Privacy Policy of Treatment of Personal Data of Information Users of the Red Latinoamericana de Inversión y Filantropía Estrategica [Latimpacto]

This Personal Data Protection Policy (hereinafter the "Policy") regulates the collection, storage, use, circulation and deletion (hereinafter the "Treatment") of Personal Data carried out by [Red Latinoamericana de Inversión y Filantropía Estrategica] (hereinafter “Latimpacto”), identified with NIT [901.367.590-8], in accordance with the provisions contained in Statutory Law 1581 of 2012, Decree 1074 of 2015 and other applicable regulations, through the which general provisions for the protection of Personal Data are dictated.

This Personal Data Treatment Policy is mandatory and strictly observed by all Latimpacto employees and contractors and third parties acting on behalf of Latimpacto. All Latimpacto employees must observe and respect this Policy in the performance of their duties. In cases where there is no employment relationship, a contractual clause must be included so that those who act on behalf of Latimpacto are obliged to comply with this Policy.

Failure to comply with this Policy will lead to labor-related sanctions or contractual liability, as appropriate. The foregoing, without prejudice to the duty to respond patrimonially for the damages caused to the Holders of the data and / or to Latimpacto for the breach of the Policy or the improper Treatment of Personal Data.

1. Information of the Person Responsible for the Treatment of personal information

The person responsible for the treatment of personal data is:

  • Legal Name: [Red Latinoamericana de Inversión y Filantropía Estrategica]

  • Address: [_Bogotá, Colombia]

  • Address: [cl 123 7 07 of 403, Bogota, Colombia]

  • Telephone: [3156106491],

  • Email: [comunidad@latimpacto.org]

Latimpacto, as Data Controller will comply with the duties established by article 17 of Law 1581 of 2012.

2. Definitions

The following are the defined terms that will be used in this Personal Data Protection Policy, in accordance with the provisions of Law 1581 of 2012, Decree 1074 of 2015 and other applicable regulations:

  • Authorization: Prior, express and informed consent of the Owner to carry out the Processing of Personal Data.

  • Database: Organized set of Personal Data that is subject to Treatment.

  • Personal Data: Any information linked or that may be associated with one or more determined or determinable natural persons.

  • Public Data: Public Data is considered, among others, data related to the civil status of people, their profession and trade and their status as a merchant or public servant. By their nature, Public Data may be contained, among others, in public records, public documents, gazettes and official gazettes and duly executed judicial decisions that are not subject to reservation.

  • Responsible for the Treatment: Natural or legal person, public or private, who by himself or in association with others, performs the Treatment of Personal Data on behalf of the Responsible for the Treatment.

  • Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the Treatment of the data.

  • Owner: Natural person whose Personal Data is subject to Treatment.

  • Treatment: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

  • Transfer: The data transfer takes place when the Person Responsible and / or in Charge of the Treatment of Personal Data, located in Colombia, sends the information or Personal Data to a recipient, who in turn is Responsible for the Treatment and is within or outside the country.

  • Transmission: Treatment of Personal Data that implies the communication of the same inside or outside the territory of the Republic of Colombia when its purpose is to carry out a Treatment by the Manager on behalf of the Responsible.

3. Principles for the Processing of Personal Data

  • Principle of legality: Treatment is a regulated activity that must be subject to the provisions of Law 1581 of 2012 and the other provisions that develop it.

  • Principle of purpose: The Treatment must obey a legitimate purpose in accordance with the Constitution and the law, which must be informed to the Owner.

  • Principle of freedom: Treatment can only be exercised with the prior, express and informed consent of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate releasing consent.

  • Principle of truthfulness or quality: The information subject to Treatment must be truthful, complete, exact, updated, verifiable and understandable. Treatment of partial, incomplete, fractional or misleading data is prohibited.

  • Principle of transparency: In the Treatment, the Holder's right to obtain from the Data Controller or the Treatment Manager, at any time and without restrictions, information about the existence of data that concerns him must be guaranteed.

  • Principle of access and restricted circulation: Treatment is subject to the limits derived from the nature of personal data, the provisions of the law and the Constitution. The Treatment can only be done by people authorized by the Owner and / or by the people provided by law. Personal data, except public information, may not be available on the Internet or other means of mass communication or dissemination, unless access is technically controllable to provide restricted knowledge only to the Holders or third parties authorized under the law.

  • Principle of security: The information subject to Treatment by the Responsible for Treatment or Person in Charge of Treatment referred to in the law, must be managed with the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration. , loss, consultation, use or unauthorized or fraudulent access.

  • Principle of confidentiality: All persons involved in the Processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that comprise the Processing, being able to only supply or communicate personal data when it corresponds to the development of the activities authorized by law and in its terms.

4. Treatment to which the Personal Data will be subjected

The Personal Data of clients are collected, stored, organized, used, circulated, transmitted, transferred, updated, rectified, deleted, deleted and managed according to the nature of said data and in accordance with the purposes established in this Policy.

4.1. Purposes of Data Processing by Latimpacto

The purposes of the Personal Data Processing carried out by Latimpacto are the following:

  • Sending monthly / weekly newsletters

  • Marketing and advertising of the events, webinars and trainings organized by Latimpacto

  • Data update

  • Market or satisfaction surveys

4.1.1. Transmission of Personal Data

Latimpacto may carry out the Transmission of Personal Data from the Holders to third parties located in Colombia, as Managers, to carry out the Processing of Personal Data on behalf of Latimpacto in order to carry out the purposes indicated above in section 4.1.1.

For such purposes, Latimpacto will implement the Data Transmission Authorizations or contracts that are necessary to comply with the obligations established in the Colombian regime for the protection of Personal Data.

5. Rights of the Holders

In accordance with the provisions of article 8 of Law 1581 of 2012 and Decree 1074 of 2015 (Chapter 25), the Owner of Personal Data has the following rights:

  • Know, update and rectify your Personal Data against Latimpacto, in your capacity as Data Controller. This right may be exercised against partial, inaccurate, incomplete, fractional, misleading data, or those whose Treatment is expressly prohibited or has not been authorized.

  • Request proof of the authorization granted to Latimpacto.

  • Be informed by Latimpacto, upon request, regarding the use that has been made of their Personal Data.

  • Present, before the Superintendency of Industry and Commerce (hereinafter “SIC”), complaints for infractions of the provisions of Law 1581 of 2012, once the process of consultation or claim before Latimpacto has been exhausted, in accordance with the provisions of this Policy.

  • Revoke the authorization and / or request the deletion of the data when the Treatment does not respect the principles, rights and constitutional and legal guarantees. The revocation and / or suppression will proceed when the SIC has determined that, in the Treatment, the Responsible or Person in Charge has engaged in conduct contrary to law and the Constitution.

  • Free access to Personal Data that has been processed by Latimpacto.

These rights may only be exercised by the following persons:

  • By the Holder, who must prove his identity sufficiently.

  • By their successors in title, who must prove such quality.

  • By the representative and / or attorney of the Holder, after accreditation of the representation or empowerment.

  • By stipulation in favor of another or for another.

6. Area Responsible for Attention to Requests, Queries and Claims

The area of [Programs of] Latimpacto will be responsible for the attention of requests, consultations, claims, complaints or for the exercise of the rights of the Holder of the Personal Data object of Treatment. This may be contacted by email [comunidad@latimpacto.org]

7. Procedure to exercise the rights and queries and claims of the Owner of Personal Data

7.1 Procedure for accessing and consulting Personal Data

The Holder of Personal Data, or any of the persons authorized in accordance with the provisions of Chapter 5 of this Policy, may consult the information contained in the databases of Latimpacto, for which they must communicate the corresponding request to the email email [comunidad@latimpacto.org]

To prevent unauthorized third parties from accessing the Owner's personal information, it will be necessary to previously establish the Owner's identification. When the request is made by a person other than the Holder and it is not proven that it acts on behalf of the latter, it will be considered as not filed.

The query will be attended within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which his query will be answered, which in no case may exceed five (5) business days following the expiration of the first term.

7.2. Procedure to request update, correction, deletion, revocation of authorization or to file claims

The Holder, or any of the persons authorized in accordance with the provisions of Chapter 5, who considers that the information contained in the Latimpacto databases must be subject to correction, updating or deletion, or when it is warned of the alleged breach of any of the duties contained in Law 1581 of 2012, Decree 1074 of 2015 or other complementary regulations, may file a claim with Latimpacto, which will be processed in accordance with the following rules:

  • The claim will be made through a request that can be sent to the email [community@latimpacto.org]

  • To prevent unauthorized third parties from accessing the Owner's personal information, it will be necessary to previously establish the Owner's identification. When the request is made by a person other than the Holder and it is not proven that it acts on behalf of the latter, it will be considered as not filed.

  • The request must contain the following information:

    • The identification of the Holder.

    • Contact details (physical and / or electronic address and contact telephone numbers).

    • The documents that prove the identity of the Holder, or the representation of his representative.

    • The clear and precise description of the Personal Data with respect to which the Owner seeks to exercise any of the rights.

    • The description of the facts that give rise to the claim.

    • The documents that you want to assert.

    • Signature and identification number.

    • Original filing.

  • If the claim is incomplete, Latimpacto will require the interested party within five (5) days after receipt of the claim to correct the failures. If two (2) months have elapsed since the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

  • If the area that receives the claim is not competent to resolve it, it will transfer to the appropriate party within a maximum term of two (2) business days and will inform the interested party of the situation.

  • Once the complete claim is received, a legend will be included in the database that says “claim in process” and the reason for it, in a term no longer than two (2) business days. Said legend must be kept until the claim is decided.

  • The maximum term to attend the claim will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days after the expiration of the first finished.

7.3. Deletion of Data

The Owner has the right, at any time, to request the deletion (deletion) of his Personal Data from Latimpacto when:

  • Consider that they are not being treated in accordance with the principles, duties and obligations set forth in Law 1581 of 2012, Decree 1074 of 2015 and the other regulations that complement or modify them.

  • They are no longer necessary or relevant for the purpose for which they were collected.

  • The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.

This suppression implies the total or partial elimination of the Personal Data in accordance with what is requested by the Owner in the registers, files, databases or Treatments carried out by Latimpacto.

The right of erasure is not absolute and the Responsible Party may deny the exercise of it when:

  • The Holder has a legal or contractual duty to remain in the Latimpacto database.

  • The suppression of Personal Data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

  • The Personal Data is necessary to protect the legally protected interests of the Holder, to carry out an action based on the public interest, or to fulfill an obligation legally acquired by the Holder.

7.4. Revocation of the Authorizatio

The Owner of the Personal Data can revoke the consent to the Treatment of her Personal Data at any time, as long as a legal provision does not prevent it.

8. Information Security.

In development of the security principle, Latimpacto has adopted reasonable technical, administrative and human measures to protect the information of the Holders and prevent adulteration, loss, consultation, use or unauthorized or fraudulent access. Access to Personal Data is restricted to its Holders and Latimpacto will not allow access to this information by third parties under conditions other than those set forth in this Policy, except for an express request from the Owner or persons legitimized in accordance with the national regulations.

9. Validity Period of the Personal Database

The Personal Data collected by Latimpacto will be kept for a period of time necessary and proportional for the purposes of the Treatment indicated in this Policy. The term of the Authorizations on the use of personal data is understood by the term of the contractual relationship and during the exercise of the corporate purpose of Latimpacto, except in those cases where the law provides for a different term.

Additionally, Latimpacto will proceed to delete the Personal Data when the Holders so require, in accordance with the provisions of Law 1581 of 2012 and its regulatory decrees, as well as the provisions of this Policy.

10. Validity of the Policy.

This Policy is effective as of February 14, 2020.