INTRODUCTION

The Policy of Treatment and Protection of Personal Data of ACKADIA SAS (hereinafter “ACKADIA” or “the Company”), has the purpose of informing its clients and suppliers, in their capacity as owners of the personal data that rest in the databases of the Company, the existence of policies for the treatment of personal information adopted by ACKADIA, as a result of the enactment of Law 1581 of 2012.

ACKADIA, is a commercial company incorporated under the laws of the Republic of Colombia, identified with NIT 901.219.446-1, with main domicile in the city of Bogotá, whose corporate purpose consists of carrying out any lawful activity, especially commercial commerce. wholesale of agricultural raw materials and animals Alive.

As a consequence of the work carried out by the Company, and the provision of the aforementioned services, ACKADIA has access to information of various kinds from its clients and suppliers, and therefore acquires the quality of Responsible or Person in Charge of the processing of personal information.

By virtue of the foregoing, in compliance with the legal duty enshrined in Law 1581 of 2012, article 17, literal K, through the issuance of this Policy, ACKADIA seeks to establish an appropriate procedural framework to safeguard the fundamental right of Habeas Data of its clients and suppliers, guaranteeing them effective mechanisms so that they know, update, rectify or request the deletion of the personal data of which they are holders, and that are processed by the Company.

DEFINITIONS

The following are the definitions provided in the General Law on Protection of Personal Data (Law 1581 of 2012) and its regulatory decree (Decree 1377 of 2013):

a. Authorization: Prior, express and informed consent of the owner to carry out the processing of personal data.

b. Privacy notice: Verbal or written communication generated by the Responsible, directed to the Holder for the Treatment of their personal data, by means of which they are informed about the existence of the information Treatment policies that will be applicable, the way to access to the same and the purposes of the Treatment that is intended to give the personal data.

c. Database: Organized set of personal data that is subject to treatment, both by public and private entities. It includes those data repositories that are contained in documents and that have the quality of archives.

d. Personal data: Any information linked to or that may be associated with one or more specific or determinable natural persons.

Classification of personal data under the Statutory Law of Habeas Data (Law 1266 of 2008):

  • Private data is that which due to its intimate or reserved nature is only relevant to the owner.
  • Semi-private data is one that is not intimate, reserved, or public in nature and whose knowledge or disclosure may be of interest not only to its owner but to a certain sector or group of people, or to society in general, such as financial and credit data of activity commercial or services referred to in the Special Law.
  • Public data is the one classified as such according to the mandates of the law or the Political Constitution and all those that are not semi-private or private in accordance with the Special Law. This includes as examples those related to the civil status of individuals and those that appear in public documents and enforceable sentences.

e. Public data: It is the data that is not semi-private, private or sensitive. Public data, among others, are data related to the marital status of individuals, their profession or trade and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public registers, public documents, gazettes and official gazettes and duly executed judicial decisions that are not subject to reservation.

F. Sensitive data: it is one that affects the privacy of the owner or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations, rights that promote the interests of any political party or that seek to guarantee the rights of opposition political parties, as well as data related to health, sexual life and biometric data.

g. Right to Habeas Data: It is the constitutional right that all people have to know, update, rectify or request the deletion of the information that has been collected about them in data banks, whose constitutional basis is found in articles 15 and 20 of the Political Constitution.

h. Responsible for the treatment: Natural or legal person, public or private, that by itself or in association with others carries out the processing of personal data on behalf of the person responsible for the treatment.

i. Responsible for the treatment: Natural or legal person, public or private, that by itself or in association with others decides on the database and / or the treatment of the data.

j. Owner: Natural person whose personal data is subject to treatment.

k. Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, deletion or circulation of the same.

—————————————————————————————–

Political Constitution of Colombia, article 15: “All people have the right to their personal and family privacy and to their good name, and the State must respect them and ensure that they are respected. In the same way, they have the right to know, update and rectify the information that has been collected about them in data banks and in files of public and private entities.

In the collection, processing and circulation of data, freedom and other guarantees enshrined in the Constitution will be respected.

Correspondence and other forms of private communication are inviolable. They can only be intercepted or registered by judicial order, in the cases and with the formalities established by law.

For tax or judicial purposes and for cases of inspection, surveillance and intervention of the State, the presentation of accounting books and other private documents may be required, in the terms established by law ”.

Political Constitution of Colombia, article 20: “Everyone is guaranteed the freedom to express and disseminate his thoughts and opinions, to inform and receive truthful and impartial information, and to found mass media.

These are free and have social responsibility. The right to rectification is guaranteed under conditions of equity. There will be no censorship ”.

l. Transfer: The transfer of data takes place when the Responsible and / or Person in Charge of the Treatment of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is Responsible for the Treatment and is inside or outside from the country.

m. Transmission: Processing of personal data that implies the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a Treatment by the Manager on behalf of the Responsible.

CHAPTER I

GENERAL DISPOSITION

Article 1 Purpose. By means of this Personal Data Treatment and Protection Policy of ACKADIA S.A.S. (hereinafter the “Treatment Policy”) the effective exercise of the right of Habeas Data of the Holders of the Personal Data processed by ACKADIA is regulated, through the setting of clear parameters of collection, conservation and administration of the same; as well as procedures for the Holders to know, update, rectify or request the deletion of the data that has been collected about them in the Company’s Database.

Article 2 Responsible for the treatment. The ACKADIA SAS Company, identified with NIT 901.219.446-1, whose offices are located at Carrera 11A # 69 – 35, in the city of Bogotá, telephone [+57 310 212 85 20], email angela @ ackadia. life.

Article 3 Scope. The Company guarantees that all ACKADIA officials or employees are aware of and are bound to comply with the Treatment Policy. The Company will carry out the training, updating and dissemination tasks that are necessary for its officials to comply with the Treatment Policy.

Article 4 Entry and period of validity. This Treatment Policy becomes effective as of [__] of [__________________], 2017, and will be in effect until it is expressly modified by the Company.

ACKADIA will notify the Holders of any modification it makes to this Treatment Policy at least five (5) business days before the entry into force. In the event that the Holder does not agree with the modifications made to this Treatment Policy, he will have the right to request the deletion of his Personal Data in accordance with the procedure described in article [___].

Article 5 Applicable law. The Treatment Policy will be governed by the laws of the Republic of Colombia, especially by Law 1581 of 2012, by Decree 1377 of 2013, and others that add, modify or complement them.

Article 6 Principles. The principles outlined in this article constitute the general framework for compliance with the provisions enshrined in the Treatment Policy.

a. Principle of purpose: the Treatment of Personal Data carried out by the Company must obey a legitimate purpose, which will be promptly informed to the Holder.

b. Principle of freedom: the Treatment can only be carried out with the prior, express and informed consent of the Holder. Personal Data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.

c. Principle of truthfulness or quality: the information subject to Treatment must be truthful, complete, exact, updated, verifiable and understandable, in accordance with the data that have been provided by the Owner.

d. Principle of transparency: in the Treatment of Personal Data, it will be sought to protect the right of the Holder to obtain from the Company, at any time and without restrictions, information about the existence of data that concerns him.

e. Principle of access and restricted circulation: the Processing of Personal Data will be subject to the limits derived from their nature, from the provisions of Law 1581 of 2012, and the Constitution. In this sense, the Treatment may only be carried out by ACKADIA itself, or in association with other people, by virtue of the alliances it makes.

Personal data will not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties.

f. Security principle: the information subject to Treatment by ACKADIA, must be handled with the technical, human and administrative measures that are necessary to guarantee the security of the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

g. Principle of confidentiality: all persons who intervene in the Processing of Personal Data are obliged to ensure the reservation of the information, even after the end of their relationship with any of the tasks that the Treatment comprises.

CHAPTER II

AUTHORIZATION FOR THE PROCESSING OF INFORMATION

Article 7 Authorization. Without prejudice to the exceptions enshrined in Law 1581 of 2012, ACKADIA will always require the prior and informed authorization of the Holder to carry out the Processing of their Personal Data according to the purpose described in Article 10, which may be obtained or granted by any means that may be subject to subsequent consultation.

The authorization of the Holder will not be necessary in the case of:

a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.

b. Data of a public nature.

c. Cases of medical or health emergency.

d. Treatment of information authorized by law for historical, statistical or scientific purposes.

e. Data related to the Civil Registry of Persons.

Article 8 Proof of Authorization. ACKADIA will adopt the necessary technological or mechanical measures to keep a record of the authorizations granted by the Holders, as well as proof of the date and manner in which the authorization was obtained.

Article 9 Information Collected: In general and non-exhaustive terms, ACKADIA obtains the following information from its clients and suppliers, in carrying out the activities of its corporate purpose:

  1. Name
  2. Personal Identification Number (ID, Passport, CE, NIT.)
  3. Name and identification of the legal representative
  4. Address, telephone, email.
  5. and. Personal Information Collected Through Surveys.

Article 10 Purpose of the Personal Data Processing. The Data contained in the ACKADIA databases will be used for the development of activities related to its corporate purpose and will have the following purpose:

    1. The purpose of the customer database is to fulfill the obligations contracted by the Company with its customers. In developing the contractual relationship with its clients, ACKADIA will seek to inform the Holder, by means of [email, physical, telephone calls, etc.], about new services or products offered, in order to deepen or expand its current portfolio, as well as to inform about the improvements or changes in its service channels and in the complementary services and products offered by the Company.
    1. The purpose of the databases of potential clients is to inform the Holder by means of [email, physical, telephone calls, etc.], about the services and products offered by the Company.
    1. The purpose of the supplier database is the proper surveillance and monitoring of the service or product acquired by ACKADIA, as well as negotiating the acquisition of future services or products. In developing the contractual relationship with its suppliers, ACKADIA will seek full compliance with the agreed services, maintaining permanent contact with the parties involved.
    1. The purpose of the employee database is to fully comply with the agreed labor benefits, as well as to carry out the communications, notices or notifications necessary for labor relations to develop properly.
    1. The purpose of using the database of former employees is to make their personal information available to the authorities and to the Holders themselves during the term established in the labor law.

Article 11 Revocation of the authorization. The Holders may at any time request ACKADIA to delete their personal data or revoke the authorization granted for the Treatment of the same, by filing a claim, in accordance with the provisions of Article 16.

The request to delete the information and the revocation of the authorization will not proceed when the Holder has a legal or contractual duty to remain in the ACKADIA database.

CHAPTER III

DUTIES OF THE RESPONSIBLE FOR THE PROCESSING OF THE INFORMATION

Article 11 In accordance with the provisions of article 17 of Law 1581 of 2012, ACKADIA undertakes to comply with the following duties, in its capacity as responsible for the Processing of Personal Data:

  1. Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.
  1. Request and keep, under the conditions provided in Law 1581 of 2012, a copy of the respective authorization granted by the Owner.
  1. Properly inform the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
  1. Keep the information under the security conditions necessary to act diligently in the prevention of its adulteration, loss, consultation, use or unauthorized or fraudulent access.
  1. Ensure that the information provided to the Treatment Manager is complete, accurate, updated, verifiable and understandable.
  1. F. Update the information, communicating in a timely manner to the Person in Charge of Treatment, all the news reported by the Holders, regarding the data that has previously been provided and adopt the other necessary measures so that the information provided to it is kept updated.
  1. Rectify the information when it is incorrect, if so informed by the Owner, and communicate the pertinent to the Person in Charge of Treatment.
  1. Provide the Treatment Manager, as the case may be, only data whose Treatment is previously authorized.
  1. Require the Treatment Manager, at all times, to respect the security and privacy conditions of the Owner’s information.
  1. Process inquiries and claims made under the terms indicated in Law 1581 of 2012.
  1. Inform the Treatment Manager when certain information is under discussion by the Owner, once the claim has been submitted and the respective process has not been completed.
  1. Inform, at the request of the Owner, about the use given to their data.
  1. Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.
  1. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

DUTIES OF THE DATA PROCESSOR

Article 12 In accordance with the provisions of article 18 of Law 1581 of 2012, ACKADIA undertakes to comply with the following duties, in its capacity as Person in Charge of the Treatment of Personal Data:

  1. Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.
  1. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
  1. Timely update, rectify or delete the data in the terms indicated in Law 1581 of 2012.
  1. Process the queries and claims made by the Holders in the terms indicated in Law 1581 of 2012.
  1. Insert in the database the legend “information in judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data.
  1. F. Refrain from circulating information that is being controversial by the Holder and whose blocking has been ordered by the Superintendency of Industry and Commerce.
  1. Allow access to information only to people who can have access to it in accordance with Law 1581 of 2012.
  1. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

CHAPTER V

RIGHTS OF THE HOLDERS

Article 13 Rights of the Holders. The rights of the Holders of the Personal Data processed by ACKADIA, in accordance with the provisions of article 8 of Law 1258 of 2012, are the following:

  1. Know, update, rectify and request the deletion of your personal data from the Company. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose Treatment is expressly prohibited or has not been authorized.
  1. Request proof of the authorization granted to the Company, as Responsible or Responsible for Treatment.
  1. Be informed by ACKADIA, regarding the use that has been given to your personal data.
  1. Present before the Superintendency of Industry and Commerce complaints for infractions to the provisions of Law 1581 of 2012, once the consultation or claim process before ACKADIA has been exhausted.
  1. Revoke the authorization and / or request the deletion of your Personal Data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment. The revocation and / or deletion will proceed when the Superintendency of Industry and Commerce has determined that in the ACKADIA Treatment has incurred in conduct contrary to Law 1581 of 2012, and the Constitution.
  1. Free access to your personal data that have been subject to Treatment.

Article 14 Legitimation for the exercise of the rights of the Holder. The rights of the Holders may be exercised by the following persons:

  1. By the Holder, who must prove his identity with the presentation of his citizenship card or equivalent document.
  1. By the successors of him, who must prove such quality with the corresponding civil registry.
  2. By the representative and / or attorney-in-fact of the Holder, prior accreditation of the representation or power of attorney with the corresponding power of attorney.

CHAPTER VI

PROCEDURES FOR ACCESS, CONSULTATION AND CLAIM

Article 15 Consultations. The Holders or persons entitled to exercise their rights, may make requests to consult their Personal Data that rest in the ACKADIA database, by means of a written document sent to the physical or electronic address of the Company.

Once ACKADIA receives the request for information through any of the aforementioned channels, it will proceed to check that the documents provided meet the accreditations required in Article 14, and that the individual registration requested corresponds to the name of the Holder and the document number of identity provided by the applicant.

If there is any divergence in the documents provided by the applicant, ACKADIA will inform it within five (5) business days of receipt, in order for the applicant to clarify the inconsistency.

If there are no divergences in the documents provided by the applicant, ACKADIA will respond within a term of ten (10) business days.

In the event that ACKADIA considers that it requires more time to respond to the query, it will inform the Holder of such situation and will respond within a term that will not exceed five (5) business days following the expiration of the initial term.

Article 16 Claims. The Holder or the persons entitled to exercise their rights, who consider that the information contained in the ACKADIA database must be corrected, updated or deleted, may submit a claim in this regard to the Company, by means of a written document containing the following:

  1. Name and identification of the Holder and of the attorney or representative thereof, if applicable.
  2. The clear description of the facts that give rise to the claim.
  3. The physical or electronic address where you want to receive notifications.
  4. The documents that you intend to assert as proof of the facts that support the claim.

If the claim is submitted incompletely, the interested party will be required within five (5) days of receipt of the claim to complete the claim.

After two (2) months from the date of the request, without the applicant submitting the supplement to the claim in the terms indicated above, it will be understood that the claimant has withdrawn from his claim.

Once the complete claim is received, a legend that says “claim in process” and the reason for it will be included in the database, within a term not exceeding two (2) business days. Said legend must be kept until the claim is decided.

The maximum term to respond to a claim will be fifteen (15) business days from the day following the date of its complete receipt. In the event that ACKADIA cannot respond within the expected term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Article 17. Complaints to the Superintendency of Industry and Commerce. The Holder or the persons entitled to exercise their rights must exhaust the consultation process before ACKADIA as a prerequisite for filing any complaint with the Superintendency of Industry and Commerce.

Article 18 Area in charge of processing petitions, complaints or claims. The petitions, complaints or claims presented to ACKADIA will be attended, in the first instance, by the Database Administrator, or whoever takes his place. Said official will ensure full compliance with this Treatment Policy.

APPENDIX 1

Request for authorization for the Processing of Personal Data obtained before the issuance of Decree 1377 of 2013:

Dear Owner:

In order to inform you about the legal framework for the protection of personal data in Colombia, we inform you that Law 1581 of 2012 (General Law of Personal Data Protection) was enacted, regulated through Decree 1377 of 2013, which regulates the right of people to know, update, rectify or delete the information that has been collected in any file or database.

In accordance with the provisions of the aforementioned regulations, we inform you that, prior to its issuance, ACKADIA had obtained some of your personal data, which, at some point, was provided to us by you or by those responsible for the treatment of your personal information, in order to provide our services. Consequently, in order to continue processing your personal data for the aforementioned purposes, we kindly request your consent.

We want to confirm that ACKADIA makes every effort to ensure that the procedures through which we use your personal data are safe and confidential, and that we have efficient technological mechanisms for their storage, preventing unwanted access by third parties.

We also remind you that you have the possibility of consulting the information registered in our databases at any time, and you have the right to request at any time the correction, update or deletion of your personal data, in the terms established in the Law 1581 of 2012 and in our Personal Data Treatment and Protection Policy.

Therefore, if you want your data to be deleted from our database, we ask you to expressly express it to the email fsuarez@suarezduque.com.co, within 30 business days from the sending of this communication . Otherwise, it will be considered that you authorize us so that your data can be processed by our Company, for the purposes previously indicated.

Cordially,

ACKADIA. S.A.S.

APPENDIX 2

PRIVACY NOTICE AND EXPRESS AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

ACKADIA S.A.S (hereinafter the “Company”), in compliance with the provisions of Law 1581 of 2012 and Decree 1377 of 2013 informs that:

    1. The personal data that you provide by virtue of the activities or operations carried out with the Company, will be treated in accordance with our Policy for the Treatment and Protection of Personal Data and the necessary technical, physical and administrative security measures will be taken to prevent unauthorized third parties access them.
    2. The person responsible for the processing of your data is ACKADIA SAS, identified with NIT 901.219.446- 1, whose offices are located at Carrera 11A # 69 – 35, in the city of Bogotá, telephone +57 310 212 85 20, email angela@ackadia.life, who will obtain them in development of the activities of its corporate purpose.
    3. The personal data collected will be used for (i) the development of activities related to the corporate purpose of the company (ii) compliance with the obligations contracted by the Company with its customers (iii) inform about the services and products offered by the Company, (vi) carry out due surveillance and monitoring of the services or products purchased by the Company and (v) comply with the agreed employment benefits.
    4. In accordance with the provisions of the Law and the regulatory Decree, the Data Owner will have the following rights: (i) To know, update, rectify and request the deletion of their personal data from the Company, (ii) Request proof of the authorization granted to the Company (iii) be informed by AGRARIS, regarding the use that has been given to their personal data, (iv) present before the Superintendence of Industry and Commerce complaints for infractions of the provisions of Law 1581 of 2012, once you have exhausted the consultation or claim process before the Company (v) revoke the authorization and / or request the deletion of your Personal Data when the treatment does not respect the principles, rights and constitutional and legal guarantees and ( vi) Free access to your personal data.
    5. The Owner of the data may exercise the aforementioned rights, in accordance with the procedure provided by the Company for this in the Policy for Treatment and Protection of Personal Data.
    6. Having read the foregoing, I authorize the Company previously, explicitly and unequivocally to process my personal data in the terms described in this Acceptance, in the Company’s Personal Data Treatment and Protection Policy and in general in the Law and the regulatory Decree.