Personal data processing policy
Scope
The policy presented below will apply to personal information hosted in the databases processed by Penagos.
Identification of the data controller
Business name: PENAGOS HERMANOS SAS, hereinafter Penagos
NIT: 890.200.685-2
Home: Calle 28 No. 20 – 80 in Bucaramanga
Phone: +57 (7) 6301600 Monday to Friday from 7:30 a.m. to 12 p.m. and from 12:45 p.m. to 5:45 p.m.
Email: contactoholding@penagos.com
Definitions
It is the consent that people give so that Penagos can use their personal data.
It is a communication issued by Penagos where the owners of the personal information are informed about the existence of the personal data processing policy, the purposes for which the data is used, the way to access it and the means to make queries, claims, requests or requests.
It is the organized set of personal data that is used by Penagos.
This is any information about a person, such as their name, identification number, and physical features.
They are those that are in public documents, such as the marital status of people, their profession or trade.
These are data that are neither public nor private and are of interest not only to the owner, but also to a group of people or society in general. Some examples are financial and credit data.
These are the data that, by their nature, are only of interest to their owner. For example, people's tastes or preferences.
They are those that affect the privacy of the person or can generate discrimination. For example, racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights, data on health, sexual life and biometric data.
It is the natural or legal person who decides on the purpose of the databases and/or their treatment.
It is the natural or legal person who processes personal data, based on a delegation made by the person responsible, receiving instructions about the way in which they should be managed.
It is the natural person whose personal data is processed.
Any operation on personal data, such as: collection, storage, use, circulation or deletion.
Right of the owners of personal data
- Know what data you have.
- Update the information that has been collected, according to the corresponding modifications.
- Rectify information that presents errors or inconsistencies.
- Request that the person responsible delete information that has not been authorized to be collected or that does not comply with the law.
- Be informed in advance regarding the use of personal data.
Duties of Penagos as responsible for personal data
- Inform the owner in advance about the use of personal data.
- Request and keep a copy of the data processing authorization.
- Guarantee information security.
- Update and rectify information when it is incorrect.
- Process queries and complaints made regarding the use of personal data.
- Adopt an internal manual of policies and procedures to guarantee adequate compliance with the law.
Processing of personal data
Penagos processes personal data, including collection, storage, use, circulation or deletion for the following purposes:
- Exchange commercial and business information inherent to business activities.
- Manage the purchase or contracting of goods and services.
- Comply with contractual obligations derived from the acquisition of goods and services.
- Collect extensive and sufficient information to:
1) Identification and verification of the counterparty.
2) Carry out the segmentation of the ML/TF risk factors of the counterparties, in this way determining the level of risk of the contractual relationship.
3) Report the event to the Financial Information and Analysis Unit (UIAF) in the event of a suspicious transaction with the counterparty.
4) Consult judicial, disciplinary, fiscal records and restrictive lists to evaluate the viability of establishing or continuing commercial relationships with suppliers and/or contractors. - Send requests, complaints, claims and requests about the goods or services purchased.
- Cite and apply knowledge tests and interviews.
- Check personal and work references.
- Evaluate the suitability of the participant in the selection process, taking into account the characteristics of the vacancy that needs to be hired.
- Comply with labor, social security regulations and related obligations as an employer.
- Maintain efficient communication within the organization.
- Protect the security of assets and people within the company.
- Issue labor certifications during the validity of the employment contract and after its termination.
- Give job references to potential employers.
- Collect extensive and sufficient information to:
1) Identification and verification of the counterparty.
2) Carry out the segmentation of the ML/TF risk factors of the counterparties, in this way determining the level of risk of the contractual relationship.
3) Report the event to the Financial Information and Analysis Unit (UIAF) in the event of a suspicious transaction with the counterparty.
4) Consult judicial, disciplinary, fiscal records and restrictive lists to evaluate the viability of establishing or continuing commercial relationships with suppliers and/or contractors. - Any other purpose that results in the development of contractual obligations and the relationship between the collaborator and the company for exclusively internal use.
- Provide information to third parties with whom Penagos has a contractual relationship and it is necessary to deliver it to fulfill the contracted objective.
- Ensure appropriate referral to medical services in the event of an accident.
- Serve as a basis for the issuance of labor certificates at the request of the former worker.
- Provide job references to potential employers of the former worker.
- Consider the former employee in the personnel hiring processes carried out by the company.
- Respond to requirements from government entities related to the contribution and payment of contributions during the time in which it was linked.
- Make the summons to meetings of the General Assembly of Shareholders.
- Make the payment of dividends.
- Make the report to the DIAN of the Single Registry of Final Beneficiaries.
- Collect extensive and sufficient information to:
1) Identification and verification of the counterparty.
2) Carry out the segmentation of the ML/TF risk factors of the counterparties, in this way determining the level of risk of the contractual relationship.
3) Report the event to the Financial Information and Analysis Unit (UIAF) in the event of a suspicious transaction with the counterparty.
4) Consult judicial, disciplinary, fiscal records and restrictive lists to evaluate the viability of establishing or continuing commercial relationships with suppliers and/or contractors.
- Ensure appropriate referral to medical services in the event of an accident.
- Keep a record of the people who are inside the company in the event of an accident.
- Protect the security of assets and people within the company.
- Protect the security of assets and people within the company.
- Use as evidence in any type of internal, judicial or administrative process.
- Inclusion in the directory of collaborators, with the purpose of facilitating a communication channel between the companies in which Penagos Hermanos SAS has investments, which enables internal communication and synergy between their collaborators.
Care procedures
The consultation, claim, request for update, rectification and deletion procedures will be processed through the application form which is located in Google Drive, by email contactoholding@penagos.com or physically at Calle 28 # 20-80 in Bucaramanga, by the owner of the personal data or successor in title.
The owner or successor in title must submit the application with the citizenship card, civil registry or any other document that identifies him or her.
Owners may consult their personal information that resides in the Penagos databases; the query will be responded to within a maximum of ten (10) business days from the date of receipt. When it is not possible to attend to the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case will exceed five (5) business days following the expiration date. of the first term.
The owner or his successors who consider that the information contained in the databases must be corrected, updated or deleted due to non-compliance with the law, may file a claim with PENAGOS using the means mentioned above, where the name and number are indicated. identification of the owner, description of the reason for the claim, address, contact telephone number and the documents they have as proof.
- The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which will not exceed eight (8) business days following the expiration of the first term.
- If the claim is incomplete, the interested party will be informed within five (5) days of receipt of the claim to complete the information. If after two (2) months the claim information is not completed, it will be understood that you have withdrawn the claim. In the event that the claim is received by a person who is not competent to resolve it, it will be transferred to the appropriate person within a maximum period of two (2) business days and the interested party will be informed of the situation.
The owner who wishes to update or rectify their personal information may request it by the means mentioned above, attaching a copy of the documentation that supports their request.
At any time, the owner of the personal data has the right to request PENAGOS to partially or totally delete personal information from the databases in which it is registered.
The owner may revoke the processing authorization at any time, as long as it is not prevented by a legal or contractual provision. The revocation may be total or partial:
- Total: Regarding all permitted purposes, that is, PENAGOS must completely stop processing the data of the owner of personal data.
- Partial: It can occur on certain types of treatment. In that case, the authorization will remain firm for all other purposes for which the owner did not revoke his authorization.
Penagos may deny the deletion of data or revocation of authorization when:
- The owner has a legal or contractual duty to remain in the database.
- The deletion of data hinders judicial or administrative actions linked to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
- The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner.
- The data is public.
Database validity
Penagos may only process personal data for as long as is reasonable and necessary, in accordance with the purposes that justify the processing. Once the purposes of the treatment have been met, Penagos will proceed to delete the personal information from the personal databases.
Security of the information
Penagos implements the technical, technological, human and administrative measures that it considers pertinent to provide security to records, files and databases, in order to prevent their adulteration, loss, consultation, unauthorized or improper use or access.
Validity
This policy was approved by the Executive President and is effective as of March 1, 2022.
Penagos may modify the terms and conditions of this personal data processing policy document as part of the effort to comply with the obligations established by the law 1581 of 2012, the regulatory decrees and other standards that complement this document.
If any change is made, the new Personal Data Processing Policy document will be published on the page www.penagosholding.com