Data Policy
1. INTRODUCTION
In compliance with the provisions of Law 1581 of 2012 and its regulatory decrees, Somos Martina S.A.S, as the entity responsible for processing the information contained in its databases, adopts the following policies aimed at ensuring the protection of information and safeguarding the rights of its holders. Somos Martina S.A.S collects, stores, uses, manages, transfers, and transmits personal data from third parties in its capacity as clients, users, suppliers, contractors, and partners.
2. PRINCIPLES
The processing of databases will adhere to the principles established in Article 4 of Law 1581, which are as follows:
a) Principle of legality in data processing: The processing of databases is a regulated activity that must comply with the provisions of the Law and other regulations that develop and complement it.
b) Principle of purpose: The processing must pursue a legitimate purpose in accordance with the Constitution and the Law, which will be informed to the data subject in all cases.
c) Principle of freedom: Processing will only be carried out with the prior, express, and informed consent of the data subject. Personal data cannot be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate that waives the need for consent.
d) Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.
e) Principle of transparency: The data subject's right to obtain, at any time and without restrictions, information about the existence of data concerning them from the data controller or data processor must be guaranteed.
f) Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of personal data and the provisions set forth in the Law and the Constitution. Processing may only be carried out by individuals authorized by the data subject or as expressly provided by Law. Personal data, except for public information, cannot be available on the internet or other mass dissemination or communication media unless access is technically controllable to provide restricted knowledge solely to the data subject or authorized third parties according to the Law.
g) Principle of security: Information subject to processing by the data controller or processor must be handled with the necessary technical, human, and administrative measures to ensure the security of records, preventing their alteration, loss, unauthorized consultation, use, or fraudulent access.
h) Principle of confidentiality: All individuals involved in the processing of personal data, except for those of a public nature, are obliged to maintain the confidentiality of the information, even after their relationship with any of the activities involved in the processing has ended. Personal data may only be disclosed or communicated when it pertains to the execution of authorized activities.
3. RIGHTS OF DATA SUBJECTS
In accordance with Article 8 of Law 1581 of 2012, data subjects have the following rights:
a) To know, update, and rectify their personal data with the data controllers or processors. This right may be exercised, among other cases, regarding partial, inaccurate, incomplete, or fragmented data, data that may lead to errors, or data whose processing is expressly prohibited or has not been authorized.
b) To request proof of the authorization granted to the data controller, except in cases where authorization is explicitly not required for processing, as stipulated in Article 10 of the Data Protection Law.
c) To be informed by the data controller or processor, upon prior request, about the use that has been made of their personal data.
d) To file complaints with the Superintendence of Industry and Commerce for violations of the provisions of the law.
e) To revoke authorization or request the deletion of data.
f) To access, free of charge, their personal data that has been processed.
4. DUTIES OF SOMOS MARTINA S.A.S. REGARDING THE PROCESSING OF PERSONAL DATA
a) Guarantee the full and effective exercise of the right of habeas data to the data subject.
b) Keep a record of the authorization granted by the data subject.
c) Properly inform the data subject about the purpose of data collection and the rights they have.
d) Store the information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
e) When applicable, ensure that the information provided to the data processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
f) Update the information and adopt necessary measures to keep it current.
g) Correct inaccurate information and communicate the corrections to the data processor.
h) Address queries and complaints submitted by data subjects.
i) Inform data subjects, upon request, about the use of their data.
j) Notify the data protection authority of security breaches and risks affecting the management of data subjects' information.
5. AUTHORIZATIONS
The processing of personal data by Somos Martina S.A.S. requires the free, prior, and informed consent of the data subject, either explicitly or through an unequivocal act, unless the data is public. Therefore, Somos Martina S.A.S., in its capacity as the entity responsible for processing personal data, will establish the necessary mechanisms to obtain the consent of the data subjects, ensuring in all cases that it is possible to verify that such consent was granted. The authorization must be retained to guarantee its availability for future consultation.
In any case, the consent must be provided by the CLIENT company, and it must be verifiable that the client understands and accepts that Somos Martina S.A.S. collects and uses the information for the purposes previously communicated before the authorization is granted.
If the requested data is sensitive, Somos Martina S.A.S. must inform the data subject that they are not obligated to authorize the processing of such data.
The data subject's consent will not be required in the following cases:
- Personal data available in publicly accessible sources, such as public records, public documents, official gazettes and bulletins, and duly executed judicial rulings that are not subject to confidentiality.
- Data related to a person's marital status.
- Data referring to profession or occupation.
- Data regarding the status of a merchant or public official.
6. POLICY AND PROCEDURES FOR INQUIRIES AND COMPLAINTS
a) The operations department of Somos Martina S.A.S is responsible for handling requests, inquiries, and complaints from data subjects. This department will coordinate data processing with the respective areas responsible for the organization's internal databases.
b) Procedure for data subjects to exercise their rights:
Data subjects may, at any time, submit inquiries and request the removal, update, correction, and/or deletion of their data in accordance with the provisions of Law 1581 of 2012 by emailing: [email placeholder].
The rights of data subjects may be exercised by the following authorized persons, in accordance with Article 20 of Decree 1377 of 2013:
a) The data subject, who must adequately prove their identity.
b) Their successors, who must prove this status.
c) The representative or attorney-in-fact of the data subject, upon prior verification of representation or power of attorney.
d) A stipulation in favor of or for another party.
The request must include the following information:
Full name
Telephone number
Email address
Phone number
Deadlines for handling requests:
Requests submitted by data subjects or authorized persons must be resolved within a maximum of ten (10) business days from the date of receipt. If it is not possible to respond within this period, the data subject will be informed of the reasons for the delay and the date on which the inquiry will be addressed, which may not exceed five (5) additional business days after the initial deadline.
Deadlines for handling complaints:
Complaints will be addressed within a maximum of fifteen (15) business days from the day following the date of receipt. If it is not possible to address the complaint within this period, the data subject will be informed of the reasons for the delay and the date on which the complaint will be resolved, which may not exceed eight (8) additional business days after the initial deadline.
7. PROCESSING, PURPOSE, AND DURATION OF DATABASES
The databases currently subject to processing by Somos Martina S.A.S. include clients, users, and suppliers.
The data of the holders stored in these databases will only be used for the following purposes:
- For the form on the Somos Martina website where personal information is requested.
- Analysis of sociodemographic information, both aggregated and individual.
- Use of information for the commercial department of Somos Martina S.A.S.
- Compliance with legal obligations, particularly those of a labor nature.
The data will be retained for a period aligned with its intended purpose.
8. MODIFICATIONS OR UPDATES
If any substantial changes are made to the data processing policies, such changes will be promptly communicated to the data subjects. When the change relates to the purpose of the processing, a new authorization will be obtained from the data subject.
9. CONTACT INFORMATION OF THE PERSONAL DATA CONTROLLER
- Name: Somos Martina S.A.S.
- Location: Bogotá
- Address: Calle 87 # 12-70
- Email: info@somosmartina.com
- Phone: +57 314 8095939