Privacy and Personal Data Protection Policy

Corazon&Color with address Cr 26 # 16c south 80 Medellin – Colombia, informs that the personal data collected through this website, as well as through campaigns, forms, events, portals and other formats used in marketing activities will be treated reliably and securely for the following purposes: to comply with the obligations arising from the contractual relationships established with the owner of the data; to provide warranty on the products purchased when appropriate; to inform about commercial conditions and after-sales services, among other actions arising from the business that the company has with the owner of the data. It is also reported that the data may be delivered securely to service providers and / or contractors and will be managed in a secure IT infrastructure, confidentially and will not be disclosed to third parties.

They may also be delivered to authorities when required according to their legal authority and may also be consulted in databases with public vocation for the detection of risks. In addition to the purposes, the data and personal information obtained from the owner of the data may be processed for the following purposes, if authorized by the owner:

To perform business intelligence actions, customer prospecting, research and market trends in relation to the personal information given by the data holder.

To create offers tailored to the client and their needs and invite them to participate in special events of their interest, among others.

Communicate promotions to the customer about products, goods and services that may be of interest, as well as sending gifts for advertising campaigns.

To send the customer advertising about Corazon&Color products, goods and services.

For the execution of orders, online payments and delivery of information about shipping guides.

To deliver the data and personal information of the holder to third parties in charge of any of the aforementioned treatments.

The holder may exercise the rights of access, correction, deletion, revocation or claim for infringement of their data and other rights indicated in Article 8 of Law 1581 of 2012 and other rules that complement or replace it, through these means: email
contacto@corazonycolor.com.

The Holders are informed that they can consult the Data Protection

Policy below:

POLICY FOR THE PROTECTION OF PERSONAL DATA

Corazon&Color with its main address in the city of Medellin Cr 26 16c south 80 is committed to comply through this document to the provisions of Law 1581 of 2012 in order to ensure that in obtaining, recording, circulation, handling, transmission, transfer, storage and in general any other type of processing of personal data that the company performs in the execution of its corporate purpose, ensuring compliance with the principles governing the aforementioned law and other rules governing the processing of personal data.

1. Reach

This policy applies to all employees, contractors and third parties in the service of Corazon&Color who have access to information through printed documents, computer equipment, technological infrastructure and communication channels of the company.

2. Legal Framework, Validity and Traceability

This Policy is based on the provisions contained in Articles 15 and 20 of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013 and Decree 886 of 2014.

Corazon&Color may change its policy for the protection of personal data when it deems appropriate, however, it is obliged to keep the previous versions of this policy if any and to guarantee the rights of the owners determined in the current legislation.

3. Processing to which the personal data will be subjected and its purpose

The information provided by the owners of Corazon&Color is required to be collected, used, circulated, stored, shared, transmitted, transferred and/or processed for the following purposes:

The development of the administrative processes of creation, contracting and management of suppliers.
Procedures associated with payment to suppliers, and in response to formalities, inquiries, complaints and claims.
To contact by different means natural persons acting as suppliers or their employees in order to provide them with information related to the commercial relationship contracted.

The development of customer management processes that include activities related to the fulfillment of the contractual relationship contracted, granting of guarantees when appropriate, communication of information on commercial conditions and after-sales services, to perform business intelligence actions, customer prospecting, research and market trends in relation to personal information provided by the data owner, creation of offers according to customer needs, sending invitations to events, sending advertising information about products, goods and services of the company, sending promotional information and gifts for advertising campaigns.

For the execution of orders, online payments and delivery of information about shipping guides.

To issue invoices for the sale of products, goods and services.

To execute everything related to the contractual relationship, affiliation processes, payment of payroll, settlement of social security contributions, payment of parafiscal, internal communication and all those information and activities in which employees and their families are related or linked.

To carry out all the steps and/or internal procedures of the company to carry out the selection processes.

To correspond to legal violations.

In compliance with administrative, judicial or legal mandates.

For the issuance of certifications related to the relationship of the owner of the data with the company.

In order to guarantee the security of persons, goods and physical facilities.

To eventually contact, via telephone, e-mail, or by any other means, natural persons with whom it has or has had a relationship, such as, but not limited to, employees and their relatives, suppliers, customers, online contacts, applicants in selection processes and other interested parties for the purposes mentioned above.

For the development of administrative processes inherent to its mission activity, therefore, when required, it may contract for services to be provided by third parties, in these cases the information will be transferred with the necessary security measures to safeguard the privacy of the owner and the proper provision of the service, and compliance with other legal and constitutional duties.

4. Rights of the holders

The owner of the information shall have the right to:

(a) To know, update and rectify their personal data against those responsible for the processing or in charge of the processing. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.

b) Request proof of the authorization granted to the data controller, except when expressly exempted as a requirement for the processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.

c) To be informed by the data controller or data processor, upon request, regarding the use given to their personal data.

d) File complaints before the Superintendence of Industry and Commerce for violations of the provisions of this law and other rules that modify, add or complement it.

e) To revoke the authorization and/or request the deletion of the data when the treatment does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that the data controller or data processor has engaged in conduct contrary to the Law and the Constitution.

f) Access free of charge to your personal data that have been subject to processing.

5. Procedure for exercising the rights of the holders

To exercise the right that the holders of the information have to know, update, rectify and delete the data and revoke the authorization, they may send a communication to the e-mail address: contacto@.com.co or submit a written request at the main address addressed to the Administrative Area.

The company will respond to the holder who makes the request within the terms established by Law 1581 of 2012 for the case of queries and claims, respectively; for this purpose, the request must contain all the necessary and applicable data to the right of petition to ensure timely and effective response. In addition, it must contain a clear and precise description of the personal data with respect to which the holder seeks to exercise any of the rights. Any request, in order to be processed, must be submitted by the owner of the data or by his legal representative; therefore, Corazon&Color reserves the right to verify the identity of the petitioner by any means.

The inquiry will be answered within a maximum of (10) business days from the date of receipt of the same. When it is not possible to attend the consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

Requests for updating, correction, rectification or deletion of data will be answered within fifteen (15) business days from the day following the date of receipt. When it is not possible to respond within such term, the interested party will be informed before the expiration of such term the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

In requests for rectification and updating of personal data, the holder must indicate the corrections to be made and provide the documentation supporting his request.

The deletion of personal data may involve the total or partial elimination of the information as requested by the holder in the records, files, databases or processing carried out by Corazon&Color.

It is important to note that the right of cancellation is not absolute and the data controller may deny the exercise of this right when:

The holder has a legal or contractual duty to remain in the database.

The deletion of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

The data is necessary to carry out an action in the public interest, or to comply with an obligation legally acquired by the holder.

The holders of personal data may revoke consent to the processing of their personal data at any time, provided that it is not prevented by a legal or contractual provision. It should be noted that there are two ways in which consent can be revoked. The first can be on the totality of the consented purposes, i.e., Corazon&Color must stop processing the data of the owner; the second can occur on specific types of processing, such as for advertising or market research purposes. With the second modality, i.e. partial revocation of consent, other purposes of the processing that the data controller, in accordance with the authorization granted, can carry out and with which the data subject agrees, are maintained.

6. Provision of Personal Data by Data Subjects.

Any holder who provides his information in order to establish precontractual, contractual, labor commitments or any relationship that allows the organization the normal development of its corporate purpose must voluntarily provide the data requested for the registration process as an interested party of the company.

7. Privacy Policy.

Contains the privacy notice which is the physical and/or electronic document that is made available to the owner of the information through which Corazon&Color informs of the existence of the policy for the protection of personal data, how to access it and the treatment that will be given to your personal data.

8. Disclosure and Contact.

The organization will have information mechanisms such as email and web page of the person in charge through which it will disseminate this policy and the protocols defined to meet the requests regarding the information provided.

9. Validity.

As a general rule, the term of the authorizations on the use of personal data is understood to be valid during the exercise of Corazon&Color corporate purpose.