Data Processing Policy
1. INTRODUCTION
INDUSTRIAS METALEX NIT. 900489117 with main address in the city of Bucaramanga at Calle 17#12-08, with telephone 6715021 and e-mail financiero@metalex.com.co; and all the companies that are part of the service network such as METALEX INTERNACIONAL NIT. 804013696 with main domicile in the city of Bucaramanga at Calle 17#12-08, with telephone 6715021 and e-mail financiero@metalex.com.co; XELATEM NIT. 830045470 with main domicile in the city of Bogotá at Carrera 68H #73-54, with telephone 3118989678 and e-mail financiero@metalex.com.co and TECNIESTRUCTURAS NIT. 804003310 with main address in the city of Bucaramanga at Calle 17#12-26, with telephone 7 6715021 and email financiero@metalex.com.co (hereinafter Metalex Group); by virtue of its condition of responsible for personal data, is committed to ensure the privacy and protection of personal information of its employees, customers and suppliers, as well as any other person who provides their data through the web form for filing PQRs and queries. This policy is in accordance with Law 1581 of 2012 of Colombia and its regulatory decree 1377 of 2013, with the objective of establishing the principles, duties and obligations that Metalex Group assumes in relation to the treatment of personal data.
2. DEFINITIONS
Personal Data: Any information that identifies a natural person or makes him/her identifiable. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or elimination. Data subject: Natural person whose personal data is the object of processing.
3. PURPOSE OF PERSONAL DATA PROCESSING
The Metalex Group will carry out the processing of personal data for the following purposes: a. Human Resources Management: For the proper development of labor relations with our employees, including payroll management, benefits, and compliance with legal and contractual obligations. b. Quotations and Customer Service: To attend to requests for quotations and offer construction formwork systems services, as well as to follow up and attend to PQRs and inquiries received through the web form. c. Security and Video Surveillance: To guarantee the security of our facilities and the protection of our assets, including the surveillance of specific areas. d. Supplier Management: To manage commercial relations and processes for the acquisition of goods and services.
4. APPLICABLE PRINCIPLES
The Metalex Group undertakes to ensure that the processing of personal data is carried out in accordance with the following principles: a. Legality: The processing of data will be carried out in accordance with Colombian laws. b. Consent: The consent of the holders of personal data will be obtained in a prior, express and informed manner, unless a legal exception exists. c. Quality: The accuracy, integrity and updating of personal data will be maintained. d. Security: Technical and organizational measures will be implemented to ensure the security of personal data. e. Confidentiality: The security of personal data will be guaranteed. Confidentiality: The confidentiality of the information will be guaranteed, limiting access only to those who require it. f. Access and Restricted Circulation: Personal data will only be processed by authorized persons and for the established purposes. g. Purpose: Personal data will be used for the purposes established. Purpose: Personal data will be used only for the purposes defined in this policy.
5. RIGHTS OF THE OWNERS
The holders of personal data have the right to: a. Access free of charge to the data provided that have been subject to processing. b. Know, update and rectify their information against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is prohibited or has not been authorized. c. Request the deletion of their personal data. d. Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual duty that prevents its deletion, the above, by filing a written complaint in accordance with Article 15 of Law 1581 of 2012, in the following cases: – When the holders consider that the same are not being treated in accordance with the principles, duties and obligations provided in Law 1581 of 2012. – When the data are no longer necessary or relevant for the purpose for which they were collected. – When the period necessary for the fulfillment of the purposes for which the data were collected has been exceeded. e. To file before the Superintendence of Industry and Commerce (SIC) complaints for violations of the provisions of current regulations.
6. TREATMENT OF SENSITIVE DATA
The Metalex Group undertakes not to process sensitive data, unless it is necessary for legal or contractual reasons.
7. TRANSFER AND TRANSMISSION OF DATA
The transfer and transmission of personal data will be made in accordance with the law and the guarantees of security and privacy.
8. CONSERVATION PERIOD
Personal data will be kept for the time necessary to fulfill the purposes of treatment and in accordance with current regulations.
9. VALIDITY OF THE POLICY
This policy will be effective as of November 01, 2023 and will be reviewed periodically or when significant changes are made in the processing of personal data.
10. MODIFICATIONS TO THE POLICY
The Company reserves the right to modify this Policy at any time, notifying the owners and publishing the updated version on its website.
11. DATA PROCESSING BY THIRD PARTIES IN THE CLOUD
The Company, in order to improve the efficiency and availability of data, may contract services from third parties that manage data in the cloud. It is important to note the following:
11.1. Selection of Cloud Providers: The Company will carefully select its cloud service providers, verifying that they meet appropriate security and data protection standards.
11.2. Shared Responsibility: Despite the outsourcing of data storage services, the Company retains its status as Data Controller and ensures that third parties that handle data in the cloud comply with the policies and security measures set forth in this Policy.
11.3. Data Transfers: In the event that cloud providers are located in locations outside Colombia, it shall ensure that international data transfer regulations are complied with and appropriate mechanisms for the protection of personal data shall be established.
11.4. Confidentiality and Security: The contracted third parties shall be obliged to maintain the confidentiality and security of personal data and to use them only for the agreed purposes.
11.5. Responsibility for Security Incidents: In the event of a security incident affecting the data stored in the cloud, the Company shall be responsible for notifying the owners and the supervisory authority under the terms and deadlines established by the applicable legislation.
11.6. Ongoing Evaluation: The Company will conduct periodic evaluations of cloud service providers to ensure that they continue to comply with security and data protection standards.
12. CONTACT
To exercise their rights, obtain more information or file complaints related to the processing of personal data, holders may contact the Data Protection Department through the url https://www.metalex.com.co/metalex_ingles/contact-us/, the email address calidad@metalex.com.co or at the following addresses:
Bogotá: Carrera 68H No. 73 – 54
Manga – Yumbo: Calle 10 No. 36A – 72
Barranquilla: Vía Juan Mina No. 8A – 241
Bucaramanga: Calle 17 No. 12 – 08
This personal data processing policy is mandatory for all employees and collaborators of the company and will be communicated to the holders of personal data in a clear and accessible manner.
Metalex Group informs the Holders, including but not limited to Employees, Suppliers and Customers, that they may request the deletion of the personal data contained in our databases or that are being processed, if they so wish, within thirty (30) days following the publication of this communication, unless there is a legal or contractual obligation to keep the data. The holders of the personal data being processed, in order to exercise their rights to know, update, rectify and delete information, revoke the authorization, among others, may go to the contact form on our website https://www.metalex.com.co/contactenos/ or to any of the member companies of the Metalex Group as responsible for the processing, free of charge, at the main offices informed in the introduction of this document, making the formal request with one of our collaborators. If you use any of the two referred consultation mechanisms, we request you to indicate the capacity in which you act (Employee/Supplier/Customer/Other) in order to derive your consultation and/or request to the department, area or function of the companies in charge and responsible for the administration and treatment of your personal data, with the purpose of giving an answer within the terms contemplated in the Law. In case of not receiving any manifestation from you during the indicated term, Metalex Group will understand that you authorize the treatment of personal data under the guidelines established in the local Privacy Policy and especially in the Information Treatment Policy and in the Privacy Notice, which are made available to you by this means, together with the mechanisms to exercise the rights you have as holder of the personal data, which you may consult at any time at https://www.metalex.com.co/home/.
This personal data processing policy is a guide for compliance with the legal provisions on data protection in the Metalex Group. All employees are expected to adhere to this policy and promote good practices in the handling of personal data.