Privacy Policy

1. Purpose
   Through this data processing policy, Colo seeks to establish the rules applicable to the processing of personal data collected, used, and stored by this company in the course of its corporate purpose, in its capacity as controller and/or processor of the information, as the case may be.
   
   All of the above is grounded in Statutory Law 1581 of 2012, regulated by National Decree 1377 of 2013 and Decree 1074 of 2015, complementary circulars, and their constitutional foundations regarding the protection of privacy, the protection of personal data, and the right to habeas data.
   
   
2. Scope of application.
   This policy shall apply to the processing of personal data carried out in Colombian territory, or when the rule is applicable to a controller and/or processor located outside Colombian territory by virtue of international treaties, contractual relationships, or otherwise.
   
   The provisions contained in this policy shall apply to any personal database in the custody of Colo, whether in its capacity as controller and/or processor.
   
   
3. Definitions.
   In accordance with Law 1581 of 2012, for the purposes of this policy, the following terms are understood as:
   
   a) Authorizations: The prior, express, and informed consent of the data subject for the processing of their personal data that is not public in nature.
   
   b) Personal database: An organized set of data that is subject to processing by the company. It may be automated or physical, depending on how it is stored.
   
   c) Personal Data: Any information linked to, or that can be associated with, one or more natural persons, identifying them.
   
   d) Sensitive personal data: Data that affects the privacy of the data subject or whose improper use may lead to discrimination. For this reason it enjoys special protection; specifically, it refers to health, sex, political affiliation, race or ethnic origin, biometric data, union membership, among others.
   
   e) Data controller: A natural or legal person, public or private, that, alone or in association with others, decides on the database and its processing.
   
   f) Data processor: A natural or legal person, public or private, that, alone or in association with others, processes personal data on behalf of the Data Controller.
   
   g) Data subject: The natural person whose data is subject to processing.
   
   h) Data processing: Any operation or set of operations performed on personal data, such as collection, storage, use, deletion, etc.
   
   i) Responsible area: The person or group of people who have custody of and responsibility for the personal databases within the company.
   
   j) Habeas data: The fundamental right of every person to know, update, rectify, and/or cancel at any time the information about them that is held by third parties.
   
   
4. Processing and purposes.
   The processing that Colo will carry out, acting as controller and/or processor, will consist of collecting, storing, processing, using, managing, circulating, and transmitting personal data, strictly following the guidelines established by law, for the following purposes as the case may be:
   
   4.1 Employee Data
   Colo will process the data collected in these databases in order to:
   
   a) Create specific files for each worker with their personal data, to be used whenever required.
   
   b) Fulfill the obligations undertaken by the company Colo in favor of the employee under the employment contract signed with the employee.
   
   c) Carry out the enrollment of employees and the beneficiaries they designate, aimed at fulfilling the obligations set forth by labor law arising from the employee's relationship with Colo.
   
   d) Assign corporate user accounts and email accounts, which entails the generation and sending of correspondence in the course of the contract signed between the worker and Colo.
   
   e) Consult and safeguard the employee's academic, disciplinary, and employment history in order to keep a historical record of such information for workers who join the company, which may in the future be used to provide references if required.
   
   f) Fulfill payroll payments and parafiscal obligations accrued in favor of the employee by virtue of their employment relationship.
   
   g) Create channels of contact between the company, the employee, and their family members, if required.
   
   h) Manage accounting and labor information to meet contractual and legal requirements.
   
   i) With respect to former employees, the information will be retained in case it is required by any judicial or administrative authority.
   
   j) With respect to candidates who provided their information when taking part in recruitment processes, this information will occasionally be retained in order to make contact again should a new vacancy open.
   
   k) Biometric and video recording and monitoring in order to safeguard the people and property located within the company Colo and within the commercial establishments owned by Colo.
   
   4.2. Suppliers.
   Within the organization, it has been decided to organize these databases into three categories for easier processing, namely: regular suppliers, occasional suppliers, and prospects. However, notwithstanding this internal scheme, the data compiled in this database will be used to:
   
   a) Collect general and contact information for all suppliers that have provided, provide, or may come to provide services to Colo.
   
   b) Establish a channel of contact between suppliers and Colo.
   
   c) Prepare and send correspondence and information from Colo regarding internal activities, promotions, and giveaways in which data subjects may participate.
   
   d) Generate and send correspondence in cases where Colo decides to launch campaigns to promote its products, services, and other offerings.
   
   e) Monitor the performance of agreements, contracts, or purchase orders generated by virtue of the commercial relationship between Colo and the supplier.
   
   f) Keep accounting records and internal follow-up regarding payments to suppliers.
   
   g) Request quotes and proposals and generate purchase orders.
   
   h) Fulfill administrative, contractual, accounting, and/or tax obligations.
   
   i) Make contact for quotes and requests for new services and products required by the company in order to properly carry out its corporate purpose.
   
   j) Verify commercial references.
   
   4.3. Customers.
   In the course of its corporate purpose, Colo processes the information contained in this database for the following purposes:
   
   a) Marketing of the products and services that Colo, in the course of its corporate purpose, usually offers in the market.
   
   b) Issuance of sales invoices generated from the customer's purchase of products.
   
   c) Carrying out follow-ups or studies aimed at improving the service Colo provides, as well as the products it sells.
   
   d) Handling requests, concerns, complaints, and inquiries raised by customers.
   
   e) Informing, by any means, about promotions, news, and current and future products and services related to events, contests, promotional activities, special dates, birthday courtesies, and other commercial purposes directly or indirectly related to Colo's own activity, and/or promotions, news, products, and services promoted directly by Colo's strategic partners that generate added value for users and/or customers.
   
   f) Properly carrying out promotional activities, events, contests, and giveaways devised by Colo to build customer loyalty.
   
   g) Generating and sending information of interest regarding advertising, promotional activities, contests, and giveaways.
   
   h) Offering incentives to all customers who are part of the interest groups created by Colo, aimed at customer loyalty.
   
   i) Conducting satisfaction surveys on the general operation and the services provided by Colo.
   
   j) Fulfilling contractual obligations.
   
   k) Fulfilling administrative, accounting, and/or tax obligations.
   
   l) Where applicable, carrying out collection efforts in the event of overdue balances or principal in arrears on the part of customers.
   
   m) Invitations to events promoted or organized by Colo, in order to promote and drive new products and services
   
   n) Biometric and video recording and monitoring in order to safeguard the security of the property and people located within the commercial establishments owned by Colo.
   
   4.4. Children and adolescents under the age of majority:
   In compliance with the provisions of Law 1581 of 2012 and Decree 1074 of 2015, this data will always be requested with the consent of the minor's representative, who will be informed in advance about the processing to be carried out and its purposes, and with full knowledge that they are under no obligation to provide it.
   
   Likewise, such data will be processed in accordance with the rulings of the Colombian Constitutional Court, that is, always respecting the minors' fundamental rights and seeking their well-being and the advancement of their best interests.
   
   Accordingly, Colo may request data of minors for the following purposes:
   
   a) Enrollment as beneficiaries of the services linked to social benefits, at the request of their representative.
   
   b) Creation of a group of minors, children of employees, for Christmas gifts.
   
   c) Biometric and video monitoring and recording installed in the commercial establishments owned by the company in order to safeguard the security of the property and people located within them.
   
   4.5. Biometric Data:
   Colo has decided to implement security systems (monitoring through Closed-Circuit Television) at its facilities in order to avoid being the target of criminal activity, as well as to safeguard the integrity and safety of the people and property located there.
   
   Lastly and specifically, any other purposes that Colo deems relevant for the proper and normal course of its corporate purpose, provided they are previously communicated to the data subject.
   
   
5. Rights of data subjects.
   The data subjects of the information contained in the databases processed by Colo, whether as controller or as processor, have the rights listed below in accordance with the provisions of the Political Constitution of Colombia and the applicable regulations in force.
   
   These rights may only be exercised exclusively by the data subject or by the persons they authorize in accordance with the law.

a) To know, update, and rectify their personal data before the Data Controllers or Data Processors. This right may be exercised, among others, with respect to data that is partial, inaccurate, incomplete, fragmented, misleading, or whose Processing is expressly prohibited or has not been authorized.

b) To request proof of the authorization granted to the Data Controller, except when it is expressly exempted as a requirement for Processing.

c) To be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been made of their personal data.

d) To file complaints with the Superintendence of Industry and Commerce for violations of the provisions of this policy and the laws governing the matter.

e) To revoke the authorization and/or request the deletion of the data when the Processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that, in the Processing, the Controller or Processor has engaged in conduct contrary to this law and the Constitution.

f) To access free of charge their personal data that has been subject to Processing.

6. Duties of Colo regarding databases containing personal information of third parties when acting as controller and processor.

6.1 Duties as Data Controller.
When Colo assumes the role of controller of personal data processing, it will carry out such activity in compliance with the following duties, without prejudice, of course, to the other provisions set forth by law.

a) Guarantee the data subject, at any time and free of charge, the full and effective exercise of their rights to know, update, modify, and rectify their data.

b) Request, and where necessary retain, a copy of the respective authorization granted by the data subject.

c) Keep the information under the security conditions necessary to prevent its unauthorized or fraudulent use, access, alteration, or consultation, as well as alteration or loss.

d) Update the information and, in the event of substantial changes to the processing of the databases, inform both the data subjects and the processor, if any.

e) Rectify the information when it is incorrect and, if there is a processor handling it, inform them.

f) If there is a data processor, provide only data whose processing has been previously authorized by the data subject.

g) Handle inquiries and claims submitted by data subjects within the terms set forth by law and reproduced in this processing policy.

h) Share with the responsible areas within the company the procedures and policies to ensure proper compliance with the law governing the matter.

i) Inform the data subject, upon request, about the use made of their data.

j) Notify the personal data protection authority when there are breaches of information security standards and, consequently, risks in the management of data subjects' information.

k) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

6.2 Duties as Data Processor. When Colo assumes the role of processor of personal data under its custody, it must comply with the following duties, without prejudice, of course, to the other provisions set forth by law.

a) Guarantee the data subject, at all times, the full and effective exercise of the right of habeas data.

b) Keep the information under the security conditions necessary to prevent its alteration, loss, or unauthorized or fraudulent consultation, use, or access.

c) Promptly carry out the updating, rectification, or deletion of data under the terms of the law.

d) Update the information reported by the data controllers in accordance with the terms agreed upon in the contracts with them.

e) Handle inquiries and claims submitted by data subjects within the terms set forth in this policy and the law governing the matter.

f) Share with the responsible areas within the company the procedures and policies to ensure proper compliance with the law governing the matter.

g) Refrain from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.

h) Allow access to the information only to those persons who are permitted to access it.

i) Notify the personal data protection authority when there are breaches of information security standards and, consequently, risks in the management of data subjects' information.

j) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

7. Procedure for handling requests and claims by data subjects.

In furtherance of the data subjects' fundamental right to Habeas Data with respect to the rights of access, consultation, updating, rectification, or cancellation, the following procedure will be followed:

a) Rights over personal data may only be exercised directly by the data subject, or by a legally authorized third party in accordance with the provisions of Law 1581 of 2012. This status will be verified by means of a copy of the identity document and, in the case of an authorized representative, the duly granted power of attorney.

b) The request to exercise any of these rights must be made through the channel designated by Colo within this Personal Data Processing Policy.

c) The request to exercise these rights must contain:

The name of the data subject and, where applicable, of their attorney-in-fact or representative. A concrete and precise statement of the right they intend to exercise. In each case, the request must be reasonably substantiated so that Colo, as controller of the database, may proceed to respond. An address for notifications. Documents supporting the request.
Signature of the request.
If any of the indicated requirements is missing, Colo will notify the requester within 5 days of receiving the request so that they may be completed. If two months pass without the required information being submitted, the request will be deemed withdrawn.

Colo will internally create a database of Requests and Claims, and will comply with the legal obligation to report them to the Superintendence of Industry and Commerce.

When Colo acts as controller of the information, it will address the claim within a maximum of 15 business days counted from the day following the date of its receipt. When it is not possible to address the claim within that term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed 8 business days following the expiration of the first term.

In turn, when Colo acts as data processor, it will inform the data subject or interested party of this situation in the request or claim, and will communicate the request to the data controller so that the latter may respond to the inquiry or claim submitted; this will be communicated to the data subject so that they are aware of the identity of the controller of the information and, consequently, of the party primarily obligated to guarantee the exercise of their right.

In accordance with the law, anyone intending to approach the Superintendence of Industry and Commerce to pursue the legal actions available to data subjects or interested parties must first exhaust the procedure described herein.

8. Channel designated for receiving requests and claims in the exercise of the rights of data subjects.

In any case, Colo, acting as processor or as controller of the information, will receive requests and claims in the exercise of the rights of data subjects at the email address:

admin@colo.coffee.

This email will be monitored and managed by the company's administrative area, which is aware of its legal obligations in order to address the requests submitted through this channel.

Any change to this channel will be duly communicated to the data subjects.

9. Prohibitions.

In furtherance of this Personal Data Processing Policy and its proper application, the following prohibitions are established:

a) Colo prohibits the access, use, management, transfer, communication, storage, and any other processing of sensitive personal data without the prior authorization of the data subject and of Colo itself.

b) Colo processes the personal data of children and adolescents under the age of majority only with the express authorization of their legal representatives; any processing carried out with respect to this type of data must be done while safeguarding the prevailing rights that the Political Constitution grants them, and for the purposes specifically communicated prior to the data being provided.

c) The international transfer of personal data to third countries that do not provide adequate levels of data protection is prohibited, in accordance with the provisions of Law 1581 of 2012 and the standards set by the Superintendence of Industry and Commerce, applying the exceptions established for such cases.

10. Data retention period.
The retention of data processed by Colo, whether as controller or as processor, will be determined by the purpose for which such data was collected or provided to Colo, as the case may be.

Therefore, once Colo's purpose has been fulfilled, it will proceed to destroy or return the data, as deemed appropriate.

In any event, Colo is aware that there are legal, labor, accounting, and tax obligations that require it to retain certain data for a specified period of time, and therefore undertakes to do so solely and exclusively for that purpose, adopting the technical and security measures appropriate for proper processing.

11. Security measures.
Colo, in the course of processing the personal data it collects or for which it is responsible as processor, as the case may be, will adopt all physical, technological, and administrative security measures it deems appropriate according to the data it handles, which will in all cases be applicable to the responsible areas.

Colo, in compliance with Statutory Law 1581 of 2012 and the requirements established by the Superintendence of Industry and Commerce, will report to the latter any case of information security failures that may have caused loss, theft, or fraudulent consultation or modification, along with the measures taken in that regard.

12. Delivery of personal data to administrative and judicial authorities.
In the event that authorities with jurisdictional or administrative functions request that Colo consult and/or deliver personal data recorded in its databases, such request will be evaluated internally and, if it meets all legal requirements, the case will be documented internally and added to the historical record kept internally by the company, in compliance with the rules governing the matter.

13. Effective date.
This personal data processing policy of Colo, which acts simultaneously as controller and processor of third-party information, has been approved and will therefore be in force as of January 1, 2018, for an indefinite term until a substantial amendment is made to it, which will be duly communicated through the designated channels.