Personal data treatment policy
The document POLICY FOR THE PROCESSING AND PROTECTION OF PERSONAL DATA, hereinafter the Policy, of the LIFEFACTORS GROUP (which includes all companies that are part of the control situation of LIFEFACTORS SAS), hereinafter LifeFactors, was prepared with the purpose of adopting and defining the rules applicable to the processing of personal data of its clients, suppliers, employees and users, among others; so that they can know the rights that assist them and the duties of the company in the matter; and to establish the procedures applicable within it to guarantee the exercise of their rights. The foregoing, in accordance with the constitutional, legal and regulatory norms on the matter, especially articles 15 and 20 of the Colombian Political Constitution, the provisions of Law 1581 of 2012, "By which general provisions for the protection of personal data are dictated", and Decree 1377 of 2013, "By which Law 1581 of 2012 is partially regulated". This Policy regulates LifeFactors' internal procedures related to the protection of the Habeas Data right of the owners, whose personal data is stored in LifeFactors' databases and files. However, the Policy was built and designed based on constitutional, legal and regulatory standards on the matter, and is mandatory for LifeFactors, all its employees, workers, directors at all levels, and contractors, regardless of the legal or contractual relationship that unites them, provided that it involves the processing of personal data, in any of its modalities, for which LifeFactors has responsibility, in accordance with what the law establishes for this purpose.
Name and Identification of the Company. The LIFEFACTORS GROUP (which includes all the companies that are part of the control situation of LIFEFACTORS S.A.S.), hereinafter LifeFactors, is made up of the following companies: LifeFactors S.A.S. identified with NIT 901.139.763-8, domiciled in Medellín, at carrera 43 5 A 95 OF 414 TO SUR, Medellín, Antioquia, whose corporate purpose consists of: the wholesale trade of pharmaceutical, medicinal, cosmetic and toiletry products; and the manufacture of pharmaceutical products, medicinal chemical substances and botanical products for pharmaceutical use. It has a telephone contact number of 322 515 6117. LifeFactors' website can be accessed at https://lifefactors.com.co/. LifeFactors Zona Franca S.A.S., identified with NIT 901.196.927-1, domiciled in Vereda Chachafruto Zona Franca de Rionegro Bodega 137, municipality of Rionegro, whose purpose is to develop its activities exclusively in one or several free trade zones in Colombia. It has the telephone contact number 322 515 6117. LifeFactors' website can be consulted at https://lifefactors.com.co/. VITALQ S.A.S., identified with NIT 901.384.477-5, domiciled in the city of Bogotá, at Calle 26 A Nro. 13-97 Oficina 1303, whose corporate purpose is the manufacture of pharmaceutical products, medicinal chemical substances and botanical products for pharmaceutical use; and the wholesale trade of pharmaceutical, medicinal, cosmetic and toiletry products. It has a telephone contact number of 322 515 6117. LifeFactors' website can be accessed at https://lifefactors.com.co/.
3. Scope of Application. This policy and in accordance with the current regulations on personal data protection, shall apply to all personal data that are processed in the normal development of LifeFactors' corporate purpose.
5. Definitions. The following definitions allow a correct and appropriate interpretation of Law 1581 of 2012 and its regulatory rights, and are essential for the protection of Habeas Data, which helps to determine the responsibilities of those involved in the processing of personal data. Privacy Notice: Verbal or written communication generated by the responsible party, addressed to the holder for the processing of personal data, by which he/she is informed about the existence of the information processing policies that will be applicable, how to access them and the purposes of the processing that is intended to be given to personal data. Authorization: Prior, express and informed consent of the holder of the personal data to carry out the processing of personal data. Database: Organized set of personal data that is subject to processing. Personal data: Any information linked or that may be associated to one or several determined or determinable natural persons. Personal data” should be understood as information related to a natural person (person individually considered). Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to the marital status of individuals, their profession or trade, and their status as merchants or public servants. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and in duly executed court rulings that are not subject to confidentiality. Public personal data: All personal information that is freely and openly available to the general public. Private personal data: All personal information that has a restricted knowledge, and in principle private for the general public. Semi-private data: Semi-private data is data that is not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of persons or to society in general. Sensitive data: That data that affects the privacy of the holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, of human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data, among others, the capture of still or moving images, fingerprints, photographs, iris, voice, facial or palm print recognition, etc. Data processor: Natural or legal person, public or private, who by himself or in association with others, carries out the processing of personal data on behalf of the data controller. Habeas Data: Right of any person to know, update and rectify the information collected about him/her in the data bank and/or data processing. Data Protection Officer: The person within LifeFactors, whose function is to monitor and control the application of the Policy, under the guidance and guidelines of the Information Systems and Telecommunications Area. Data Controller: Natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the processing of the data. Data Controller: Natural person whose personal data is the object of processing. Transfer: The transfer of data takes place when the person responsible and/or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is responsible for the processing and is located inside or outside the country. Transmission: Processing of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia when the purpose of the processing is carried out by the processor on behalf of the data controller. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or suppression.
7. Information of the Responsible. The following data corresponds to the person responsible for the information, this natural or legal person makes the decisions on the databases and on the treatment of the data. Name: LifeFactors Zona Franca S.A.S. Identification: 901.196.927-1 Address: Vda Chachafruta zf Rionegro bg 137 E-mail: Vda Chachafruta zf Rionegro bg 137 Phone number: 322 515 6117
9. Purpose of the treatment. The authorization for the processing of personal data allows LifeFactors to collect, transfer, store, use, circulate, delete, share, update and transmit, in order to comply with the objectives established by law in accordance with the nature of LifeFactors. The treatment of personal data of individuals who have established or establish a relationship with LifeFactors, permanently or occasionally, will be carried out within the legal framework that regulates the matter. In any case, the personal data may be processed to: - - Develop LifeFactors' Mission in accordance with the bylaws. - Comply with the rules applicable to suppliers, contractors and students, including, but not limited to tax, commercial and academic. - Comply with the provisions of the Colombian legal system in labor and social security matters, among others, applicable to former employees, employees and candidates for future employment. - Conduct surveys related to LifeFactors services. - Comply with all contractual commitments. - Development of LifeFactors' activities within the framework of the corporate purpose detailed in the certificate of existence and representation of non-profit entities. - Validate the information updated by the Holder and the information collected by LifeFactors. - Consult government databases or third party companies. - Inform about the status of procedures or payments to the social security system. - Identify the holder when he/she enters a workplace where LifeFactors has control over the entry of personnel. - Store documentation as evidence of compliance with the standards required by the system of safety and health at work (SG-SST) required in each job that the holder is required to perform. - Request evaluations on the services provided by the organization and its personnel. - Send to the physical mail, email, cell phone or mobile device, via text messages (SMS and / or MMS) commercial, advertising or promotional information about products and / or services, events and / or promotions of commercial or non-commercial nature of these, in order to promote, invite, direct, run, run, inform and generally carry out campaigns, promotions or contests of commercial or advertising nature. - To make internal studies about our clients with a view to optimize the service provided by LifeFactors. - Inform about new services, related or not, with the one acquired by the Holder. - To comply with obligations contracted with the Card Holder. - Inform about changes in services. - Evaluate the quality of services. - Execute any other type of contracts subscribed with the Card Holders, in order to provide an effective service. - To contact the Holders by virtue of the existing commercial, civil or labor relationship. - Share the personal data collected with third parties that have the quality of commercial and/or business partners in order to offer products and/or services to improve the value offer to LifeFactors' customers. - To pay fees, remunerations or salaries arising from commercial, civil or labor relationships with the Holders. - Comply with the labor obligations, which arise for LifeFactors as employer, including, but not limited to: evaluation of candidates interested in becoming employees, employment, training processes, performance evaluation, social welfare and occupational health programs, issuance of labor certifications, management of resume banks and recruitment days for hiring personnel. - Manage all the necessary information for compliance with tax obligations and commercial, corporate and accounting records that may eventually fall on LifeFactors. - Comply with the obligations of prevention of money laundering and financing of terrorism. - Register the information of the Data Holders in LifeFactors' Database. - Provide the Services offered in the Website and/or mobile applications. - To make reports and meet the requirements of the different administrative control and surveillance authorities, police authorities or judicial authorities. - To carry out LifeFactors internal administrative procedures. - Statistical analysis and market research. - Transmission of information to third parties involved in the provision, production or commercialization of the products or services offered. - The creation of the personal account on LifeFactors Website. - - Protect LifeFactors' rights, in accordance with legal provisions. - Complete transactions, obtain billing data and issue invoices. - Personalize the website according to the tastes and interests of the Holders. - Sharing information through social networks and websites. - Any other purpose resulting in the development of the relationship held. We will only keep your information for as long as we are required by law or due to the relevance of the very purposes for which they were collected. You can visit the Website, the App and browse without having to provide personal data. During your visit to the Website and/or App, you will remain anonymous and at no time will we be able to identify you, unless you have an account on the Website and/or App and log in with your username and password. In advance and/or at the time of collecting the personal data, LifeFactors will request the data owner's authorization to collect and process the data, indicating the purpose for which the data is requested, using for such purposes automated, written or oral technical means, which allow to keep proof of the authorization and/or of the unequivocal conduct described in article 7 of Decree 1377 of 2013. Such authorization shall be requested for the time that is reasonable and necessary to meet the needs that gave rise to the request for the data and, in any case, in compliance with the legal provisions governing the matter.
11. Information Security. For this purpose, we have security protocols and access to information, storage and processing systems, including physical measures to control security risks. In addition, we have a perimeter security system such as firewall and first level proactive intrusion detection to keep our users' information safeguarded. Access to the different databases is restricted even for employees and collaborators. All LifeFactors employees and contractors are committed to the confidentiality and proper handling of databases in compliance with the guidelines on the treatment of information established by law.
13. Rights of the Data Subject. The holder of the personal data shall have the following rights: - - To know, update and rectify their personal data vis-à-vis those responsible for the processing or in charge of the processing. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized. -To request proof of the authorization granted to the data controller, except when expressly exempted as a requirement for the processing, in accordance with the provisions of paragraph 10 of this law. -To be informed by the data controller or data processor, upon request, regarding the use made of their personal data. - To file before the Superintendence of Industry and Commerce complaints for violations of the provisions of this law and other rules that modify, add or complement it. -To revoke the authorization and/or request the deletion of the data when the processing does not respect the principles, rights and constitutional and legal guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that in the treatment the responsible or in charge have incurred in conduct contrary to this law and the constitution. - Access free of charge to your personal data that have been subject to processing.
15. Canal de la atención de peticiones, consultas y reclamos: Cualquier petición, consulta y reclamo será atendida en los siguientes canales de atención y comunicación Responsable: LIFEFACTORS S.A.S. y LIFEFACTORS ZONA FRANCA S.A.S. Domicilio: carrera 43 5ª 95 OF 414 TO SUR, Medellin. Correo electrónico: info@lifefactors.facturas@lifefactors.co comunicacioneslfsas@lifefactors.co Teléfono: 322 515 6117
2. Legal Framework. This policy is given in compliance with Article 15 of the Political Constitution of the Republic of Colombia, Law 1266 of 2008, Law 1581 of 2012, Regulatory Decree 1727 of 2009 and 2952 of 2010, and partial Regulatory Decree 1377 of 2013. 1377 of 2013.
4. Purpose of the Policy. The purpose of this document is to adopt the policy of personal data processing, to protect the constitutional right that all holders have the right to know, update, rectify and delete the information that has been collected about the holder in the different databases or files owned by LifeFactors, or whose treatment has been entrusted to LifeFactors, and other rights, freedoms and constitutional guarantees, in accordance with Law 1581 of 2012 and its Regulatory Decree 1377 of 2013. LifeFactors in all its actions, through its business units and by all means in which information is requested, physical, electronic, virtual, telephone access, via web, among others, is committed to respecting the rights of all holders of personal data that are subject to processing. For this reason, the present Policy is adopted, which is of mandatory compliance and application in all activities involving the processing of personal data.
6. Principles for the treatment of personal data. In the development, interpretation and application of Law 1581 of 2012 by which general provisions are issued for the protection of personal data and the rules that complement, modify or add to it, the following guiding principles shall be applied in a harmonious and comprehensive manner: Access and circulation: The treatment is subject to the limits derived from the nature of the personal data, the provisions of the law and the constitution. In this sense, the processing may only be carried out by persons authorized by the owner and/or by the persons provided by law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the owners or third parties authorized by law. Confidentiality: LifeFactors is obliged to guarantee the confidentiality of the information, even after the end of its relationship with any of the tasks included in the treatment, and may only provide or communicate personal data when it corresponds to the development of the activities authorized by law. Purpose: The treatment must obey a legitimate purpose in accordance with the constitution and the law, which must be informed to the Holder. Regarding the collection of personal data, LifeFactors will limit itself to those data that are pertinent and adequate to the purpose for which they were collected or required. Legality: Data processing is a regulated activity that must be subject to the provisions of the Law and other provisions that develop it. Freedom: The treatment can only be exercised with the prior, express and informed consent of the owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that reveals consent. Security: The information subject to treatment by LifeFactors must be handled with the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized fraudulent access. Transparency: The right of the Data Subject to obtain from the data controller or data processor, at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed. Veracity or Quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. It is forbidden to process data with prior authorization, or in the absence of a legal or judicial mandate that reveals consent.
8. Processing Policy. Pursuant to the Personal Data Processing Policy, the following are the duties of LifeFactors as detailed below: - Guarantee the holder at all times, the full and effective right of Habeas Data. - To request and keep a copy of the respective authorization granted by the holder. - To duly inform the holder about the purpose of the collection and the rights he/she has by virtue of the authorization granted. - To keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. - Guarantee that the information is truthful, complete, exact, updated, verifiable and understandable. - To update the information, attending in this way all the novelties regarding the holder's data. Additionally, all necessary measures must be implemented to keep the information updated. - Rectify the information when it is incorrect and communicate the pertinent. - Respect the security and privacy conditions of the holder's information. - To process the consultations and claims formulated in the terms indicated by the Law. - Identify when certain information is under discussion by the owner. - Inform at the request of the holder on the use of their data. - Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the holder's information. - Comply with the requirements and instructions given by the Superintendence of Industry and Commerce on the particular subject. Use only data whose treatment is previously authorized in accordance with the provisions of Law 1581 of 2012. LifeFactors will use the personal data of the holder only for those purposes for which it is duly authorized and respecting in any case the current regulations on personal data protection.
10. Content of the databases. LifeFactors' databases store general information such as first and last names, type and number of identification, age, gender, department, city, neighborhood and residence address, landline and cellular phones, e-mail address. In addition to these, and depending on the nature of the database, LifeFactors may have specific data required for the treatment to which the data will be submitted. The database of employees, contractors or collaborators includes, additionally, information about labor and academic history, sensitive data required by the nature of the labor relationship (photography, filming, family group, biometric data, financial data, etc.) - Types of personal data LifeFactors collects the following Personal Data: - Name, ID number, home address, telephone, physical or postal address, email, and contact information. - Nationality, date of birth, citizenship card, gender and marital status. - Occupation, company where you work, position and contact information. - Information that is sent to us or consulted through databases of social networks, among other means where you have included your Personal Data. - IP address and browser type when obtained by electronic means. - Information obtained by cookies, web beacons and web crawlers. Page 12 of 12 - Financial information. - Any information necessary to fulfill special requests. - Information you provide in connection with your business preferences or in the course of participating in surveys, contests or promotional offers. - Images, recordings, photographs. - Personal Data that is considered to be of a sensitive nature.
12. Modification of the Personal Data Processing Policy. The data processing policy shall be modified every time a representative change is generated that must be made available to the right holders. Each time it is updated, the modified document shall be published in LifeFactors website https://lifefactors.com.co/.
14. Rights of Children and Adolescents. In the treatment, it is ensured that respect for the rights of children and adolescents are prevalent. The processing of personal data of children and adolescents is prohibited, except for data of a public nature. It is the task of the State and educational entities of all kinds to provide information and train legal representatives and guardians on the possible risks faced by children and adolescents regarding the improper processing of their personal data, and to provide knowledge about the responsible and safe use by children and adolescents of their personal data, their right to privacy and protection of their personal information and that of others.
16. Procedure for the Holders of the information to exercise the rights to know, update, rectify and delete information and revoke the authorization. The owners of the personal data being processed in the different databases of LifeFactors may use any of the following methods of communication described and detailed below in order to access the rights to know, update, rectify, rectify, delete information and revoke the authorization granted by the quality of Owner: Telephone Call: 322 5156117 Sending Letter: Vereda Chachafruta ZONFA FRANCA de Rionegro bg 137, Rionegro-Antioquia. E-mail: info@lifefactors.co; facturas@lifefactors.co comunicacioneslfsas@lifefactors.co Personalized attention by the Responsible or Responsible for the Treatment of information at the address Vda Chachafruta Zona Franca de Rionegro bg 137, Rionegro-Antioquia. In each communication, the Holder must register the following information in order to provide a solution to the request: * - Full names of the holder. * Identity document (original). * Identity document (legible copy). * Residence address. * City of residence. * Telephone landline. * Cell phone. * E-mail address. * Description of the request about the right(s) you wish to access regarding the processing of personal data. The petition, complaint or claim must contain the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying documents to be asserted. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned. In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation. Once the complete claim has been received, a legend will be included in the database stating “claim in process” and the reason for the claim, within a term not exceeding two (2) business days. Such legend shall be maintained until the claim is decided. The maximum term to address the claim shall be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.
17. Validity. This policy is effective from the date of its publication in the official gazettes. May 19, 2021.