Terms and Conditions

PERSONAL DATA POLICY

DecidoSinFronteras.org website is an initiative of FUNDACIÓN ORIÉNTAME.

Therefore, the processing of personal data on this website will be governed by Colombian laws and the Personal Data Processing Policy of FUNDACIÓN ORIÉNTAME will be adopted.

This Policy is prepared in accordance with the provisions of the Colombian Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other complementary provisions. It will be applied with respect to the collection, storage, use, circulation, deletion and all those activities that constitute the processing of personal data for those who visit or use the web services available at DecidoSinFronteras.org

1. DEFINITIONS

For the purposes of the execution of this policy and in accordance with legal regulations, the following definitions will apply:

a) Authorization : Prior, express and informed consent of the Owner to carry out the Processing of personal data;

b) Privacy Notice : A physical, electronic or other format document generated by the Controller that is made available to the Data Subject for the processing of his/her personal data. The Privacy Notice informs the Data Subject of the information regarding the existence of the information processing policies that will be applicable to him/her, the way to access them and the purpose of the processing that is intended to be given to the personal data;

c) Database : Organized set of personal data that is subject to Processing;

d) Personal data : Any information linked to or that can be associated with one or more specific or identifiable natural persons;

e) Public data : Data classified as such according to the mandates of the law or the Political Constitution and that which is not semi-private, private or sensitive. Public data includes, among others, data relating to the civil status of persons, their profession or trade, their status as a merchant or public servant and those that can be obtained without reservation. Public data may be contained in public records, public documents, official gazettes and bulletins, among others;

f) Private data : This is data that, due to its intimate or reserved nature, is only relevant to the owner;

g) Sensitive data : Sensitive data is understood to be data that affects the privacy of the Data Subject or whose improper use may lead to discrimination, such as data that reveals ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, biometric data and sexual life;

h) Data Processor : Natural or legal person, public or private, who by itself or in association with others, carries out the processing of personal data on behalf of the Data Controller;

i) Data Controller : Natural or legal person, public or private, who by itself or in association with others, decides on the database or the processing of data;

j) Owner : Natural person whose data is subject to processing;

k) Processing : Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion thereof.

2. PURPOSE FOR WHICH PERSONAL DATA IS COLLECTED AND PROCESSED

ORIÉNTAME FOUNDATION may use personal data to:

a) Manage the existing relationship with beneficiaries of social or educational programs, volunteers, sponsored persons, users of health services, donors, suppliers, contractors, and collaborating personnel with an employment relationship, including the payment of contractual obligations;

b) Provide the services and/or products required by users of the services, patients and clients;

c) Inform about new products and services or about changes thereto;

d) Evaluate the quality of service;

e) Conduct internal studies on consumer habits;

f) Send to the physical, electronic, cellular or mobile device, via text messages (SMS and/or MMS) or through any other analogous and/or digital means of communication created or to be created, commercial, advertising or promotional information about the products and/or services, events and/or promotions of a commercial or non-commercial nature, in order to promote, invite, direct, execute, inform and in general, carry out campaigns, promotions or contests of a commercial or advertising nature, carried out directly or through third parties on behalf of FUNDACIÓN ORIÉNTAME;

g) Manage selection, evaluation and employment processes;

h) Support internal or external audit processes;

i) Register the information of active, on leave, retired or pensioned personnel in the databases of FUNDACIÓN ORIÉNTAME

j) Those indicated in the authorization granted by the data owner or described in the respective privacy notice, as the case may be;

k) Provide, share, send or deliver personal data to subsidiaries, affiliates or subordinate companies of FUNDACIÓN ORIÉNTAME located in Colombia or any other country in the event that said companies require the information for the purposes indicated herein.

Regarding the data (i) collected directly at security checkpoints, (ii) taken from documents provided by people to security personnel and (iii) obtained from video recordings made inside or outside the facilities of FUNDACIÓN ORIÉNTAME, these will be used for security purposes of the people, property and facilities of FUNDACIÓN ORIÉNTAME and may be used as evidence in any type of process.

All personal data will be used only for the purposes stated herein, and therefore, FUNDACIÓN ORIÉNTAME will not sell, license, transmit or disclose it, unless: (i) there is express authorization to do so; (ii) it is necessary to allow contractors or agents to provide the services entrusted; (iii) it is necessary in order to provide our services and/or products; (iv) it is necessary to disclose it to entities that provide marketing services on behalf of FUNDACIÓN ORIÉNTAME or to other entities with which we have joint marketing agreements; (v) the information is related to a merger, consolidation, acquisition, divestiture or other restructuring process; (vi) those purposes permitted or required by law.

FUNDACIÓN ORIÉNTAME may subcontract third parties to process certain functions or information. When the processing of personal information is subcontracted to third parties or personal information is provided to third-party service providers, FUNDACIÓN ORIÉNTAME warns such third parties about the need to protect such personal information with appropriate security measures, prohibits the use of the information for their own purposes and requests that they do not disclose the personal information to others.

3. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

The processing of personal data at FUNDACIÓN ORIÉNTAME will be governed by the following principles:

a) Principle of purpose : The processing of personal data collected must obey a legitimate purpose, which must be informed to the Owner;

b) Principle of freedom : Treatment may only be carried out with the prior, express and informed consent of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent;

c) Principle of truthfulness or quality : The information subject to processing must be true, complete, accurate, up-to-date, verifiable and understandable. Partial, incomplete, fractioned or misleading data will not be processed;

d) Principle of transparency : In the Treatment, the right of the Owner to obtain from FUNDACIÓN ORIÉNTAME at any time and without restrictions, information about the existence of data that concerns him/her must be guaranteed;

e) Principle of restricted access and circulation : Processing is subject to the limits arising from the nature of the personal data, the provisions of this law and the Constitution. Personal data, except for public information, and the provisions of the authorization granted by the data owner, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Owners or authorized third parties;

f) Security principle : The information subject to Processing by FUNDACIÓN ORIÉNTAME must be protected through the use of the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access;

g) Confidentiality principle : All persons involved in the processing of personal data are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks that comprise the processing has ended.

FIRST PARAGRAPH: In the event that sensitive personal data is collected, the Owner may refuse to authorize its Processing.

4. RIGHTS OF DATA OWNERS WHO ARE PROCESSED BY FUNDACIÓN ORIÉNTAME

Data owners, either themselves or through a legal representative, agent or successor in title, may exercise the following rights with respect to personal data processed by FUNDACIÓN ORIÉNTAME:

a) Right of access : By virtue of which you may access the personal data that is under the control of FUNDACIÓN ORIÉNTAME, in order to consult it free of charge at least once each calendar month, and each time there are substantial modifications to the Information Processing Policies that motivate new consultations;

b) Right to update, rectification and deletion : By virtue of which you may request the update, rectification and/or deletion of the personal data being processed, in such a way that the purposes of the processing are met;

c) Right to request proof of authorization : except in events in which, according to current legal regulations, authorization is not required to carry out the treatment;

d) Right to receive information regarding the use of personal data;

e) Right to file complaints : through the channels available to FUNDACIÓN ORIÉNTAME for this purpose, or before competent entities such as the Superintendency of Industry and Commerce for violations of the provisions of current regulations on the processing of personal data;

f) Right to require compliance with official orders issued by the Superintendency of Industry and Commerce.

FIRST PARAGRAPH: For the purposes of exercising the rights described above, both the owner and the person representing him/her must prove their identity and, if applicable, the capacity by virtue of which they represent the owner.

SECOND PARAGRAPH: The rights of persons under eighteen (18) years of age will be exercised through persons who are legally authorized to represent them.

5. ORIÉNTAME FOUNDATION DUTIES

All persons obliged to comply with this Policy must bear in mind that FUNDACIÓN ORIÉNTAME is obliged to comply with the duties imposed by law in this regard. Consequently, the following obligations must be fulfilled:

a. Duties when acting as Controller:
(i) Request and retain, under the conditions provided in this Policy, a copy of the respective authorization granted by the data subject. (ii) Inform the data subject in a clear and sufficient manner about the purpose of the collection and the rights that he or she has by virtue of the authorization granted. (iii) Inform the data subject at his or her request about the use given to his or her personal data. (iv) Process the queries and complaints made under the terms indicated in this policy. (v) Ensure that the principles of truthfulness, quality, security and confidentiality are observed in the terms established in the following Policy. (vi) Keep the information under the security and confidentiality conditions necessary to prevent its adulteration, loss, unauthorized or fraudulent consultation, use or access. (vii) Update the information when necessary. (viii) Rectify personal data when appropriate.

b. Duties when acting as the Data Controller
If you process data on behalf of another entity or organization (Data Controller), you must comply with the following duties: (i) Establish that the person responsible for the processing has authorization to provide the personal data that will be processed as the Data Processor. (ii) Guarantee the owner, at all times, the full and effective exercise of the right to habeas data . (iii) Keep the information under the security and confidentiality conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access. (iv) Carry out the timely update, rectification or deletion of the data. (v) Update the information reported by the Data Controllers within five (5) business days from its receipt. (vi) Process the queries and claims made by the owners in the terms indicated in this policy. (vii) Register in the database the legend “claim in process” in the manner established in this policy. (ix) Insert the legend “information under judicial discussion” into the database once notified by the competent authority of judicial proceedings related to the quality of personal data. (x) Refrain from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendency of Industry and Commerce. (xi) Allow access to the information only to persons authorized by the data subject or empowered by law for such purpose. (xii) Inform the Superintendency of Industry and Commerce when violations of security codes occur and there are risks in the management of the information of the data subjects. (xiii) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

c. Duties when carrying out the treatment through a Manager
(i) Provide the Data Processor only with personal data whose processing has been previously authorized. For the purposes of national or international data transmission, a personal data transmission contract must be signed or contractual clauses agreed upon as established in article 25 of decree 1377 of 2013. (ii) Guarantee that the information provided to the Data Processor is true, complete, accurate, updated, verifiable and understandable. (iii) Promptly communicate to the Data Processor all new developments regarding the data previously provided and adopt other measures necessary to ensure that the information provided remains up to date. (iv) Promptly inform the Data Processor of any corrections made to personal data so that the relevant adjustments can be made. (v) Demand that the Data Processor, at all times, respect the security and confidentiality conditions of the information of the data subject. (vi) Inform the Data Controller when certain information is being disputed by the owner, once the claim has been submitted and the respective process has not been completed.

d. Duties regarding the Superintendence of Industry and Commerce
(i) Inform you of any violations of security codes and the existence of risks in the management of the information of the data subjects. (ii) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

6. REQUEST FOR AUTHORIZATION FROM THE PERSON WHO IS THE OWNER OF THE DATA

Prior to or at the time of collecting personal data, FUNDACIÓN ORIÉNTAME will request authorization from the data owner (or his/her legal representative) to collect and process the data, indicating the purpose for which the data is requested, using automated technical means, written or oral, that allow for the preservation of proof of the authorization or of the unequivocal conduct described in article 7 of Decree 1377 of 2013. Said authorization will be requested for the time that is reasonable and necessary to satisfy the needs that gave rise to the request for the data and, in any case, in compliance with the legal provisions that govern the matter.

7. PRIVACY NOTICE

In the event that FUNDACIÓN ORIÉNTAME is unable to make this information processing policy available to the data subject, it will publish the privacy notice attached to this document, the text of which will be kept for later consultation by the data subject or the Superintendency of Industry and Commerce.

8. TEMPORARY LIMITATIONS ON THE PROCESSING OF PERSONAL DATA

FUNDACIÓN ORIÉNTAME may only collect, store, use or circulate personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the processing, taking into account the provisions applicable to the subject matter in question and the administrative, accounting, fiscal, legal and historical aspects of the information.

Once the purpose(s) of the processing have been fulfilled and without prejudice to legal provisions that provide otherwise, the personal data in its possession will be deleted. However, personal data must be retained when required to comply with a legal or contractual obligation.

9. RESPONSIBLE AREA AND PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF PERSONAL DATA OWNERS

The SYSTEMS AREA is responsible for addressing requests, complaints and claims made by the data owner in exercising the rights contemplated in section four of this Policy.

For such purposes, the data owner or the person representing him/her may send his/her request, complaint or claim from Monday to Friday from 8:00 am to 4:00 pm Colombia time, to the email address [email protected], call the FUNDACIÓN ORIÉNTAME telephone line at 601 917 3500, or file it at the following address which corresponds to our offices:

OFFICE ADDRESS Carrera 18 #33A-27, Bogotá – Colombia.

The request, complaint or claim must contain the identification of the Owner, the description of the facts that give rise to the claim, a contact telephone number, email and address for correspondence, and attach the necessary supporting documents. If the claim is incomplete, the interested party will be asked within five (5) business days following receipt of the claim to correct the deficiencies. After two (2) calendar months from the date of the request, without the requesting party submitting the required information, it will be understood that the claim has been withdrawn. In the event that the person receiving the claim is not competent to resolve it, he/she will forward it to the appropriate person within a maximum period of two (2) business days and will inform the interested party of the situation.

Once the complete claim has been received, a legend stating “claim in process” and the reason for it will be included in the database within a period of no more than two (2) business days. This legend must be maintained until the claim is decided. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within this period, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

10. DATA COLLECTED BEFORE THE ISSUANCE OF DECREE 1377 OF 2013

In accordance with the provisions of section 3 of article 10 of Regulatory Decree 1377 of 2013, FUNDACIÓN ORIÉNTAME will publish a notice addressed to holders of personal data in order to publicize this Information Processing Policy and the manner of exercising their rights as holders of personal data stored in FUNDACIÓN ORIÉNTAME databases.

11. SECURITY MEASURES

Pursuant to the security principle established in Law 1581 of 2012, FUNDACIÓN ORIÉNTAME will adopt the technical, human and administrative measures necessary to ensure the security and confidentiality of the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access. The personnel who process the personal data will execute the established protocols in order to guarantee the security of the information.

12. EFFECTIVE DATE

This Personal Data Policy was created on January 2, 2016. Any changes to this policy will be reported through this means or by email at: [email protected]