Data Protection Policy

1. AUTHORIZATION: Prior, express and informed consent of the owner to carry out the processing of personal data.
2. PRIVACY NOTICE: Verbal or written communication generated by the person responsible addressed to the owner for the processing of their personal data, informing them of the existence of the information processing policies that will be applicable to them, the way to access them and the purposes of the intended processing of personal data.
3. DATABASE: Organized set of personal data that is subject to processing.
4. ROOT CAUSE: A person who has succeeded another because of their death (heir).
5. PERSONAL DATA: Any piece of information linked to one or more specific or determinable persons or that can be associated with a natural or legal person.
6. PUBLIC DATA: It is data that is not semi-private, private or sensitive. Public data are considered, among others, data relating to the civil status of individuals, their profession or profession and their capacity as a merchant or public servant. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly enforceable court judgments that are not subject to reservation.
7. SENSITIVE DATA: Sensitive data is understood to be data that affects the owner's privacy or whose misuse may lead to discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social or human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.
8. ESSENTIAL DATA: They are understood as those personal data of the owners, essential for carrying out higher education activities in teaching, research and social projection. Data of an indispensable nature must be provided by their owners or those entitled to exercise these rights.
9. OPTIONAL DATA: These are the data that the U.D.C.A requires to offer additional services in research, teaching, social outreach, job offers, etc.
10. PERSON IN CHARGE OF THE TREATMENT: Natural or legal person, public or private, who, on their own or in association with others, carries out the processing of personal data on behalf of the Data Controller.
11. DATA PROTECTION LAW: It is Law 1581 of 2012 and its Regulatory Decrees or the regulations that modify, complement or replace them.
12. HABEAS DATA: Right of any person to know, update and rectify the information that has been collected about them in the database and in the files of public and private entities.
13. RESPONSIBLE FOR THE TREATMENT: Natural or legal person, public or private, who, on their own or in association with others, decides on the basis of data and/or data processing.
14. INCUMBENT: Natural person whose personal data are subject to treatment.
15. TREATMENT: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
16. TRANSFER: The transfer of data takes place when the person responsible and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is located inside or outside the country.
17. TRANSMISSION: Processing of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia when the purpose of carrying out processing by the processor on behalf of the person responsible.

‍

1. PRINCIPLE OF LEGALITY: Data processing is a regulated activity that must be subject to the provisions of the law and the other provisions that implement it.
2. PRINCIPLE OF PURPOSE: the treatment must serve a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the owner. With regard to the collection of personal data, JACARANDAS will be limited to those data that are relevant and adequate for the purpose for which they were collected or required. Likewise JACARANDAS you must inform the owner of the reason for which the information is requested and the specific use that will be given to it.
3. THE PRINCIPLE OF FREEDOM: processing can only be carried out with the prior, express and informed consent of the owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate to relieve consent.
4. PRINCIPLE OF VERACITY OR QUALITY: the information subject to processing must be true, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractional or misleading data is prohibited.
5. PRINCIPLE OF TRANSPARENCY: processing must guarantee the right of the owner to obtain from the data controller or the processor, at any time and without restrictions, information about the existence of data concerning him.
6. PRINCIPLE OF RESTRICTED ACCESS AND MOVEMENT: processing is subject to the limits that derive from the nature of personal data, from the provisions of the law and the Constitution. In this sense, processing may only be carried out by persons authorized by the owner and/or by persons provided for by law. Personal data, with the exception of public information, may not be available on the internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to owners or third parties authorized by law.
7. SAFETY PRINCIPLE: information subject to processing by JACARANDAS it must be handled with the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, unauthorized or fraudulent consultation, use or access.
8. CONFIDENTIALITY PRINCIPLE: JACARANDAS is obliged to guarantee the confidentiality of information, even after the end of its relationship with any of the tasks that comprise the processing, and may only provide or communicate personal data when this corresponds to the development of the activities authorized by law.
9. PRINCIPLE OF NOT ENGAGING IN BEHAVIORS THAT CAUSE HARM: JACARANDAS shall have as its guiding principle confidentiality in the handling and use of the personal data of women and pregnant persons and will not carry out any type of conduct that causes harm to people who come in search of the provision of the service. This includes the protection of personal data and will only request those that are strictly necessary to fight for the exercise, enjoyment and protection of the fundamental rights that women and pregnant people have.

1. Know, update and rectify your personal data against JACARANDAS in your capacity as data controller. This right may be exercised, among others, against partial, inaccurate, incomplete, fractional, misleading, or data whose processing is expressly prohibited or has not been authorized.
2. Request proof of authorization granted to JACARANDAS except when it is expressly excluded as a requirement for treatment (cases in which authorization is not necessary).
3. To be informed by JACARANDAS upon request, regarding the use you have given to your personal data.
4. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or supplement it.
5. Revoke the authorization and/or request the deletion of the data when the Treatment does not respect constitutional and legal principles, rights and guarantees.
6. Free access to your personal data that has been processed.

In accordance with the Colombian legal system, the processing of personal data of children and adolescents may be done when it comes to data of a public nature and when it meets the requirements of respecting the best interests of children and adolescents and ensuring respect for their fundamental rights.

JACARANDAS is obliged to observe and comply with the provisions of the Constitutional Court on the understanding that there is no absolute prohibition on the processing of data of children and adolescents, as this would result in the denial of other higher rights of this population.

Accordingly, for JACARANDAS it is clear that the management and processing of the personal data of children and adolescents is carried out exceptionally as long as the following criteria are met:

1. That the purpose of the treatment responds to the best interests of children and adolescents.
2. That children and adolescents are respected for their fundamental rights.
3. Depending on the maturity of the child or adolescent, their opinion will be taken into account.
4. That the principles set out in Law 1581 of 2012 for the processing of personal data are complied with.

In that regard, JACARANDAS may exceptionally dispense with requesting the authorization of the minor's legal representative to process their data when their fundamental rights, especially life, integrity, health or the free development of their personality, are at serious and imminent risk due to situations of physical or moral violence, abandonment or serious parental neglect.

‍In any case, JACARANDAS will respect the right of children or adolescents to be heard and will only process those data that are absolutely essential to guarantee their best interests, after evaluating the maturity, autonomy and capacity of the minor to understand the matter in question.

However, it is specified that when children and adolescents range from the age of 12 to 18, and taking into account that in some circumstances and especially those that contemplate the processing of personal data for the purpose of sexual and reproductive education, it is possible that the authorization for the processing and management of personal data is granted, in a prior and express manner, by the adolescent. In the face of which JACARANDAS you are required to verify that the referral complies with the following requirements:

1. Be in writing.
2. Be oral.
3. Through unambiguous conduct that allows us to reasonably conclude that the authorization was granted.
4. That the authorization be explicit.

Under this policy, the processing and protection of personal data are the duties of JACARANDAS the following, without prejudice to the provisions provided for by law.

1. Guarantee the holder, at all times, the full and effective exercise of the right to habeas data.
2. Request and keep a copy of the respective authorization granted by the owner.
3. Duly inform the owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted.
4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
5. Ensure that information is true, complete, accurate, up to date, verifiable and understandable.
6. Update the information, thus taking into account all the news regarding the owner's data. Additionally, all necessary measures must be implemented to keep the information up to date.
7. Rectify information when it is incorrect and communicate what is appropriate.
8. Respect the security and privacy conditions of the owner's information.
9. To process inquiries and complaints made in the terms indicated by law.
10. Identify when certain information is under discussion by the owner.
11. Inform at the request of the owner about the use given to their data.
12. Inform the data protection authority when there are violations of security codes and there are risks in the management of the information of the owners.
13. Comply with the requirements and instructions issued by the Superintendency of Industry and Commerce on the particular subject. n) Use only data whose processing is previously authorized in accordance with the provisions of Law 1581 of 2012.
14. JACARANDAS will use the owner's personal data only for those purposes for which it is duly empowered and in any case in compliance with current regulations on the protection of personal data.

Notwithstanding the exceptions provided for in the Act, the processing of the owner's personal data requires the owner's prior and informed authorization, which must be obtained by any means that may be the subject of subsequent consultation.

1. PRIVACY NOTICE: The privacy notice is the verbal or written communication originated by the data controller, addressed to the owner of the personal data. The privacy notice is made known to the owner through physical, electronic or any other means that JACARANDAS consider, and this document reports at least the following:
2. Who is responsible for the treatment.
3. The treatment and purpose of obtaining, collecting, using, processing, exchanging, transferring and transmitting personal data.
4. The existence of this policy and how to consult it.

Under the terms set out in the Act, you will publish the data processing policy through the institutional website www.somosjacarandas.com, through which you inform the owners that they can exercise their rights with respect to the processing of their personal data, requesting their acceptance or rejection through the email somosjacarandas@gmail.com

The authorization will be generated by JACARANDAS and made available to the OWNER in advance and prior to the processing of their personal data. This authorization may consist of a physical, electronic document, text message, INTERNET, WEBSITES, in any other format that allows you to guarantee your subsequent consultation, or through an appropriate technical or technological mechanism that allows you to express or obtain consent via click or double click, through which it can be concluded unequivocally that, had there been no conduct on the part of the OWNER, the data would never have been captured and stored in the database.

The authorization of the owner of the information will not be necessary in the following cases:

1. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
2. Data of a public nature.
3. Cases of medical or health emergencies.
4. Information processing authorized by law for historical, statistical or scientific purposes. Data related to the Civil Registry of individuals.

The rights of the owners established in the Act may be exercised by the following persons:

1. By the owner, who must prove his identity sufficiently by the various means he makes available to him.
2. For the claimants of the owner, who must prove such quality.
3. By the representative and/or proxy of the owner, after accreditation of the representation or power of attorney.
4. By stipulation in favor of another or for another.
5. The rights of children and adolescents shall be exercised by those who are empowered to represent them.

The processing for the essential personal data of women and pregnant persons will be framed in the legal order and will be all that is necessary for the fulfillment of the corporate purpose.

In the case of sensitive personal data, they may be used and processed when:

1. The Data Controller has given his explicit authorization to said Treatment, except in cases where the granting of such authorization is not required by law.
2. The Treatment is necessary to safeguard the vital interest of the owner and the owner is physically or legally incapacitated. At these events, legal representatives must grant their authorization.
3. The Treatment is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided that they refer exclusively to its members or to people who maintain regular contacts because of their purpose. In these events, the data cannot be provided to third parties without the authorization of the Owner.
4. Processing refers to data that is necessary for the recognition, exercise or defense of a right in a judicial proceeding.
5. The Treatment has a historical, statistical or scientific purpose. At this event, measures must be taken to suppress the identity of the Holders.
6. The processing of personal data of children and adolescents is prohibited, except when it concerns public data, and when such processing meets the following parameters and/or requirements: a) that respond to and respect the best interests of children and adolescents. b) that respect for their fundamental rights and compliance with the provisions of paragraph xi of this policy is ensured.

The direct and indirect purposes of this policy are related to the fulfillment of the corporate purpose of JACARANDAS.

In compliance with personal data protection regulations, JACARANDAS has established the following procedure so that the owners of the information can exercise them fully and with all the guarantees.

The right to inquiries consists of the right of the data subject, their successors, or anyone with a legitimate interest to formulate before JACARANDAS inquiries in order to know what personal data of the owner are processed by JACARANDAS.

In accordance with the above, JACARANDAS will guarantee the right of consultation, making you aware of the personal information linked to the owner.

Inquiries will be submitted through the channels enabled for this purpose and will be answered within a maximum period of ten (10) business days from the date of receipt of the same. When it is not possible to respond to the query within that period, the interested party will be informed, stating the reasons for the delay and the date on which the consultation will be answered, which will not exceed five (5) business days following the expiration of the first term, in accordance with the provisions of article 14 of Law 1581 of 2012.

Complaints consist of a request that the Owner or his relatives who consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in this policy or in the law, may submit to JACARANDAS a complaint.

The complaint will be made by means of a request addressed to JACARANDAS through established channels, with the identification of the Owner, the description of the facts giving rise to the claim, the address, and accompanying the documents that you want to assert.

Once the complaint is received, a legend that says “pending claim” and the reason for the claim will be included in the database, within a period not exceeding two (2) business days. This legend must be kept until the claim is resolved.

The maximum period for dealing with the claim will be fifteen (15) business days from the day following the date of its receipt. When it is not possible to deal with the claim within that period, the interested party will be informed of the reasons for the delay and the date on which their claim will be dealt with, which in no case may exceed eight (8) business days following the expiration of the first term.

The owners of personal data have the right to request the deletion of personal data and/or the revocation of the processing authorization, taking into account the following caveats:

Deletion: by deletion we mean to delete from the databases of JACARANDAS all or part of the personal data held by the owner, however, this deletion will not proceed in cases in which a record must be kept either by law or through contractual links held or maintained by the owner with JACARANDAS.

Revocation of Authorization: The revocation of the authorization consists of a power that the holder has to revoke the authorization previously granted to JACARANDAS, this will only proceed when it is not necessary to continue with the processing of information by law or for contractual purposes.

Once you receive a request to delete the information or to revoke the authorization, JACARANDAS will proceed to the analysis of said submitted request, which request must contain at least identification of the owner, contact details, reasons or facts to which the request relates.

JACARANDAS in your capacity as Personal Data Controller, you are authorized to exercise the rights of the owners:

Email: lineajacarandas@gmail.com

Claims Area: The Legal Area of JACARANDAS is responsible for ensuring compliance with this policy, who will carry out the processing of the owners' requests to enforce their rights.

This will have direct communication with those responsible for the different databases previously identified and processed by JACARANDAS, in order to ensure that all the above-mentioned aspects are duly reflected and that the duties stipulated by the Act are fulfilled.

JACARANDAS, you may modify the terms and conditions of this policy and procedure document as part of the effort to comply with the obligations established by Law 1581 of 2012, regulatory decrees and other regulations that complement, modify or repeal what is contained in this document. If this happens, the new policy and procedure document will be published on the website https://www.somosjacarandas.com/ or in any other medium deemed appropriate.

This Policy is effective as of March 31, 2022.