PERSONAL DATA PROTECTION AND PROCESSING POLICIES AND PROCEDURES MANUAL, INCLUDING THE HANDLING OF REQUESTS, INQUIRIES, AND COMPLAINTS, IN ACCORDANCE WITH LAW 1581 OF 2012 AND SOLE REGULATORY DECREE 1074 OF 2015
I. PURPOSE.
This policy is issued in compliance with Law 1581 of 2012 and Sole Regulatory Decree 1074 of 2015, which govern the protection of personal data. Its purpose is to ensure that Crosettes, in its capacity as the entity responsible for processing personal data, processes such data in strict compliance with applicable regulations while safeguarding the rights of data subjects.
II. DATA CONTROLLER.
Name: Crosettes
Email: info@crosettes.com
Telephone: (+57) 3005656745
III. PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA.
In the development, interpretation, and application of this policy, the following principles shall be applied harmoniously and comprehensively:
1. Principle of Legality in Data Processing: The processing covered by this policy is a regulated activity and must comply with the provisions established by law and any other regulations implementing it.
2. Principle of Purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the law, which must be communicated to the Data Subject.
3. Principle of Freedom: Processing may only be carried out with the Data Subject's prior, express, and informed consent. Personal data may not be obtained or disclosed without prior authorization, unless there is a legal or judicial order that waives the consent requirement.
4. Principle of Accuracy or Data Quality: Information subject to processing must be truthful, complete, accurate, up to date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.
5. Principle of Transparency: The Data Subject's right to obtain information from the Data Controller or Data Processor regarding the existence of personal data concerning them must be guaranteed at any time and without restrictions.
6. Principle of Restricted Access and Circulation: Processing is subject to the limitations arising from the nature of personal data and the provisions of the law and the Constitution. Accordingly, processing may only be carried out by persons authorized by the Data Subject and/or by persons legally authorized to do so.
Except for publicly available information, personal data may not be made available on the Internet or through other mass-distribution or communication channels, unless access can be technically controlled to restrict it to Data Subjects or third parties authorized in accordance with the law.
7. Principle of Security: Information processed by the Data Controller or Data Processor must be handled using the necessary technical, human, and administrative measures to safeguard records and prevent their alteration, loss, consultation, use, or unauthorized or fraudulent access.
8. Principle of Confidentiality: All persons involved in processing personal data that is not publicly available must maintain the confidentiality of such information, even after their relationship with any activity involving its processing has ended. Personal data may only be disclosed or communicated when necessary for the performance of activities authorized by law.
IV. PROCESSING OF PERSONAL DATA AND ITS PURPOSES.
In the course of its business activities, Crosettes processes the personal data of users of its platforms, clients, affiliates, employees, staff members, and suppliers. Such processing is carried out directly by Crosettes, through its employees or staff members, or by contractors or agents entrusted with these activities.
Crosettes may also share personal data with third parties located in Colombia and abroad with whom it enters into a Personal Data Transfer and/or Transmission Agreement, as applicable, in order to maintain data security and protection in accordance with applicable rules and standards. In all cases, Crosettes shall require Data Processors to respect the applicable security and privacy conditions governing the Data Subject's information at all times.
In the event of a sale, merger, spin-off, consolidation, change in corporate control, substantial asset transfer, global asset transfer, reorganization, or liquidation of Crosettes, Crosettes may, at its discretion and under any legal arrangement, transfer, transmit, sell, or assign the personal data collected to any third party or to one or more relevant parties. In accordance with this policy, Data Subjects expressly and unequivocally authorize the transfer, transmission, sale, or assignment of any and all of their personal data to any person located in Colombia and/or abroad.
Crosettes is obligated to maintain the confidentiality of the personal data it processes and may only disclose such data upon an express request from supervisory and regulatory entities or authorities legally empowered to request it. Crosettes shall also allow Data Subjects, at all times and free of charge, to access, update, and correct their personal information in accordance with Article 8 of Law 1581 of 2012.
In accordance with the principle of purpose limitation, Crosettes shall only collect personal data that is relevant and appropriate for fulfilling the purposes set forth in this policy. Except in cases expressly provided for by law, personal data may not be collected without the Data Subject's authorization.
The following personal data may be collected, among other information: first and last names, telephone and mobile numbers, email addresses, physical addresses, images, contact details of guardians and students, and employment and academic certificates of guardians.
The processing of personal data includes its collection, storage, administration, use, transfer, transmission, and destruction, as permitted by law, and is carried out for the following specific purposes:
1. To maintain constant and effective communication with users of our platforms, clients, affiliates, employees, staff members, suppliers, and any other persons whose personal data we are authorized to process.
2. To offer and promote Crosettes' products and services, or those of companies legally affiliated with Crosettes, through any means.
3. To invite individuals to events organized by Crosettes, affiliated companies, and third parties; organize contests; and award prizes.
4. To develop joint commercial activities with affiliated or partner companies and entities.
5. To maintain records of petitions, complaints, and claims submitted by platform users, clients, and affiliates in connection with the company's activities.
6. To retain information relating to compliance with Quality Policies.
7. To enable the identification of and relationships between different individuals through platforms operated by Crosettes.
8. To conduct statistical, demographic, and market analyses.
9. To prepare academic and journalistic studies and publications related to Crosettes' activities and the market it serves.
10. To fulfill Crosettes' legal and other applicable obligations.
11. To pursue any other purpose appropriate to the relationship established between the Data Subjects and the company.
V. PROCESSING OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS.
In compliance with Article 7 of Law 1581 of 2012 and Article 2.2.2.25.2.9 of Decree 1074 of 2015, the personal data of children and adolescents shall only be processed for the purposes described above when the data is publicly available or when such processing meets the following conditions and requirements:
1. It must respond to and respect the best interests of children and adolescents.
2. It must ensure respect for their fundamental rights.
3. Authorization for the processing of the personal data of children and adolescents must be granted by one of their legal representatives.
The legal representative shall ensure that the minor has the opportunity to be heard before authorization is granted and shall consider the minor's opinion in light of their maturity, autonomy, and ability to understand the matter.
For these purposes, Crosettes, its employees, staff members, and Data Processors shall ensure that the processing of minors' personal data serves their best interests and respects their fundamental rights.
The Data Controller and Data Processor responsible for processing the personal data of a child or adolescent shall ensure that the data is used appropriately and shall apply the principles and obligations established in Law 1581 of 2012 and its implementing regulations.
VI. PROCESSING OF SENSITIVE DATA.
Pursuant to Article 5 of Law 1581 of 2012, sensitive data is defined as “data that affects the privacy of the Data Subject or whose improper use may result in discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or organizations that promote the interests of any political party or guarantee the rights and protections of opposition political parties, as well as data relating to health, sexual life, and biometric information.”
None of the data intended to be processed is classified as sensitive data.
However, if the collection of sensitive data becomes necessary to fulfill any of the purposes set forth in this policy, the person responsible for collecting such data shall inform the Data Subject that answering questions concerning sensitive data is optional. Such data shall only be processed once the Data Subject has provided explicit authorization.
The Data Subject is not required to provide sensitive data. Accordingly, any response to questions involving sensitive data shall be entirely voluntary.
No employee, staff member, or representative of the Data Controller or Data Processor is authorized to require the Data Subject to disclose their own sensitive data or that of third parties.
VII. RIGHTS OF DATA SUBJECTS.
Data Subjects or their legal successors shall have the following rights:
1. To receive information regarding: (i) the processing to which their personal data will be subject and its purpose; (ii) the voluntary nature of responses to questions involving sensitive data; (iii) their rights as Data Subjects; and (iv) the identity, physical or electronic address, and telephone number of the Data Controller.
2. To obtain information from the Data Controller or Data Processor, at any time and without restrictions, regarding the existence of personal data concerning them.
3. To be informed by the Data Controller or Data Processor, upon request, about how their personal data has been used.
4. To request proof of the authorization granted to the Data Controller, except where such authorization is expressly not required for processing under Article 10 of Law 1581 of 2012.
5. To ensure that their personal data is not disclosed without prior authorization, except where a legal or judicial order waives the consent requirement.
6. To receive, free of charge, all information contained in their individual record or linked to their identification, whenever they or their legal successors request it through the channels established by the Data Controller or Data Processor.
7. To access their personal data and exercise their rights concerning such data through the mechanisms established by the Data Controller or Data Processor.
8. To consult their personal data free of charge: (i) at least once per calendar month; and (ii) whenever substantial changes are made to the data processing policies, using the mechanisms established by the Data Controller or Data Processor.
9. To receive responses to all inquiries concerning their personal data within the legally established time limits and, in any event, within a period not exceeding fifteen (15) business days, as provided for in Article 14 of Law 1581 of 2012.
10. To receive responses to all complaints concerning their personal data within the legally established time limits and, in any event, within a period not exceeding twenty-three (23) business days, as provided for in Article 15 of Law 1581 of 2012.
11. To request the updating and/or correction of their personal data from the Data Controller or Data Processor.
12. To revoke their authorization and/or request the deletion of their personal data through the petitions, complaints, and claims procedures established by the Data Controller or Data Processor. The Data Subject may not revoke authorization and/or request deletion when they have a legal or contractual obligation to remain in the database.
13. To be informed of any substantial change concerning the identity of the Data Controller or the purpose of processing, before or, at the latest, when the new policies are implemented.
14. To file complaints with the competent authorities regarding violations of the law.
VIII. PROCEDURE FOR THE EXERCISE OF DATA SUBJECTS' RIGHTS.
Data Subjects must direct their requests or complaints to the email address servicioalcliente@maestrik.co or submit them in person at the company's offices nationwide. For this purpose, they may use the Personal Data Processing Requests and Claims Form.
1. Procedure for requests and inquiries
Crosettes must respond to requests and inquiries within ten (10) business days from the date the request is received. If it is not possible to meet this deadline, the interested party must be informed of the reasons for the delay and the date on which the request or inquiry will be addressed. This extension may not exceed five (5) additional business days following the expiration of the initial deadline.
2. Procedure for complaints
Any Data Subject or legal successor who believes that information contained in a database should be corrected, updated, or deleted, or who identifies a potential breach of any obligation established by law or this Policy, may submit a complaint to Crosettes, which shall be processed in accordance with the following rules:
a. The complaint must be submitted through a request addressed to the Personal Data Protection and Processing Office, either at its physical address or via the email address servicioalcliente@maestrik.co. It must include the Data Subject's identification, a description of the facts giving rise to the complaint, an address, and any supporting documents the complainant wishes to submit.
If the complaint is incomplete, the interested party shall be asked to correct the deficiencies within five (5) days following receipt. If two (2) months elapse from the date of the request for additional information without the requester providing the required information, the complaint shall be deemed withdrawn.
b. Once a complete complaint has been received, a notation stating “complaint under review,” together with the reason for the complaint, shall be entered into the database within a maximum of two (2) business days. This notation must remain in place until the complaint has been resolved.
c. The maximum period for responding to a complaint shall be fifteen (15) business days, counted from the day following receipt. If it is not possible to respond within this period, the interested party shall be informed of the reasons for the delay and the date on which the complaint will be addressed. In no case may this extension exceed eight (8) additional business days following the expiration of the initial deadline.
3. Procedure for revoking authorization and/or requesting data deletion
Data Subjects may, at any time, request that Crosettes delete their personal data and/or revoke the authorization granted for its processing by submitting a complaint in accordance with Article 15 of Law 1581 of 2012, Article 2.2.2.25.2.6 of Decree 1074 of 2015, and the procedure established in this Policy.
If Crosettes has not deleted the personal data upon expiration of the applicable legal deadline, the Data Subject shall be entitled to request that the Superintendence of Industry and Commerce order the revocation of the authorization and/or the deletion of the personal data.
Notwithstanding the foregoing, pursuant to Articles 2.2.2.25.2.6 and 2.2.2.25.2.8 of Decree 1074 of 2015, requests for data deletion and revocation of authorization shall not be granted when the Data Subject has a legal or contractual obligation to remain in the database.
IX. TEMPORARY LIMITATIONS ON THE PROCESSING OF PERSONAL DATA
MAESTRIK S.A.S. may only collect, store, use, or circulate personal data for a period that is reasonable and necessary in accordance with the purposes that justified its processing, taking into account the applicable regulations governing the relevant subject matter and the administrative, accounting, tax, legal, and historical considerations associated with the information.
Once the purpose or purposes of processing have been fulfilled, Crosettes or the Data Processor, as applicable, shall proceed to delete the personal data in their possession. Notwithstanding the foregoing, personal data must be retained whenever required to fulfill a legal or contractual obligation.
X. EFFECTIVE DATE AND DURATION
The database shall remain in effect indefinitely.
This Policy shall enter into force on August 1, 2017.