- Scope and application of the policy
- Obligations of GALVA OPERATOR GROUP S.A.S
- Rights of the individual
- Right to access personal data
- Right to correct personal data
- Right to object to direct marketing actions
- Right to access personal data
- Area responsible for the implementation and observance of this policy
1. Scope and application
To fulfill its corporate purpose GALVA OPERATOR GROUP S.AS., creates, adopts and safeguards confidential information, and personal data, including databases of its employees, its suppliers and its customers. Through this document, and in accordance with the provisions of Law 1581 of October 17, 2012, adopts a Manual of Data Privacy Policies.
This policy regulates the way GALVA OPERATOR GROUP S.A.S. obtains, collects, uses, stores, custody, circulates, processes, transfers, deletes and in any other way processes confidential information and personal data of individuals.
GALVA OPERATOR GROUP S.A.S. It ensures that its employees are trained, understand and apply the protocols that regulate this policy. This policy explains the rights of people in relation to their personal data processed by GALVA OPERATOR GROUP S.A.S and regulates the circumstances in which GALVA OPERATOR GROUP S.A.S may transfer personal data to other entities. GALVA OPERATOR GROUP S.A.S is responsible and in charge of the processing of personal data of its employees, its suppliers and its clients for different business objectives, which include:
- treat your employees' data for payroll, historical and statistical management purposes.
- treat the data of their suppliers to operate, manage the companies and fulfill their corporate purpose. - treat your customers' data to fulfill their corporate purpose.
2. Obligations of GALVA OPERATOR GROUP S.A.S
2.1. To protect the personal data included in the databases and / or systems of GALVA OPERATOR GROUP S.A.S. or of those databases and / or systems for which it is responsible, the company will treat personal data in a fair, lawful, truthful, transparent, secure and confidential manner. In particular, it will not process personal data at all, unless one of the following conditions is met:
- That the person involved has given their authorization for such treatment;
- That GALVA OPERATOR GROUP S.A.S needs to carry out the treatment to:
- (a) for statistical purposes suppressing the identity of the interested party;
- (b) comply with a legal obligation, or (c) protect the vital interests of the person involved in a "life or death" situation.
2.3. GALVA OPERATOR GROUP S.A.S. generally does not seek to obtain sensitive data, related to the following aspects:
- Racial or ethnic origin
- Political opinions
- Religion or other similar beliefs
- Union affiliation, social human rights organizations, or promoting interests of any political party,
- Physical or mental health
- Sex life
- Biometric data GALVA OPERATOR GROUP S.A.S. You will not obtain such data except when:
- 2.3.1. The data subject or interested party has given their explicit authorization to said treatment,
- 2.3.2. The treatment is necessary to safeguard the vital interest of the owner of the data and it is physically or legally incapacitated. In these events, legal representatives must grant their authorization;
- 2.3.3. The treatment refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process;
- 2.3.4. The treatment has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the owners of the personal data must be taken.
- 2.4.1. It will guarantee to the holder of the data, the full and effective exercise of the right of habeas data;
- 2.4.2. Request and keep a copy of the respective authorization granted by the owner of the data;
- 2.4.3. Inform the holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted;
- 2.4.4. It will keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
- 2.4.5. It will guarantee that the information provided to the person in charge of the treatment (in case GALVA OPERATOR GROUP S.A.S. entrusts the treatment to a third party) is true, complete, accurate, updated, verifiable and understandable;
- 2.4.6. It will update the information, communicating in a timely manner to the person in charge of the treatment (in case GALVA OPERATOR GROUP SAS entrusts the treatment to a third party), all the news regarding the data that it has previously provided and will take the other necessary measures so that the Information provided to it is kept up to date;
- 2.4.7. It will rectify the information when it is incorrect and will communicate the pertinent to the person in charge of the treatment (in case GALVA OPERATOR GROUP S.A.S entrusts the treatment to a third party);
- 2.4.8. It will provide the person in charge of the treatment, only data whose treatment is previously authorized in accordance with the provisions of this manual and in the current law;
- 2.4.9. It will require the person in charge of the treatment at all times (in the event that GALVA OPERATOR GROUP S.A.S entrusts the treatment to a third party), respect for the security and privacy conditions of the information of the owner of the data;
- 2.4.10. It will process the queries and claims made by the owners of the data.
- 2.4.11. It will inform the person in charge of the treatment when certain information is under discussion by the owner of the data, once the claim has been submitted and the respective procedure has not been completed;
- 2.4.12. It will inform at the request of the owner of the data about the use given to its data;
- 2.4.13. It will inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the owners of the data.
- 2.4.14. It will comply with the instructions and requirements given by the Superintendence of Industry and Commerce.
- 2.5.1. It will guarantee the holder of the data the full and effective exercise of the right of habeas data;
- 2.5.2. Timely update, rectify or delete the data;
- 2.5.3. Update the information reported within five (5) business days from its receipt;
- 2.5.4. It will record in the database the legend "claim in process" when appropriate.
- 2.5.5. It will insert in the database the legend “information in judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data;
- 2.5.6. Refrain from circulating information that is being controversial by the owner of the data and whose block has been ordered by the Superintendence of Industry and Commerce;
- 2.5.7. It will allow access to information only to people who may have access to it;
- 2.5.8. It will inform the Superintendence of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the owners of the data;
- 2.5.9. It will comply with the instructions and requirements given by the Superintendence of Industry and Commerce. In the event that GALVA OPERATOR GROUP S.A.S. hire a third party responsible for data processing on your behalf, GALVA OPERATOR GROUP S.A.S. recognizes the importance of having adequate security. When GALVA OPERATOR GROUP S.A.S signs these contracts, it will ensure that the data processing service providers of GALVA OPERATOR GROUP S.A.S maintain binding contracts by which they are obliged to act only as instructed by GALVA OPERATOR GROUP S.A.S. and to maintain security agreements to protect said personal data and to comply with the current legislation that is applicable to it.
2.7. GALVA OPERATOR GROUP S.A.S. It will not allow the processing of the data for which it is responsible in those countries that do not provide adequate levels of data protection. It is understood that a country offers an adequate level of data protection when it meets the standards established in this manual and in Law 1581 of October 17, 2012.
2.8 GALVA OPERATOR GROUP S.A.S. will not allow personal data in your custody, except for public information, to be available on the internet or other means of disclosure or mass communication, unless there is authorization or that access is technically controllable to provide restricted knowledge only to the owners of the data or authorized third parties.
3. Rights of the individual
3.1. Right of access
- 3.1.1. Through a written request from an individual, and when GALVA OPERATOR GROUP S.A.S. You have confirmed the information that allows you to identify the person making the request, and if you have such personal data stored about that individual, GALVA OPERATOR GROUP S.A.S
- I. Inform the person if GALVA OPERATOR GROUP S.A.S has personal data of its own;
- II. Describe the data you have, the reason and purpose for which you maintain them; Y
- III. It will provide the individual with copies of the personal data that are maintained about him, together with an indication of the source (s).
- 3.1.2. The consultation will be formulated by the means enabled by GALVA OPERATOR GROUP S.A.S as long as proof of this can be maintained.
- 3.1.3. GALVA OPERATOR GROUP S.A.S. The question will be answered within a maximum period of ten (10) business days from the date of receipt of the same. When it is not possible to attend the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which his query will be attended, which in no case will exceed the five (5) business days following the expiration of the first term.
- 3.2.1.The owner of the data or its successors who consider that the information contained in a database of GALVA OPERATOR GROUP SAS must be subject to correction, updating or deletion, may file a complaint with GALVA OPERATOR GROUP SAS, for which GALVA OPERATOR GROUP SAS has made available to its employees, its customers and its suppliers, and all those whose data are subject to processing in the databases of GALVA OPERATOR GROUP S.A.S. the following email: firstname.lastname@example.org, or by calling the telephone line (57) 317 34 00.
- 3.2.2. The claim will be made by request addressed to GALVA OPERATOR GROUP S.A.S. or to the person in charge of the treatment, if any, with the identification of the holder of the data, the description of the facts that give rise to the claim, the address, and accompanying the documents to be asserted.
- 3.2.3. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to remedy the failures. After two (2) months from the date of the request, without the holder of the data submitting the required information, it will be understood that he has given up the claim.
- 3.2.4. In case GALVA OPERATOR GROUP S.A.S. Not competent to resolve the claim, will transfer the interested party within a maximum period of two (2) business days.
- 3.2.5. Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database, in a term not exceeding two (2) business days. The legend will remain until the claim is decided.
- 3.2.6. The maximum term to handle the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case will exceed eight (8) business days following the expiration of the first term .
Use your personal data for direct marketing purposes.
4. Area responsible for the implementation and observance of this policy
GALVA OPERATOR GROUP S.A.S is responsible for the development, implementation, training and enforcement of this Policy. For this purpose, all the officials who carry out the Processing of Personal Data in the different processes of GALVA OPERATOR GROUP SAS, are obliged to report these Databases to Legal Matters and to transfer them immediately, of all the requests, complaints or claims they receive from the Personal Data Holders. Comptroller and General Administration has also been designated by GALVA OPERATOR GROUP S.A.S as the area responsible for handling requests, inquiries, complaints and claims before which the Holder of the information may exercise their rights to know, update, rectify and delete the data and revoke the authorization
This policy will be effective from November first (1) of 2017.