Personal data treatment and protection policy

PERSONAL DATA PROCESSING POLICY

CIENTONCE SAS

In compliance with the provisions of Article 15 of the Political Constitution of Colombia, Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015 and other regulations governing the protection of personal data in Colombia, CIENTONCE SAS adopts this Personal Data Processing Policy, which establishes the conditions for the collection, storage, use, circulation, and deletion of personal data.

ARTICLE 1. PERSONAL DATA PROCESSING

In accordance with current legislation, Personal Data Processing is understood as any operation or set of operations performed on personal data, such as:

  • Collection

  • Storage

  • Use

  • Circulation

  • Updating

  • Transfer

  • Transmission

  • Deletion

These operations may be performed on information linked or that can be linked to one or more determined or determinable natural persons.

ARTICLE 2. DATA CONTROLLER

The data controller for personal data is:

CIENTONCE SAS
NIT: 901475331-1
Domicile: Medellín, Colombia
Address: Calle 20 No. 65-16, Medellín
Email: admin@111cientonce.com
Phone: (604) 4487735

CIENTONCE SAS will act as the Data Controller for personal data, insofar as it determines the purposes and means for the collection, storage, use, circulation, updating, transmission, or deletion of the personal information of data subjects.

ARTICLE 3. DATA SUBJECT

A Data Subject is considered to be the natural person whose personal data is processed by CIENTONCE SAS.

ARTICLE 4. PURPOSE OF PERSONAL DATA PROCESSING

CIENTONCE SAS may collect, store, use, circulate, update, transfer, or delete personal data for the following purposes:

Data of applicants, employees, interns, former employees, suppliers, contractors, and shareholders

a) Comply with legal obligations regarding labor and social security.
b) Carry out selection, evaluation, and employment recruitment processes.
c) Inform about job opportunities.
d) Provide labor or commercial references when required.
e) Establish, maintain, or execute commercial or contractual relationships.
f) Comply with commercial, contractual, accounting, and tax obligations.
g) Recognize, protect, and allow the exercise of the rights of the company's shareholders.
h) Make reports to administrative, judicial, or surveillance and control authorities when required.
i) Manage internal administrative processes.

Data of current, past or potential clients

Client personal data may be processed for:

a) Establish, maintain, or execute commercial relationships.
b) Provide contracted products or services.
c) Manage invoicing processes, payments, and commercial obligations.
d) Inform about news, product and service updates, or commercial communications.
e) Perform customer service and support activities.
f) Comply with legal and regulatory obligations.
g) Make reports to administrative or judicial authorities when required.
h) Develop administrative, commercial, or contact activities with clients.

ARTICLE 5. RIGHTS OF DATA SUBJECTS

In accordance with Article 8 of Law 1581 of 2012, data subjects have the right to:

a) Know, update, and rectify their personal data.
b) Request proof of the authorization granted for the processing of their personal data.
c) Be informed about the use given to their personal data.
d) File complaints with the Superintendence of Industry and Commerce (SIC) for violations of data protection regulations.
e) Revoke authorization and/or request the deletion of data when there is no legal or contractual obligation preventing it.
f) Access their personal data that has been processed free of charge.

ARTICLE 6. PROCEDURE FOR INQUIRIES, COMPLAINTS, AND CLAIMS

Data subjects may submit inquiries, petitions, complaints, or claims related to the processing of their personal data through the following channels:

Email: admin@111cientonce.com
Phone: (604) 4487735

The request must contain:

  • Full name of the data subject

  • ID document number

  • Clear description of the request

  • Contact information for receiving a response

Response times

  • Inquiries: will be addressed within a maximum period of 10 business days.

  • Claims: will be addressed within a maximum period of 15 business days.

If it is not possible to respond within the indicated timeframe, the interested party will be informed, stating the reasons for the delay and the date on which a response will be provided.

ARTICLE 7. DATABASE VALIDITY

The databases managed by CIENTONCE SAS will remain valid as long as it is necessary to fulfill the purposes of information processing, or as long as there is a contractual, commercial, or legal relationship that requires it.

ARTICLE 8. SECURITY MEASURES

CIENTONCE SAS will adopt reasonable technical, human, and administrative measures to protect personal data against:

  • unauthorized access

  • loss of information

  • adulteration

  • misuse

  • fraud or unauthorized access

These measures will be implemented in accordance with the company's internal information security policies.

ARTICLE 9. POLICY VALIDITY

This policy comes into effect upon its publication and may be modified or updated by CIENTONCE SAS when necessary to comply with regulatory changes or improve personal data processing procedures.

Modifications will be communicated timely through the company's official channels.

CIENTONCE SAS