Company Name: LABORINTOS S.A.S.
TAX IDENTIFICATION NUMBER: 900.589.886-1
Address: Carrera 15 No. 88-64 Office 605 Bogotá, Colombia
Telephone: 60 (1) 7551991
Website: www.laborintos.com
OBJECTIVE
LABORINTOS S.A.S. (hereinafter LABORINTOS), in compliance with Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other rules that complement, modify or replace them, committed to the protection of personal data of its customers, suppliers, candidates and workers, former, current and future, as well as any natural person from whom LABORINTOS collects or treats personal information, has adopted this Policy for the Protection and Treatment of Personal Data (hereinafter, the "Policy"), the main purpose of which is to guarantee compliance with the constitutional right of all persons to know, update, rectify or delete the information that has been collected about them in databases of any kind or files by LABORINTOS. The rules of this Policy apply to the processing of all personal information that LABORINTOS collects, stores, processes, uses or deletes.
Likewise, this Policy intends to make known the rights of the Personal Data Holders and the channels necessary for them to exercise their rights, among which are: the rights to access, rectification, updating, cancellation and opposition of the personal information whose processing is exercised by LABORINTOS, through consultations or claims, in the channels provided for this purpose in this Policy.
This Policy is mandatory for LABORINTOS employees, contractors and Clients.
DEFINITIONS
For the purposes of the application of the Policy and in accordance with the provisions of the personal data protection regime in Colombia, the following definitions shall apply:
Authorization: The prior, express and informed consent of the Data Controller to carry out the processing of personal data. In cases where LABORINTOS acts as a second Data Processor, the Data Controller (i.e. LABORINTOS' Client) shall be solely responsible for obtaining and retaining proof of the Data Subject's authorization.
Privacy Notice: Verbal or written communication generated by the Data Controller, addressed to the Data Subject for the processing of his Personal Data, through which he is informed about the existence of this Policy, how to access it and the purposes of the processing that is intended to be given to his Personal Data.
Data Base: Organized set of personal data that is subject to processing. In this definition, databases shall include those stored in physical or magnetic media (Office files) or in cloud computing services contracted by LABORINTOS in compliance with the applicable regulations. If the Database is owned by LABORINTOS, it shall be the Data Controller; otherwise, LABORINTOS shall act as the Data Processor.
Attention Channels: These are the following means provided by LABORINTOS to receive queries, requests or complaints regarding the Processing of your Personal Data by LABORINTOS. These Channels are:
E-mail: asistente@laborintos.com
Physical address: Carrera 15 No. 88-64 Office 605 Torre Zimma Building - Bogotá, Colombia.
Client: Natural or legal person who contracts LABORINTOS services.
Personal data: Any information linked or that can be associated to one or several determined or determinable natural persons.
Private data: Data that, due to its intimate or reserved nature, is only relevant to the Data Subject.
Public data: Data qualified as such according to the provisions of the law or the Political Constitution and that which is not semi-private, private or sensitive. Public data includes, among others, data relating to the marital status of individuals, their profession or trade, their status as merchants or public servants, and data that may be obtained without any reservation whatsoever. By their nature, public data may be contained, among others, in public records, public documents, gazettes and official bulletins.
Sensitive Data: Data that affect the privacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or those that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life and biometric data.
Data Processor: A natural or legal person, public or private, that by itself or in association with others, carries out the processing of personal data on behalf of LABORINTOS. In most cases, LABORINTOS acts as Data Processor to carry out, on behalf of its clients, activities related to services rendered in the preparation, development and planning of recruitment, selection and personnel evaluation processes, as well as any form of consultancy in matters related to recruitment and personnel selection.
Personal Data Compliance Officer: The person appointed by LABORINTOS to ensure compliance with this Policy and to receive requests from Data Subjects.
Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the processing of the data. In the case of the collection and processing of personal data of candidates, employees, suppliers and natural person clients of LABORINTOS, the latter shall act as Data Controller.
Data Subject: Natural person whose personal data is subject to processing. In the context of the present Policy, the data subjects may be: (i) employees currently employed or not, (ii) clients, natural persons, (iii) contractors, natural persons, (iv) candidates who apply for employment at LABORINTOS and (v) all those persons not related to LABORINTOS whose Personal Data is processed.
Processing: Any operation or set of operations on personal data, such as the collection, storage, use, circulation, updating or deletion of such data.
Transfer: The transfer of data takes place when the controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is responsible for the processing and is located inside or outside the country.
Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when the purpose of the processing is carried out by the processor on behalf of the controller.
GUIDING PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA
According to the provisions of Title II of the Statutory Law 1581 of 2012, the protection of Personal Data shall be governed by the harmonious and comprehensive application of the following principles:
Principle of legality in the processing of personal data: LABORINTOS shall at all times process Personal Data in accordance with the provisions established by law.
Principle of purpose: Personal Data will be processed only for the purposes for which they have been previously authorized by the Data Subject.
Principle of freedom: The Processing of Personal Data by LABORINTOS may only be carried out with the prior, express and informed consent of the Data Subject.
Principle of truthfulness: The information subject to Processing must be truthful, complete, accurate, updated, verifiable and understandable by the Holder.
Principle of transparency: The Data Subject may always request information from LABORINTOS about the Personal Data that is processed.
Security principle: LABORINTOS has the strictest levels of information security, since it has implemented the necessary technical and administrative measures to ensure the security of Personal Data, with a technical, administrative and legal team that prevents the adulteration, loss, consultation, unauthorized or fraudulent use or access of this data.
Principle of confidentiality: LABORINTOS requires all natural and/or legal persons involved in the Processing of Personal Data to guarantee the confidentiality of the information, even after the end of their relationship.
Principle of restricted access and circulation: LABORINTOS restricts access to the Databases only to persons who know and understand the data protection culture, have been authorized and have signed a confidentiality agreement and require the same to comply with the purposes for which the Processing is carried out.
PROCESSING OF PERSONAL DATA
Commitment to privacy: LABORINTOS, from its senior management to all the organization's collaborators, is committed to the confidentiality and privacy of the personal information stored in its Databases, which have the highest security standards, with access restrictions established for each case and are not available to the public at any time. For this reason, it guarantees its owners the conservation of their information under strict security conditions that prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access, as well as internal policies and practices that contribute to a safe information environment.
LABORINTOS has manuals and protocols for the handling and protection of the information in each of the Databases under its control and administration, which are made available to the personnel in charge, so that the person handling the information is aware of the security standards under which the Processing must be carried out.
Likewise, LABORINTOS requires its contractors and Clients to comply with this Policy and the applicable regulations, in order to guarantee natural persons that, at all times, their Personal Data will be protected and used only for the purposes authorized by them.
Collection of Personal Data: Personal Data is collected by LABORINTOS by any of the following means:
Through the exchange of e-mails or telephone calls.
By means of authorized access, within the framework of a contract, to the Databases owned by LABORINTOS Customers.
Through the academic resumes of candidates.
In the development of job interviews.
By sending information from companies that have the quality of headhunting and the Data Controllers have provided the data.
Through affiliation forms to EPS, ARL and other entities of the General Social Security System.
Through an employment or service contract.
Through events carried out by LABORINTOS.
Through the transmission or transfer by LABORINTOS' strategic allies.
Through the use of lists of persons entering LABORINTOS facilities.
Through service offerings.
Through service portfolios.
Through meetings or telephone communications.
Beginning and termination of the processing of information: LABORINTOS guarantees that it only processes the personal information of persons who have previously and expressly authorized such Processing. LABORINTOS or the Data Controller shall keep a true copy of the authorization so that the Data Subject may request its revocation and the immediate deletion of his/her information at any time he/she so desires, provided that this is appropriate. 6 Without prejudice to the application of the Policy for any Personal Data stored in LABORINTOS' Databases, LABORINTOS shall not be obliged to request the authorization of the data subject in the following cases: (i) for information required by a public or administrative entity in the exercise of its legal functions or by court order; (ii) when dealing with data of a public nature; (iii) in cases of medical or health emergency; (iv) when the processing is authorized by law for historical, statistical or scientific purposes; and, (v) when dealing with data related to the Civil Registry of Persons.
Purpose of the processing: The purpose of the processing of Personal Data carried out by LABORINTOS is: i) to execute the existing contractual relationship with its Clients, suppliers, contractors, workers and candidates; ii) so that LABORINTOS can develop its corporate purpose within the framework of a contract with its Clients, i.e.: to carry out telephone marketing, answer calls from customers of LABORINTOS' Clients, advance sales campaigns, loyalty plans, prizes and bonuses, among others; iii) to inform about new services provided by LABORINTOS; iv) to evaluate the quality of service, carry out satisfaction campaigns and follow up on the provision of its services; v) to carry out statistical studies; vi) to send communications by physical mail, electronic mail, mobile device, or through any other analog and/or digital means of communication; vii) maintain an efficient communication of information that may be useful in the contractual links; viii) develop the selection, evaluation and employment process; ix) comply with the obligations contracted with LABORINTOS employees in relation to the payment of salaries, social benefits and other matters set forth in the labor contract; x) perform verification in the risk centers; xi) support internal or external auditing processes; xii) evaluate the quality of services rendered by workers; xiii) conduct internal studies on workers' habits for corporate welfare programs; xiv) conduct accounting processes; xv) contact guardian in case of emergency; xvi) keep support of information on employees and/or pensioners (active and inactive); xvii) supply, share, send or deliver personal data to LABORINTOS' subsidiaries, affiliates or subordinates, located in Colombia or any other country, in the event that these companies require the information for the purposes indicated herein; xviii) participate in public or private bids in which the profile of LABORINTOS' human resources is required; and xix) transfer or transmit Personal Data nationally or internationally to suppliers with whom LABORINTOS carries out activities in compliance with its corporate purpose.
For greater control and security of the Data Subject, LABORINTOS undertakes to inform in the request for authorization for the Processing of the information, the specific purpose for which the personal information is collected, stored or used, which will depend on the Data Subject's status as an employee, client, user or supplier of LABORINTOS. In the event that LABORINTOS does not act as Data Controller vis-à-vis the Data Subject, LABORINTOS' Client shall be responsible for informing in the Data Subject's request for authorization, that the use of his/her Personal Data will be used to carry out the activities contracted to LABORINTOS.
Access to information: In the development of the aforementioned purposes and/or in those expressly indicated in the request for authorization for Processing, LABORINTOS employees who are directly related to the aforementioned purpose may be authorized access to the information stored in LABORINTOS' Databases.
LABORINTOS does not share, market or give Personal Data stored in its Databases to third parties unrelated to LABORINTOS. However, and when the purpose so requires, personal information may be legitimately transmitted or transferred to business partners or service providers of LABORINTOS, in order to fulfill specific contractual or commercial objectives. In these cases, LABORINTOS guarantees compliance with the regulations related to the Transfer and/or Transmission of Data, especially with respect to the countries to which such operations are carried out for the storage of Personal Data, ensuring that they have adequate levels of data protection and are endorsed by the competent authorities.
In any of these events, LABORINTOS undertakes to take all relevant measures to ensure that the processing of Personal Data by its business partners or service providers is carried out in strict compliance with our Policy.
Treatment of the information in each case: The particular terms and conditions for the Processing of Personal Data contained in the LABORINTOS databases are documented in each of the contracts signed with the Data Holders and Clients, and in cases where this is not required, in the request for authorization for the processing of the information. Therefore, when a Client, supplier, contractor, natural person or worker signs the corresponding contract, it is understood that he/she is giving his/her prior, express and informed consent for LABORINTOS to process his/her information, as well as in the requests for authorization to process the information.
Request for updating information: In compliance with the principles governing the Processing of Personal Data, LABORINTOS undertakes to make its best effort to ensure that the information contained in its Databases is accurate, complete and up-to-date. To this end, LABORINTOS may request its customers, suppliers and employees to update their personal information on an ongoing basis.
RIGHTS OF PERSONAL DATA SUBJECTS
The Holder of the Personal Data contained in LABORINTOS' Databases shall have the following rights:
Know, update and rectify your Personal Data.
Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing.
Be informed by LABORINTOS, upon request, regarding the use that has been made of your personal data.
File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
To revoke the authorization and/or request the deletion of your data when the treatment does not respect the principles, rights and constitutional and legal guarantees.
Access free of charge to your personal data that has been processed.
AUTHORIZATION AND CONSENT OF THE HOLDER
The consent and authorization by the Data Subject is a constitutional and legal requirement that the Controller of Personal Data must comply with. The authorization must comply with the following assumptions:
Prior: Authorization must be given before proceeding with the Treatment.
Express: The authorization must be given in an unequivocal, clear and specific manner.
Informed: The Data Subject must clearly understand the purpose for which his or her personal data will be processed and the effects that may derive from the processing of such data.
In order to comply with the aforementioned requirements, LABORINTOS has established the following methods for obtaining authorization, which will be applied depending on the relationship between the Holder and LABORINTOS:
By filling out and signing a physical form.
By means of telephone calls in which the Data Subject is expressly asked if he/she wishes to give authorization for the processing of his/her data.
Notwithstanding the foregoing, in the events in which LABORINTOS is not the Controller of the Personal Data but one of its Clients, within the framework of a service contract, it shall be the obligation of the Controller of the Personal Data to obtain the authorization of the Data Subject in compliance with this Policy and the applicable rules, having also to inform the Data Subject in such authorization that: (i) LABORINTOS may make use of his/her personal data in execution of a service provision contract with the Client; and, (ii) in the events in which Sensitive Data is processed, to inform which Sensitive Data will be processed and those on which he/she is not obliged to grant his/her consent.
CHANNELS OF ATTENTION
In development of the constitutional guarantee regarding the rights of access, updating, rectification and suppression by the Personal Data Holder, its assignees, legal representatives and/or attorneys-in-fact, LABORINTOS has channels of attention for the Data Holders.
All communications, inquiries, complaints and/or claims should be addressed to the Personal Data Protection Officer by any of the following means:
E-mail: asistente@laborintos.com
Physical address: Carrera 15 No. 88-64 Office 605 Torre Zimma Building - Bogotá, Colombia.
PERSONS AUTHORIZED TO EXERCISE THE RIGHTS OF THE HOLDERS OF THESE RIGHTS
LABORINTOS may only provide information contained in its Databases to:
The Holders, their successors in title or their legal representatives;
Public or administrative entities in the exercise of their legal functions or by court order;
Third parties authorized by the owner or by law.
LABORINTOS reserves the right to request additional documentation in order to verify the quality of the person requesting the information.
PROCEDURES FOR THE HANDLING OF REQUESTS, INQUIRIES OR CLAIMS
Requests, inquiries or complaints may be submitted through a document with the characteristics described in each of the cases, and sent through any of the Service Channels indicated herein.
These procedures shall only be carried out by LABORINTOS when it is the Data Controller. In cases where LABORINTOS acts as Data Processor, requests from Data Subjects shall be addressed to the Data Controller in accordance with the procedures established by the latter.
The following are the procedures established by LABORINTOS to process queries, requests or complaints from data subjects:
INQUIRY
In the case of requests for information and/or queries, LABORINTOS will respond within a maximum of ten (10) working days from the day following the date of receipt of the request or query that has been received in compliance with this procedure.
When it is not possible to attend the consultation within said term, the interested party shall be informed, indicating the reasons for the delay and stating the date on which it will be attended, which in no case may exceed five (5) working days following the expiration of the first term. The consultation document shall contain the following:
The name and identification number of the Holder.
Copy of the holder's identity document.
Complete description of the consultation.
Address and contact information of the consultant.
In the event that the Beneficiary's successor requests the consultation, he/she must attach to the consultation:
The name and identification number of the Holder.
Copy of the Causahabiente's identity document.
Copy of the Holder's civil registry of death.
Document that accredits the quality in which it works.
Copy of the Holder's identity document.
Complete description of the consultation.
Address and contact information of the consultant.
If it is the legal representative and/or attorney-in-fact of the Holder, he/she must submit:
The name and identification number of the Holder.
Copy of identity document of the legal representative of the Holder.
Document that accredits the capacity in which it works (power of attorney, certificate of existence and legal representation issued by the respective Chamber of Commerce).
Copy of the Holder's identity document.
In case the attorney-in-fact is a minor, he/she must present the identity card and/or civil registry and the document that proves the capacity of representative or custodian of the minor.
Complete description of the consultation.
Address and contact information of the consultant.
COMPLAINTS AND/OR CLAIMS
When the Data Subject considers that his/her information should be corrected, updated or deleted or when he/she notices an alleged breach of any of his/her rights, the maximum term for LABORINTOS to respond to the complaint or claim shall be fifteen (15) business days from the day following the date of receipt of the document. If it is not possible to deal with the complaint within said term, the interested party shall be informed of the reasons for the delay and the date on which it will be dealt with, which in no case may exceed eight (8) working days following the expiration of the first term. If the claim is incomplete, the interested party will be required within five (5) days following the receipt of the complaint and/or claim to correct the faults. After two (2) months from the date of the requirement without the applicant submitting the required information, the complaint or claim shall be deemed withdrawn. The complaint or claim document must contain:
The name and identification number of the Holder.
Copy of identity document of the holder
In the event that the Beneficiary's successor presents the complaint and/or claim, he/she must attach:
The name and identification number of the Holder.
Copy of identity document of the holder
Copy of the identity document of the Beneficiary
Copy of the Holder's civil registry of death.
Complete description of the consultation.
Address and contact information of the consultant.
Document that accredits the quality in which it works.
If it is a legal representative and/or proxy:
The name and identification number of the Holder.
Copy of the Holder's identity document.
Copy of the legal representative's identity document
Document accrediting the capacity in which he/she works (power of attorney, certification).
In case the attorney-in-fact is a minor, he/she must present the identity card and/or civil registry and the document that proves the capacity of representative or custodian of the minor.
Description of the facts giving rise to the claim and/or complaint.
The object pursued.
Claimant's address and contact information.
NON-AUTHORIZATION OR REVOCATION OF AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA
Any person is completely free not to authorize LABORINTOS to process his or her Personal Data. Notwithstanding the foregoing, in the event that Customers, suppliers, candidates or former or current employees do not authorize or request their revocation for the processing of their Data, LABORINTOS may refrain from initiating a contractual relationship or to continue providing benefits to these persons.
In this sense, LABORINTOS shall not be liable for any pre-contractual or contractual breach, or for the assignment of particular benefits that may be accessed by third parties with whom LABORINTOS communicates on an ongoing basis, as a consequence of the non-revocation of the authorization for the Processing of Personal Data.
In the event that the Data Controller is not LABORINTOS, the Data Subject shall request the revocation of the authorization before the Data Controller, who is the same person to whom the authorization was granted.
TREATMENT OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS
LABORINTOS understands that the Processing of Personal Data of children or adolescents is prohibited, except in the case of data of a public nature. Therefore, it is our policy not to collect data from persons under 18 years of age, except when their representative authorizes the Processing, event in which LABORINTOS will take into account:
Respect for the best interests of children and adolescents.
Respect for their fundamental rights
The opinion of the minor shall be valued when he/she has the capacity and autonomy to understand the matter.
In any case, it shall be the responsibility of the legal representatives of the children and adolescents to grant authorization to proceed with the Processing of the Personal Data of minors. If the authorization of the representative is not obtained, the data shall not be processed and no relationship may be established between LABORINTOS and the minor.
TREATMENT OF SENSITIVE DATA
The Data Controller understands and accepts that, due to LABORINTOS' corporate purpose, Sensitive Data is processed, and therefore undertakes to do so only when strictly necessary, in which case LABORINTOS will take this into account:
The need to inform the holder that since it is sensitive information, he/she is not obliged to authorize its processing.
The need to inform the holder explicitly and in advance, in addition to the general requirements of authorization for the collection of any type of Personal Data, that the data to be processed are sensitive and the purpose of the processing.
Increase the security measures for Sensitive Data, by means of restrictions, encryption and other measures within LABORINTOS's reach to provide greater security for this data.
In the event that LABORINTOS needs to collect and process Sensitive Data, it shall not carry out any processing without the prior, informed and express authorization of the Data Subject, except in those cases in which the granting of such authorization is not required by law and any of the following exceptions are present:
When the Processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated.
When the Processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization, whose purpose is political, philosophical, religious or trade union, provided that it refers exclusively to its members or to persons who maintain regular contacts by reason of its purpose, in which cases, the data may not be provided to third parties without the authorization of the Data Controller.
When the Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.
When the Processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted.
When it is carried out in compliance with a public or administrative order in the exercise of its legal functions or by court order.
TIME LIMITATIONS ON THE PROCESSING OF PERSONAL DATA
LABORINTOS keeps a record of information related to employees, suppliers, Clients or candidates during and after termination of the contractual relationship. These records may include personal data, which, after the contractual termination, will be kept for a reasonable period of time until the information contained therein is no longer required to comply with legal, administrative, auditing or regulatory requirements.
TRANSMISSION AND/OR NATIONAL OR INTERNATIONAL TRANSFER OF PERSONAL DATA
LABORINTOS may share the information of the Personal Data with those third parties that are necessary for the development of its activities and corporate purpose, always protecting the rights and information of the Data Subject.
The Transmission or Transfer of Personal Data that is carried out shall observe the rules provided for such purpose by the applicable regulations and the controlling authority, especially the following:
In the case of domestic transmission or transfer of personal data, LABORINTOS shall ensure compliance with the requirements of the applicable data protection legislation and protection measures by the processor or new data controller, as the case may be.
In the case of an international transfer, it must be ensured that the country receiving the personal data provides adequate levels of protection, in the manner established by the competent authority in Colombia, so that the same may issue the declaration of conformity referred to in the first paragraph of Article 26 of Law 1581 of 2012 and Circular 05 of 2017 issued by the Superintendence of Industry and Commerce. When the receiving country does not comply with adequate data protection standards, the Transmission or Transfer shall be prohibited unless one of the following legal exceptions is configured:
That the Data Subject has given express and unequivocal authorization for the Transfer or Transmission of Data.
Exchange of medical data when required by the treatment of the Data Subject for reasons of public health and hygiene.
Bank or stock exchange transfers, in accordance with the applicable legislation.
Transfers agreed within the framework of international treaties to which Colombia is a party, based on the principle of reciprocity.
Transfers necessary for the execution of a contract between the Data Subject and the Data Controller, or the execution of pre-contractual measures as long as the Data Subject's authorization is obtained.
MODIFICATIONS TO THE POLICY
LABORINTOS informs that any substantial change in this Policy will be communicated in a timely manner through its web page www.laborintos.com, for which reason we suggest that it be permanently consulted.
CURRENT
This Policy replaces in its entirety the Policy that was in effect prior to this one, which becomes effective on February 29, 2020 for an indefinite term.
