Privacy Policy

PERSONAL DATA PROCESSING POLICY AUREN COLOMBIA 

1. INTRODUCTION 

AUREN COLOMBIA, that is AUREN COLOMBIA S.A.S. with NIT. 900.733.238-6, AUREN CONSULTORES MEDELLIN S.A.S., with NIT. 900.347.225-5, AUREN AUDITORES Y CONSULTORES S.A., with NIT. 830.069.788-3, AUREN ASESORES CORPORATIVOS 

S.A.S. with NIT. 806.000.527 – 3 and AUREN LEGAL E IMPUESTOS S.A.S. with NIT 

901.613.791 – 7, with address, email and telephone indicated in section XIV of this policy, hereinafter AUREN COLOMBIA, whose corporate purpose is to provide services related to accounting, legal, tax, financial and auditing advice, committed to the values of respect, subject to the law, confidentiality, availability, integrity and proper handling of information and especially with the protection of personal data that are stored in their databases, acting in accordance with the provisions of the Law on Protection of Personal Data, Law 1581 of 2012 and its Regulatory Decrees and as responsible and / or responsible for the processing of personal data, is allowed to inform the owners whose personal data, stores and treats, within which are its employees, customers, shareholders, suppliers and in general to all holders of personal information that AUREN COLOMBIA, on the content of these policies for the processing of personal data. 

In accordance with the above, the purpose of this Policy is to guarantee by AUREN COLOMBIA. the protection of the fundamental right of HABEAS DATA and to allow its exercise by the owners of the information, as well as to comply with the provisions enshrined in Law 1581 of 2012 and its Regulatory Decree 1377 of 2013. 

2. SCOPE OF APPLICATION 

This Personal Data Processing Policy shall be applicable to the databases that are under the administration of AUREN COLOMBIA or are likely to be known by AUREN COLOMBIA, by virtue of employment or business relationships. In this way, AUREN COLOMBIA will act as the Controller, in the cases in which it stores and processes personal data itself, and as the Processor, when it processes personal data on behalf of the data controller. 

3. DEFINITIONS 

For the purposes of this policy, the definitions established by current regulations are listed below: 

• Authorisation: Prior, express and informed consent of the Data Subject to carry out the processing of personal data. 

• Privacy notice: Verbal or written communication generated by AUREN COLOMBIA addressed to the holder of the personal data, in which he/she is informed of the existence of the information processing policies that will be applicable, the way to access them and the purposes of the processing that is intended to be given to the personal data. 

• Database: An organised set of personal data that is the subject of processing. 

• Personal Data: Any information linked or linkable to one or more specific or identifiable natural person(s). 

• Public data: Data relating to the civil status of persons, their profession or trade and their status as traders or public servants; data which, by their nature, are not subject to protection. 

• Sensitive data: Sensitive data are understood to be those that affect the privacy of the holder or whose improper use may lead to discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social organisations, human rights organisations or those that promote the interests of any political party or that guarantee rights, as well as data relating to health, sex life and biometric data. 

• Data Processor: A natural or legal person, public or private, who by himself or in association with others, carries out the processing of personal data on behalf of the data controller. 

Data Controller: Natural or legal person, public or private, who alone or in association with others, decides on the database and/or the processing of the data. 

• Data subject: Natural person whose personal data is subject to processing. For the purposes of this policy, personal data owners will be understood to be employees, suppliers, clients, shareholders and in general, any natural person who is the owner of the personal data registered in the databases of AUREN COLOMBIA. 

In the case of minors (children and adolescents), their legal representatives will have the power to authorise or not the processing of their personal data. In the processing of this data, respect for the prevailing rights of minors, such as privacy and protection of personal information, will be ensured. 

• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion. 

• Transfer: The transfer of data takes place when AUREN COLOMBIA, located in Colombia, sends the information or personal data to a recipient, which in turn is the Data Controller and is located inside or outside the country. 

• Transmission: Processing of personal data that involves the communication of personal data within or outside the territory of the country 

4. PRINCIPLES 

AUREN COLOMBIA will act in all collection, handling and deletion of personal data in accordance with the guiding principles set out in Law 1581 of 2012: 

• Access and Restricted Circulation: The treatment that AUREN COLOMBIA will give to personal data will be subject to the provisions established in the law and the Constitution. Personal data may not be available on the internet or other means of dissemination or mass communication, except for those of a public nature or those in which access is technically controllable to restricted knowledge to the owner or authorised third parties. 

• Confidentiality: The persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information provided, even after the end of their relationship with any of the tasks involved in the processing. 

• Purpose: AUREN COLOMBIA will inform the holder of the purpose of the processing of personal data, which must be legitimate in accordance with the constitution and the law. 

• Legality: For the processing of personal data, AUREN COLOMBIA shall be subject to the provisions of the Law and other provisions. 

• Freedom: The processing of personal data will only be carried out by AUREN COLOMBIA with the prior, express and informed consent of the owner; or by legal or judicial mandate. 

• Security: The information subject to treatment by AUREN COLOMBIA, will be protected through the use of technical, human and administrative measures that provide security to the records, avoiding its adulteration, loss, consultation, use or unauthorized or fraudulent access. 

• Transparency: AUREN COLOMBIA guarantees the holder the right to obtain at any time and without restrictions, information about the existence of their data. 

• Truthfulness: The information subject to the processing of personal data must be truthful, complete, accurate, up-to-date, verifiable and comprehensible. The processing of partial, incomplete, fragmented or misleading data is prohibited. 

5. APPLICABLE LAW 

• Political Constitution of Colombia, Article 15. 

• Statutory Law 1581 of 17 October 2012. 

• Regulatory Decree 1377 of 2013. 

• Regulatory Decree 886 of 2014. 

• Sole Circular No. 002 of 2015. 

• Sentence C-748 of 2011 of the Constitutional Court. 

• Other rules governing the matter. 

6. PROCESSING OF PERSONAL DATA 

The data processed by AUREN COLOMBIA has been obtained as a result of the different contractual relationships it establishes in the development of its corporate purpose. 

In this sense, the processing activities carried out by AUREN COLOMBIA on its databases include the collection, consultation, compilation, evaluation, cataloguing, classification, ordering, recording, storage, updating, modification, clarification, report, analysis, use, circulation, supply, suppression, processing, transmission, transfer and in general the handling of the Personal Data provided by the Data Subject by any means. 

Personal information includes identification, names, location data, email, mobile phone number, among other data associated with natural persons whose authorization has been obtained in a prior, free, express, clear and informed manner. AUREN COLOMBIA may, without prior authorisation from the owner, process public data. 

The collection and processing of personal data may be carried out by physical mail, email, landline telephone, website, mobile phone or mobile device, via text message, social networks, surveys or through any other widely known means of communication, in compliance with the provisions of current regulations . 

AUREN COLOMBIA has technological and organisational mechanisms in place to maintain the security of the information, thus preventing the loss, unauthorised access, disclosure or improper use of the information. 

7. PURPOSE 

The following is a general and specific description of the purpose of the processing of personal data by AUREN COLOMBIA for each group of data subjects. 

Specific purposes of the processing of customers’ personal data. 

AUREN COLOMBIA processes the personal data of its customers for the following purposes: 

(i) To comply with the obligations under the contracts and commercial relationships entered into. 

(ii) To provide information about our products and services. (iii) To carry out commercial, social and informative events or promotions for our customers. (iv) To carry out campaigns, studies, promotions or contests of a commercial, social, marketing or advertising nature or in execution of our corporate purpose. (v) Carry out loyalty programmes and update the data of customers, suppliers, employees, distributors and other third parties. (vi) Inform about changes in our products, prices or services. (vii) Send portfolio statements. (viii) Evaluate the quality of our products and/or services through satisfaction surveys. (ix) Carry out collection activities, collection, queries, verifications, control and enablement of means of payment. (x) Properly advance all its credit risk analysis processes and comply with the regulations related to Habeas Data. 

Specific purposes of the processing of employee and service provider databases. 

The data provided by Employees and/or service providers to AUREN COLOMBIA will be used for the following purposes: (i) to manage the selection processes for internal and external recruitment. (ii) to access the occupational medical history of workers, in order to comply with the Occupational Health and Safety System. (iii) Use their biometric data such as fingerprints for time control, likewise this data may be used by AUREN COLOMBIA during the employment relationship or provision of services or strategic linkage through contracts and / or agreements in order to enhance the skills of employees linked through courses, training, workshops, etc., and to incorporate them into different processes of the company, (iv) to provide labour references, affiliation or strategic linkage, both of themselves and their family members. (v) to issue labour certificates. (vi) to carry out performance and competence evaluations. (vii) to carry out human resources programmes. (viii) to provide information to third parties in charge of evaluation, training, certification and other processes required in the development of the labour relationship. 

(ix) to send information to the social security and parafiscal entities. (x) In general, to manage the existing employment or service provision relationship. 

AUREN COLOMBIA may additionally request from its employees, by means of a special form, authorisation for the processing of the personal data of their minor children and for the development of the following purposes: (i) affiliation to social security, family compensation funds and other entities whose connection is necessary within the framework of the employment relationship. (ii) to carry out programmes in the area of human resources (iii) to grant benefits to the family group. (iv) other similar purposes to those mentioned above, related to the development of the employment relationship. 

Regarding the personal data collected and stored in selection processes of both workers and service providers, AUREN COLOMBIA informs that the same will be stored in a physical or digital file or folder to which the human resources area or whoever carries out the management of the pre-contractual relationship will have access. 

Specific purposes of the processing of databases of former employees. 

The storage of the databases of former employees will be carried out for a period of 5 years from the end of the employment relationship, for the following purposes: (i) Conservation of documents to respond to possible claims. (ii) Delivery of information to any competent authority that requires it. (iii) Statistical and process evaluation purposes (iv). New recruitment processes. 

(v) Any other eventuality that may arise in connection with the employment relationship. 

Specific purposes of the processing of suppliers’ databases. 

The purpose of the processing of suppliers’ personal data shall be the following: (i) To develop appropriate quotation and negotiation processes. (ii) To evaluate the quality of the products purchased. (iii) To award contracts and services. (iv) To make payments. (v) Accounting, tax and administrative management. (vi) To communicate fluently within the framework of the commercial relationship. 

General purposes of all data subject databases 

AUREN COLOMBIA may process the personal data provided by its customers, suppliers, employees, shareholders and other third parties for the purposes of: (i) Manage the pre- contractual, contractual and post-contractual relationship of a commercial, civil, labour and nature of any other nature; (ii) Verify the proper fulfilment of obligations; (iii) Satisfy the legitimate interests arising from the relationship established or planned to be established; (iv) Provide or obtain commercial and/or financial references; (v) Administer and operate the contracted product or service, which includes, among other aspects, the management and accounting registration of the operations that are developed during the validity of any legal relationship, as well as all those that are carried out for the termination, closure or liquidation of the same; (vi) Document the existing relationship and verify the execution and compliance of the respective contract; (vii) Verify and confirm identity and contact; (viii) Send commercial information about the products and/or services that AUREN COLOMBIA provides in the development of its corporate purpose; (ix) adopt measures aimed at the prevention of illicit activities; (x) AUREN COLOMBIA may take the fingerprint, obtain images from security cameras or use other authorised biometric mechanisms of its clients, suppliers, employees and other third parties and administer them in order to validate their identity in the handling of the products and/or services that they acquire with the company. (xi) AUREN COLOMBIA may provide the personal data of its customers, suppliers, employees, distributors and other third parties to entities based in Colombia or abroad, whether public or private, provided that: They are companies or entities with which AUREN COLOMBIA is related by shareholding links or are its parent, subsidiary or operated company; o the delivery of personal data has as its purpose the structuring, design and implementation of offers of products and/or services, or in general additional value proposals to those that AUREN COLOMBIA is not able offer autonomously, or has as its purpose to facilitate the development of the corporate purpose of AUREN COLOMBIA by means of the outsourcing of its processes, such as physical or digital archiving, collection, risk management, software development, customer contact, market research, statistical analysis, development of commercial and/or social strategies, marketing, social impact studies, participation in social inclusion programmes of the state, establishment of new service channels, and other related and related purposes. Similarly, the personal data of customers, employees, providers or any other person whose personal data is held, will be used by AUREN COLOMBIA in order to properly advance all its processes, in the development of the aforementioned activities and to comply with the regulations related to Habeas Data and personal data protection. (xii) Conduct studies and analysis for statistical purposes for strategy planning and decision making of the company (xiii) Send communications and notifications of commercial, institutional and general related to the operations of the company, by any means of communication.(xiv) Consultation and verification of personal information by cross- checking information with other databases, both private and public, such as credit risk centres, national and international money laundering control lists . (xv) Study on prevention of money laundering and financing of terrorism/recordings. (xvi) Use of the personal image and/or videos where the personal image of the holder appears, captured by monitoring and/or video surveillance systems provided by THE RESPONSIBLE in all its infrastructure and/or Companies in which THE RESPONSIBLE has any participation, as a means of proof or evidence in internal, judicial, extrajudicial, or administrative processes and procedures in which the Responsible and/or Companies in which THE RESPONSIBLE has any participation, are part or are linked in any way. 

Specific purposes of the processing of web users’ data 

AUREN COLOMBIA will process the data of those web users who use the contact form on the website. The purpose of the processing of such data is to manage the query raised, send the requested information or answer the questions posed through the form. 

Likewise, in the event of sending a curriculum through the e-mail address provided for this purpose, AUREN COLOMBIA will process the personal data contained therein in order to manage present or future selection processes that may fit the candidate’s profile. 

With the user’s consent, through the cookies present on the website, data such as the user’s IP address may be processed in accordance with the purposes indicated in the Cookies Policy. 

8. LEGAL BASIS LEGITIMISING THE PROCESSING OF PERSONAL DATA 

The authorisation given through the relevant mechanism provided for this purpose for the sending of personal data through any of the forms on this website will mean that the user expressly consents to their processing. 

Personal data may also be processed on the basis of the performance of a contract entered into between both parties or in compliance with legal obligations applicable to the Data Controller. 

9. RIGHTS OF DATA SUBJECTS 

Data subjects whose data is processed by AUREN COLOMBIA, shall have the right to: 

• To know, update and rectify your personal data in relation to AUREN COLOMBIA This right may be exercised, among others, in relation to partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorised. 

• Ask AUREN COLOMBIA for proof of the authorisation granted for the processing of your personal data, except for the exceptions provided for by law. 

• Be informed by AUREN COLOMBIA upon request, about the use of your personal data. 

• Submit requests, queries, complaints and claims to AUREN COLOMBIA. 

• File complaints with the Superintendency of Industry and Commerce for violations of Law 1581 of 2012 and other regulatory decrees. 

• Request the revocation and/or deletion of your personal data when AUREN COLOMBIA engages in conduct contrary to the law and the Constitution. 

• Request opposition and restriction of the processing of your data 

• Free and unrestricted access to the personal data undergoing processing. 

10. SPECIAL CATEGORIES OF DATA 

Rights of children and adolescents. 

In the processing of personal data, respect for the prevailing rights of children and adolescents shall be ensured. 

The processing of personal data of children and adolescents is prohibited, except for those data that are of a public nature, or where authorisation is obtained from their representative, and provided that the best interests of the children and adolescents are met and respected and that respect for their fundamental rights is ensured. 

AUREN COLOMBIA, will act with the utmost diligence and care in the processing of data of children and adolescents. 

11. TREATMENT OF SENSITIVE DATA 

In accordance with the definition of sensitive data, AUREN COLOMBIA shall refrain from processing this type of data, except in the following cases: a) The Data Subject has given his/her explicit authorization to such Processing, except in cases where by law the granting of such authorization is not required; b) The Processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorisation; c) The Processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non- profit organisation, whose purpose is political, philosophical, religious or trade union, provided that it refers exclusively to its members or to persons who maintain regular contact for its purpose. In these events, the data may not be provided to third parties without the Data Controller’s authorisation; d) The Processing refers to data that are necessary for the recognition, exercise or defence of a right in legal proceedings; e) The Processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted. 

The answers to the questions about sensitive data are optional, therefore, they will not be mandatory. In any case, AUREN COLOMBIA will strictly observe the legal limitations to the Processing of Sensitive Data. AUREN COLOMBIA will not, under any circumstances, make any activity conditional on the provision of Sensitive Data. Sensitive Data will be treated with the greatest possible diligence and with the highest security standards. Limited access to Sensitive Data shall be a guiding principle to safeguard the privacy of such data and, therefore, only authorised personnel shall have access to this type of information. 

Sensitive data may not be processed for purposes other than those expressly authorised by the Data Subject. 

12. CASES IN WHICH AUTHORISATION IS NOT REQUIRED 

In accordance with the provisions of Art. 10 of Law 1281 of 2012, the holder’s authorisation will not be necessary in the following cases: a) Information required by a public or administrative entity in the exercise of its legal functions or by court order; b) Data of a public nature; c) Cases of medical or health emergency; d) Processing of information authorised by law for historical, statistical or scientific purposes; e) Data related to the Civil Registry of Persons. 

When the aforementioned personal data is accessed without prior authorisation, the provisions contained in Law 1581 of 2012 and its regulatory decrees shall be complied with in all cases. 

13. INFORMATION SECURITY 

In accordance with the provisions of Article 19 of Decree 1377 of 2013, AUREN COLOMBIA undertakes to adopt the instructions issued by the Superintendence of Industry and Commerce related to information security measures and declares that it has security policies and a technological and administrative infrastructure that allows it to reasonably protect the information collected, limiting access to the information to unauthorised third parties. 

14. AREA RESPONSIBLE FOR DEALING WITH QUERIES AND COMPLAINTS 

The Marketing area shall be the area in charge of dealing with queries, requests and claims submitted by the holders of personal data and shall strictly comply with the procedure indicated below. 

15. PROCEDURE FOR THE EXERCISE OF RIGHTS 

AUREN COLOMBIA, as the party responsible for the processing of personal data, has established the following channels of communication with the owners: 

E-mail: aurencolombia@auren.com.co 

Address: Cr 55 No. 152 B 68 Of. 1001 Etapa 3, Bogotá D.C. 

Phone: (601) 3737722 – 3103046015 

Consultations 

The queries made by the owner of the personal data or their assignees, will be dealt with without delay by AUREN COLOMBIA, within a maximum period of ten (10) working days from the receipt of the respective request, which may be extended for a maximum period of five (5) working days, AUREN COLOMBIA must previously inform the interested party. 

Claims 

The owner or their assignees who consider that the information contained in the database of AUREN COLOMBIA should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the law or in this policy, or when they wish to exercise their rights regarding data protection, may file a complaint, which will be processed under the following rules: 

The claim shall be formulated by means of a request addressed to the Administrative Management or by means of the e-mail accountaurencolombia@auren.com.co , with the identification of the Holder, the description of the facts that give rise to the claim, the address and/or e-mail address for notifications and the attached documents that may be required. 

• The maximum term to deal with the claim will be fifteen (15) working days from the day following the date of receipt, which may be extended for a maximum term of eight 

(8) working days, when it is not possible to deal with the claim within that term, and the Administrative Department must inform the interested party of the reasons for the delay. 

• If the claim is incomplete, the interested party will be required within five (5) working days of receipt of the claim to rectify the faults. If two (2) months have elapsed since the date of the request without the applicant submitting the required information, it will be understood that the claim has been withdrawn. 

• In the event that the person who receives the complaint is not competent to resolve it, he/she will transfer it to the area in charge within a maximum of two (2) working days and inform the interested party of the situation. 

Procedural requirement. 

The Data Subject or assignee may only lodge a complaint with the Superintendency of Industry and Commerce once he/she has exhausted the consultation or complaint procedure with the Data Controller or Data Processor. 

The application shall contain at least the information identified below: 

• Identification of the holder 

• Description of the facts giving rise to the enquiry, suggestion, complaint or grievance 

• Terms of application 

• Address for notification 

16. PRIVACY, CONFIDENTIALITY AND INFORMATION SECURITY 

AUREN COLOMBIA will guarantee the privacy, confidentiality and security of the data provided, preventing adulteration, loss, consultation, use or unauthorised or fraudulent access by third parties. 

AUREN COLOMBIA, applying the principle of autonomy, reserves the right to maintain and classify as confidential the information contained in its databases. 

AUREN COLOMBIA will adopt the technical, human and administrative measures necessary to ensure the security of personal data, avoiding its adulteration, loss, consultation, use or unauthorised or fraudulent access. 

AUREN COLOMBIA states that some of its websites may contain links to third party websites over which it has no management or control, for this reason, is not responsible for the content, privacy policies, security and / or management of personal data that are established in the same, being the obligation of the owner of the personal data in the respective portals know the policies related to the protection and processing of their information. 

On the AUREN COLOMBIA website, instructions will be established under absolute security for each user or holder of personal data to interact with them and submit their requests to AUREN COLOMBIA regarding any type of correction, modification and/or deletion. 

17. ENTRY INTO FORCE AND AMENDMENT 

This policy shall be effective from the date of its publication and shall be valid for as long as AUREN COLOMBIA carries out its corporate purpose in Colombia or until the law provides otherwise or otherwise. 

This policy may be modified at any time and unilaterally by AUREN COLOMBIA, which must inform the owners of the personal data of such modifications in a timely manner. 

The personal data provided shall be kept for as long as the contractual relationship with the Data Controller is maintained. The personal data provided will be kept for as long as the data subject does not request its deletion and as long as there is no legal duty to keep it. 

Date of publication: 9 January 2024