GENERAL PROVISIONS
ARTICLE 1. APPLICABLE LEGISLATION.
This policy was developed taking into account the provisions contained in Law 1581 of 2012 "Which establishes general provisions for the protection of personal data" and Decree 1377 of 2013 "Which partially regulates Law 1581 of 2012".
ARTICLE 2. SCOPE OF APPLICATION.
This policy shall apply to the processing of personal data collected and handled by CHECOREPUESTOS S.A.S.
ARTICLE 3. PURPOSE.
To protect and guarantee, based on the manual, the fundamental right to habeas data regulated by Law 1581 of 2012, which governs the procedures for the collection, management, and processing of personal data carried out by CHECOREPUESTOS S.A.S.
ARTICLE 4. DATABASE VALIDITY.
CHECOREPUESTOS SAS will apply the policies and procedures contained in the manual to the databases over which it has decision-making power, for a term equal to that established by the bylaws for the duration of the company.
ARTICLE 5. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA.
In the development, interpretation, and application of the aforementioned law, the following principles shall be applied in a harmonious and comprehensive manner:
• Principle of purpose: The processing of personal data collected by CHECOREPUESTOS S.A.S. must be reported to the Owner.
• Principle of freedom: Processing may only be carried out with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial order that waives consent.
• Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.
• Transparency Principle: Data Processing must guarantee the Data Subject's right to obtain from the Controller, at any time and without restrictions, information about the existence of data concerning him or her.
• Principle of restricted access and circulation: Personal data, except for public information, may not be made available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the data subjects or authorized third parties.
• Security Principle: Information subject to processing by the Controller must be handled with the technical, human, and administrative measures necessary to ensure the security of records, preventing their alteration, loss, unauthorized or fraudulent access, or access.
• Confidentiality Principle: All persons involved in the processing of personal data that is not public are required to ensure the confidentiality of that information, even after their relationship with any of the tasks involved in the processing has ended.
RIGHTS AND DUTIES
ARTICLE 6. RIGHTS OF DATA SUBJECTS.
In accordance with Law 1581 of 2012, data subjects have the following rights:
1. To know, update, and correct your Personal Data. You have the right to exercise this right, among others, in relation to information that is partial, inaccurate, incomplete, divided, misleading, or whose processing is prohibited or unauthorized.
2. Require proof of consent given for the collection and processing of Data
3. Be informed by CHECOREPUESTOS S.A.S. of the use that has been given to the Data
4. Submit complaints to the Superintendency of Industry and Commerce for non-compliance with the provisions of Law 1581 of 2012, Decree 1377 of 2013 and other regulations that modify, add to, complement, or replace them in accordance with the provisions on the procedural requirement established in Article 16 of Law 1581 of 2012.
5. Revoke the authorization granted for the processing of Personal Data.
6. Request to be removed from our database. This deletion or removal entails the total or partial elimination of personal information, as requested by the Data Subject, from CHECOREPUESTOS S.A.S.'s databases. It is important to keep in mind that the right to erasure is not absolute, and the data controller may deny the exercise of this right when: the Data Subject has a legal and/or contractual obligation to remain in the database; the deletion of data would hinder judicial or administrative proceedings or the investigation and prosecution of crimes; or the data would be necessary to comply with a legal obligation acquired by the Data Subject.
7. Have access to the Personal Data that CHECOREPUESTOS S.A.S. has collected and processed.
ARTICLE 7. DUTIES OF THE PERSON RESPONSIBLE FOR THE INFORMATION:
As the Controller of personal data, and in accordance with the provisions of Law 1581 of 2012, CHECOREPUESTOS SAS undertakes to comply with the following obligations regarding the processing of personal data:
1. Guarantee the owner of the information, at all times, the full and effective exercise of the right to habeas data;
2. Keep a copy of the respective authorization granted by the owner;
3. Properly inform the Owner about the purpose of the collection and the rights to which he/she is entitled by virtue of the authorization granted;
4. Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
5. Process queries and complaints made by information holders in accordance with Articles 14 and 15 of Law 1581 of 2012;
6. Inform the Owner, upon request, about the use given to their data;
7. Inform the Superintendency of Industry and Commerce when security code violations occur and there are risks in the management of the Holders' information;
8. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce;
9. Insert the legend "information under judicial discussion" into the database once notified by the competent authority about judicial proceedings related to the quality or details of the personal data;
10. Refrain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendency of Industry and Commerce;
11. Allow access to information only to authorized persons;
12. Inform, through the media it deems relevant, of any new mechanisms it implements to enable information holders to exercise their rights.
AUTHORIZATION AND PURPOSE
ARTICLE 8. AUTHORIZATION:
CHECOREPUESTOS SAS, as the Data Controller, has implemented the necessary mechanisms to obtain authorization from the data subjects, ensuring in all cases that it will be possible to verify the granting of said authorization.
Authorization may be given verbally or by means of a physical, electronic, or other document that allows for subsequent consultation.
ARTICLE 9. PURPOSE OF THE AUTHORIZATION:
The processing of the personal data of the Data Subjects will be carried out by CHECOREPUESTOS S.A.S., for the following purposes:
• Execute the existing contractual relationship with its clients, suppliers, employees and contractors, including the payment of contractual obligations
• Provide the services or products required by its customers
• Send by physical mail, electronic mail, cell phone or mobile device, or through any other analogous or digital means of communication created or to be created, commercial, advertising or promotional information about the products or services, events, promotions of a commercial or non-commercial nature, in order to promote, invite, direct, execute, inform, and in general, carry out campaigns, promotions, contests of a commercial or advertising nature, raffles, sporting events, advanced by CHECOREPUESTOS S.A.S. or by third party(ies)
• Develop the selection, evaluation and employment placement process
• Inform about new products or changes to them
• Perform data updates
• Evaluate the quality of service
• Communicate news about CHECOREPUESTOS S.A.S. and the sales and service network
• Process exclusively legal processes
• Conduct market research
• Support internal or external audit processes
• Those indicated in the authorization granted by the Data Owner, or described in the respective privacy notice, as the case may be.
ARTÍCULO 10. FORMA Y MECANISMOS PARA OTORGAR LA AUTORIZACIÓN.
En el Anexo 1 de este documento se presenta el formato de autorización que ha definido CHECOREPUESTOS S.A.S., para la recolección y tratamiento de datos personales. La autorización también podrá ser obtenida por alguno de los siguientes medios:
• Employment contract annex
• Addition of a clause to the employment contract
• Sales Invoices
• Purchase order
• Purchase invoice,
• Proof of Expenditure
• Cash Receipt
• Digital media
• Customer creation and data update format
ARTICLE 11. PRIVACY NOTICE.
Annex 2 of this document presents the privacy notice format defined by CHECOREPUESTOS SAS.
PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF THE INFORMATION HOLDER
RECLAMOS Y EJERCICIO DE SUS DERECHOS:
Los titulares de la información podrán ejercer sus derechos en cualquier momento y de manera gratuita, previa acreditación de su identidad.
Para tales efectos, el Titular del dato en ejercicio de los derechos contemplados en el artículo 6 de la Ley 1581 de 2012, podrá enviar su petición, queja o reclamo de lunes a viernes de 8:00 a.m. a 5:45 p.m. por alguno de los siguientes medios:
• Email address: servicioalcliente@checorepuestos.com
• Calling the responsible area (Customer Service Area) in Bogotá: 3145010
• Write through the “Contact” form on our website www.checorepuestos.com
The application must include at least the following information:
• First and last names
• Document type
• Document number
• Phone number
• Email address
• City
• Subject
INFORMATION SECURITY AND CONFIDENTIALITY
ARTICLE 13. INFORMATION SECURITY AND CONFIDENTIALITY MEASURES:
For data storage, the Company uses an application that stores personal data, and data is automatically transmitted to data processors within the same application. Access to the systems is protected with a high level of authentication. The databases are hosted on its own server located on the company's premises, ensuring high levels of integrity, confidentiality, and availability.
De igual manera, CHECOREPUESTOS S.A.S. dispondrá de los recursos técnicos, humanos y administrativos que sean necesarios, para otorgar seguridad a los registros, evitando su adulteración, consulta, uso o acceso no autorizado o fraudulento.
FINAL PROVISIONS
ARTICLE 14. DESIGNATION:
CHECOREPUESTOS S.A.S. designates the Service Area or whoever acts in its place to fulfill the function of personal data protection, as well as to process requests from data subjects for the exercise of their rights as Data Subject.
ARTICLE 15. VALIDITY OF THE POLICY:
This policy is effective as of November 1, 2016.