Database protection policy

I. INTRODUCTION

In order to comply with the provisions of Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, GRUPO ZICAV S.A.S identified with NIT. 900725660-8 , in its capacity as responsible for the processing of personal data collected through different channels of marketing and contact, has implemented internal policies that ensure the protection of personal data stored and which will apply to all databases and / or files containing personal data that are subject to treatment by GRUPO ZICAV S.A.S. these policies came into force on November 1, 2022 and any changes will be duly notified.

II. PERSON IN CHARGE OF THE TREATMENT AND AREA IN CHARGE

RESPONSIBLE

GRUPO ZICAV S.A.S identified with NIT No. 900725660-8 legally represented by Carlos Silva Corredor, has the following locations:

– BARRANQUILLA – ATLÁNTICO – COLOMBIA.
Located at 85th Street No 49C- 56

E-mail info@grupozicav.com, Telephone +57 (5) 3015496927, customer service area.

The above address corresponds to the current headquarters of GRUPO ZICAV S.A.S, in case new offices are created, they can be consulted on the website www.grupozicav.com.

2. PROCESS IN CHARGE OF REQUESTS, QUERIES, COMPLAINTS AND CLAIMS:

Before the Customer Service process of GRUPO ZICAV S.A.S in the city of Barranquilla (Atlántico), the holders of the information may exercise their rights to know, update, rectify and delete information and revoke the authorization.

3. PROCEDURE

In order for the holders of the information to exercise their rights to know, update, rectify and delete information and revoke the authorization, they may contact us by e-mail at info@grupozicav.com, in writing to our headquarters in the city of Barranquilla (Atlántico – Colombia) or by phone at +57 (5) 3015496927 customer service area.

In any case, any officer of GRUPO ZICAV S.A.S. may receive the requests submitted by the holders and forward it to the Customer Service Coordinator.

3.1. QUESTIONS

The Holder or assignee shall request through a written communication, by e-mail or by telephone, providing the necessary information to clarify the request, which must contain at least the following information

– Full name and surname of the holder of the information.
– Identity document number, address and telephone number to be able to make the respective notifications.
– Clear and precise purpose of the request.
– Reasons on which it is based.
– List of documents accompanying the request (when applicable).

In the communication you must explain the reason for your request, in case of claim description of the facts that give rise to the claim and when necessary send supporting documents.

The response to the consultation will be given within a maximum of 10 working days. If it is not possible in that term the holder will be informed, and will have 5 more working days.

3.2. CLAIMS

The holder or assignee may file a complaint with the Data Controller or the Data Processor:

1. The claim shall be formulated by means of a request addressed to the Data Controller or the Data Processor, with the identification of the Data Subject, the description of the facts giving rise to the claim, the address, and accompanied by the documents to be asserted. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned. In the event that the person receiving the claim is not competent to resolve it, he/she shall transfer it to the appropriate person within a maximum term of two (2) business days and shall inform the interested party of the situation.

2. Once the complete claim has been received, a legend will be included in the database stating «claim in process» and the reason for the claim, within a term no longer than two (2) business days. Said legend shall be maintained until the claim is decided.

3. The maximum term to address the claim shall be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

3.3. SUPPRESSION OF INFORMATION

The request for deletion of data will not be made in the event that the holder has a legal or contractual duty to remain in the database. When appropriate, the use of the personal data to develop the authorized purpose will be suspended.

III. DEFINITIONS

Contained in Law 1581 of 2012:

– Authorization: prior, express and informed consent of the Data Subject to carry out the Processing of personal data;

– Database: Organized set of personal data that is subject to Processing;

– Personal data: Any information linked or that may be associated to one or several determined or determinable natural persons;

– Data Processor: Natural or legal person, public or private, who by himself or in association with others, performs the Processing of personal data on behalf of the Data Controller;

– Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the processing of data, in this case GRUPO ZICAV S.A.S.

– Holder: Natural person whose personal data are subject to processing;

– Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or suppression.

Contained in Decree 1377 of 2013:

– Privacy Notice: Verbal or written communication generated by the Controller, addressed to the Data Subject for the Processing of his personal data, by which he is informed about the existence of the information Processing policies that will be applicable, how to access them and the purposes of the Processing that is intended to be given to the personal data.

– Public data: Data that is not semi-private, private or sensitive. Public data are considered, among others, the data related to the marital status of individuals, their profession or trade and their status as merchant or public servant. Due to their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality.

– Sensitive data: Sensitive data are understood as those that affect the privacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.

– Transfer: The transfer of data takes place when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is the Data Controller and is located inside or outside the country.

– Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when the purpose is the performance of a Processing by the Processor on behalf of the Controller.

IV. GUIDING PRINCIPLES

Based on the law 1581 of 2012, GRUPO ZICAV S.A.S. will treat personal data in accordance with the following principles:

a) Principle of legality in matters of Data Processing: The processing referred to in the law is a regulated activity that must be subject to the provisions of the law and other provisions that develop it;

b) Principle of purpose: The processing must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject;

c) Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent;

d) Principle of truthfulness or quality: The information subject to Processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited;

e) Principle of transparency: The right of the Data Subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed in the Processing;

f) Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of the personal data, the provisions of this law and the Constitution. In this sense, the Processing may only be carried out by persons authorized by the Holder and/or by the persons provided for in this law;
Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or third parties authorized in accordance with this law;

g) Principle of security: The information subject to Processing by the Data Controller or Data Processor referred to in this law, shall be handled with the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access;

h) Principle of confidentiality: All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the processing, and may only provide or communicate personal data when this corresponds to the development of the activities authorized in this law and under the terms of the same.

V. RIGHTS OF THE OWNERS

Art. 8 of Law 1581 of 2012, establishes:

Rights of the Holders. The Data Controller shall have the following rights:

(a) To know, update and rectify their personal data against the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized;

b) Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing, in accordance with the provisions of article 10 of this law;

c) Be informed by the Data Controller or the Data Processor, upon request, regarding the use made of their personal data;

d) File complaints before the Superintendence of Industry and Commerce for violations of the provisions of this law and other rules that modify, add or complement it;

e) To revoke the authorization and/or request the deletion of the data when the processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has incurred in conduct contrary to this law and the Constitution;

f) Access free of charge to their personal data that have been subject to Processing.

VI. PROCESSING OF PERSONAL DATA

GRUPO ZICAV S.A.S, for the celebration of its civil, commercial and labor contracts and for the adequate development of its commercial activities, collects, stores, uses, circulates and deletes Personal Data corresponding to natural/legal persons with whom it has or has had a relationship.

Processing of public data

GRUPO ZICAV S.A.S. will treat the public data of the owners in accordance with the purpose for which such information is captured, taking the necessary measures to ensure compliance with the respective legal principles and obligations.

Treatment of sensitive data

GRUPO ZICAV S.A.S. will only process sensitive personal data in those cases that are strictly necessary, notifying their owners the optional nature of the provision of this information, for which it will request the prior and express authorization to the owner of the data and will inform the specific purpose of the treatment.

GRUPO ZICAV S.A.S will use and process data of a sensitive nature, when:

1. The processing has been expressly authorized by the owner of the sensitive data, except in cases where by law, the granting of such authorization is not required.

2. The Processing is necessary to safeguard the vital interest of the owner and he/she is physically or legally incapacitated. In these events, the legal representatives must grant the authorization.

3. The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.

4. The Processing has a historical, statistical or scientific purpose or, within the framework of improvement processes; the latter, provided that measures are taken to suppress the identity of the Data Subject or the data is dissociated, i.e., the sensitive data is separated from the identity of the Data Subject and is not identifiable or it is not possible to identify the person who is the Subject of the sensitive data or data.

Treatment of data of minors

GRUPO ZICAV S.A.S. will only process personal data of minors, when these are of public nature or come from the information provided by employees or contractors, and are required for the fulfillment of legal obligations by GRUPO ZICAV S.A.S.

The treatment of this type of personal data will be carried out in accordance with the law, provided that it complies with the following parameters and requirements:

1. That it responds to and respects the best interests of children and adolescents.

2. That it ensures respect for their fundamental rights.

Fulfilled the previous requirements, GRUPO ZICAV S.A.S. will demand to the legal representative or guardian of the child or adolescent, the authorization of the minor, before the minor gives his opinion in front of the Treatment that will be given to his data, opinion that will be valued taking into account the maturity, autonomy and capacity to understand the matter, as indicated by the Law.

GRUPO ZICAV S.A.S. and any person involved in the processing of personal data of children and adolescents, will ensure the proper use of the same and will comply with the respective legal regime.

VII. TYPES OF DATABASES

1. OF CUSTOMERS:

GRUPO ZICAV S.A.S will collect, use, store, circulate (transfer to third parties), analyze, delete, data of public and private nature of natural or legal persons. These data will be organized in manual/systematized databases.

Customers: natural/legal persons with whom a contractual and/or commercial relationship is maintained in the development of the corporate purpose of GRUPO ZICAV S.A.S.

1.1. PURPOSE

To fulfill the obligations undertaken by GRUPO ZICAV S.A.S. with its clients at the moment of acquiring its products/services/projects; Send/receive text or verbal messages for commercial purposes, customer service and/or collection management; Send information about changes or modifications in the projects; Send information about offers related to our products/services/projects offered by GRUPO ZICAV S.A. S; to implement loyalty programs; to implement collection campaigns or collections; to evaluate the quality of our products and services; to carry out satisfaction surveys to close cases; to improve, promote and develop its products/projects/services; calls for advertising purposes; to train salesmen and agents in basic aspects of commercial management of the products/projects/services offered by GRUPO ZICAV S. A.S; Control access to the offices of GRUPO ZICAV S.A.S and establish security measures, including the establishment of video-monitored areas; Use the different services through the websites of GRUPO ZICAV S.A. S websites, including content and format downloads; Allow companies linked to GRUPO ZICAV S.A.S, with which it has entered into contracts that include provisions to ensure the security and proper processing of personal data processed, to contact the Data Subject for the purpose of offering goods or services of interest; For the determination of outstanding obligations, the consultation of financial information and credit history and reporting to information centers of unfulfilled obligations with respect to its debtors; Transfer the information to financial institutions with which GRUPO ZICAV S. A.S. has an agreement with the purpose of allowing clients interested in acquiring bank loans to know the products offered by such entities (in any case, such financial entities shall have implemented data protection policies and shall be obliged to protect the data according to the protection policies of GRUPO ZICAV S.A.S.; transfer to third parties in order to comply with contractual obligations; activities related to the ordinary course of business of GRUPO ZICAV S.A.S.).

1.2. TOOLS

GRUPO ZICAV S.A.S. has a customer database for each of its branches, headquarters or commercial establishments. These are stored in a manual and systematized way.

2. TELEMARKETING

GRUPO ZICAV S.A.S. will collect, use, store, circulate, analyze and delete public and private data of natural or legal persons. Which will be organized in manual/systematized databases.

TELEMERCADEO: It is the name given to the natural/legal persons who express an interest in acquiring or receiving commercial information about the projects/services/products offered by GRUPO ZICAV S.A.S.

2.1. PURPOSE

To send/receive text or verbal messages for commercial and customer service purposes; To send information about changes or modifications in the projects; To send information about offers related to our products/services/projects offered by GRUPO ZICAV S.A. S; to implement loyalty programs; to implement collection campaigns or collections; to evaluate the quality of our products and services; to carry out satisfaction surveys to close cases; to improve, promote and develop its products/projects/services; calls for advertising purposes; to train salesmen and agents in basic aspects of commercial management of the products/projects/services offered by GRUPO ZICAV S. A.S; Control access to the offices of GRUPO ZICAV S.A.S and establish security measures, including the establishment of video-monitored areas; Use the different services through the websites of GRUPO ZICAV S.A.S, including downloading of contents and formats; activities related to the ordinary course of business of GRUPO ZICAV S.A.S.

2.2. TOOLS

GRUPO ZICAV S.A.S. has a database of natural/legal persons who express an interest in acquiring or receiving commercial information about the projects/services/products offered, from each of its branches, headquarters or commercial establishments. These are stored in a manual and systematized way.

3. SUPPLIERS, FREELANCER CONTRACTORS

GRUPO ZICAV S.A.S. will collect, use, store, circulate, analyze and delete data of public and private nature of natural or legal persons. Which will be organized in manual/systematized databases.

SUPPLIERS: Natural/legal persons with whom there is a contractual and/or commercial relationship between GRUPO ZICAV S.A.S. and the owner of the data and whose processing is intended to comply with contractual and legal obligations.

FREE LANCE CONTRACTORS: Natural person, who provides services to GRUPO ZICAV S.A.S. as an independent, in the commercial and/or sales area.

3.1. PURPOSES

3.1.1. SUPPLIERS

To invite them to participate in selection processes and events organized or sponsored by GRUPO ZICAV S.A.S; To evaluate the fulfillment of their obligations; To register in GRUPO ZICAV S.A. S systems; To process their payments and verify their payments. S; To process their payments and verify outstanding balances; To manage the information of suppliers and contractors; To update the suppliers with whom it has commercial relationship; To control the documentation for the registration of suppliers suitable to perform an activity or execute a supply for GRUPO ZICAV S.A.S; Accounting, fiscal and administrative management in relation to the supplier base; activities related to the ordinary course of business of GRUPO ZICAV S.A.S.

3.1.2. FREELANCE CONTRACTORS

Training of personnel to carry out the management of sales as freelance, payment of social security contributions, as well as to carry out the activities related to the ordinary course of business of GRUPO ZICAV S.A.S.

3.2. TOOLS

GRUPO ZICAV S.A.S. has a database of suppliers and freelance contractors of each of its branches, headquarters or commercial establishments. These are stored in a manual and systematized way.

4. SUMMONED, WORKERS, FORMER WORKERS

GRUPO ZICAV S.A.S. will collect, use, store, circulate, analyze and delete data of public and private nature of natural or legal persons. These data will be organized in manual/systematized databases.

CANDIDATES/CANDIDATES: Natural persons who aspire to be employed by GRUPO ZICAV S.A.S. In order to determine if they qualify for the profile of a position to be filled, a selection process is previously carried out to verify the quality of the information provided by the candidate and the authenticity of the same and to store the data with the purpose of being used in future selection processes.

WORKERS: Natural persons who work with GRUPO ZICAV S.A.S. and whose private and public information, sensitive data and data of minors is incorporated. The processing of personal data for purposes other than compliance with the obligations arising from the employment relationship shall require prior authorization of the owner or his Legal Representative, as the case may be. In no case, GRUPO ZICAV S.A.S. will treat sensitive data or data of minors without prior authorization.

FORMER EMPLOYEE: Natural persons that were linked to GRUPO ZICAV S.A.S.

4.1. PURPOSES

4.1.1. CALLED

To carry out a selection process for a vacancy and is limited to participation in it.

4.1.2. WORKERS

To administer the contractual relationship existing between the worker and the company, to achieve the adequate training of personnel, to advance personnel management, payroll, affiliations to entities of the general social security system, welfare and health at work activities, exercise of the employer’s sanctioning power, prevention of occupational risks, to achieve the promotion and management of employment; To administer and operate, directly or through third parties, the processes of selection and hiring of personnel, including the evaluation and qualification of the participants and the verification of labor and personal references, and the performance of security studies; Carry out Human Resources activities; Make the necessary payments derived from the execution of the employment contract and/or its termination, and other social benefits in accordance with the applicable law; – Contract labor benefits with third parties, such as life insurance, medical expenses, among others; Notifying authorized contacts in case of emergencies during working hours or on the occasion of the development of the same; Coordinate the professional development of employees, employee access to the employer’s computer resources and provide support for their use; Plan business activities; activities related to the ordinary course of business of GRUPO ZICAV S. A.S

4.1.3. FORMER EMPLOYEES

To comply with Colombian or foreign law and the orders of judicial or administrative authorities or private entities in the exercise of public services; To issue certifications related to the relationship of the owner of the data with the company; Statistical or historical purposes.

4.1.4. TOOLS

GRUPO ZICAV S.A.S. has a database of the summoned, employees, former employees and intranet, of each of its branches, headquarters or commercial establishments. These are stored in a manual and systematized way.

VIII. INFORMATION OBTAINED THROUGH THE WEB AND/OR SOCIAL NETWORKS

In order to advertise products and services, GRUPO ZICAV S.A.S. has a profile on social networks Facebook, Instagram, Youtube and LinkedIn. The information obtained through these media or through the website www.grupozicav.com will be stored in the database of «TELEMERCADEO», with the same treatment, purposes and tools applied to this type of databases.

7.1. COLLECTION

The holder who has a personal profile on the social networks Facebook, Instagram, Youtube, linkedIn and who decides to follow the official page created by GRUPO ZICAV S.A.S, may by these means provide GRUPO ZICAV S.A.S with personal information, for which he/she will authorize it previously, clearly, expressly and voluntarily.

For this purpose, the user/owner/potential client will previously access the internal policies published on the website www.grupozicav.com, as well as may also configure their profile or user in the respective social network to ensure their privacy.

GRUPO ZICAV SA will have access to that public information of the user, in particular, your contact name. These data are only used within the social network itself. And will not be stored in any database of GRUPO ZICAV S.A.S unless the owner so authorizes.

7.2. ACTIONS

ACTIONS BY GRUPO ZICAV S.A.S:

– Access to the public information of the profile of the user who has decided to follow the account of GRUPO ZICAV S.A.S in the respective official social networks.

– Publication in the profile of the user/owner/potential customer, of all information already published on the page of GRUPO ZICAV SA.

– Respond to requests on the profile of the user/owner/potential customer.

– Send group and individual messages through the social network channels.

– Updates on the status of the page that will be published on the user’s profile.

– The user can always, individually and privately, control their connections, delete content that is no longer of interest to them and restrict who they share their connections with by accessing their privacy settings.

7.3. PUBLICATIONS

The user, once linked to the page of GRUPO ZICAV S.A.S, may publish in the latter comments, links, images or photographs or any other type of multimedia content supported by the social network. To carry out this procedure, the user, in all cases, must be the owner of the same, enjoy the copyright and intellectual property rights or have the consent of the third parties concerned. It is expressly forbidden any publication on the page, whether texts, graphics, photographs, videos, etc. that infringe or are likely to infringe morality, ethics, good taste, and / or infringe, violate or violate the rights of intellectual or industrial property, the right to the image or the law. In these cases, GRUPO ZICAV SA reserves the right to immediately remove the content, and may request the permanent blocking of the user.

GRUPO ZICAV SA will not be responsible for the contents freely published by a user. However, the protocol of social networks and user care will be taken into account to handle these actions.

The user must keep in mind that his publications will be known by other users, so he himself is the main responsible for his privacy.

The images that may be published on the page will not be stored in any magnetic media by GRUPO ZICAV SA, but they will remain in the social network.

It is reiterated that GRUPO ZICAV S.A.S will not require authorization to use any information considered public by law, or that has been made public by the owner of the information.

7.4. CONTESTS AND PROMOTIONS

GRUPO ZICAV S.A.S. reserves the right to carry out contests and promotions, in which the user can participate linked to your page. The bases of each of them, when the platform of the social network is used for this purpose, will be published in the same. Always complying with current regulations and any other applicable rules.

The social network does not sponsor, endorse or administer, in any way, any of our promotions, nor is it associated with any of them.

7.5. ADVERTISING

GRUPO ZICAV S.A.S. will use the social network to advertise its products and services, in any case, if you decide to treat your contact information for direct commercial prospecting actions, it will always be in compliance with legal requirements.

It will not be considered advertising the fact of recommending to other users the page of GRUPO ZICAV S.A.S. so that they can also enjoy the promotions or be informed of its activity.

IX. APPLICABLE LEGISLATION
This Personal Data Protection Policy, the Privacy Notice, and the authorizations are governed by the Political Constitution of Colombia, Law 1581 of 2012, Decree 1377 of 2013, Decree 1727 of 2009 and other regulations that modify, repeal or replace them.