Here you can find all our personal data processing policy.
PROSAGRO EXPORT S.A.S
1. SCOPE
The Policy of Treatment and Protection of Personal Data presented below, will be applied to all the Databases and Files that contain personal data and that are object of treatment by PROSAGRO EXPORT S.A.S (THE COMPANY), considered as responsible or in charge of the treatment of the personal data.
All employees, collaborators and third parties who have a relationship with the Company and who process personal data must comply with this policy and the procedures established for the processing of personal data.
Prosagro Export S.A.S., in order to comply with current legislation on data protection, especially Law 1581 of 2012 and other current and complementary rules that treat and regulate this matter, informs the relevant aspects regarding the collection, use and transfer of personal data that the Company performs with personal data, under the authorization granted to advance such treatment, as well as the handling of them.
In this personal data processing policy (hereinafter the “Policy”) you will find the institutional and legal guidelines under which the Company processes your data, the purpose, your rights as owner, as well as the procedures for the exercise of such rights.
2. IDENTIFICATION OF THE CONTROLLER OR PROCESSOR OF PERSONAL DATA
Prosagro Export S.A.S. with address at Calle 12 # 30 – 340, Medellín, Antioquia, identified with Tax Identification Number NIT: 901.487.559-3.
E-mail: juridica@gruposanjose.com.co
Phone: 3136603066 from Monday to Friday from 8:00 a.m. to 4:00 p.m.
3. DEFINITIONS
For the interpretation of this Policy, please consider the following definitions:
- Authorization: Verbal or written communication generated by the responsible party, addressed to the Data Subject for the processing of his/her personal data, through which he/she is informed about the existence of the Information Processing Policies that will be applicable to him/her, the way to access them and the purposes of the processing that is intended to be given to the personal data.
- Data Base: Organized set of personal data that is subject to Processing.
- Personal Data: Any information linked or that can be associated to one or several determined or determinable natural persons.
- Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller.
- Data Controller: Natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the processing of the data.
- Data Subject: Natural person whose personal data is the object of processing.
- Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
- Sensitive Data: Information that affects the privacy of individuals or whose improper use may generate discrimination (racial or ethnic origin, political orientation, philosophical or religious convictions, relevance to trade unions or social organizations or human rights, health data, sex life and biometric data).
- Transfer: The transfer of data takes place when the controller or processor of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is responsible for the processing and is located inside or outside the country.
4. USE AND PURPOSE OF THE TREATMENT
Prosagro Export S.A.S. will use the information provided only and exclusively for the purposes indicated, therefore, will safeguard the databases containing the information collected, and will not allow access to unauthorized personnel, except for the constitutional and legal exceptions in force and applicable on the matter.
In this sense, it shall take all the necessary precautions and measures to guarantee the confidentiality of the information, in accordance with the confidentiality principle set forth in Law 1581 of 2012, and other information in force on the matter. Likewise, the holder is entitled to the rights granted by the applicable and current regulations regarding data protection and the right to information.
The treatment to be carried out by the Company will be to collect, store, process, use and transfer (as appropriate) personal data, in strict compliance with the duties of security and confidentiality mandated by Law 1581 of 2012 and Decree 1377 of 2013, for the following purposes, but not limited to:
- Execute the activities of the Company in order to fulfill its corporate purpose.
- To offer products, services and/or benefits to the Holders.
- Consult information in the restrictive lists.
- Record personal data information in the Company’s databases, in order to analyze, evaluate and generate statistical data.
- Send the information to governmental or judicial entities at their express request.
- Support external and internal audit processes.
- Sending of contractual, commercial and obligatory information.
Likewise, the Company will provide personal data to third parties that provide services or with whom it has some kind of cooperation relationship, in order to:
- Facilitate the implementation of programs in compliance with legal mandates.
- Manage and administer databases.
- Respond to requests, complaints and appeals.
- Provide answers to control agencies.
When the Company receives information that has been transferred to it by other natural or legal persons due to its request, it will give it the same treatment of confidentiality and security that it provides to the information produced by itself.
5. RIGHTS OF THE HOLDER
Pursuant to Article 8 of Law 1581 of 2012, the rights that you as a Data Subject have in relation to personal data are:
- Access free of charge to personal data that have been subject to Processing.
- Know, update and rectify your personal data. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
- Request proof of the authorization granted to the Company except when expressly exempted as a requirement for the Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.
- Be informed by the Company, upon request, regarding the use that has been made of their personal data.
- To revoke the authorization and/or request the deletion of the data when the processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that the Company has incurred in conducts contrary to the law and the Constitution.
- The others indicated in Article 8 of Law 1581 of 2012.
6. PROCEDURE FOR THE EXERCISE OF YOUR RIGHTS AS OWNER
The Owners of the Personal Data being collected, stored, processed, used and transferred by the Company, may at any time exercise their rights to know, update and rectify the information.
For this purpose, the following procedure will be followed, in accordance with the Personal Data Protection Law:
6.1 MEANS OF SUBMITTING PETITIONS, INQUIRIES, COMPLAINTS AND GRIEVANCES
The Company has provided the following means for the reception and attention of requests, inquiries, complaints and claims that allow to keep proof of the same:
- Written communication addressed to Prosagro Export S.A.S. located at Calle 12 30-340, Medellín, Antioquia.
- E-mail request: informacionexport@gruposanjose.com.co
6.2 CONSULTATION
The Holder or his attorney-in-fact may request the Company:
- Information about the Personal Data of the Data Subject that are subject to Processing.
- Information regarding the use given by the Company to your personal data.
The request for consultation addressed to the Company shall contain at least the following information:
- Names and surnames of the holder and/or his proxy.
- Copy of the holder’s identity document.
- Physical and electronic address and contact telephone number of the owner.
- Signature, type and identification number or corresponding validation procedure.
The consultation will be answered within a maximum term of ten (10) business days from the date of receipt of the same. When it is not possible to attend the consultation within said term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term.
6.3 CLAIMS
The Holder or his attorney-in-fact, may request the Company, through a written request submitted through the aforementioned channels:
- The correction or updating of the information.
- That the alleged breach of any of the duties contained in the Personal Data Protection Law be remedied or corrected.
The Data Subject or attorney-in-fact who considers that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in law 1581 of 2012, may file a claim with the Company which will be processed under the following rules:
- The claim shall be formulated by means of a request addressed to the Company, with the identification of the Holder, the description of the facts that give rise to the claim, the physical and electronic address, contact telephone number, and accompanying the documents that the claimant wishes to assert. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, if the applicant does not submit the required information, it will be understood that the claim has been abandoned.
In the event that the Company receives a complaint addressed to another organization, it will forward it to the appropriate party within a maximum of two (2) business days and inform the complainant of the situation.
2. Once the claim has been received in full, and within a maximum term of two (2) business days from its receipt, the Company will include in the database where the holder’s personal data is stored a legend that reads “claim in process” and the reason for the claim. This legend shall be maintained until the claim is resolved.
The maximum term to address the claim shall be fifteen (15) business days from the day following the date of its receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) working days following the expiration of the first term.
7. VALIDITY
This Policy of Treatment and Protection of Personal Data will become effective once this document is approved and published.
Effective date: July 2022.