Policies for processing personal information

This document contains the policy for processing information and personal data applied by RACAFE & CIA S.C.A. which regulates the collection, storage, use, circulation, transference and elimination of the data collected by RACAFE & CIA S.C.A (hereinafter the “Company”) according to the provisions contained in Statutory Law 1581 issued in 2012, and Decree 1377 of 2013, through which general provisions are enacted for the protection of personal data.

1. Information of the party responsible for processing personal information.

The Company responsible for processing personal data is:
• Corporate name: RACAFE & CIA S.C.A.
• Domicile: BOGOTÁ
• Address: CARRERA 11 No. 82 - 01 Piso 5
• Email: entoficiales@racafe.com
• Telephone: 6118700

2. Processing personal data and object
The personal data you provide to us are collected, stored, organized, used, circulated, transmitted, transferred, updated, corrected, eliminated, and managed according to the following objects: (i) expand commercialization offers and publish products and services that could be of interest to you; (ii) personalize and improve our products and services; and (iii) statistical, fiscal, accounting and legal use of the Company.
Any information you provide to us will be processed according to the applicable legislation and will only be used according to the limits established in this document.

3. Processing sensible data
The Company will strictly observe the legal limitations regarding processing sensible data; therefore, it will make sure that:

a) The Owner has given explicit authorization to said processing, with the exception of the cases in which by law granting said authorization is not required.

b) Processing is necessary to protect the vital interest of the Owner and the latter is physically or legally disabled. In said events, the legal representatives must grant authorization.

c) Processing is conducted in the course of the legitimate activities and with the due warranties provided by a foundation, NGO, association or any other non-profit entity, whose object is political, philosophical, religious or union, provided they exclusively refer to their members or to the individuals that maintain regular contact as a result of their object. In such events, the data may not be provided to third parties without authorization from the Owner.

d) Processing refers to data necessary for the acknowledgement, exercise or defense of a right in a legal process.

e) Processing has a historical, statistical or scientific object. In such event, measures leading to the elimination of identity of the Owners must be adopted.

4. Video-surveillance

The Company uses diverse means of video-surveillance installed in different places of its premises or offices.

The information collected will be used for the security of the individuals, assets and premises. This information may be used as evidence in any type of process regarding any authority and organization.

5. Processing personal data of girls, boys and/or adolescents

Processing personal data of boys, girls and/or adolescents that are of public nature must satisfy the following parameters and requirements:

a) It must respond and respect the higher interest of boys, girls and adolescents.
b) It must ensure the respect of their fundamental rights.
c) It must assess the opinion of the minor whenever the latter has the maturity, autonomy and capacity to understand the subject.

Having satisfied the above requirements, the legal representative of the boy, girl or adolescent may grant the authorization for processing, prior exercise of the right of the minor of his/her right to being heard, opinion which must be assessed considering the maturity, autonomy and capacity to understand the subject.

6. Rights as Owner of the data

According to what has been established in article 8 of Law 1581 of 2012 and Decree 1377 of 2013, the Owner of the personal data has the following rights:
a) Acknowledge, update and correct the personal data regarding the Company, as the one responsible of processing. This right may be exercised regarding partial, inexact, incomplete, fractioned data that induce into error or those whose processing is expressly prohibited or which has not been authorized.

b) Request evidence of the authorization granted to the Company, as the one responsible of processing, except when it is expressly excluded as requirement for processing, according to what has been established in article 10 of Law 1581 of 2012 (or in the norms that regulate, add, complement, modify or revoke it), or when the continuity of processing has arisen according to what has been provided in clause 4A of article 10 of Decree 1377 of 2013.

c) Be informed by the Company, prior application, regarding the use given to the personal data;

d) File with the Superintendence of Industry and Trade claims for infringement of what has been provided in Law 1581 of 2012, after exhausting the proceeding for enquiry or claim with the Company.

e) Revoke the authorization and/or apply for the elimination of the data when the principles, rights and constitutional and legal warranties are not observed. The revocation and/or elimination will proceed when the Superintendence of Industry and Trade has determined that the Company has incurred when processing in behaviors contrary to the legislation and the Constitution.

f) Have free access to the personal data that has been object of processing.

7. Responsible area for attending petitions, enquiries and claims.

The Customer Service area of the Company will be responsible for dealing with petitions, enquiries, claims, complaints or exercising the rights of the Owner of the personal information.

8. Procedure to exercise the rights of the Owner of the data.

8.1 Access and enquiry procedure

The Owner of the data, or its successors or assignees, may enquire the information that rests on the data bases possessed by the Company, for which purpose they must formulate the corresponding petition, in writing, and file it with the responsible area according to the above clause, from Monday to Friday from 7:30 a.m. to 5:00 p.m. at Carrera 11 No. 82-01, Fifth Floor, in the city of Bogotá.

To avoid that non-authorized third parties access the personal information of the Owner of the data, the identification of the Owner must be previously established. When the application is formulated by other than the Owner and it is not certified that the said individual acts in representation of the latter, it will be considered as not filed.

The enquiry will be answered within a maximum term of ten (10) working days counted as of the date of reception. If it is not possible to answer the enquiry within said term, the interested party will be informed of the reasons for the delay and the date in which the enquiry will be satisfied, which under no circumstance may exceed five (5) working days after the expiration of the first term.

8.2 Procedure to apply for updating, correction, elimination, revocation of the authorization or for filing claims

The Owner, or its successors or assignees, that consider that the information contained on the data bases of the Company must be object of correction, updating or elimination, or when aware of the assumed non-compliance with any of the duties contained in this law, may file a claim with the Company, which will be processed under the following rules, according to article 15 of Law 1581 of 2012:

a) The claim will be formulated through application filed with the responsible area of the Company from Monday to Friday from 7:30 a.m. to 5:00 p.m., at Carrera 11 No. 82-01, Fifth Floor, in the city of Bogotá.

b) To avoid that non-authorized third parties access the personal information of the data Owner, the identification of the Owner must be previously established. When the application is formulated by an individual different from the Owner and it is not certified that the former acts in representation of the latter, it will be considered as not filed.

c) The application must contain at least the following information:

(i) Identification of the Owner
(ii) Contact data (physical and/or electronic address and telephone numbers)
(iii) The documents that certify the identity of the Owner, or the representation of its representative
(iv) Clear and precise description of the personal data regarding which the Owner intends to exercise any of his rights
(v) The description of the facts that originate the claim
(vi) The documents that want to be asserted
(vii) Signature, identification number and fingerprint
(viii) Filing the original documents

d) If the claim is incomplete, the Company will request the interested party within the five (5) days following the reception of the claim to correct the failures. After two (2) months have elapsed as of the date of the requirement, without applicant filing the information requested, it will be understood that the claim has been abandoned.

e) If the area that receives the claim is not competent to solve it, it will transfer it to the corresponding area within a maximum term of two (2) working days and the interested party will be informed of the situation.

f) After receiving the complete claim, a legend will be included on the data base saying that said claim is in process and the reason thereof, within a term not exceeding two (2) working days. Said legend must be maintained until the claim has been solved.

g) The maximum term to solve the claim will be fifteen (15) working days counted as of the day following its reception. If it is not possible to solve the claim within said term, the reasons for the delay and the date in which the claim will be solved will be informed to the interested party, which under no circumstance may exceed eight (8) working days following the expiration of the first term.

8.3 Elimination of Data

The Owner has the right, at any time, to request the Company the elimination of its personal data when:

a) The Owner considers that the data is not being processed according to the principles, duties and obligations provided in Law 1581 of 2012.

b) They are no longer necessary or pertinent for the object for which they were collected.

c) The period necessary for compliance of the objects for which they were collected has been exceeded.

This elimination implies the total or partial elimination of the personal information according to what has been applied for by the Owner regarding the registers, files, data bases or processing conducted by the Company.

It is important to take into consideration that the right of cancelation is not absolute and the responsible party may reject the exercise thereof when:

a) The application of elimination of information is not appropriate when the Owner has a legal or contractual obligation of remaining on the data base.

b) The elimination of data obstructs judicial or administrative actions regarding fiscal obligations, investigation and persecution of crimes or updating administrative sanctions.

c) The data are necessary to protect the legally protected interests of the Owner, to conduct an action regarding public interest, or to satisfy an obligation legally acquired by the Owner.

8.4 Revocation of the Authorization

The Owner of the personal data may revoke the consent to processing its personal data at any time, provided a legal provision does not prevent thereof.

9. Duration of the Policy

The policy governs as of the terms established in Decree 1377 of 2013.

As a general rule the term of the authorizations regarding the use of personal data is understood for the term of the commercial relationship or entailment to the service and during the exercise of the corporate object of the Company.

Modifications of our Privacy Policies / Legal Notes

The Company retains the right, at its discretion, to modify, alter, add or eliminate parts of these Privacy Policies / Legal Notes at any time. It is advised to examine this policy each time the web page of the Company, www.racafe.com, is visited.