Treatment of Information

Policy on the treatment of information and protection of personal data

IMPULSO COMMUNICATION S.A.S.

 

Policy on the treatment of information and internal manual to ensure compliance with the statutory law on the protection of personal data

General considerations

IMPULSO COMMUNICATION S.A.S. is a company whose corporate purpose is the development of any lawful activity, including but not limited to, the purchase and sale of shares in companies; the purchase, sale, and negotiation of all types of movable and immovable property; and consulting, technical advice, administration, outsourcing, marketing, import, and export of all types of products and goods, including but not limited to advertising guidelines, advertising transmissions, equipment, and frequencies related to telecommunications.

 

Article 15 of the Constitution of the Republic of Colombia enshrines the right of any person to know, update, and rectify the personal data that exists about them in databases or files of public or private entities. Likewise, it orders those who have personal data of third parties to respect the rights and guarantees provided in the Constitution when collecting, processing, and circulating such information.

 

Statutory Law 1581 of October 17, 2012 establishes the minimum conditions for the legitimate processing of personal data of clients, employees, and any other natural person. Both literal k) of article 17 and f) of article 18 of this law obligate those responsible and in charge of the processing of personal data to "adopt an internal manual of policies and procedures to ensure the proper compliance with this law and, in particular, for the attention of inquiries and complaints."

Article 25 of the same law orders that the data treatment policies are mandatory and that ignorance of them will result in sanctions. Such policies cannot guarantee a level of treatment lower than that established in Law 1581 of 2012. Chapter III of Decree 1377 of June 27, 2013 regulates some aspects related to the content and requirements of the Information Treatment Policies and Privacy Notices.

IMPULSO COMMUNICATION S.A.S. is committed to respecting the rights of its clients, employees, and third parties in general. Therefore, it adopts the following policy on the treatment of personal data, which is mandatory for all activities involving the processing of personal data.

 

Obligatoriedad

These policies are of mandatory and strict compliance by all employees of IMPULSO COMMUNICATION S.A.S, contractors, and third parties acting on behalf of IMPULSO COMMUNICATION S.A.S. All employees of IMPULSO COMMUNICATION S.A.S must observe and respect these policies in the performance of their duties. In cases where there is no employment relationship, a contractual clause must be included so that those acting on behalf of IMPULSO COMMUNICATION S.A.S are obliged to comply with these policies. Non-compliance with them will result in labor sanctions or contractual liability as the case may be. This is without prejudice to the duty to respond financially for the damages and losses caused to the data subjects or to IMPULSO COMMUNICATION S.A.S due to non-compliance with these policies or the improper handling of personal data. For all purposes, this document will serve as the internal manual of policies and procedures, as well as the information treatment policies referred to in articles 17 (literal k), 18 (literal f), and 25 (paragraph 25).

 

Definiciones

  • Autorización: Prior, express, and informed consent of the data subject to carry out the processing.
  • Consulta: Request from the data subject or the persons authorized by them or by law to know the information that rests on them in databases or files.
  • Dato personal: Any information linked or that can be associated with one or several determined or determinable natural persons.
    • Dato personal sensible: Information that affects the intimacy of the person or whose improper use may generate their discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights, or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data (fingerprints, among others).
    • Dato personal público: It is the data qualified as such according to the mandates of the law or the Political Constitution and all those that are not semi-private or private. Public data includes, among others, data contained in public documents, public records, official gazettes and bulletins, and judicial rulings that are duly executed and not subject to reservation, those related to the civil status of persons, their profession or trade, and their status as a merchant or public servant. Public personal data existing in the commercial register of the Chambers of Commerce are public (Article 26 of the C.Co). This data can be obtained and offered without any reservation and regardless of whether it refers to general, private, or personal informationP.

Personal Data Types

  • Private personal data. It is the data that, by its intimate or reserved nature, is only relevant to the data subject. Examples: books of merchants, private documents, information extracted from the inspection of the domicile.
  • Semiprivate personal data. The data that does not have an intimate, reserved, or public nature and whose knowledge or disclosure may interest not only its holder but also a certain sector or group of people or society in general, such as, among others, data regarding compliance and non-compliance with financial obligations or data related to relationships with social security entities.

These data are classified as sensitive, public, private, and semiprivate.

  • Data processor: person who processes data on behalf of the data controller.
  • Claim: request from the data subject or persons authorized by them or by law to correct, update, or delete their personal data.
  • Data controller: person who decides on, among other things, the collection and purposes of the processing. It can be, for example, the company that owns the database or information system that contains personal data.
  • Data subject: It is the natural person to whom the data refers.
  • Processing: Any operation or set of operations on personal data such as, among others, the collection, storage, use, circulation, or deletion of that kind of information.
  • Transmission: Processing of personal data that involves the communication of the same within (national transmission) or outside of Colombia (international transmission) and that aims to carry out processing by the Processor on behalf of the controller.
  • Transfer: The transfer of data takes place when the controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for processing and is located inside or outside the country.

 

Principles for the Processing of Personal Data

The processing of personal data must be carried out respecting the general and special rules on the matter and for activities permitted by law. In the development, interpretation, and application of this policy, the following principles will be applied harmoniously and integrally:

 

Principles related to the collection of personal data.

  • Principle of freedom: Unless otherwise provided by law, the collection of data can only be exercised with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without the prior consent of the data subject, or in the absence of a legal or judicial mandate that relieves consent.
  • Principles Related to the Use of Personal Data
  • The data holder must be informed clearly, sufficiently, and in advance about the purpose of the information provided and, therefore, data cannot be collected without specifying the purpose of the same. The principle of freedom must be observed both for the case of data collected through forms and those that are part of the annexes or documents provided by the data holders to IMPULSO COMMUNICATION S.A.S. Deceptive or fraudulent means may not be used to collect and process personal data.
  • • Principle of limitation of collection: Only personal data that is strictly necessary for the fulfillment of the purposes of the processing should be collected, in such a way that the registration and disclosure of data that is not closely related to the objective of the processing is prohibited. Consequently, everything reasonably possible must be done to limit the processing of personal data to the minimum necessary. That is, the data must be: (i) adequate, (ii) relevant, and (iii) in accordance with the purposes for which they were intended.
  • Principles Related to the Use of Personal Data
  • • Principle of purpose: The processing must obey a legitimate purpose according to the Constitution and the Law, which must be communicated to the holder. The data holder must be informed clearly, sufficiently, and in advance about the purpose of the information provided and, therefore, data cannot be collected without a specific purpose.
  • • The data must be processed according to the authorized uses. If, over time, the use of personal data changes to forms that the person does not expect, it is necessary to obtain the prior consent of the holder again.
  • • Principle of temporality: Personal data will be kept only for the reasonable and necessary time to fulfill the purpose of the processing and the legal requirements or instructions from the supervisory and control authorities or other competent authorities. Data will be retained when necessary to fulfill a legal or contractual obligation. To determine the duration of the processing, the applicable regulations for each purpose and the administrative, accounting, tax, legal, and historical aspects of the information will be considered. Once the purpose(s) have been fulfilled, the data will be deleted.
  • • Principle of non-discrimination: Any act of discrimination based on the information collected in databases or files is prohibited.
  • • Principle of compensation: It is an obligation to compensate for the damages caused by possible failures in the processing of personal data.
  • Principles Related to the Quality of Information
  • • Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented data, or data that leads to error is prohibited. Reasonable measures must be adopted to ensure that the data is accurate and sufficient, and when necessary.
  •  

Request for the Holder or When IMPULSO COMMUNICATION S.A.S. Determines, They Shall Be Updated, Rectified, or Deleted When Appropriate.

Principles Related to the Protection, Access, and Circulation of Personal Data

 

Security Principle: Each person linked to IMPULSO COMMUNICATION S.A.S must comply with the technical, human, and administrative measures established by the entity to ensure the security of personal data, preventing its alteration, loss, consultation, unauthorized or fraudulent use or access.

 

Transparency Principle: In the processing, the right of the holder to obtain at any time and without restrictions information about the existence of data concerning them must be guaranteed.

 

Restricted Access Principle: Access to personal data shall only be permitted to the following persons:

  • The data holder
  • Persons authorized by the data holder
  • Persons who, by legal mandate or judicial order, are authorized to know the information of the data holder.
  • Other persons legitimized as indicated in Article 20 of Decree 1377 of 2013.
  • In all cases, before granting access to the data, the identity of the person requesting to know the personal data must be established with certainty and sufficiency.

Personal data, except for public information, may not be available on the internet or other means of mass dissemination or communication, unless access is technically controllable to provide restricted knowledge only to the holders or third parties authorized according to the law and this policy.

 

Restricted Circulation Principle: Personal data may only be sent or provided to the following persons:

  • The data holder
  • Persons authorized by the data holder
  • Other persons legitimized as indicated in Article 20 of Decree 1377 of 2013.
  • Public or administrative entities in the exercise of their legal functions or by judicial order.

In the latter case, in accordance with the Constitutional Court, the following procedure shall be followed: First, the public or administrative entity must justify its request by indicating the link between the need to obtain the data and the fulfillment of its constitutional or legal functions. Second, upon delivery of the information, the public or administrative entity will be informed that it must comply with the duties and obligations imposed by Law 1581 of 2012 and its regulatory norms as the data processing responsible party. The administrative entity receiving the personal data must comply with the obligations of.

Protection and the Guarantees Derived from the Mentioned Law

 

In particular, the observance of the principles of purpose, legitimate use, restricted circulation, confidentiality, and security.

• Principle of confidentiality: all persons involved in the processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks involved in the processing has ended, being able to only supply or communicate personal data when it corresponds to the development of the activities authorized by the law.

 

Purpose of the processing to which the personal data of clients will be subjected.

IMPULSO COMMUNICATION S.A.S will collect, use, and process personal data in a fair and lawful manner to fulfill the activities inherent to its corporate purpose, especially to provide services such as the following:

✓ Implementation of communication campaigns.✓ Economic exploitation of activities or businesses related to radio advertising and media.✓ Advertising, marketing, economic studies, and public opinion, marketing, planning, presentation, and exhibition, directly or through other companies or in partnership or by intermediation, as companies dedicated to the dissemination or commercialization of goods and services.✓ Dissemination or commercialization of goods and services that involve all kinds of advertising through any means of communication such as radio, press, television, and the internet.✓ Communication campaigns, dissemination, and promotion of products or services developed as part of internal strategies of IMPULSO COMMUNICATION S.A.S.✓ Market research and statistical analysis.✓ Conducting satisfaction surveys and offering or recognizing benefits.✓ Preservation of historical records of IMPULSO COMMUNICATION S.A.S.✓ Contact with suppliers of goods or services.✓ Purchase and sale of shares in companies.✓ Purchase, sale, and negotiation of all types of movable and immovable property.✓ Consulting, technical advice, administration, outsourcing, marketing, import, and export of all types of products and goods, including, but not limited to, advertising guidelines, advertising transmissions, equipment, and frequencies related to telecommunications.✓ Communication campaigns, dissemination, and promotion of products, and activities or services developed as part of internal strategies of IMPULSO COMMUNICATION S.A.S.✓ Market research and statistical analysis.✓ Conducting satisfaction surveys and offering or recognizing benefits.✓ Preservation of historical records of IMPULSO COMMUNICATION S.A.S.✓ Contact with suppliers of goods or services.

IMPULSO COMMUNICATION S.A.S.

also may process personal data for the following purposes:

✓ Carry out the relevant management for the development of the pre-contractual, contractual, and post-contractual stage of the data subjects with IMPULSO COMMUNICATION S.A.S. any of the contracts in which it is part, as well as comply with Colombian or foreign law and the orders of judicial or administrative authorities.

✓ Disclose, transfer, and/or transmit personal data inside and outside the country to third parties as a result of a contract, law, or lawful link that requires it or to fulfill the contracts in which it is a part, as well as implement cloud computing services or "big data."

✓ Implement CRM (customer relationship management) strategies, which include, among others, (i) a management model for the entire organization, based on customer orientation and relational marketing; (ii) Create databases or computer systems to support the management of customer relationships, sales, and marketing.

✓ Make invitations to events, improve products and services or offer new products, and all activities associated with the commercial relationship or existing link with IMPULSO COMMUNICATION S.A.S, or that which may come to have.

✓ Manage procedures (requests, complaints, claims), conduct satisfaction surveys regarding the goods and services of IMPULSO COMMUNICATION S.A.S or related companies, such as those that are part of the Todelar Circuit holding in Colombia and the commercial allies of IMPULSO COMMUNICATION S.A.S.

✓ Provide contact information and relevant documents to the sales force and/or distribution network, telemarketing, and any third party with which IMPULSO COMMUNICATION S.A.S has a contractual link of any kind.

Purpose and treatment to which the personal data of employees, contractors, or suppliers of IMPULSO COMMUNICATION S.A.S. will be subjected. The data that is collected or stored about employees, contractors, or suppliers of IMPULSO COMMUNICATION S.A.S through the completion of forms, by phone, or with the delivery of documents (resumes, attachments) will be processed for everything related to labor issues of a legal or contractual nature as applicable.

By virtue of the above, IMPULSO COMMUNICATION S.A.S will use personal data for the following purposes regarding employees: (1) Comply with laws such as, among others, labor law, social security, pensions, professional risks, family compensation funds (Comprehensive Social Security System) and taxes; (2) Comply with the instructions of the competent judicial and administrative authorities; (3) Implement the labor and organizational policies and strategies of the parent company.

Regarding contractors and suppliers, the information will be used to advance the relevant pre-contractual, contractual, and post-contractual processes and maintain communication with them for contractual and legal purposes.

Purpose and treatment to which the personal data of visitors to the facilities of IMPULSO COMMUNICATION S.A.S will be subjected. Regarding the data (i) collected directly at security points, (ii).

 

Taken from the documents provided by individuals to the security personnel and (iii) obtained from the video recordings made inside or outside the facilities of IMPULSO

COMMUNICATION S.A.S, these will be used for the security purposes of individuals, property, and facilities of IMPULSO COMMUNICATION S.A.S and may be used as evidence in any type of process.

Purpose and treatment to which the personal data of the partners or shareholders of IMPULSO COMMUNICATION S.A.S will be subjected. The treatment of the data of the shareholders will aim to fulfill the relevant legal duties such as, among others, keeping the commercial books and papers. Likewise, the information will be used to carry out all activities related to the economic and administrative political rights of the partners or shareholders. Additionally, their data will be used to maintain communication with them.

Rights of the data subjects. The individuals obligated to comply with these policies must respect and guarantee the following rights of the data subjects:

  • Know, update, and rectify personal data. For this purpose, it is necessary to previously establish the identification of the person to prevent unauthorized third parties from accessing the data of the data subject.
  • Obtain a copy of the authorization.
  • Inform about the use that IMPULSO COMMUNICATION S.A.S has given or is giving to the personal data of the data subject.
  • Process inquiries and complaints following the guidelines established by law and in this policy.
  • Access the request for revocation of the authorization and/or deletion of the personal data when the Superintendence of Industry and Commerce has determined that in the treatment by IMPULSO COMMUNICATION S.A.S there have been behaviors contrary to law 1581 of 2012 or the Constitution. The data subject may also revoke the authorization and request the deletion of the data when there is no legal or contractual duty that imposes the obligation to remain in the database or file of the responsible party or in charge. The request for deletion of the information and the revocation of the authorization will not proceed when the data subject has a legal or contractual duty to remain in the database of the responsible party or in charge.
  • Access their personal data free of charge. The information requested by the data subject may be provided by any means, including electronic ones, as required by the data subject. The information must be easy to read, without technical barriers that prevent access, and must correspond entirely to that which rests in the database. The rights of the data subjects, in accordance with article 20 of decree 1377 of 2013, may be exercised by the following persons:
  • By the data subject, who must sufficiently prove their identity by the various means made available by IMPULSO COMMUNICATION S.A.S.
  • By their heirs, who must prove such quality.
  • By the representative and/or attorney of the Holder, prior accreditation of the representation or power of attorney.
  • By stipulation in favor of another or for another. The rights of children, girls, or adolescents will be exercised by the persons who are authorized to represent them.

 

Duties of IMPULSO COMMUNICATION S.A.S when acting as the data controller.

All those obligated to comply with this policy must keep in mind that IMPULSO COMMUNICATION S.A.S is obliged to fulfill duties imposed by Colombian law. Therefore, they must act in such a way that they comply with the following obligations:

 

Duties of IMPULSO COMMUNICATION S.A.S regarding the data holder.Request and keep, under the conditions provided in this policy, a copy of the respective authorization granted by the holder.Inform the holder clearly and sufficiently about the purpose of the collection and the rights that assist them by virtue of the authorization granted.Guarantee the holder, at all times, the full and effective exercise of the right of habeas data, that is, to know, update, or rectify their personal data.Inform at the request of the holder about the use given to their personal data.Process the inquiries and complaints made in the terms indicated in this policy.

 

Duties of IMPULSO COMMUNICATION S.A.S regarding the quality, security, and confidentiality of personal data

  • Observe the principles of truthfulness, quality, security, and confidentiality in the terms established in this policy.
  • Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
  • Update the information when necessary.
  • Rectify personal data when appropriate.
  •  

Duties of IMPULSO COMMUNICATION S.A.S when processing through a data processor

  • Provide the data processor only with the personal data whose processing has been previously authorized. When it comes to national and international transmissions, a contract for the transmission of personal data must be signed or contractual clauses must be agreed upon that contain the provisions of Article 25 of Decree 1377 of 2013.
  • Ensure that the information provided to the data processor is truthful, complete, accurate, updated, verifiable, and understandable.
  • Communicate in a timely manner to the data processor all updates regarding the data previously provided to them and adopt the others.
  • Demand from the person in charge of the processing at all times, respect for the security and privacy conditions of the information of the Holder.
  • • Inform the person in charge of the processing when certain information is under discussion by the holder, once the complaint has been filed and the respective procedure has not been completed.
  • Duties of IMPULSO COMMUNICATION S.A.S regarding the Superintendence of Industry and Commerce
  • • Inform them of any violations of security codes and any risks in the management of the information of the holders.
  • • Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
  • Duties of IMPULSO COMMUNICATION S.A.S when acting as the person in charge of the processing of personal data.
  • If IMPULSO COMMUNICATION S.A.S processes data on behalf of another entity or organization (Responsible for the Processing), it must comply with the following duties:
  • • Establish that the responsible party for the processing is authorized to process the data it provides to IMPULSO COMMUNICATION S.A.S.
  • • Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.
  • • Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
  • • Timely carry out the updating, correction, or deletion of the data.
  • • Update the information reported by the responsible parties for the processing within five (5) business days from its receipt.
  • • Process the inquiries and complaints made by the holders in the terms indicated in this policy.
  • • Register in the database the legends "claim in process" in the manner established in this policy.
  • • Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of the personal data.
  • • Refrain from circulating information that is being disputed by the holder and whose blocking has been ordered by the Superintendence of Industry and Commerce.
  • • Allow access to the information only to persons authorized by the holder or empowered by law for that purpose.
  • • Inform the Superintendence of Industry and Commerce when violations of security codes occur and there are risks in the management of the information of the holders.
  • • Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
  • Regarding the authorization
  • Law 1581 of 2012 requires that the authorization to collect personal data (email address, phone number, etc.) be informed, prior, and express
  • As illustrated below:
  • Thus, those obligated to comply with this policy must obtain prior, express, and informed authorization from the holder to collect and process their personal data. This obligation is not necessary when it comes to publicly available data, processing of information for historical, statistical, or scientific purposes in which the information is not linked to a specific person, and data related to the Civil Registry of Persons.
  • To obtain the authorization, the following instructions must be followed:
  • First, before the person authorizes, it is necessary to inform them clearly and expressly of the following: • The processing to which their personal data will be subjected and the purpose of it.• The optional nature of the response to the questions that are asked, when these concern sensitive data or data of children and adolescents.• The rights that assist them as holders provided in Article 8 of Law 1581 of 2012.• The identification, physical or electronic address, and phone number of IMPULSO COMMUNICATION S.A.S.
  • Second, the consent of the holder will be obtained through any means that can be subject to subsequent consultation. Proof of compliance with the obligation to inform and of consent must be retained. If the holder requests a copy of these, they must be provided. Authorization may also be obtained from unequivocal conduct of the Data Holder that allows for a reasonable conclusion that they granted their consent for the processing of their information. Such conduct must be very clear so that it does not admit doubt or error regarding the will to authorize the processing, and in no case may the silence of the holder be considered as unequivocal conduct.
  • The following are legitimized to grant consent: • The Holder, who must sufficiently prove their identity by the various means made available by IMPULSO COMMUNICATION S.A.S. • The heirs of the Holder, who must prove such quality. • The representative and/or attorney of the Holder, upon prior accreditation of the representation or power of attorney. • Authorization may also be granted when there are cases of stipulation in favor of another or for another.
  •  
  • Authorization for the processing of sensitive data:
  • When it comes to the collection of sensitive data, the following requirements must be met:
  • The authorization must be explicit.
  • The Holder must be informed that they are not obligated to authorize the processing of such information.
  • The Holder must be explicitly and prior informed which of the data that will be subject to processing are sensitive and the purpose of it.
  •  
  • Authorization for the processing of data of children and adolescents (NNA)

When it comes to the collection and processing of data of children and adolescents, the following requirements must be met:

  • The authorization must be granted by persons who are authorized to represent the NNA. The representative of the NNA must guarantee them the right to be heard and value their opinion on the processing, taking into account the maturity, autonomy, and capacity of the NNA to understand the matter.
  • It must be informed that it is optional to answer questions about the NNA's data.
  • The processing must respect the best interests of the NNA and ensure the respect of their fundamental rights. The Holder must be explicitly and prior informed which of the data that will be subject to processing are sensitive and the purpose of it.
  •  
  • Classification and special treatment of certain personal data

The persons obligated to comply with this policy must identify the sensitive data and that of children and adolescents (NNA) that they may collect or store with a view to:

  • Implementing reinforced responsibility in the processing of these data, which translates into a greater requirement in terms of compliance with the principles and duties.
  • Increasing the levels of security of that information.
  • Increasing access and use restrictions by the personnel of IMPULSO COMMUNICATION S.A.S and third parties.
  • Keeping in mind the legal requirements and this policy for their collection.

 

International transfer of personal data

When data is sent or transferred to another country, it will be necessary to have the authorization of the holder of the information that is subject to transfer. Unless the law states otherwise, such authorization is a prerequisite for carrying out the international circulation of data. In this sense, before sending personal data to data controllers located in another country, those obligated to comply with this policy must verify that they have the prior, explicit, and unequivocal authorization of the holder that allows transmitting their personal data.

 

International and national transmissions of data to Processors

When IMPULSO COMMUNICATION S.A.S wishes to send or transmit data to one or more processors located outside the territory of the Republic of Colombia, it must, through contractual clauses or a personal data transmission contract, agree on the following, among others: (i) the scope of the processing.

ii) the activities that the Manager will carry out on behalf of IMPULSO COMMUNICATION S.A.S

(iii) the obligations that the Manager must fulfill regarding the Data Holder and IMPULSO COMMUNICATION S.A.S.

(iv) The obligation of the Manager to comply with the obligations of the responsible party observing this policy.

(v) The duty of the Manager to process the data according to the authorized purpose for it and observing the principles established in Colombian law and this policy.

(vi) The obligation of the Manager to adequately protect personal data and databases, as well as to maintain confidentiality regarding the processing of the transmitted data.

Procedures for Data Holders to Exercise Their Rights

Below are the procedures for data holders to exercise their rights to know, update, rectify, and delete information or revoke authorization. The rights of the Holders may be exercised by the following legitimized persons in accordance with Article 20 of Decree 1377 of 2013:

  • By the Holder, who must sufficiently prove their identity by the various means made available by IMPULSO COMMUNICATION S.A.S.
  • By their heirs, who must prove such quality.
  • By the representative and/or attorney of the Holder, prior accreditation of the representation or power of attorney.
  • By stipulation in favor of another or for another.
  • The rights of children, girls, or adolescents will be exercised by the persons authorized to represent them.

All inquiries and complaints will be channeled through the means enabled by IMPULSO COMMUNICATION S.A.S, via the email impulsocommunication@gmail, which will adopt mechanisms to prove the filing and processing of the same.

These are the guidelines for addressing inquiries and complaints:

Inquiries

All inquiries made by the persons legitimized to know the personal data held by IMPULSO COMMUNICATION S.A.S will be channeled through the channels that IMPULSO COMMUNICATION S.A.S has for this purpose. In any case, it is necessary to leave proof of the following:

  • Date of receipt of the inquiry
  • Identity of the requester

Once the identity of the holder is verified, the requested personal data will be provided. The response to the inquiry must be communicated to the requester in a.

Maximum term of ten (10) business days counted from the date of receipt of the same. When it is not possible to address the inquiry within this term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

Claims

Claims aim to correct, update, or delete data or to raise a complaint for the alleged non-compliance with any of the duties contained in Law 1581 of 2012 and in this policy. The claim must be submitted through a request addressed to IMPULSO COMMUNICATION S.A.S that contains the following information:

• Name and identification of the data subject or the legitimized person. • Precise and complete description of the facts that give rise to the claim. • Physical or electronic address to send the response and inform about the status of the process. • Documents and other relevant evidence that you wish to assert. • If the claim is incomplete, the interested party will be required within five (5) business days following the receipt of the claim to remedy the deficiencies. Two (2) months after the date of the requirement, without the applicant presenting the required information, it will be understood that they have withdrawn the claim. If the claim is complete, a legend stating "claim in process" and the reason for it will be included in the database or information system, within a term not exceeding two (2) business days. This must be maintained until the claim is decided. The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to address the claim within this term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Person or area responsible for the protection of personal data

The Management of IMPULSO COMMUNICATION S.A.S is the department or person in charge of the data protection function, which can be contacted via email at impulsocommunication@gmail.com.

Video surveillance

• IMPULSO COMMUNICATION S.A.S uses various means of video surveillance installed in different internal and external sites of our facilities or offices. • IMPULSO COMMUNICATION S.A.S informs about the existence of these mechanisms by disseminating visible announcements of video surveillance.

 The information collected will be used for the safety of individuals, property, and facilities. This information may be used as evidence in any type of process before any type of authority and organization.

Other documents that are part of this policy

This policy will be preferentially applicable in case of any inconsistency regarding the treatment of personal data between the previous documents and this one.

Demonstrated responsibility regarding the treatment of personal data.

IMPULSO COMMUNICATION S.A.S will adopt the necessary measures to, if necessary, demonstrate before the Superintendence of Industry and Commerce (SIC) that it has implemented appropriate and effective measures to comply with its legal obligations regarding the treatment of personal data. Such measures will be consistent with the instructions that impact the SIC and the mandates of articles 26 and 27 of decree 1377 of 2013.

Effective date of this policy and duration of the database.

This policy was approved after the issuance of law 1581 of 2012 and modified to incorporate some aspects established by decrees 1377 of 2013, 886 of 2014, and 1074 of 2015, which is why it will come into effect from the twentieth (20) of October 2016. The purposes of the treatment of data were modified on the twenty-fifth (25) of August 2017. The duration of the database will be the reasonable and necessary time to fulfill the purposes of the treatment, taking into account the provisions of article 11 of decree 1377 of 2013.

 

Data of the person responsible for the treatment:

Name or corporate name: IMPULSO COMMUNICATION S.A.S

NIT: 901.998.689-5

Address: Calle 152 A # 13-21

Email: impulsocommunication@gmail.com.