In compliance with the provisions of 1582, 2012 from the statutory law and its regulatory decree 1377 of 2013, Caribbsa S.A adopts the following policy in order to process personal information. Each holder of the collected data will be notified about this policy as well those gathered in the future because of commercial or labor activities.
This means that, Caribbsa S.A. manifests that the company guarantees privacy right, intimacy right and good name when processing personal data, and in consequence, all its actions will be governed by the principles of legality, purpose, freedom, veracity or quality, transparency, access and restricted circulation, security and privacy.
Every person who in development of different comercial contractual and labor activities, amongst others, is permanent or occasional, will provide Caribbsa S.A any kind of information or personal information, may know it, update it and rectify it.
POLICY OF HOLDERS PERSONAL DATA PROTECTION PROCESSING
I. THE IDENTIFICATION OF THE RESPONSIBLE PROCESSING:
INSTITUTION NAME: CARIBBEAN WORLD WIDE SHIPPING AGENCY S.A., which will be referred as Caribbsa, a company with legal status granted by public deed No. 3196 of December 10, 1992, registered on December 23, 1992 under the number 9485 of the respective book, in the Commerce Chamber of Cartagena.
PLACE OF RESIDENCE AND ADDRESS: Caribbsa has its residence in Cartagena, and its main site is located in: Manga Calle 25 No. 24A-16 Bancolombia Building, 2301 Office.
EMAIL ADDRESS: Hseq@caribbsa.com
TELEPHONE: (57) 6649595
II. LEGAL FRAMEWORK:
Colombian constitution.Article 15. Law 1266 of 2008
Law 1581 of 2012
Regulatory Decrees 1727 of 2009 and 2952 of 2010,
Partial Regulatory Decree 1377 of 2013
Sentences C – 1011 of 2008, and C – 748 of 2011, of the Constitutional Court.
III.SCOPE OF APPLICATION
The present policy will be applicable to the personal data registered in any Caribbsa database whose holder is a natural or legal person.
IV. DEFINITIONS
For the purpose of this policy and in accordance with current regulations on the protection of personal information, the following definitions will be taken into account:
Authorization: Prior and informed expressed consent of the Holder to carry out the processing of personal data.
Privacy notice: Verbal or written communication generated by the Responsible, addressed to the holder for processing his personal information, which informs him about the existence of the information process policies that will be applied to him, and how to access to them. And the processing purpose that is intended to give the personal information.
Database: Organized group of personal information that could be subjected to processing.
Successor: Person who has succeed to another because of the death of this one.
(Heir).
Personal information: Any information linked to or associated with one or more specific or determinable natural person.
Public information: It is the information that is not semi-private, private or sensitive are considered public, among other things, The information relating to the people civil status, their profession or function and. By their nature, public information may be contained, amongs others things, in public records, public documents, official gazettes and bulletins, and duly executed judicial ruilings that are not subject to reservation.
Sensitive information: By Sensitive information we mean those that affect the privacy of the Holder or whose use may generate discrimination, such as revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of syndicates, Social organizations, human rights or which promote interests of any opposition political party, as well as information relating to health, sexual life and biometrical data.
Supervisor for the processing: Natural or legal person, public or private, that by itself or in association with others, perform the personal information processing on behalf of the Responsible for the processing.
Responsible for the processing: Natural or juridical person, public or private, that by itself or in association with others, decides on the database and / or the processing of the information.
Holder: Natural person whose personal data are subject to processing.
Processing: Any operation or set of operations on personal information, such as collection, storage, use, circulation or deleting
Transference: The transfer of data takes place when the person responsible for processing personal information, located in Colombia, sends the information or personal information to a receiver, who in turn is responsible for the processing and is inside or outside from the country.
Transmission: The processing of personal information that involves the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a treatment by the manager on behalf of the responsible.
V. PRINCIPLES
In order to guarantee the protection of personal information, Caribbsa will apply in a harmonic and integral manner the following principles, in the light of which have to be performed the processing, transference, and personal information transmission.
Principle of legality in the matter of information processing : The information processing is a regulated activity, which must be subject to the current and applicable legal provisions which govern the subject.
Principle of purpose: the activity of the personal information processing that Caribbsa carries out or to which it has access, will comply a legitimate purpose in consonance with the Political Constitution of Colombia, which must be informed to the respective holder of the personal information.
Principle of freedom: the processing of the personal information can only be carried out with the consent, previous, express and informed of the Holder. Personal information may not be obtained or disclosed without prior authorization, or in the absence of a legal statutory, or judicial mandate that relieves consent.
Principle of veracity or quality: the information subject to Processing of personal information must be truthful, complete, accurate, updated, verifiable and understandable. It is prohibited the processing of partial, incomplete, fractional or misleaded information.
Principle of transparency: In the processing of personal information, Caribbsa will ensure the Holder its right to obtain at any time and without restrictions, information about the existence of any type of information or personal information that is of interest or ownership.
Principle of access and restricted circulation: The processing of personal information is subject to the limits that derive from the nature of these, the provisions of the law and the Constitution. In Consequence, the treatment can only be done by persons authorized by the holder and / or by the persons provided by law. Personal information, except for public information, may not be available on the Internet or other mass advertising channels, unless access is technically controllable to provide restricted knowledge only to holders or third parties authorized by law. In this regard, the processing can only be done by Caribbsa itself, or in association with others, by virtue of the alliances it carries out.
Principle of security: The information subject to processing by Caribbsa, must be handled with the technical, human and administrative measures that are necessary to provide security to the registries avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
Principle of confidentiality: All persons who in Caribbsa, administer, manage, update or have access to information of any kind that is in Databases, are obliged to ensure the reservation of the information, therefore, assume responsibility for conserve and keep strictly confidential and not reveal to third parties all the information they come to know in the execution and exercise of their functions; Except in the case of activities authorized expressly by the data protection law. This obligation persists and will be maintained even after the end of its connection with any of the tasks included in the processing.
VI. RIGHTS OF THE INFORMATION HOLDER
In keeping with the current regulations applicable to information protection, the following are the rights of the owners of the personal information:
a. To access, know, update and rectify your personal data against Caribbsa in its capacity as responsible for the processing. This right may be exercised, among others thing, against partial, inaccurate, incomplete, fractioned, misleading, or those whose processing is expressly prohibited or has not been authorized.
b. To Request evidence of authorization released to Caribbsa for the processing of data, by any valid means, except in cases in which the authorization is not necessary.
c. Shall be informed by Caribbsa, by a request, regarding on the use of their personal information.
d.Submit to the Superintendency of Industry and Commerce, or the entity that makes its turn, complaints for infractions to the provisions of law 1581 of 2012 and other regulations that modify, add or complement, request or consultation procedure before Caribbsa.
e.To revoke the authorization and / or request the elimination of the information when in the processing the principles, rights and constitutional and legal guarantees are not respected.
f.Free access to his personal information that have been processed, at least once every month each calendar, and whenever there are substantial modifications of the present policy that need further consultations.
These rights can be exercised by:
i. The holder, who must prove his identity in sufficient form by the different means that Caribbsa makes available to him.
ii. The assignee’s successors, who must prove such quality.
iii. The representative of the holder, prior accreditation of the representation or empowerment.
iv. Other in favor or for which the holder had stipulated
VII. CHILDREN AND ADOLECENTS RIGHTS
In the processing of personal information will ensure respect for the prevailing rights of minors.
The processing of personal information of minors is prohibited, except for those information that are public in nature, and in this case the processing must comply with the following parameters:
a. To Respond and respect the best interests of minors.
b. Ensure respect for the fundamental rights of minors.
It is the responsibilitty of the State and educational institutions of all types to provide information. And training to legal representatives and tutors on the the type of risks faced by children and adolescents regarding the improper processing of their personal information and provide knowledge About the responsible and safe use by children and adolescents of their personal information, their right to privacy and protection of their personal information and others.
VIII.DUTIES OF CARIBBSA AS RESPONSIBLE AND COMMISSIONED FOR THE PROCESSING OF PERSONAL INFORMATION
Caribbsa recognizes the holding of the personal information held by the persons and accordingly, they can exclusively decide on the same. Therefore, Caribbsa will use the personal information to compliance the purpose expressly authorized by the owner or by current regulations.
In the processing and protection of personal information, Caribbsa will have the following duties, without prejudice to the provisions that regulate or reach regulate this subject:
a. To ensuring the holder, at all times, the full and effective exercise of the right of habeas data.
b. To request and keep, copy of the respective authorization granted by the holder for the processing of personal information.
c. Report the owner about the purpose of the collection and the rights under the authorization granted.
d. Preserve the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
e. Ensure that the information is truthful, complete, accurate, updated, verifiable and understandable.
f. Update the information in a timely manner, responding in this way to all the updates regarding the information of the holder. In addition, all necessary measures must be implemented so that the information is kept updated.
g. Rectify the information when it is incorrect and communicate the pertinent.
h. Respect the conditions of security and the holder privacy information
i. To process the consultations and claims formulated in terms of the law.
j.To identify when certain information is under discussion by the holder.
k.To inform to the holder about the use given to his information.
l. Inform to the data protection authority when there are security codes violations and when there are risks in the administration of the holder information.
m. Comply with the requirements and instructions issued by the Superintendency of Industry and Commerce on the particular subject.
n. Only use information that has been authorized previously, in accordance with the provisions of Law 1581 of 2012.
o. Assure the proper use of the personal information of children and adolescents, in those cases where the processing of their data is authorized.
p. Record in the database the caption “claim in process” as it is regulated by law
q. Insert in the database the caption “information in judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal information.
r.Abstain from circulating information which is being disputed by the holder and whose blockade has been ordered by the Superintendency of Industry and Commerce.
s. Allow information Access only to people who can access it.
t. Use the holder personal information only for those purposes for which is authorized and respecting the current legislation on protection of personal information.
IX.HOLDER AUTHORIZATION AND CONSENT
Caribbsa requires the free, prior, express and informed consent of the holder of the personal information for the processing of the same, except in cases specifically authorized by law, namely:
A. Required information by a public or administrative entity in the exercise of its legal functions or by court order.
B. Information of a public nature.
C. Cases of medical or health emergency.
D. Processing of information authorized by the law for historical, statistical or scientific purposes.
E. Information related to the Civil Registry of Persons
Authorization Manifestation
The authorization to Caribbsa for the processing of personal information will be granted by:
- The holder, who must prove his identity in sufficient address by the different means that Caribbsa makes available to him.
- The successors , who must prove such quality.
- The representative and / or authorized of the holder, prior accreditation of the representation or empowerment.
- Other in favor or for which the holder has stipulated.
Means for granting authorization
Caribbsa will obtain authorization through different means, among which the physical document, electronic, data message, Internet, Websites, or any other format that in any case allows the obtaining of consent through unequivocal conduct whereby it is concluded that If it had not taken effect by the holder or the person entitled to do it, the information would not have been stored in the database. The Authorization will be requested by Caribbsa prior to the processing of personal information.
Authorization Proof
Caribbsa will preserve proof of the authorization granted by the holders of the personal information for its processing, using the mechanisms available to it currently. As well as taking the necessary actions to keep the Record of the date which it was obtained. Consequently Caribbsa may establish physical files or electronic repositories made directly or through third parties hired for this purpose.
Revocation of authorization: The holders of personal information may at any time revoke the authorization given to Caribbsa for the processing of their personal information or request the deletion of the same, as long as there is not prevented by a legal or contractual provision. Caribbsa will establish simple and free mechanisms that allow the holder to revoke their authorization or request the elimination of their personal information, at least by the same medium by which it was granted.
Consequently, it should be taken into account that the revocation of the consent can be expressed, on one side, totally with regard to the authorized purposes, and in conseguence Caribbsa must cease any activity of information processing; And on the other hand, partially on certain types of processing, in which case they will be the ones on which the treatment activities will cease, as well as for advertising purposes, among others. In this case, Caribbsa may continue to process personal information for those purposes with regard to the holder has not revoked their consent.
X. PROCESSING WHICH THE INFORMATION AND THE PURPOSE OF THE SAME WILL BE SUBMITTED
The processing of the personal information of students, applicants, graduates, teachers, employees, former employees, retirees, suppliers, contractors, or any person with whom Caribbsa has established or establish a permanent or occasional relationship, Within the legal framework that regulates the matter and by virtue of its status as a corporation, and will be all those necessary for the fulfillment of the company’s mission.
In any case, personal information may be collected and processed for:
A. To perform the sending of information related to programs, activities, news, contents by area of ??interest, products and other goods or services offered by Caribbsa.
B. Implement the mission of Caribbsa in accordance with its statutes.
C. Comply with applicable standards for suppliers and contractors, including but without limited to tax and commercial.
D. Comply with the provisions of the Colombian legal system in the labour field and social security, among others, applicable to former employees, current employees and candidates for future employment.
E. Comply with all its contractual commitments.
For the children and adolescents personal information processing will be in accordance with the contemplated in the present policy in the apart related to the rights of these.
Sensitive data
In the case of sensitive personal information, Caribbsa may use and processing them when:
A. The holder has given his explicit authorization, except in cases where the law is not required to give such authorization.
B. The processing is necessary to safeguard the vital interest of the Holder and the Holder is physically or legally incapacitated. In such cases, legal representatives must grant their authorization.
C. The processsing is performed in the course of legitimate activities and with appropiate guarantees from the foundation, NGO, association or any other non-profit making organization whose purpose is political, philosophical, and religious. Its members or persons who maintain regular contacts by reason of their purpose. In such cases, the information cannot be supplied to third parties without the authorization of the holder.
D. The processing refers to information that is required for the recognition, exercise or defense of a right in a judicial process.
E. The processing has a historical, statistical or scientific purpose. In such case, the measures must be adopted leading to the elimination of the identity of the holders.
Without prejudice to the exceptions provided for by the law, in the processing of sensible information it is required the prior, express and informed consent of the holder, which must be obtained by any means that may be subject to subsequent consultation and verification.
XI. PRIVACY NOTICE
The Privacy Notice is the physical document, electronic or in any other format, made available to the holder to inform him about the processing of his personal information. Through this document, the holder is informed of the information related to the existence of Caribbsa‘s information
Will be applicable, the way to access them and the characteristics of the processing intended to be given to personal information.
The privacy notice must contain at least the following information:
A. The identity, address and contact details of the holder processing.
B. The type of processing which the information will be subjected and its purpose.
C. The rights of the holder.
D. The general mechanisms provided by the responsible for the holder to know the processing information policy and any substantial changes that produce in it. In all cases, you must inform the holder how to access or consult the policy of information processing.
E. The optional nature of the response related to questions of sensitive data.
XII. RIGHT OF ACCESS GUARANTEES
In order to guarantee the right of access of the information holder, Caribbsa will provide, prior accreditation or legitimacy, or personality of its representative without charge or delivery, in a detailed manner, the corresponding personal information through all kind of mean, including electronic means that allow the direct access of the holder to them. Such access must be offered without limit and should enable the holder to know and update them online.
XIII. PROCEDURE FOR THE ATTENTION OF ENQUIRIES, COMPLAINTS, REQUESTS FOR RECTIFICATION, UPDATE AND SUPPRESSION OF DATA
A. ENQUIRIES
The holders or their successors in title may consult the personal information of the holder who is in Caribbsa, who will provide all the information contained in the individual registration or which is associated to the identification of the Holder.
With regard to the handling of requests for personal information Caribbsa consultation guarantees:
B. COMPLAINTS
The holders of the information or their succesors may present a complaint before Caribbsa when they consider that the information of a database must be corrected, updated or suppressed, or when they notice the allegedly unfullfilment of the duties established by the law.The claim will be processed under the following rules:
1. The complaint of the holder will be presented through a request addressed to Caribbsa to the e-mail: pqr@caribbsa.com or through written communication addressed to the quality department, with the Id of the holder, a description of the facts that support the complaint, the address and the pertinent documents.
If the claim is incomplete, within five (5) days since the claim is received, the interested party will be required to remedy the faults. After two (2) months from the date of the request, if the applicant has not presented the requested information, it will be understood that he has withdrawn the claim. In the event that the person receiving the complaint is not competent to resolve it, it will be transferred to whom it corresponds in a maximum term of two (2) working days and the interested party will be notified.
2. Once the claim is received, it will be catalogued as “Claim in process” and its reasons, in a term of maximum two (2) working days. The mentioned classification will last until the claim is decided.
3. The maximum term to attend the claim will be fifteen (15) working days counted since the day after it is received. When it is not possible to attend the claim within the mentioned term, the interested party will be informed about the reasons of the delay and the date when the clam will be attended. In any case the date of attention cannot exceed the term of eight (8) working days after the expiration of the first term.
c. Updating and/or rectification request.
At the request of the holder, Caribbsa will rectify and update the information that may be incomplete or imprecise, according to the procedure and the terms before mentioned, for which the following items will be taken into consideration:
1. The holder must send the request to the e-mail: pqr@caribbsa.com or a physical request addressed to the quality department showing the update and/or rectification with the pertinent documents.
2. Caribbsa, wil be able to enable mechanisms that facilitate the performance of this right for the holder, as long as they benefit the holder. Therefore, electronic or any other pertinent mean may be enabled.This means will be reported in the privacy announcement and they will be put at the disposal of the interested parties in the website.
d.Request of data elimination
The holder of the personal data has the right to request Caribbsa the elimation of the information in any of the following cases:
1. The holder considers that his information is not treated according to the principles, duties and obligations of the current regulation.
2. The information is no longer necessary or pertinent for the purpose of what it was requested for in the first place.
3. It has expired the term for the compliance of the aim for which the information was requested.
This elimination implies the total or partial elimination of the information according to the holder request in the registers, files, database or treatment performed by Caribbsa. However this right of the holder is not absolute anf therefore Caribbsa may reject the request when:
a. The holder has a legal or contractual duty to remain in the database.
b. The elimination of the data obstructs judicial or administrative activities related to fiscal obligations, investigation and the pursuit of crimes or the update of administrative fines.
c. The data is necessary to protect the legal interests of the holder in order to act based on the public interest or to cumply witch an obligation legally adquired by the holder.
XIV. NATIONAL REGISTER OF DATABASE
For the cases considered by the law, its statutes and internal regulation, Caribbsa reserve the right to keep and catalogue as confidential particular information in their database, according to the current law, its statutes and regulation.
According to the current regulation and the regulation that will be issued by the Colombian government, Caribbsa will proceed to register its database before National Registration Database (NRD) that will be managed by Industry and trade superintendence. The NRD is the public directory of the database subject to processing in the country. Any citizen is free to search in the directory accrding to the regulation that the government issues for that purpose.
XV. SECURITY OF THE INFORMATION AND SECURITY MEASURES.
Obeying the security principle established in the current regulation, Caribbsa will adopt the technical, human and administrative measures needed to provide security for the registers avoinding its falsification, loss, research, use or non-authorized or fraudulent access.
XIV. USE AND INTERNATIONAL TRANSFER OF PERSONAL DATA AND PERSONAL INFORMATION BY Caribbsa.
In compliance with the institutional mission and the strategic development plan of Caribbsa, and taking into account the nature of the permanent or occasional relationships that any holder of personal data may have with Caribbsa,the company may transfer and trasmit all personal data, as long as they meet the legal requirements Applicable; And consequently the holders with the acceptance of this policy, expressly authorize to transfer and transmit, even an international level, personal data. The data are transferred, for all the relationships established with Caribbsa.
For the international transfer of the holder personal data, Caribbsa will take the neccesary measures for the commitment of third parties involved to know the present policy, so they understand that the use of personal data shall be strictly for issues related to Caribbsa and only as long as it lasts and it must not be used for any other different purpose.
For the international transfer of personal data, it will be noted what is established in the article 26 of the law 1581 of 2012. The international transmission of personal data executed by Caribbsa, will not require to be informed to the holder or will not need his approval when there is a contract of personal data transmission in accordace to the article 25 of the decree 1377 of 2013.
Caribbsa also may interchange personal information with government authorities or public authorities (included, other judicial or administrative authorities, fiscal authorities and criminal investigation organisms, civil, administrative, disciplinary and fiscal) and third parties that participate in legal civil procedures and its accountants, auditors, lawyers and other consultants and managers, because it is necessary or appropriate: (a) in order to cumply with the current law included the law different from the residence country; (b) in order to cumply with legal process; (c) in order to answer the requests of the public authorities and the government different from the residence country; (d) in order to make people cumply with our terms and conditions; (e) in order to protect our operations; (f) in order to protect our rights, privacy, security or property, theirs or thirds; and (g) in order to get applicable compensation and to limit damage and harms that can affect us.
XVII. RESPONSIBLE AND IN CHARGE OF THE PROCESSING OF PERSONAL DATA
Caribbsa will be responsible for processing personal data. The quality department will be in charge of processinf personal data for Caribbsa.
XVIII. VALIDITY
The present policy has effect from June 28 of 2017 and invalidate the regulations or special manuals that could have been adopted for administrative request in Caribbsa.
ROQUE MANUEL ROSERO MUÑOZ
Legal Representative.
