Overview

Purpose

This Policy for the Processing of Personal Data is issued in compliance with Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013, Single Decree 1074 of 2015, Resolution 2881 of 2018, and other concordant regulations on the protection of Personal Data, and its purpose is that C-NEUTRAL S.A.S. (hereinafter C-NEUTRAL), in its capacity as responsible for handling the personal information found in its Databases, carry out the Treatment of the same in strict compliance with the applicable regulations, guaranteeing the rights that correspond to its Holders.

Reach

This Information Processing Policy will apply to all organizational processes of C-NEUTRAL that involve the processing of personal data. In this sense, C-NEUTRAL will fully comply with the provisions of this Policy to carry out any behavior that involves the processing of information. And it includes interaction with sites and platforms Related domains below:

Responsible

C-NEUTRAL is the legal entity responsible for the processing of Personal Data contained in its Databases. Your contact details are as follows:

NIT901.426.711-9
Address, cityCalle 94 A # 13-34 Oficina 105 – Bogotá
Phone3183503197 –
Emailadministrativa@C-NEUTRAL.co
Area in chargeAdministrative

Validity of the policy

This Policy enters into force on April 12, 2021 and will be updated under current Colombian laws.

Definitions

  • Authorization: Prior, express and informed consent of the Owner to carry out the Processing of Personal Data.
  • Privacy Notice: Verbal or written communication generated by the Responsible, addressed to the Owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable, how to access them and the purposes of the treatment that is intended to give to personal data.
  • Database: Organized set of Personal Data subject to Treatment.
  • Personal data: Any information linked or that can be associated with one or more determined or determinable natural persons, among others, customers, users, consumers who provide information to C-NEUTRAL.
  • Sensitive Data: Those that affect the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data related to health, sex life and biometric data. In accordance with the law, the Data Controller is not obliged to provide sensitive data.
  • Public Data: Those that are not semi-private, private or sensitive (e.g. data relating to the civil status of persons, their profession or trade and their quality as a merchant or public servant.
  • Data Processor: Natural or legal person, public or private, that by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller.
  • Politics: Refers to this Policy for the Processing of Personal Data.
  • C-NEUTRAL: C-NEUTRAL S.A.S.
  • Responsible for the Treatment: Natural or legal person, public or private, who by itself or in association with others, decides on the database and / or the Treatment of data.
  • Holder: Natural person whose Personal Data are subject to Treatment.
  • Treatment: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

Principles

C-NEUTRAL undertakes to respect the following principles during the Processing of Personal Data contained in its Databases:

  • Purpose: The purposes of the Treatment of Personal Data established in the Privacy Notice that will be communicated in a timely manner to its Owner.
  • Freedom: The Processing of Personal Data will be preceded by a prior, express and informed consent by the Owner. Personal Data will not be obtained or disclosed without prior Authorization, or in the absence of legal or judicial mandate that relieves the prior Authorization of the Holder.
  • Veracity: The Personal Data subject to Treatment must be true, complete, accurate, updated, verifiable and understandable.No treatment will be carried out on partial, incomplete, fractional or misleading data.
  • Transparency: The right of the Holders to obtain information about the existence of Personal Data concerning them will be guaranteed.
  • Access and restricted movement: The persons designated for this purpose by C-NEUTRAL will have access to the Personal Data contained in the C-NEUTRAL Databases. Personal Data, except those that are public, will not be available on the Internet or other mass media.
  • Safety: The necessary technical, human and administrative measures will be adopted to guarantee the security of the data subject to Treatment, in particular to avoid its adulteration, loss, consultation, use or unauthorized or fraudulent access.
  • Confidentiality: All persons involved in the Processing of Personal Data will be obliged to guarantee the confidentiality of the information.
  • Protection of sensitive data: No Treatment will be carried out on Sensitive Data, unless expressly authorized by the Owner.

Processing of personal data

In the exercise of its corporate purpose, the Processing of Personal Data by C-NEUTRAL includes its collection, storage, administration, use, transfer, transmission and destruction, in the manner indicated in this Policy and permitted by law.

  • C-NEUTRAL will carry out the Processing of Personal Data of employees, contractors, suppliers, customers, platform visitors, users and third parties, among others, directly or through contractors or agents commissioned for it.
  • The collection of Personal Data by C-NEUTRAL will be limited to those relevant and adequate data for the purpose for which they are collected or required in accordance with current regulations.
  • Except in the cases expressly provided by law, C-NEUTRAL will not collect Personal Data without the prior authorization of the owner.
  • C-NEUTRAL will keep the necessary records to demonstrate when and how it obtained the corresponding Authorizations from the Holders.
  • In compliance with the law, C-NEUTRAL will not collect or store data from children and adolescents.
  • C-NEUTRAL will maintain the confidentiality of the Personal Data subject to Treatment and will only disclose them at the express request of the surveillance and control entities or the authorities that have the legal power to request them.
  • C-NEUTRAL will allow at all times and free of charge to know, update and correct personal information to the Holders of the same in the manner permitted by law.

Purposes of the treatment to which the personal data will be submitted

The purposes of the Treatment to which the Personal Data will be submitted by C-NEUTRAL or the third parties commissioned for it, will depend on who they come from, in the manner indicated below:

Processing of Personal Data of people linked to employment and former employees:

It will be carried out to comply with the labor obligations in charge of C-NEUTRAL, such as payroll payments, payments and reports to the general social security system in health, attention to consultations, requests, requests, actions and claims made by the Holder of the information or by his heirs, or by entities of the general social security system in health to which the Holder is or has been linked.

Likewise, it will be carried out with the purpose of managing the participation of employees in the activities and programs carried out by C-NEUTRAL, which includes sending communications and correspondence, conducting internal investigations and audits, allowing their entry into C-NEUTRAL’s systems and facilities and / or those purposes notified in the Privacy Notice

Database content

Personal databases may contain the following information:

  • General Data, such as, full name / company name, class and identification number, marital status and gender.
  • Specific such as signature, nationality, place and date of birth and age.
  • Biometrics, such as fingerprint, photographs and videos.
  • Location data related to business or professional activity, such as address, telephone and email.
  • Personal location data related to private activity, such as home, telephone and email.
  • Performance data such as work and academic history.
  • Sensitive data such as the conformation of the family group, the health of the worker.

Processing of Personal Data of contractors and suppliers

It will be carried out in order to comply with the processes of negotiation, presentation of commercial offers, presentation of tenders, sending of communications and correspondence related to the activities executed by C-NEUTRAL or in which it has an interest and, other negotiation processes carried out with C-NEUTRAL; as well as comply with the contractual obligations in charge of C-NEUTRAL, such as billing, payment payments, payment reports and reports or interactions that by law or by policies C-NNEUTRAL has the obligation to perform and / or those purposes that are notified in the Privacy Notice. Likewise, it will be carried out with the purpose of attending queries, requests, requests, actions and claims made by the Owner of the information or by his heirs.

Personal databases may contain the following information:

Database content

  • General, such as, full name/company name, class and identification number, marital status, gender, etc.
  • Specific such as signature, nationality, place and date of birth, age, etc.
  • Biometrics, such as fingerprint, photographs and videos.
  • Location data related to business or professional activity, such as address, telephone and email.
  • Personal location data related to private activity, such as home, telephone and email.
  • Data relating to your profession, trade or occupation.
  • Nature of the contract or legal transaction between the supplier and C-NEUTRAL.
  • The status of compliance with its obligations to C-NEUTRAL.

Processing of Personal Data of customers

It will be carried out for the purpose of:

  • Provide commercial information about C-NEUTRAL and any of its brands
  • Be invited to events and activities for educational and commercial purposes
  • Comply with the contractual obligations in charge of C-NEUTRAL, such as billing, delivery of products, payment reports or interactions that by law or by internal policies it has the obligation to perform.
  • Likewise, to be contacted by text message, email, physical mail, telephone and any other suitable means of communication, and,
  • In order to respond to queries, requests, requests, actions and claims, made by the Holders of the information or by their heirs.
  • Those purposes that are notified in the Privacy Notice.

Database content

Personal databases may contain the following information:

  • Email
  • Full name
  • Identification
  • Address
  • Phone

C-NEUTRAL does not collect financial information from customers or visitors to platforms such as credit or debit card numbers, or bank account numbers. The foregoing taking into account that payments for products offered on these platforms are made through electronic payment platforms or systems external to C-NEUTRAL.

Customers are advised to review the Privacy and Information Use Policies of the corresponding payment platforms. (PAYULATAM)

Processing of Personal Data of Users of C-NEUTRAL Products:

It shall be carried out for the purpose of:

  • Contact Users by text messages, email, physical mail, telephone, and any other suitable means of communication, to: (i) send information, advertising, news, and offer the Products of C-NEUTRAL or third parties through the Domains as any other action to publicize the existing and new Products to its Users (ii) to make the purchase and return process of Products purchased by C-NEUTRAL. (iii) sending invitations to events held by C-NEUTRAL or third parties related to C-NEUTRAL in the development of its corporate purpose. (iv) provide the information to third parties with whom C-NEUTRAL has a relationship and it is necessary to deliver it to them to comply with the process of acquiring the Products.
  • Comply with the obligations in charge of C-NEUTRAL related to the quality of its products, and in order to respond to queries, requests, requests, actions and claims, made by the Holders of the information by their legitimaries.
  • Those purposes that are notified in the Privacy Notice.

Database content

Personal databases may contain the following information:

  • First Name, Surname
  • Email
  • Physical Address
  • Data related to information on habits (means of transport, food, household consumption and consumption in general) under the Products offered.
  • And others requested for registration, payment and others notified in the Privacy Notice.

Processing of Personal Data of shareholders

It will be carried out in order to manage the processes of entry into the company and any other matter related to its object, legality, management and performance reports and results on investments and / or those purposes that are notified in the Privacy Notice.

Database content

Personal databases may contain the following information:

  • General, such as, full name/business name, identification class and number, marital status and gender.
  • Specific such as signature, nationality, place and date of birth and age.
  • Biometrics, such as fingerprint, photographs and videos.
  • Location data related to business or professional activity, such as address, telephone and email.
  • Personal location data related to private activity, such as home, telephone and email.
  • Data related to the class of shares of which it is the holder, its capital participation, the status of compliance with its obligations with C-NEUTRAL and the meaning of its votes in the deliberation processes at the Shareholders’ Meeting.

Processing of Personal Data of Third Parties, among others, candidates for C-NEUTRAL positions, members of government, directors and any person with whom C-NEUTRAL requires interaction by virtue of its corporate purpose

It will be carried out in order to manage the processes of entry to C-NEUTRAL and its facilities, and any other matter related to its purpose and / or those purposes that are notified in the Privacy Notice.

Database Creation Procedure

C-NEUTRAL and the Processors or Data Controllers, as applicable, will comply with the following procedure when creating a Database:

  • Perform due diligence on the persons and data to whom the Treatment will be carried out, with their respective supporting documents according to the policies of C-NEUTRAL.
  • Carry out the verification of the respective Authorizations by the Holders, prior to the inclusion of the data in the corresponding Database, which must comply with the minimum requirements required by law.
  • Create the Database including in it only the information that the Owner authorized to be treated according to the indicated purpose.
  • Delete the Database once the purpose for which it was created has ceased or when the legal provisions so require.

Duties of the controller

C-NEUTRAL, as Data Controller, will comply with the following duties, without prejudice to the others that may be required of it in accordance with the law or other provisions governing its activity:

  1. Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.
  2. Request and keep, under the conditions provided by law, a copy of the respective Authorization granted by the Holder.
  3. Duly inform the Owner about the purpose of the collection of Personal Data and the rights that assist him by virtue of the Authorization granted.
  4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
  5. Ensure that the information provided to the Data Processor is true, complete, accurate, updated, verifiable and understandable.
  6. Update the information, when necessary in accordance with the purpose of the Database, communicating in a timely manner to the Treatment Manager, all the news regarding the data previously provided and adopt the other necessary measures so that the information provided to it is kept updated.
  7. Rectify the information when it is incorrect and communicate the pertinent to the Treatment Manager.
  8. Provide the Data Processor, as the case may be, only data whose Treatment is previously authorized in accordance with the provisions of the law.
  9. Require the Data Processor at all times to respect the security and privacy conditions of the Owner’s information.
  10. Process queries, complaints, petitions and claims formulated in the terms indicated in this Policy and in the law.
  11. Adopt an internal manual of policies and procedures to ensure adequate compliance with this policy regarding the attention of queries, complaints, petitions and claims.
  12. Inform the Treatment Manager when certain information is under discussion by the Holder, once the claim has been filed and the respective procedure has not been completed.
  13. Inform, at the request of the Owner, about the use given to their data.
  14. Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.
  15. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
  16. When applicable, register the database of Natural Persons with the Superintendence of Industry and Commerce.
  17. Comply with all obligations and administration of the database in the terms indicated by the Law, instructions of the Superintendence of Industry and Commerce and Corporate Policies of C-NEUTRAL.
  18. Guarantee the implementation and compliance in the databases of the security measures in the terms indicated by the Law; instructions from the Superintendence of Industry and Commerce Corporate and Local Policies of C-NEUTRAL. Likewise, attend and inform immediately to the Legal area and other applicable areas the security incidents for the timely and adequate implementation of the corrective and preventive actions that are necessary.

Duties of processors

C-NEUTRAL or the third party Data Processors will comply with the following duties, without prejudice to the others that may be required of them in accordance with the law or other provisions governing their activity:

  1. Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data.
  2. Keep the information under the necessary security conditions to prevent its adulteration. loss, consultation, use or unauthorized or fraudulent access.
  3. Timely update, rectification or deletion of data under the terms of this law.
  4. Update the information reported by the Data Controller within five (5) business days from its receipt.
  5. Process the queries, petitions, complaints and claims made by the Holders in the terms indicated in this Policy and in the law.
  6. Adopt an internal manual of policies and procedures to ensure adequate compliance with this Policy and, in particular, for the attention of queries, complaints, petitions and claims by the Holders.
  7. Register in the Database the legend “claim in process” in the way it is regulated by law.
  8. Insert in the Database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of Personal Data.
  9. Refrain from circulating information that is being controversial by the Holder and whose blocking has been ordered by the Superintendence of Industry and Commerce.
  10. Allow access to information only to persons who may have access to it.
  11. Inform C-NEUTRAL, if a third party has the quality of Treatment Manager, or the Superintendence of Industry and Commerce if C-NEUTRAL falls as Responsible and Responsible for the Treatment, when violations of the security codes occur and there are risks in the administration of the information of the Holders.
  12. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

Rights of holders

The Holders of Personal Data will have the following rights:

  1. Know your Personal Data; update them when they have had any variations; rectify them when they are inaccurate, incomplete or non-existent;   cancel or delete them when they are excessive, not relevant or when the Treatment is contrary to the rules, except in those cases contemplated as exceptions by law.
  2. Request proof of the Authorization granted except when it is not required, in accordance with the provisions of article 10 of Law 1581 of 2012.
  3. Be informed, upon request, regarding the use given to your Personal Data.
  4. Submit to the Superintendence of Industry and Commerce complaints for violations of the provisions of the law and other regulations that modify, add or complement it.
  5. Revoke the Authorization and / or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment.The revocation and / or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Treatment the Responsible or Person in Charge have incurred in behaviors contrary to the Constitution and the law.
  6. Access free of charge to your Personal Data that have been subject to Treatment.

Transfer of data to third countries

In accordance with the provisions of article 26 of Law 1581 of 2012, the transfer of Personal Data of any kind to countries that do not provide adequate levels of data protection according to the standards set by the Superintendence of Industry and Commerce on the matter is prohibited, which in no case may be lower than those required by Law 1581 of 2012. This prohibition shall not apply in the case of:

  1. Information with respect to which the Holder has granted his express and unequivocal Authorization for the transfer.
  2. Exchange of medical data, when required by the Treatment of the Holder for reasons of health or public hygiene.
  3. Bank or stock market transfers, in accordance with the legislation applicable to them.
  4. Transfers agreed within the framework of international treaties to which the Republic of Colombia is a party, based on the principle of reciprocity.
  5. Transfers necessary for the execution of a contract between the Holder and the Data Controller, or for the execution of pre-contractual measures provided that the Authorization of the Holder is available.
  6. Transfers legally required for the safeguarding of the public interest, or for the recognition, exercise or defense of a right in a judicial process.

Procedure for the exercise of rights by holders

Consultations

The Holders or their successors in title may submit queries and requests related to the personal information subject to Treatment by C-NEUTRAL to the email referred to in the general information of this document; C-NEUTRAL must respond to such inquiries and requests within a period of ten (10) business days from the date of receipt. When it is not possible to comply with this time, C-NEUTRAL will inform the interested party expressing the reasons for the delay and the date on which the consultation or request will be attended, which in no case may exceed five (5) business days following the expiration of the initial term.

Claims

The Holders or their successors in title who consider that the information contained in a C-NEUTRAL Database should be corrected, updated or deleted, or when they notice the alleged breach by C-NEUTRAL of any of the duties contained in this Policy or in the law, may submit a claim to C-NEUTRAL, which will be processed under the following rules:

The claim will be made by means of a request addressed to the Data Controller or the Treatment Manager, to the C-NEUTRAL email referred to in the general information of this document, indicating the following: (i) the identification data of the Holder, with the supporting documents of this information;  (ii) a clear and concise description of the facts giving rise to the claim;  (iii) the physical or electronic address where you wish to receive notifications, and (iv) the documents that substantiate the facts of the claim, which you wish to assert. If the claim is incomplete, C-NEUTRAL will require the interested party within five (5) days of receipt of the same, to correct the failures. After two (2) months from the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the respective Database, within a term not exceeding two (2) business days. Such legend must be maintained until the claim is decided.

C-NEUTRAL will attend to claims within a maximum period of fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the claim within that term, the interested party will be informed of the reasons for the delay and the date on which it will be attended, which in no case may exceed eight (8) business days following the expiration of the first term.

The Holder or successor in title may file complaints with the Superintendence of Industry and Commerce, once the consultation or claim procedures have been exhausted, as applicable, before C-NEUTRAL.

Revocation of the Authorization and / or deletion of the data

The Holders may at any time revoke the Authorization granted to C-NEUTRAL and request the deletion of their Personal Data, with the exception of those events in which C-NEUTRAL must keep them by virtue of a legal or contractual provision. If the respective legal term expires, C-NEUTRAL has not deleted the Personal Data, the Holder will have the right to request the Superintendence of Industry and Commerce to order the revocation of the Authorization and / or the deletion of the Personal Data.

However, Personal Data must be kept when required for compliance with a legal or contractual obligation.

Security measures

C-NEUTRAL has the necessary measures to guarantee the security of its Databases in order to avoid the adulteration, loss, consultation, use or unauthorized or fraudulent access of the personal information found in them. As a guarantee of the foregoing, C-NEUTRAL’s policies on the security of personal information are aligned with local and corporate laws, and these ensure that C-NEUTRAL has security controls for the Processing of Personal Data, security controls in its personal information systems and procedures for the management of security incidents. Likewise, these policies oblige C-NEUTRAL to carry out audits periodically, in order to control and monitor the security of the information contained in its Databases and the correct management thereof.

C-NEUTRAL has security policies necessary to maintain the security of personal data with complete care and restricted access, additional each user has their own processes to carry out a correct handling of the data collected and thus comply with an adequate administration of the data collected. All colleagues must be trained and have full knowledge of the security policies that C-NEUTRAL has for this type of administration, below are the security policies of C-NEUTRAL that account for the above:

Time limitation for the processing of personal data

C-NEUTRAL will carry out the Processing of the Personal Data collected in its Databases for the reasonable and necessary time according to the purposes that justify it, taking into account the provisions applicable to the matter in question and the administrative, accounting, fiscal, legal and historical aspects of the information.

Once the purpose of the Treatment has been fulfilled or the maximum legal period in which C-NEUTRAL has the obligation to keep the Personal Data has expired, C-NEUTRAL or the third party to whom it orders, will proceed to delete the Personal Data that it has under possession. However, Personal Data must be kept by C-NEUTRAL when required for compliance with a legal and contractual obligation.

Authorization of use of personal data

I expressly authorize C-NEUTRAL S.A.S and third parties to use as database processors (hereinafter jointly “C-NEUTRAL”), to process my personal data which includes collecting, storing, managing, using, destroying them, as well as transferring or transmitting them between them, in the manner permitted by law, in accordance with the policy of treatment and use of personal data, published in www.cneutral.co and the purposes indicated there and / or that were notified to me in the Privacy Notice that are part of this consent.

I know that I have the right not to authorize the processing of sensitive personal data such as those related to health, those that reveal racial or ethnic origin, data related to sex life, biometric data, revealing political orientation, religious or philosophical convictions, membership of trade unions, social organizations, human rights and in general those that are considered sensitive personal data in the light of Colombian legislation in effect.   

C-NEUTRAL undertakes to maintain the confidentiality of my personal data and only disclose it in compliance with express requests from surveillance and control entities and authorities or entities that have the legal power to request it or to whom it has the legal obligation to deliver it. I know the policies of C-NEUTRAL for the protection and management of personal information, the rights that assist me as a holder and how to exercise them, and the privacy notice found on the website www.C-NEUTRAL.co

For the record, I grant my authorization as _____

Signature: ____

Privacy Notice

The Privacy Notice (hereinafter the “Notice”) sets forth the terms and conditions under which C-NEUTRAL identified with NIT. 901.426.711-9 and with address at Calle 94 Aª # 13-34 Oficina 105 in Bogotá D.C. will process your personal data.

Thus, who subscribes and accepts the Terms and Conditions, and expressly authorizes C-NEUTRAL S.A.S. and third parties to use as processors of personal data (hereinafter “C-NEUTRAL”) to carry out the treatment in the manner permitted by law, in accordance with the Policy on Treatment and Use of Personal Data published in www.cneutral.co, and in accordance with the purposes indicated therein, and / or that were notified in this Privacy Notice.

C-NEUTRAL undertakes to inform the Owner by sending the Notice: the identity, address, and contact details of the Data Controller, the purposes and treatment to which your personal data will be subject, as well as the access mechanisms to know the personal data policy, and the mechanisms for making inquiries, claims by the Owner under the terms of current legislation.

Once sent, C-NEUTRAL will keep a copy of the Notice sent to the Holder, together with the Authorization for the Processing of Personal Data granted while the Treatment is carried out and in accordance with the obligations that assist C-NEUTRAL. The file may be made by any physical or electronic means available for these purposes.

Last update date:

April 9, 2021