Personal data processing, privacy and protection policy
This is a translation for visitors. The Spanish text published on this website is the official version.
Objective
To set the responsibilities for handling and processing personal data held in the databases and files of CARGRANEL S.A., in compliance with Law 1581 of 2012, Regulatory Decree 1377 of 2013, Decree 1074 of 2015 and the rules that amend or add to the personal data protection regime.
Scope
This policy applies to anyone who has or has had a relationship with the company: active and former employees, applicants, suppliers, clients or third parties whose personal data are held in the company’s databases.
Controller and contact
Company name: Integral de Carga Cargranel S.A.
Address: Calle 77 sur No. 47B-46
City: Sabaneta, Antioquia
Website: www.cargranel.com
Phone: (604) 2883878 ext. 1103
Email: gerente@cargranel.com
Contact: General Manager
Purpose
The purpose of this policy is to inform the data subject of the reason for collecting personal data and of the rights arising from the authorization granted. It also sets the guidelines for handling personal data inside the organization.
Security measures
CARGRANEL S.A. has systematic measures that control the processes in charge of personal data, so that the information provided by the data subject is used only for the purposes for which authorization was given.
Privacy notice
When collecting personal data, CARGRANEL S.A. will inform the data subject, verbally, in writing or by any electronic means, of the information-processing policies through a privacy notice containing the information referred to in Article 15 of Decree 1377 of 2013.
The privacy notice is contained in the document Authorization for the processing of personal data, which is an integral part of this policy.
Authorization
Authorization is contained in the document Authorization for the processing of personal data, which is an integral part of this policy.
Definitions
Under current Colombian law on the processing of personal data, the following terms have the meaning given by that regulation:
Authorization: prior, express and informed consent of the data subject to process personal data.
Privacy notice: verbal or written communication from the controller to the data subject, informing of the applicable information-processing policies, how to access them, and the purposes of the processing.
Database: organized set of personal data that is subject to processing.
Successor: the natural or legal person who has succeeded another, by any legal title. Succession may occur between living persons or by reason of death.
Personal data: any information linked or that can be linked to one or more identified or identifiable natural persons.
Public data: data that is not semi-private, private or sensitive. Public data include, among others, marital status, profession or trade, and the status of merchant or public servant. By their nature they may appear in public records, official gazettes and final court decisions that are not confidential.
Sensitive data: data that affect the privacy of the data subject or whose misuse may cause discrimination, such as racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social or human-rights organizations, or data that promote the interests of a political party, as well as data related to health, sexual life and biometric data.
Processor: a natural or legal person, public or private, that processes personal data on behalf of the controller.
Habeas data: the fundamental right in Article 15 of the Colombian Constitution, developed by Law 1581 of 2012, which allows people to know, update and rectify information collected about them in databases and files of public and private entities.
Controller: a natural or legal person, public or private, that decides on the database and/or the processing of the data.
Data subject: the natural person whose personal data are processed.
Transfer: when the controller and/or processor located in Colombia sends personal data to a recipient that is itself a controller, inside or outside the country.
Transmission: processing that involves communicating personal data inside or outside Colombia so that a processor can process them on behalf of the controller.
Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
Processing of personal data
Processing at CARGRANEL S.A. includes collection, storage, administration, use, transfer, transmission and destruction in the manner allowed by current Colombian law, and it is carried out for the specific purpose of each case.
The information CARGRANEL S.A. requests from people and companies linked to the company is limited to the personal data that are relevant and necessary for the purpose for which they are collected, in particular information related to freight transport, in accordance with current regulation. Except in the cases provided by law, personal data may not be collected without the data subject’s authorization.
The company must keep the information under the security and confidentiality conditions needed to prevent its alteration, loss, consultation, use or unauthorized or fraudulent access, and must ensure that the information given to the processor is truthful, complete, exact, updated, verifiable and understandable.
Sensitive data and data of minors: for sensitive data and data of children and adolescents whose representatives are employees or candidates, CARGRANEL S.A. will request explicit authorization and will tell the data subject that answering those questions is optional.
Purposes: personal data such as names, identification number, gender, date of birth, address, phone and mobile numbers and email are used to fulfill the company’s corporate purpose and, in particular, employment obligations, welfare activities and programs for workers, and corporate communications.
Employees: data are processed to comply with legal and contractual obligations, including human-resources management, employment files, payroll, payments and reports to the health social-security system, internal audits, confidentiality obligations, sending information of interest to the company and other employment obligations.
Data provided in résumés during selection and in the employment contract are used to verify identity, for internal control of knowledge and skills, to check personal and employment references, to contact the person and send information about the stages of selection, and to contact family members, dependents or beneficiaries in an emergency.
Suppliers: supplier data are used to comply with the contracts between the parties, including background checks under Cargranel’s internal procedures, payment for the product or service, payment reports, reports or interactions required by law or internal policy, access identification, and handling of queries, requests and complaints by the data subject or their successors.
Data in supplier and contractor databases are also used for market surveys, follow-up and process improvement, service-improvement plans, management indicators, evaluation of suppliers and contractors, and information on their performance in previous contracts with the company.
Clients: client data are used for background checks under Cargranel’s internal procedures, to contact clients in order to evaluate service quality, to invoice, to inform clients in a timely way of availability or of changes in the service, and to comply with legal and contractual obligations.
Third parties: third-party data are processed to protect the security of the company and of those third parties, and, in an emergency, to verify information when they are on the company’s premises.
Because of the company’s economic activity, personal data of own and third-party drivers, and of owners and/or holders of vehicles, will be transmitted to the operating companies that act as clients of CARGRANEL S.A., according to the contract between the client and the company, in order to protect the cargo assigned by the client. Those data will also be transmitted to government entities according to the legal requirements applicable to freight transport.
How the data will be processed and for what purpose
CARGRANEL S.A. will use personal data to:
a) Provide the services requested.
b) Inform about new products or services, whether or not related to the one contracted or acquired by the data subject.
c) Comply with obligations undertaken with the data subject.
d) Inform about changes in products or services.
e) Evaluate the quality of products or services.
f) Carry out marketing or promotional activities.
g) Send to a physical or email address, mobile phone or device — by text message (SMS and/or MMS) — commercial, advertising or promotional information about products and/or services, events and promotions, in order to promote, invite, direct, execute, inform and, in general, carry out commercial or advertising campaigns, promotions or contests.
h) Share data, including transfer and transmission to third parties, for purposes related to the operation of CARGRANEL S.A.
i) Carry out internal studies on commercial relationships and market studies at every level.
j) Answer legal requests from administrative and judicial entities.
k) Comply with reporting duties to the entities to which CARGRANEL S.A. is obliged, such as the Superintendence of Ports and Transport, UIAF, the Ministry of Transport and DIAN, without this list being exhaustive.
l) Verify the data provided, applying the SIPLAFT policy manual, BASC policies, ISO 9001 and related rules.
Rights of data subjects
A. Personal data must be managed under the principles of Article 4 of Law 1581 of 2012. Data subjects may at any time demand that those principles be respected.
a) Principle of legality. Processing must follow the law.
b) Principle of transparency. The data subject’s right to obtain information about their data at any time and without restrictions must be guaranteed.
c) Principle of purpose. The purpose of processing must be legitimate and informed to the data subject.
d) Principle of restricted access and circulation. Processing may be done only by people authorized by the data subject or by the people provided in the law.
e) Principle of freedom. Data may be processed only with the prior, express and informed consent of the data subject, or by legal or judicial mandate.
f) Principle of security. Information must be handled with the measures needed to secure the records and prevent alteration, loss, consultation, use or unauthorized or fraudulent access.
g) Principle of truthfulness and quality. Information must be truthful, complete, exact, updated, verifiable and understandable.
h) Principle of confidentiality. Personal data that are not public are reserved and may be disclosed only in the terms of the law.
B. The data subject may at any time, free of charge, know, update and correct personal information in accordance with Article 8 of Law 1581 of 2012. This right may also be exercised when the data are inaccurate, partial, incomplete, fragmented, misleading, or when processing is prohibited by law or was not authorized by the data subject.
C. Request from the controller proof of the authorization granted, except when authorization is not required under Article 10 of Law 1581 of 2012.
D. Be informed by the controller, upon request, of the use given to their personal data.
E. File complaints with the Superintendence of Industry and Commerce for breaches of the current rules and of those that amend the personal data protection regime.
F. Revoke the authorization and/or request deletion of the data when processing does not respect constitutional and legal principles, rights and guarantees, except when the data subject has a legal or contractual duty to remain in the database. Revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the controller or processor has acted contrary to the Constitution and the law.
Duties of data subjects
Data subjects must keep their information updated and guarantee, at all times, that it is true. CARGRANEL S.A. will not be liable, in any case, for any liability arising from the inaccuracy of the information provided.
Cases in which authorization is not required
The data subject’s authorization is not necessary when it concerns:
Information required by a public or administrative entity in the exercise of its legal functions, or by court order.
Data of a public nature, or cases of medical or health emergency.
Processing authorized by law for historical, statistical or scientific purposes.
Data related to the Civil Registry of Persons.
Who may exercise the data subject’s rights
The rights of data subjects may be exercised by:
The data subject, who must prove their identity by the means the company makes available.
The data subject’s successors (when the data subject is absent by death or incapacity).
The data subject’s representative and/or attorney, after proving the representation or power of attorney.
By stipulation in favor of another person.
The rights of children and adolescents will be exercised by the people authorized to represent them.
People responsible for processing
CARGRANEL S.A. acts as controller. Administrative and operational areas act as processors, with these contacts:
For personal data of active and former employees and of candidates in selection, the quality coordinator and the occupational health and safety assistant act as processors. Queries, petitions or complaints go to calidad@cargranel.com or saludocupacional@cargranel.com.
For personal data of clients and suppliers, the commercial, traffic and security teams, administrative management, accounting, billing and the process leaders who hire suppliers act as processors. Queries go to direccioncomercial@cargranel.com or administracion@cargranel.com.
For personal data of third parties and other stakeholders who enter the company’s facilities, the company’s brigades act as processors only when an event may affect the personal integrity of visitors. Queries go to saludocupacional@cargranel.com.
For logistics management, in the daily scheduling of freight transport, the national operations manager and the logistics coordinator of each city are responsible for personal data of own and third-party drivers and of owners and holders of vehicles. Queries go to diroperaciones@cargranel.com or operaciones@cargranel.com.
Procedure for queries and complaints
The data subject may exercise the rights to know, update, rectify, delete information and/or revoke authorization at any time by contacting the controller by email, phone, in writing or in person.
Revocation or deletion may be requested at any time by filing a complaint, in accordance with Article 15 of Law 1581 of 2012 and the procedure in this policy.
A query, request or complaint by the data subject, their successors, or entities of the general health social-security system to which the data subject is or was linked must contain, at least:
The name and address of the data subject, or any other means to receive the reply.
Documents that prove identity or the capacity of the representative.
A clear and precise description of the personal data regarding which the data subject seeks to exercise a right.
Any other element that helps locate the personal data.
Queries: to know the personal data processed by CARGRANEL S.A., the data subject may submit a request indicating the information they wish to know, through any of the means indicated.
The query will be answered within a maximum of ten (10) business days from receipt. When it cannot be answered in that term, the applicant will be informed of the reasons for the delay and of the date on which it will be answered, which may not exceed five (5) business days after the first term expires.
Complaints: when the data subject or their successors consider that the information in the database must be updated, corrected or deleted, or that authorization must be revoked because of an alleged breach of Law 1581 of 2012 and/or Decree 1377 of 2013, they may file a complaint with CARGRANEL S.A., addressed to the Human Talent Management Coordinator (phone 2883878 ext. 1107, email calidad@cargranel.com), who is designated to handle such complaints, under these requirements:
A. The rights of rectification, update, deletion or revocation of consent may be exercised only by the data subject or their successors, after proving identity; by their representative, after proving representation; or by stipulation in favor of another person.
B. The request must include at least the name and address of the data subject or another means to receive the reply; documents that prove the identity of the applicant and, if applicable, of the representative with the respective authorization; a clear and precise description of the personal data, the specific request and the documents to be asserted; and any other element that helps locate the data.
C. If the information required for the complaint is incomplete, the interested person will be informed within five (5) business days of receipt so they can correct it. If two (2) months pass from the request and the applicant does not provide the required information, the complaint will be understood as withdrawn.
D. Once the complete complaint is received, the maximum term to answer it is fifteen (15) business days counted from the day after receipt. When it cannot be answered in that term, the interested person will be informed of the reasons for the delay and of the date on which it will be answered, which may not exceed eight (8) business days after the first term expires.
E. The data subject or successor may file a complaint with the Superintendence of Industry and Commerce only after the query or complaint procedure before the controller at CARGRANEL S.A. has been exhausted and has not been resolved.
Validity
The period of validity of the databases will take into account the general rules and principles that govern the purpose and temporality of the information.
This Personal Data Processing, Privacy and Protection Policy is in force as of 20 April 2015.
This policy may be modified at any time and unilaterally by CARGRANEL S.A.