Personal data processing policy

Generalities

Responsible

Definitions

• Authorization: prior, express, and informed consent of the owner to carry out the processing of personal data;
• Database: an organized set of personal data that is subject to processing;
• Personal data: any information linked to or that can be associated with one or several specific or determinable natural persons;
• Processor: a natural or legal person, public or private, who, by themselves or in association with others, carries out the processing of personal data on behalf of the data controller;
• Responsible: A natural or legal person, public or private, who, alone or in association with others, decides on the database and/or the processing of the data;
• Owner: A natural person whose personal data is the subject of processing;
• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion;
• Principle of Legality: The processing of personal data is a regulated activity that must be subject to the provisions of the law and the other provisions that develop it;
• Principle of purpose: The treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the owner;
• Principle of freedom: Treatment can only be carried out with the prior, express, and informed consent of the owner. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate that requires consent;
• Principle of truthfulness or quality: The information subject to treatment must be truthful, complete, exact, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited;
• Principle of transparency: In the treatment, the right of the owner to obtain from the data controller or the data processor, at any time and without restrictions, information about the existence of data that concerns him or her must be guaranteed;
• Principle of restricted access and circulation: Treatment is subject to the limits derived from the nature of the personal data, the provisions of the law, and the Constitution. In this sense, the treatment can only be carried out by people authorized by the owner and/or by the people provided for by law.

Personal data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide knowledge restricted only to the Owners or authorized third parties in accordance with the law;

• Security principle: The information subject to Treatment by the Data Controller or Data Processor must be handled with the technical, human, and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized access. authorized or fraudulent;
• Principle of confidentiality: All persons involved in the Processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks included in the Processing has ended, and may only supply or communicate personal data when this corresponds to the development of activities authorized by law and in its terms.

Database content

In the NAUTICENTER S.A.S. databases. General information is stored, such as full name, identification number and type, gender, and contact information (email, physical address, landline, and mobile phone). In addition to these, and depending on the nature of the database, NAUTICENTER S.A.S. may have specific data required for the processing to which the data will be subjected. Information on employment and academic history is additionally included in the employee and contractor databases.

Handling of sensitive data

NAUTICENTER S.A.S. will not collect, use, or process sensitive data unless the owner issues express authorization for such treatment or in cases where the law determines that such authorization is not required.

Treatment

The information contained in the databases of NAUTICENTER S.A.S. is subjected to different forms of treatment, such as collection, exchange, updating, processing, reproduction, compilation, storage, use, systematization, and organization, all of which are partially or totally in compliance with the purposes established here.

The information may be delivered, transmitted, or transferred to public entities, business partners, or contractors solely for the purpose of fulfilling the purposes of the corresponding database.

In any case, the delivery, transmission, or transfer will be made after signing the commitments that are necessary to safeguard the confidentiality of the information.

In compliance with legal duties, NAUTICENTER S.A.S. may provide personal information to judicial or administrative entities.

NAUTICENTER S.A.S. will ensure the correct use of personal data of minors, guaranteeing that the applicable legal requirements are complied with and that all processing is previously authorized and justified in the best interests of minors; however, the law generally establishes that the Processing of personal data of children and adolescents is prohibited, except for those data that are public in nature.

Data Transfer to Third Countries

When data is sent or transferred to another country, the authorization of the owner of the information that is transferred must always be obtained. Unless the law authorizes otherwise, the existence of said authorization is a necessary presupposition to carry out the international circulation of data. In this sense, before sending personal data to another country, those obliged to comply with this policy must verify that they have the prior, express and unequivocal authorization of the Owner that allows their personal data to be transmitted.

Said transfer of personal data is carried out only to third parties with whom NAUTICENTER S.A.S. has a contractual, commercial, and/or legal relationship.

Purpose

The information collected by NAUTICENTER S.A.S. Its purpose is to allow the proper development of its commercial purpose. Furthermore, NAUTICENTER S.A.S. stores the information necessary to comply with legal duties, mainly in accounting, corporate, and labor matters.

Information about clients, suppliers, partners, and employees, current or past, is stored for the purpose of facilitating, promoting, allowing, or maintaining employment and civil and commercial relationships.

Owners’ rights

In accordance with the provisions of Article 8 of Law 1581 of 2012, the owners may:

• Know, update, and rectify your personal data against NAUTICENTER S.A.S. or to those in charge. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or has not been authorized.
• Request proof of the authorization granted to NAUTICENTER S.A.S., except when expressly excepted as a requirement for Treatment, in accordance with the provisions of Article 10 of this law.
• Be informed by NAUTICENTER S.A.S. or the Processor, upon request, regarding the use that has been given to your personal data.
• Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add to, or complement it.
• Revoke the authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights, and guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that NAUTICENTER S.A.S. or the Manager has engaged in conduct contrary to this law and the Constitution.
• Access free of charge to your personal data that has been processed.

OBLIGATIONS OF NAUTICENTER S.A.S.

• Guarantee the Holder, at all times, the full and effective exercise of the right to Habeas Data.
• Request and keep, under the conditions provided in this law, a copy of the respective authorization granted by the Owner.
• Duly inform the Owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted.
• Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access.
• Guarantee that the information provided to the Processor is true, complete, accurate, updated, verifiable, and understandable.
• Update the information, communicating in a timely manner to the Data Processor, all the news regarding the data that you have previously provided, and adopt the other necessary measures so that the information provided to it remains updated.
• Rectify the information when it is incorrect and communicate the pertinent information to the Manager.
• Provide the Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of this law.
• Demand that the Manager at all times respect the security and privacy conditions of the Owner’s information.
• Process queries and claims made in the terms indicated in this law.
• Adopt an internal manual of policies and procedures to guarantee adequate compliance with this law and, especially, to respond to queries and complaints.
• Inform the Manager when certain information is under discussion by the Owner, once the claim has been submitted and the respective process has not been completed.
• Inform, at the request of the Owner, about the use given to his data;
• Inform the data protection authority when violations of security codes occur and there are risks in the administration of the Owners’ information.
• Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

Purposes for the General processing of information from clients and suppliers

• Carry out the pertinent steps for the development of the corporate purpose of the company in what has to do with the fulfillment of the purpose of the contract entered into with the Owner of the information.
• Offer new products.
• Manage procedures (requests, complaints, and claims).
• Contact the Owner via email to send statements, account statements, or invoices in relation to the obligations derived from the contract entered into between the parties.
• Contact the Owner via email to send account statements or invoices in relation to the obligations derived from the contract entered into between the parties.
• Transmit personal data outside the country to third parties with whom NAUTICENTER S.A.S. has signed a data processing contract and it is necessary to deliver it to fulfill the contractual object.
• Provide the information to third parties with whom NAUTICENTER S.A.S. has a contractual relationship and it is necessary to deliver it for the fulfillment of the contracted object.
• Carry out satisfaction surveys regarding the products offered by NAUTICENTER S.A.S.

Purposes for the general processing of information about employees and candidates to fill vacancies:

• For purposes relevant to the employment relationship (EPS, ARL, pension and severance funds, family compensation funds, etc.).
• In the case of employees, with the signing of the employment contract, express authorization to Process the information is understood.
• In the case of judicial and legal requirements.
• Accounting and payment of payroll.
• Recruit and select personnel to fill vacancies.
• Process, confirm, and comply with legal and extralegal labor obligations derived from the employment contract.
• Make transactions.
• Payment of extralegal benefits.
• Audits.
• Statistical analysis.
• Maintain a candidate database.
• Training and education.
• Share personal data with banking entities and companies that offer benefits to our active workers, among others.
• Safety and health programs at work.

Responsible person or area

Any request, complaint or claim related to the handling of personal data, in application of the provisions of Law 1581 of 2012 and Decree 1377 of 2013, must be sent to:

Company: NAUTICENTER S.A.S.

Person in Charge: Francy Fernández – Data Protection Area.

Address: Avenida Jiménez Calle 26 No. 17 – 49 Cartagena – Bolívar – Colombia.

Email: nauticenter@nauticenter.com

Telephone: +57(5) 660 8192

Procedures for submitting and responding to queries

The owners of personal data that appear in the databases of NAUTICENTER S.A.S. or their successors in title may consult the data that the information will provide in the terms provided in the applicable legislation.

Any request for consultation, correction, update, or deletion must be submitted in writing or by email, according to the information contained in this document.
Queries will be answered within a period of ten (10) business days from the date of receipt of the respective request.

When it is not possible to attend to the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case may exceed five (5) business days following the expiration of the first term.

Procedures for submitting and responding to queries, complaints and claims

Claims must be formulated in writing or by email, according to the information contained in this document, and must contain, at least, the following information:

• Identification of the Owner
• Description of the facts giving rise to the claim
• Address of the owner
• Documentation that you want to present as proof If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies.

After two (2) months from the date of the request, without the applicant presenting the required information, it will be understood that the claim has been abandoned.

In the event that the person receiving the claim is not competent to resolve it, he or she will forward it to the appropriate person within a maximum period of two (2) business days and will inform the interested party of the situation.

Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database within a period of no more than two (2) business days. Said legend must be maintained until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days, counting from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Database validity

The Personal Information Processing Policies of NAUTICENTER S.A.S. They will be valid from the fifth (5th) of August 2020.
NAUTICENTER S.A.S. reserves the right to modify them under the terms and with the limitations provided by law.
The databases managed by NAUTICENTER S.A.S. will be maintained indefinitely while it develops its purpose and as long as it is necessary to ensure compliance with legal obligations, particularly labor and accounting, but the data may be deleted at any time at the request of its owner, as long as this request does not contradict a legal obligation of NAUTICENTER S.A.S. or an obligation contained in a contract between NAUTICENTER S.A.S. and Owner.