part of the business establishment;
8. KNOWING, UPDATING AND RECTIFYING USERS' PERSONAL INFORMATION.
At any time, customers and/or users may request "S&S IP SAS" as the person responsible for personal data, to provide information about them, to update them, to rectify them, as well as to include new data if it is their wish, delete them or exclude them from the database unless the data is absolutely necessary for the provision of the service to which the client and/or user is registered and/or enrolled and wants to remain in it, otherwise, it will be disassociated and/or inactivated. totally the same.
If the user and/or client wishes to exercise their rights and therefore update, rectify, delete, among others, they must send an email to comunicacion@serviciosysolucionesip.com
9. RIGHTS OF CUSTOMERS AND/OR USERS (1581 OF 2012, ARTICLE 8).
• Know, update and rectify your personal data in front of the Treatment Managers or Treatment Managers. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Treatment is expressly prohibited or has not been authorized;
• Request proof of the authorization granted to the Treatment Manager except when expressly excepted as a requirement for Treatment, in accordance with the provisions of article 10 of this law;
• Be informed by the Treatment Manager or the Treatment Manager, upon request, regarding the use that has been given to your personal data;
• Submit complaints to the Superintendency of Industry and Commerce for infractions of the provisions of this law and the other regulations that modify, add or complement it;
• Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that in the Treatment the Responsible or Person in Charge has incurred in conduct contrary to this law and the Constitution;
• Free access to your personal data that has been processed.
10. CUSTOMER SERVICE.
For inquiries, claims, complaints or for the exercise of the rights of the user or client, you can contact "S&S IP SAS" at the email comunicacion@serviciosysolucionesip.com or call the telephone line 3812878 extension 201 of the city of Bogotá,
Once the User and/or client submits a request of the aforementioned, S&S IP SAS will have up to fifteen (15) business days to respond. In any case, "S&S IP SAS" may be subject to the terms established by law.
11. VALIDITY.
The client and/or User accepts and acknowledges that this authorization will be in force from the moment it was accepted and during the time that S&S IP SAS carries out the activities of its corporate purpose.