Skip to content

Privacy notice and data processing policy

GENERAL CONSIDERATIONS

Article 15 of the Constitution of the Republic of Colombia enshrines the right of any person to know, update and rectify the personal data that exists about him/her in data banks or files of public or private entities. Likewise, it orders those who have personal data of third parties to respect the rights and guarantees provided in the Constitution when such information is collected, treated and circulated.

Likewise, Article 21 guarantees the right to honor and provides that the law will indicate the form of its protection, therefore, in observance of the constitutional norms considered as Fundamental Rights
.

Statutory Law 1581 of October 17, 2012 establishes the minimum conditions to carry out the legitimate processing of personal data of customers, employees and any other natural person. Both paragraphs k) of article 17 and f) of article 18 of said law obliges those responsible and in charge of the processing of personal data to "adopt an internal manual of policies and procedures to ensure proper compliance with this law and in particular, for the attention of queries and complaints".

 

Article 25 of the same law mandates that data processing policies are mandatory and that failure to comply with them will result in sanctions. Such policies cannot guarantee a lower level of treatment than that established in law 1581 of 2012.

 

Chapter III of Decree 1377 of June 27, 2013 regulates some aspects related to the content and requirements of the Information Processing Policies and Privacy Notices.

 

ARANDA SOFTWARE ANDINA S.A.S. is committed to respecting the rights of its employees and third parties in general. Therefore, it adopts the following policy of treatment of personal data of mandatory application in all activities involving the processing of personal data. In compliance with the provisions of the Statutory Law 1581 of 2012 and its Regulatory Decrees, the Company establishes the General and Special Policy applicable to the Processing and Protection of Personal Data in the organization.

MANDATORY

These policies are mandatory and strict compliance by all employees of the organization in Colombia, as well as for contractors, suppliers, agents and third parties acting on behalf of ARANDA SOFTWARE ANDINA S.A.S. therefore must observe and respect these policies in the performance of their duties and activities entrusted or delegated in which the processing of Personal Data is involved.

Failure to comply with them will result in labor penalties or contractual liability as appropriate. The above, without prejudice of the duty of the employees or those who act on behalf of
ARANDA SOFTWARE ANDINA S.A.S. to respond patrimonially for the damages caused to the owners of the data or to ARANDA SOFTWARE ANDINA S.A.S. for the breach of these policies or the improper treatment of personal data.

Taking into account all of the above, in compliance with the provisions of the Statutory Law 1581 of 2012 and its Regulatory Decrees, the Company establishes this General Policy, which in turn includes the Special policies applicable to the Processing and Protection of Personal Data in the organization.

IDENTIFICATION OF THE PERSON IN CHARGE:

ARANDA SOFTWARE ANDINA S.A.S. commercial company identified with NIT 830.099.766-1 is constituted as a Colombian company, whose corporate purpose is to provide development services, production and marketing of software projects.

● PHYSICAL ADDRESS: Diagonal 97 # 17 - 60 Office 702 Bogotá D.C.

● WEBSITE: www.arandasoft.com

● PHONE: +57 (1) 7563000

● EMAIL: protecciondedatos@arandasoft.com

2. OBJECTIVE

This Policy establishes the general guidelines for the protection and processing of personal data within ARANDA SOFTWARE ANDINA S.A.S. thus allowing to strengthen the level of trust between the Controller and the Data Controllers in relation to the processing of their information; to inform the Data Controllers of the purposes and transfers to which their personal data are subjected and the mechanisms and forms for the exercise of their rights.

3. SCOPE

This Policy of Treatment and Protection of Personal Data will be applied to all databases and/or files that include personal data that are subject to treatment by ARANDA SOFTWARE ANDINA S.A.S. as responsible for the treatment of personal data.

4. DEFINITIONS

Habeas Data: The right of every person to know, update and rectify the information that has been collected about him/her in files and data banks of a public or private nature.

Personal data: This is any information linked or that can be associated with a specific person, such as their name or identification number , or that can make them determinable, such as their physical features.

Data public: Data relating to the civil status of persons, their profession or trade and their status as merchants or public servants , among others, are considered public data.By their nature, public data may be contained, among others, in public records, public documents , official gazettes and bulletins and duly executedcourt judgments that are not subject to reserve.

Semi-private data: Data that are not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to the holder but to a certain sector or society in general .Financial, credit and economic data of commercial or serviceactivity are some examples.

Private data: It is data that due to its intimate or reserved nature is only relevant to the holder. The tastes or preferences of individuals, for example, correspond to private data.

Sensitive data: That data that affects the privacy of the holder or whose improper use may generate their discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data relating to health, sex life and biometric data.

Database: Organized set of personal data that is the subject of processing.

Data quality: The personal data subject to processing must be truthful, complete, accurate, updated, verifiable and understandable . When in possession of partial, incomplete, fractioned or misleading personal data; ARANDA SOFTWARE ANDINA S.A.S. shall refrain from submitting it to treatment, or request the Holder the completeness or correction of the information.

Processing: Any operation or set of operations on personal data such as collection, storage, use, circulation or deletion. deletion.

Authorization: Prior, express and informed consent of the Data Subject to carry out the processing of personal data.

Privacy Notice: It is the physical, electronic document or in any other known or to be known format, which is made available to the Data Subject in order toinform about the processing of their personal data.

Data Subject: Natural person whose personal data is the subject of processing.

Causahambiente: Person who by succession or transmission acquires the rights of another person.

Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the processing of the data.

Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the processing of personal data onbehalf of the Data Controller.

Digital information: All information that is stored or transmitted by electronic and digital means such as e-mail or other information systems.

5. GUIDING PRINCIPLES APPLICABLE TO PERSONAL DATA

The following guiding principles shall apply to the protection of personal data:

a) Principle of legality in data processing: The processing referred to in the Habeas Data Law is a regulated activity that must be subject to the provisions set forth therein and in the other provisions that develop it.

b) Principle of purpose: The processing must obey a legitimate purpose in accordance with the Constitution and the law, which must be informed to the Data Subject.

c) Principle of freedom: Processing may only be exercised with the prior, express and informed consent of the Data Subject .Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent.

d) Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.

e) Principle of transparency: In the processing, the right of the Data Subject to obtain from the Controller or Process or, at any time and without restriction, information about the existence of data concerning him/her must be guaranteed.

f) Principle of restricted access and circulation: The treatment is subject to the limits derived from the nature of the personal data, the provisions of the law and the Constitution. In this sense, the processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for by law.

Personal data, except for public information, may not be made available on the Internet or other means of dissemination or mass communication, unless access is technically controllable so as to provide restricted knowledge only to the Data Subject or authorized third parties. mass communication, unless access is technically controllable to provide restricted knowledge only to Data Holders or authorized third parties in accordance with the law. in accordance with the law.

g) Principle of security: The information subject to processing by the Data Controller or Data Processor referred to inthe Habeas Data Law, shall be handled with the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulentaccess .

h) Principle of confidentiality: All persons involved in the processing of personal data that are not of apublic nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that comprise the processing, and may only supply or communicate personal data when this corresponds to the development of the activities authorized by law and under the terms of the same.

i) Principle of temporality: Personal data will be kept only for the reasonable and necessary time to fulfill the purposes that justified the processing, taking into account the provisions applicable to the matter in question and the administrative, accounting, fiscal, legal and historical aspects of the information. The data will be kept when this is necessary to comply witha legal or contractual obligation . Once thepurpose of the processing and the terms established above have been fulfilled , the data will bedeleted.

j) Integral interpretation of constitutional rights: The rights shall be interpreted in harmony and on a plane of balance with the right to information provided for in Article 20 of the Constitution and with the applicable constitutional rights.

k) Principle of Necessity: The personal data processed must be those strictly necessary for the fulfillment of the purposes pursued with the database.

6. RIGHTS OF THE OWNERS

Personal data owners shall enjoy the following rights, and those granted to them by law:

a) To know, update and rectify their personal data with respect to the Data Controller or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized;

b) Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the processing, in accordance with the provisions of Article 10 of the Law;

c) To be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been made of their personal data;

d) File before the Superintendence of Industry and Commerce complaints for violations to the provisions of the law and other regulations that modify, add or complement it;

e) To revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the processing. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the processing the Controller or Processor has incurred in conduct contrary to the law and the Constitution;

f) Access free of charge to your personal data that have been processed.

7. AUTHORIZATION OF THE HOLDER OF PERSONAL DATA

Notwithstanding the exceptions provided for in the Statutory Law 1581 of 2012, as a general rule, in the processing of personal data, the following shall apply to the processing of personal data ARANDA SOFTWARE S.A.S.will collect the prior and informed authorization of the Data Subject, which may be obtained by any means that may be subject to subsequent consultation.

7.1 Events in which authorization is not required

The authorization of the Holder shall not be necessary in the case of:

a) Information required by a public or administrative entity in the exercise of its legal functions or by court order;

b) Data of a public nature;

c) Cases of medical or sanitary emergency;

d) Processing of information authorized by law for historical, statistical or scientific purposes;

e) Data related to the Civil Registry of Persons.

8. DUTIES OF ARANDA SOFTWARE ANDINA S.A.S. AS CONTROLLER OF PERSONAL DATA PROCESSING

ARANDA SOFTWARE ANDINA S.A.S. as responsible for the processing of personal data, shall comply with the following duties:

a) Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data.

b) Request and keep, under the conditions provided by law, a copy of the respective authorization granted by the Data Subject.

c) Duly inform the Data Subject about the purpose of the collection and the rights he/she is entitled to by virtue of the authorization granted.

d) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

e) Ensure that the information provided to the Data Processor is truthful, complete, accurate, updated, verifiable and understandable.

f) Update the information, communicating in a timely manner to the Data Processor, all the news regarding the data previously provided and adopt the other necessary measures so that the information provided to the Data Processor is kept up to date.

g) Rectify the information when it is incorrect and communicate the pertinent to the Data Processor.

h) To provide to the Data Processor, as the case may be, only data whose processing is previously authorized in accordance with the provisions of this law.

i) To require the Data Processor, at all times, to respect the security and privacy conditions of the Data Subject's information.

j) To process queries and claims formulated under the terms set forth in the Statutory Law 1581 of 2012.

k) Adopt an internal manual of policies and procedures to guarantee adequate compliance with the law and, in particular, to attend to queries and complaints.

l) Inform the Data Controller when certain information is under discussion by the Data Subject, once the claim has been submitted to
and the respective process has not been completed.

m) To inform, upon request of the Data Subject, about the use given to his/her data.

n) Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the Data Holders.

o) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

9. SPECIFIC POLICIES FOR THE TREATMENT OF PERSONAL DATA.

9.1 Processing of Employees' Personal Data

ARANDA SOFTWARE ANDINA S.A.S. collects the personal data of its Employees which are classified by the company as confidential, and will only be disclosed by the Company with the express authorization of the owner or when requested by a Competent Authority.

The purposes for which the personal data of the Company's employees are used will be:

a) To comply with the obligations imposed by the Colombian Labor Law on employers, or with the orders issued by the competent Colombian or foreign authorities;

b) Issue certifications regarding the relationship of the data subject with the Company.

c) Comply with the obligations imposed on the Company as employer, in relation to Occupational Safety and Health standards, and the so-called Occupational Safety and Health Management System (SGSST).

d) Comply with the biosafety protocols applicable to the Company.

e) Manage the functions performed by the workers.

f) Consult memorandums or calls for attention.

g) To develop and apply the disciplinary process.

h) Establish communication in case of emergency.

i) To carry out control, follow-up and evaluation of the workers.

j) Protect ARANDA SOFTWARE ANDINA S.A.S. confidential and proprietary materials.

k) Take images, photographs and fingerprints necessary for the recognition of the worker, compliance control and collection of evidence of the services rendered.

l) Additionally, biometric data of employees are used for commercial purposes related to the Company's corporate purpose.

m) Communicate information about employees to third parties with which the Company maintains a contractual relationship, as well as with suppliers, collaborators, partners or consortiums and customers to the extent necessary to comply with the protocol of the third parties, with the sole purpose that they can manage the control and coordination with respect to the personnel who effectively provide the services arising from the contractual relationship, as well as to enable compliance with legal obligations, tax and social security.

n) Communicate workers' identification data to travel agencies, transportation companies, hotels and car rental companies , for the management of reservations and settlement of expenses incurred.

o) To carry out international transfer or transmission of data to countries that provide similar protection to Colombia.

p) Delivery of information to third parties in charge of evaluation, training, certification and other processes required in the development of the contractual relationship.

 

q) Verify, compare and evaluate the work and personal competencies of employees.

r) Sending information to compensation funds, AFP, ARL, insurance companies , among others.

s) Initiate internal investigations based on complaints filed by customers, third parties or employees themselves.

t) Handling of complaints against employees for harassment at work or violation of codes of conduct.

ARANDA SOFTWARE ANDINA S.A.S. stores the personal data of its employees, including those that have been obtained in the development of the selection process , and keeps them in a folder identified with the name of each of them.

Such folder will only have access and will be treated by the administrative area, with the purpose of managing the contractual relationship between ARANDA SOFTWARE ANDINA S.A.S. and the employee.

ARANDA SOFTWARE ANDINA S.A.S. treats Sensitive Personal Data of its employees such as fingerprints through biometric control for the sole purpose of controlling the entry to the company's facilities and provide safe working environments. For the purposes of this treatment, the respective authorization is collected , which in any case will be express and optional, clearly indicating the Sensitive Personal Data to be treated and the purpose of this.

Likewise, it will have high security systems for the handling of those sensitive data and its reserve, in the understanding that such sensitive data will only be used by ARANDA SOFTWARE ANDINA S.A.S. for the aforementioned purposes.

Termination of the labor relationship, ARANDA SOFTWARE ANDINA S.A.S. will proceed to store all personal data obtained from the selection process and the documentation generated in the development of the employment relationship, in a central file with restricted access, subjecting the information at all times to appropriate security measures and levels of security, since the labor information may contain sensitive data.

In any case, the information will not be processed for a period longer than twenty (20) years. twenty (20) years counted from the termination of the labor relationship, or according to the legal or contractual circumstances that make it necessary to handle the information.

9.2 Processing of personal data of candidates or applicants to selection processes:

ARANDA SOFTWARE ANDINA S.A.S. collects the personal data of its applicants and stores them in a database which is classified by the Company as confidential, and will only be disclosed with the express authorization of the owner or when requested by a Competent Authority.

The purposes for which are used the personal data of the applicants of ARANDA SOFTWARE ANDINA S.A.S. will be:

a) Carrying out internal and external administrative management for the transparent execution of the personnel selection process.

b) Sending of communications programmed by the Company to carry out different selection tests.

c) Corroborate any requirement that may arise in the development of the selection process.

d) Verification of the applicant's work, academic and personal references.

e) To carry out the general hiring process of the selected personnel.

All personal data provided by the applicant or applicant will become part of a "Talent Bank", which the Company, as Responsible, may use for current and future selection processes in which the applicant's profile is suitable. The databases where such information is stored have the necessary security measures to ensure the total security of the data provided selection. In any case, the information will not be processed for a period longer than that authorized by the applicant and the additional time required according to the legal or contractual circumstances that make it necessary to handle the information.

9.3 Processing of personal data of Suppliers and contractors:

ARANDA SOFTWARE ANDINA S.A.S. collects personal data from its suppliers and contractors and stores them in a database which, although it consists mostly of public data, is classified by the company as confidential. In the case of private data, the Company will only disclose them with the express authorization of the owner or when requested by a Competent Authority.

The purposes for which are used the personal data of suppliers or contractors of ARANDA SOFTWARE ANDINA S.A.S. will be:

a) Manage the accounts receivable submitted by suppliers or contractors.

b) Keeping a control of the contributions made to the social security system by contractors.

c) Conduct evaluations and selection of potential suppliers.

d) Compliance with tax and legal aspects with public and regulatory entities.

e) Control and payment for goods and services received.

f) Qualitative and quantitative evaluations of service levels received from suppliers.

g) Process of control and accounting record of the obligations contracted with suppliers and contractors.

h) Sending invitations to contract and making arrangements for the pre-contractual, contractual and post-contractual stages.

i) Others specifically established in the authorizations granted by the suppliers themselves.

ARANDA SOFTWARE ANDINA S.A.S. will only collect from its suppliers and contractors the data that are necessary, relevant and not excessive to carry out the process of selection, evaluation and execution of the contract .

The collection of personal data of employees of suppliers and
contractors by ARANDA SOFTWARE ANDINA S.A.S. will in any case aim to verify the suitability and competence of employees; that is, once verified this requirement, ARANDA SOFTWARE ANDINA S.A.S. will return or delete such information, except when its conservation is expressly authorized .

In any case, the information will not be processed for a period longer
than the duration of the relationship of the Supplier or contractor with the Company, and the additional time required according to the legal or contractualcircumstances that make necessary the handling of the information.

9.4 Processing of Customers' personal data:

ARANDA SOFTWARE ANDINA S.A.S. collects the personal data of its customers and stores them in a database which is classified by the company as confidential, and will only be disclosed with the express authorization of the owner or when requested by a Competent Authority.

The purposes for which are used the personal data of the Clients of ARANDA SOFTWARE ANDINA S.A.S.'S CUSTOMERS ARE USED FOR will be:

a) Process of control and accounting records of the obligations contracted with customers.

b) Compliance with tax and legal aspects before public and regulatory entities.

c) Fulfillment of contractual obligations, for which the information may be transferred to third parties, such as financial entities, notaries, lawyers, etc.

d) To process petitions, complaints and claims filed by consumers in accordance with the provisions of the Consumer Statute Law 1480 of 2011.

e) Compliance with judicial decisions and administrative, legal, tax and regulatory provisions.

f) Transmission of information and personal data in auditing processes.

g) Administrative management for the execution of the pre-contractual, contractual and post-contractual stages.

h) Creation of the client in the Company's platforms or software.

i) Ensure compliance with the rights to which they are entitled under Law 1581 of 2012.

j) To carry out commercial prospecting and marketing activities.

k) Evaluate customer service and conduct satisfaction surveys.

l) Share the information with third party allies that collaborate with the company, considering that for the fulfillment of their duties they must have access to some extent to the information, which will also be subject to the obligations of confidentiality, handling of information and protection of personal data to which this company is subject.

m) To process the requests, complaints or claims established directly by the client through the customer service channels.

n) Contact the customer through physical and electronic means - email, SMS or chat to send information of interest or related to the contractual relationship, invite them to trainings or with the portfolio of services.

o) Maintain commercial contact with the Company, even after the termination of the contractual relationship.

p) To consult, as a good business practice or legal obligation, clients' background information in restrictive lists, OFAC, PEPS, Clinton and UN lists , in order to prevent money laundering and financing of terrorism. In any case, the information will not be processed for a period longer than the duration of the contractual relationship between the customer and the Company, and the additional time required according tothe legal or contractual circumstances that make it necessary to handle theinformation.

9.5 Processing of Personal Data of Prospective Clients

ARANDA SOFTWARE ANDINA S.A.S. has a record of Prospective Customers, whose information has been collected by the Company with the express authorization of the Holder through events, seminars, website or through the completion of requests for quotations by them.

ARANDA SOFTWARE ANDINA S.A.S. stores such information in a database which is classified by the company as confidential, and will only be disclosed with the express authorization of the owner or when requested by a Competent Authority.

The purposes for which the personal data of ARANDA SOFTWARE ANDINA S.A.S.'s Prospective Clients are used will be:

a) To send invitations to events, trainings, seminars scheduled by the company.

b) To send information about the products offered by the company to interested persons.

c) To send information about new products, promotions, discounts and gifts about the products and services offered by the company.

d) To carry out commercial prospecting activities and marketing operations.

e) To process inquiries, complaints or claims submitted by the owners.

f) To make management reports and internal statistics.

g) To ensure the exercise of their right of Habeas Data (inquiries, complaints and claims about updating, correction, deletion or elimination of data).

In any case, the information will not be processed for a period longer than the period agreed with the prospect through an authorization to use their personal data counted from its collection in accordance with the legal or contractual circumstances that make it necessary to handle the information.

9.6 Processing of Visitors' personal data at the Entrance Control

ARANDA SOFTWARE ANDINA S.A.S., collects the personal data of its visitors and stores them in a database which is qualified by the company as reserved, and will only be disclosed by the company with the express authorization of the owner or when a Competent Authority requests it. The purposes for which the personal data of those who enter the facilities of ARANDA SOFTWARE ANDINA S.A.S. are used will be:

a) Ensure the entry to the company's facilities to persons who have the authorization of free transit and restrict the passage to those persons who are not authorized.

b) Guarantee safety in the monitored environments.

c) Allow adequate working environments for the safe development of activities within the company.

d) Comply with the requirements of the Occupational Health and Safety Management System.

e) Comply with the biosafety protocols implemented by the Company.

In any case, the information will not be processed for a period of more than one (1) year from its collection in accordance with the legal or contractual circumstances that make it necessary to handle the information.

In accordance with the provisions of External Circular 008 of 2020 of the Superintendence of Industry and Commerce, the data collected to comply with biosafety protocols will only be used for the purposes indicated by the Ministry of Health and Social Protection, and will only be stored for the reasonable and necessary time to comply with such protocols. Once the purpose of the Personal Data Processing has been fulfilled, the Company will automatically delete the data collected.

9.7 Processing of personal data from the Video Surveillance Record

ARANDA SOFTWARE ANDINA S.A.S. collects biometric data of its employees and visitors through its Surveillance Cameras and stores them in a database which is classified by the company as confidential, and will only be disclosed with the express authorization of the owner or when requested by a Competent Authority. The purposes for which the personal data contained in the Surveillance Cameras are used will be:

a) To guarantee safety in work environments.

b
) To provide adequate work environments for the safe development of the company's work activities.

c
) To control the entry, permanence and exit of employees, contractors and clients in the company's facilities.

d
) To follow up on employees and verify compliance with their duties.

In order to comply with the duty of information that corresponds to ARANDA SOFTWARE ANDINA S.A.S. as administrator of personal data, the company will implement Privacy Notices in the areas where the capture of images involving the processing of personal data is performed.

In any case, the information will not be processed for a period longer than 30 days from its collection, according to the legal or contractual circumstances that make it necessary to handle the information.

9.8 Processing of personal data of website users:

ARANDA SOFTWARE ANDINA S.A.S. collects personal data from interested third parties through its website and stores them in a database which is classified by the company as confidential, and will only be disclosed with the express authorization of the owner or when requested by a Competent Authority.

The purposes for which are used the personal data contained in the website of ARANDA SOFTWARE ANDINA S.A.S. WEBSITE. will be:

a) Allow communication with customers or third parties through the contact us section.

b) Publish events or news of interest.

c) Receive and process complaints and claims from third parties.

d) Legal, accounting, administrative, commercial, promotional, informative, marketing and sales purposes.

e
) To carry out promotional, marketing and advertising campaigns.

f
) To make the company's portfolio of services known.

In any case, the information will not be processed for a period longer than the period agreed with the third party or user through a contract or authorization to use their personal data counted from its collection in accordance with the legal or contractual circumstances that make necessary the handling of the information.

9.9 Processing of personal data of SENA Apprentices:

ARANDA SOFTWARE ANDINA S.A.S. collects the personal data of its SENA trainees and stores them in a database, which is classified by the company as confidential, and will only be disclosed with the express authorization of the owner or when requested by a Competent Authority. The purposes for which the personal data of the SENA apprentices of the ARANDA SOFTWARE ANDINA S.A.S. will be:

a) To comply with the obligations imposed by Colombian labor law on employers, especially with the provisions of Law 789 of 2002 and its Regulatory Decrees.

b) Issue certifications regarding the relationship of the data subject with the company.

c) To corroborate any requirement that may arise in the development of the apprenticeship process.

d) Comply with the obligations imposed on the company as employer, in relation to Occupational Health and Safety standards, and the so-called Occupational Health and Safety Management System (SGSST).

e) Manage the functions developed by the apprentices.

f) Control the development of the apprentices in the teaching stage and practical stage.

g) Contact family members in case of emergency.

In any case, the information will not be processed for a period longer than the duration of the applicant's relationship with the company, which in no case may exceed two (2) years, and the additional time required according to the legal or contractual circumstances that make it necessary to handle the information.

9.10 Processing of personal data of Shareholders:

ARANDA SOFTWARE ANDINA S.A.S. collects the personal data of its Shareholders and stores them in a database which is classified by the company as reserved, and that will only be disclosed by the company with the express authorization of the owner or when a Competent Authority requests it.

The purposes for which the personal data of the Suppliers are used will be:

a) Allow the exercise of the duties and rights derived from the quality of shareholder.

b) Allow the sending of invitations to events scheduled by the company.

c) Issue certifications regarding the relationship of the Holder with the company.

d
) Comply with the precepts and regulations established in the Code of Commerce and other applicable regulations.

e
) Summon or invite you to the different meetings of corporate nature to which you must attend as a shareholder.

In any case, the information will not be processed for a period longer than the period established in the authorization granted by the member to use his/her personal data, counted from the time of its collection, in accordance with the legal or contractual circumstances that make it necessary to handle the information.

10. VALIDITY OF PERSONAL DATA CONTAINED IN DATABASES

The personal data provided by the specific holders previously mentioned in this ARANDA SOFTWARE ANDINA S.A.S. Personal Data Treatment Policy; will be kept as long as:

Paragraph is excluded from the data conservation time stipulated in paragraph C, that information that in its content stipulates a term longer than indicated, in accordance with a legal mandate or by an order issued by a competent authority.

11. TYPE OF TREATMENT TO WHICH THE PERSONAL DATA WILL BE SUBJECTED.

In accordance with the provisions of the Regulatory Decrees 1 , which regulate the Personal Data Processing Policies, the Data Controllers are informed that their information may be used, stored and preserved in electronic and physical media.

The storage of digital and physical information is carried out in media or environments that have adequate controls for data protection. This involves physical and computer, technological and environmental security controls in all areas of the company, both in its own facilities, computer centers and document storage sites.

In accordance with the principle of transparency, the Data Subjects have access at all times (upon written or verbal request) to the stored information, as well as, their successors who prove their quality, the representative and/or attorney-in-fact of the Data Subject, by a competent authority and by stipulation in favor of another or for another.

The purposes or purposes of their collection, storage, use and disposal are regulated in accordance with the provisions of Law 1581 of 2012, its regulatory decrees and the present Policy.

1Art. 13 - Decree 1377 of 2013.

12. DATA PROTECTION OFFICER

The company, in accordance with the international principle "Accountability" and art. 26 of decree 1377 of 2013, has appointed the administrator of ARANDA SOFTWARE ANDINA S.A.S. - SANDRA DONCEL, as the Data Protection Officer.

Role performed under the responsibilities and duties defined for the position by current regulations.

13. INTERNATIONAL TRANSFER AND TRANSMISSION OF PERSONAL DATA

Currently, the Company does not make any international transfer or transmission of personal data related to information contained in its databases. In the event that ARANDA SOFTWARE ANDINA S.A.S. requires to make such a transfer, it will verify that the destination country meets the standards that guarantee an adequate level of protection of personal data, the above in accordance with paragraph 3.2. of Chapter Three, Title V of the Sole Circular 005 of August 10, 2017 of the Superintendence of Industry and Commerce.

Additionally, in the event that
ARANDA SOFTWARE ANDINA S.A.S. performs international transmission of personal data, in addition to having the express and unequivocal authorization from the Data Subject, it will ensure that the action provides adequate levels of data protection and meets the requirements set in Colombia by the Habeas Data Regime.

On the other hand, when ARANDA SOFTWARE ANDINA S.A.S. decides to make an international transfer of data, it may do so without the authorization of the owners, provided that it guarantees the security of the information, confidentiality and the conditions that regulate the scope of data processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.

14. DATA ON CHILDREN AND ADOLESCENTS

ARANDA SOFTWARE ANDINA S.A.S. does not directly process personal data of minors; however, in particular, the Company collects and processes the personal data of the minor children of its employees, for the sole purpose of complying with the obligations imposed by law on employers in relation to affiliations to the social security and parafiscal system, as well as compliance with the family day (Law 1857 of 2017), and in particular to allow the enjoyment of the fundamental rights of children to health, recreation and the right to family.

In any case, ARANDA SOFTWARE ANDINA S.A.S. will collect when appropriate the respective authorization to their legal representatives for their treatment, always bearing in mind the best interests of the child and respect for the prevailing rights of children and adolescents enshrined in Article 44 of the Political Constitution of Colombia.

15. PROCEDURE OR PROTOCOL FOR HANDLING QUERIES, CLAIMS AND PETITIONS, AND MECHANISMS FOR EXERCISING THE RIGHTS OF THE OWNERS.

The Data Subject, his assignees, his representative and/or attorney-in-fact, or whoever is determined by stipulation in favor of another; may exercise his rights by contacting us through written communication addressed to the area in charge of the protection of personal data in the company, being the RISK MANAGEMENT AREA responsible. The communication may be sent to the following e-mail address: protecciondedatos@arandasoft.com or through written communication filed at Diagonal 97 # 17 - 60 Office 702 Bogotá D.C.

15.1 Consultations

The personal information of the Holder may be consulted in the databases of ARANDA SOFTWARE ANDINA S.A.S. and the Company will be responsible for providing all the information contained in the individual record or that is linked to the identification of the applicant.

The consultation, once received by the Company, will be answered within a maximum term of ten (10) business days. ten (10) working days from the date of receipt of the same.

When it is not possible to attend the consultation within said term, the interested party shall be informed, stating the reasons for the delay and indicating the new date on which the consultation will be attended, which in no case may exceed five (5) working days after the date of the consultation. (5) working days following following the expiration of the first term.

15.2 Claims

When it is considered that the information contained in a database of ARANDA SOFTWARE ANDINA S.A.S. should be corrected, updated or deleted, or when the alleged breach of any of the duties contained in the Law of Habeas Data is noticed, you can file a claim to ARANDA SOFTWARE ANDINA S.A.S which will be processed under the following rules:

1. The claim shall be formulated by means of a written communication addressed to ARANDA SOFTWARE ANDINA S.A.S with the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents you want to assert.

If the claim is incomplete, the interested party will be requested within five (5) days. five (5) days following the receipt of the claim to correct the faults or complete the missing documents. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

In the event that ARANDA SOFTWARE ANDINA S.A.S.receives a Claim of which it is not competent to solve it, the Company will transfer it to the person who effectively corresponds in a maximum term of two (2) working days. two (2) working days and inform the Holder.

2. Once the completed claim has been received, the Company will include in the respective database a legend that reads. "claim in process" and the reason for the claim and the reason for the claim, within a term no longer than two (2) business days. two (2) working days. The Company will keep such legend in the data under discussion until the claim is decided.

3. The maximum term to attend to the claim will be fifteen (15) working days. fifteen (15) working days from the day following the date of its receipt. When it is not possible to address the claim within such term, the Company shall inform the Holder the reasons for the delay and the new date on which the claim will be addressed, which in no case may exceed eight (8) business days. eight (8) working days following the expiration of the first term.

MINIMUM CONTENT OF THE APPLICATION

The requests submitted by the holder in order to make a query or complaint about the use and handling of their personal data must contain minimum specifications, in order to provide the holder with a clear and consistent response to the request. The requirements of the request are:

a) Be addressed to ARANDA SOFTWARE ANDINA S.A.S

b) Contain the identification of the Holder (Name and Identification Document).

c) Contain a description of the facts that motivate the consultation or complaint.

d) The object of the petition.

e) Indicate the Holder's notification address, physical and/or electronic (e- mail).

f) Attach the documents you wish to assert (especially for claims).

g) Signature, identification number or corresponding validation procedure.

In the event that the consultation or claim is submitted in person, the Holder must submit the request or claim in writing without any formality other than the requirements set forth in the previous point.

16. Procedural requirement

The Holder, his assignees, his representative and/or proxy, or whoever is determined by stipulation in favor of another; may only file a complaint before the Superintendence of Industry and Commerce for the exercise of his rights once he has exhausted the process of Consultation or Claim directly before the Company.

17. Request for update and/or rectification

ARANDA SOFTWARE ANDINA S.A.S will rectify and update, at the request of the holder, the information that is inaccurate or incomplete, according to the procedure and the terms indicated above, for which the Holder must submit the request according to the channels provided by the company, indicating the update and rectification of the data and in turn must provide documentation to support such request.

18. Revocation of Authorization and/or Deletion of Data

The Data Subject may revoke at any time the consent or authorization given for the processing of his/her personal data, as long as there is no impediment enshrined in a legal or contractual provision.

Likewise, the Holder has the right to request at any time to ARANDA SOFTWARE ANDINA S.A.S the deletion or elimination of their personal data when:

a) Consider that they are not being treated in accordance with the principles, duties and obligations set forth in the regulations in force.

b) Are no longer necessary or relevant for the purpose for which they were obtained.

c) The time necessary for the fulfillment of the purposes for which they were obtained has been fulfilled.

Such deletion implies the elimination, either in whole or in part of the personal information, as requested by the holder in the records, files, databases or treatments carried out by ARANDA SOFTWARE ANDINA S.A.S.

The right of cancellation is not absolute and therefore ARANDA SOFTWARE ANDINA S.A.S. may deny revocation of authorization or deletion of personal data in the following cases:

a) The holder has a legal or contractual duty to remain in the database.

b) The deletion of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

c
) The data is necessary to protect the legally protected interests of the holder; to perform an action in the public interest, or to comply with an obligation legally acquired by the holder.

 
19. MODIFICATION OF POLICIES

ARANDA SOFTWARE ANDINA S.A.S reserves the right to modify the Policy of Treatment and Protection of Personal Data at any time. However, any modification will be communicated in a timely manner to the holders of personal data through the usual means of contact with ten (10) working days prior to its entry into force.

In the event that a Data Subject does not agree with the new General or Special Policy and with valid reasons that constitute a just cause for not continuing with the authorization for the processing of personal data, the Data Subject may request the Company to withdraw his/her information through the channels indicated in Chapter 12. However, Data Subjects may not request the withdrawal of their personal data when the Company has a legal or contractual duty to process the data.

20. VERSION AND VALIDITY

This policy constitutes version 3.0 of the company's personal data processing policy, based on the database update process carried out by the company in compliance with External Circular 003 of 2018, i.e. the update that every company must carry out of its databases between January 2nd and March 31st of each year from 2020 onwards.


This policy is effective as of March 2023.