Privacy Policy

This Data Processing Policy is based on Articles 15 and 20 of the Political Constitution, as well as Articles 17(k) and 18(f) of Statutory Law 1581 of 2012 and Article 13 of Decree 1377 of 2013, which partially regulates the law.

This policy applies to all personal data stored in databases subject to processing by CBL SOLUTIONS S.A.S. (hereinafter referred to as “the Company”), to ensure compliance with current personal data protection regulations in Colombia.

DEFINITIONS

Authorization: Prior, express, and informed consent given by the data subject for the processing of their personal data.
Privacy Notice: Verbal or written communication from the data controller to the data subject, informing them about the applicable data processing policies, how to access them, and the purposes for which their data will be processed.
Database: An organized set of personal data subject to processing.
Personal Data: Information that is linked to or can be associated with an identified or identifiable natural person.
Sensitive Data: Data that affects the privacy of the data subject or whose misuse may result in discrimination, such as information about racial or ethnic origin, religious beliefs, health, sexual orientation, and biometric data.
Data Subject: A natural person whose personal data is processed.
Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

AUTHORIZATION FOR DATA PROCESSING

According to Article 9 of Law 1581 of 2012, the processing of personal data requires the prior, informed authorization of the data subject, except in cases established by law, such as:

• Public data.
• Medical or health emergencies.
• Historical, statistical, or scientific purposes.
• Information related to the Civil Registry.

By accepting this policy, the data subject consents to the processing of their personal data by CBL SOLUTIONS S.A.S. under the terms described herein.

DATA CONTROLLER

CBL SOLUTIONS S.A.S.

• Address: Carrera 90 No. 65 C10.
• Email: sara@cblsolutions.com.
• Phone: +57 322 536 7349.

PROCESSING AND PURPOSES

CBL SOLUTIONS S.A.S. processes personal data for legitimate purposes, in compliance with the Constitution and the law. Each database is registered with the Superintendence of Industry and Commerce and complies with the specific purposes described in this policy.

BROWSING DATA

Technological tools necessary for the proper functioning of our websites collect certain personal data implicitly through Internet communication protocols, such as IP address, URL, access date and time. This data is immediately deleted after verification and is used solely for statistical and technical purposes.

RIGHTS OF DATA SUBJECTS

In accordance with Article 8 of Law 1581 of 2012 and Articles 21 and 22 of Decree 1377 of 2013, data subjects have the following rights:

1. Consultation: The right to request information about their data from the data controller.
2. Rectification: The right to correct incomplete, incorrect, or unauthorized data.
3. Deletion: The right to request the deletion of data that is inappropriate or excessive.
4. Revocation: The right to revoke consent for data processing.
5. Filing Complaints: The right to submit complaints to the Superintendence of Industry and Commerce regarding breaches of data protection laws.

DATA PROTECTION CHANNELS AND PROCEDURES

Inquiries: Data subjects or their representatives may request information about their data through the contact channels provided, upon verification of identity.

Claims: Data subjects may submit requests for correction, updating, deletion, or revocation of data processing consent through the defined channels and procedures in this policy.

SECURITY MEASURES

CBL SOLUTIONS S.A.S. ensures the security of personal data by implementing technical, human, and administrative measures to prevent unauthorized or fraudulent access. These include confidentiality agreements, access controls, and staff training.

TRANSFER OF DATA TO THIRD COUNTRIES

The transfer of personal data to countries that do not provide adequate data protection levels is prohibited, except in cases such as express authorization from the data subject, international treaties, or legal obligations.

VALIDITY

This Data Processing Policy is effective as of October 29, 2024. Databases will remain valid as long as the data is required for the purposes described in this policy. Once the purposes are fulfilled, and there is no legal or contractual obligation to retain the information, the data will be deleted from our databases.