Data processing policy

OBJECTIVE:

Establish the criteria for the collection, storage, use, circulation and deletion (specifically mention the treatment that will be given to personal data) of the personal data processed by ICRA.

SCOPE:

This policy applies to all personal information registered in the ICRA databases.

who acts as the person responsible for the processing of personal data.

OBLIGATIONS:

This policy is mandatory and strict compliance for ICRA

RESPONSIBLE FOR THE TREATMENT:

ICRA, legally constituted commercial company, identified with NIT 901335753-4, with main domicile at (address) Calle 31 sur #47 a 15 in the city of Envigado, Republic of Colombia. Pagewww.icra.com.co, Telephone +57 311 7208203 in the city of Envigado.

PERSONAL DATA PROCESSING POLICY TREATMENT AND PURPOSE:

The treatment that ICRA will carry out with the personal information will be the following:

Collection, storage, use, circulation for:

Carry out the pertinent steps for the development of the corporate purpose of the company in what has to do with the fulfillment of the object of the contract entered into with the Owner of the information.
Make invitations to events and offer new products and services.
Manage procedures (requests, complaints, claims).
Conduct satisfaction surveys regarding the goods and services offered by ICRA.
Provide contact information to the commercial force and/or distribution network, telemarketing, market research and any third party with which ICRA has a contractual relationship for the development of activities of this type (market research and telemarketing, etc.) for the execution of the same.
Contact the Holder through telephone means to carry out surveys, studies and/or confirmation of personal data necessary for the execution of a contractual relationship.
Contact the Holder through electronic means – SMS or chat to send news related to loyalty campaigns or service improvement.
Contact the Holder via email to send extracts, account statements or invoices in relation to the obligations arising from the contract entered into between the parties.
Comply with the obligations contracted by ICRA) with the Holder of the Information, in relation to the payment of salaries, social benefits and other remuneration enshrined in the employment contract or as provided by law (in the case of employees of the organization).
Offer programs and/or business activities for the owner and their beneficiaries (children, spouse, permanent partner).
Transfer personal data outside the country to the parent company of ICRA to comply with the anti-money laundering regulations that apply to it.
Transmit personal data outside the country to third parties with whom ICRA has signed a data processing contract and it is necessary to deliver it for the fulfillment of the contractual object.
Provide the services offered by ICRA and accepted in the signed contract.
Provide the information to third parties with whom ICRA has a contractual relationship and that it is necessary to deliver it for the fulfillment of the contracted object.

RIGHTS OF THE HOLDERS:

As the owner of your personal data, you have the right to:

(i) Free access to the data provided that have been processed.

(ii) Know, update and rectify your information against partial, inaccurate, incomplete, fragmented, misleading data, or those whose treatment is prohibited or has not been authorized.

(iii) Request proof of the authorization granted.

(iv) Submit to the Superintendency of Industry and Commerce (SIC) complaints for violations of the provisions of current regulations.

(v) Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual duty that prevents their deletion.

ATTENTION OF PETITIONS, INQUIRIES AND CLAIMS

The communications area is the unit in charge of processing the requests of the owners to make their rights effective. These rights may be exercised through the channels or means provided by ICRA for public attention, the email address [email protected], whose information I can consult atwww.icra.com.co, available from Monday to Friday from 8:00 am to 4:00 pm, to attend to requirements related to the processing of my personal data and the exercise of the rights mentioned in this authorization.

PROCEDURE FOR THE EXERCISE OF THE RIGHT OF HABEAS DATA

In compliance with the regulations on personal data protection, ICRA presents the procedure and minimum requirements for the exercise of your rights:

For the filing and attention of your request, we ask you to provide the following information:

Full name and surname

Contact information (Physical and/or electronic address and contact telephone numbers),

Means to receive a response to your request,

Reason(s)/event(s) giving rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete it, access information)

Signature (if applicable) and identification number.

The maximum term provided by law to resolve your claim is fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to address the claim within said term, ICRA will inform the interested party of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished. Once the terms indicated by Law 1581 of 2012 and the other regulations that regulate or complement it have been fulfilled, the Holder who is denied, totally or partially, the exercise of the rights of access, update, rectification, deletion and revocation, may report your case to the Superintendence of Industry and Commerce –Delegation for the Protection of Personal Data-.

VALIDITY:

This Policy for the Treatment of Personal Data governs from

From April 16, 2020.

The databases in which the personal data provided will be recorded will be kept as long as their deletion is not requested by the interested party and as long as there is no legal duty to keep them.

ICRA