Data Processing Policy

INVERSIONES LUNATI S.A.S.

    1. INTRODUCTION.

    In INVERSIONES LUNATI S.A.S., we care about the protection of your Personal Data, reason why, has decided to adopt this POLICY FOR THE TREATMENT OF PERSONAL DATA, in order to give full compliance with the provisions of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Articles 2.2.2.25.1.1, of Decree 1074 of 2015, in the other relevant and concordant rules with the matter or in any other rule that modifies, adds, replaces, modifies or complements them. In this policy we include information of interest, such as: type of data we collect and treat; the purposes of the treatment, the rights of the holder of the personal data; the mechanisms to enforce their rights as holder of the personal data; among other topics. This policy is addressed to: Workers, Contractors, Shareholders, Suppliers, Users, Customers, Visitors, Creditors, Debtors, among others. We request that you carefully read this Policy before accepting the processing of your data and/or making use of our services.

    1. RESPONSIBLE FOR DATA PROCESSING.

     

    Company name:Inversiones Lunati S.A.S
    Address:Bogotá, D.C.
    Address:Carrera 16 No. 109 - 34 Office 201
    E-mail address:lunatidian@hotmail.com
    Phone:4746655

     

    1. OBJECTIVE

    This Policy for the Treatment of Personal Data of INVERSIONES LUNATI S.A.S., aims to provide guarantees and security to any kind of data collected, complying with the provisions of the Constitution and the Law, and thus ensure that all persons involved feel secure about the management of their data.

    1. SCOPE

    This Manual shall apply to all persons with whom INVERSIONES LUNATI S.A.S. may have any type of labor, civil or commercial relationship, such as Employees, Contractors, Shareholders, Suppliers, Users, Customers, Visitors, Creditors, Debtors, among others.

    1. DEFINITIONS AND CONCEPTS.

    For the purposes of this policy, the following is understood as:

    AUTHORIZATION: Prior, express and informed consent of the Data Subject to carry out the Processing of personal data.

    PRIVACY NOTICE: Verbal or written communication generated by the responsible party, addressed to the Data Subject for the Processing of his/her personal data, by means of which he/she is informed about the existence of the information processing policies that will be applicable, the way to access them and the purposes of the Processing that is intended to be given to the personal data.

    DATA BASE: Organized set of personal data that is subject to Processing.

    PERSONAL DATA. It is any piece of information linked to one or several determined or determinable persons or that may be associated with a natural or legal person.

    PRIVATE DATA. It is data that, due to its intimate or reserved nature, is only relevant to the owner.

    PUBLIC DATA: Data that is not semi-private, private or sensitive. Public data includes, among others, data related to the civil status of individuals, their profession or trade, and their status as merchants or public servants. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed court rulings that are not subject to confidentiality.

    SEMI-PRIVATE DATA. Semi-private data is data that is not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of persons or to society in general, such as the financial and credit data on commercial activity or services referred to in Title IV of this law.

    SENSITIVE DATA: Sens itive data are understood as those that affect the privacy of the Data Subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life, and biometric data.

    PERSON IN CHARGE OF PROCESSING: Natural or legal person, public or private, who by himself or in association with others, performs the processing of personal data on behalf of the controller.

    SOURCE OF INFORMATION. It is the person, entity or organization that receives or knows personal data of the owners of the information, by virtue of a commercial or service relationship or of any other nature and that, due to legal or owner's authorization, provides such data to an information operator, which in turn will deliver it to the end user.

    INFORMATION OPERATOR. The information operator is the person, entity or organization that receives from the source personal data on several holders of the information, manages them and makes them known to the users under the parameters of this law.

    PERSON RESPONSIBLE FOR THE PROCESSING: Natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the processing of the data.

    HOLDER OF THE INFORMATION. It is the natural or legal person to whom the information contained in a database refers and subject of the right of habeas data and other rights and guarantees.

    TRANSFER: The transfer of data takes place when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is the Data Controller and is located inside or outside the country.

    TRANSMISSION: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when the purpose is the performance of a Processing by the Processor on behalf of the Controller.

    PROCESSING: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

    USER. The user is the natural or legal person who can access personal information of one or more owners of the information provided by the operator or by the source, or directly by the owner of the information.

    1. GUIDING PRINCIPLES.

    This Policy for the Treatment of Personal Data shall have the following guiding principles:

    PRINCIPLE OF ACCESS AND RESTRICTED CIRCULATION: The administration of personal data is subject to the limits derived from the nature of the personal data, the provisions of this law and the Constitution.

    PRINCIPLE OF CONFIDENTIALITY. All natural or legal persons involved in the administration of personal data that are not of a public nature are obliged at all times to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the administration of data, and may only supply or communicate data when this corresponds to the development of the activities authorized by law.

    PRINCIPLE OF PURPOSE: The administration of personal data must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject.

    PRINCIPLE OF LEGALITY: The data and the treatment that is done to them must be under the legal provisions and regulated by the same.

    PRINCIPLE OF FREEDOM: The administration of personal data can only be exercised with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent.

    PRINCIPLE OF SECURITY. The information that makes up the individual records constituting the data banks, as well as the information resulting from the queries made by its users, must be handled with the technical measures necessary to guarantee the security of the records, avoiding their adulteration, loss, consultation or unauthorized use.

    PRINCIPLE OF TEMPORALITY OF THE INFORMATION. The holder's information may not be provided to users or third parties when it ceases to serve the purpose of the database.

    PRINCIPLE OF TRANSPARENCY: The right of the Data Subject to obtain from the Controller or the Processor, at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed in the Processing.

    PRINCIPLE OF VERACITY OR QUALITY OF THE RECORDS OR DATA. The information contained in the data banks must be truthful, complete, accurate, updated, verifiable and understandable.

    1. PROCESSING OF PERSONAL DATA.

    The treatment to which the data will be subjected is as follows:

    • PUBLIC DATA.

    INVERSIONES LUNATI S.A.S., will treat, without prior authorization from the Holder, personal data of a public nature, the foregoing, is not due to failure to adopt necessary measures to ensure compliance with the principles and obligations under Law 1266 of 2008, Law 1581 of 2012, and Articles 2.2.2.2.25.1.1., and s.s., of Decree 1074 of 2015, and in the other pertinent and concordant regulations on the matter or in any other regulation that modifies, adds, substitutes, modifies or complements them.

    • SENSITIVE DATA.

    INVERSIONES LUNATI S.A.S., will restrict the treatment of sensitive personal data to what is strictly indispensable and will request prior and express consent from the owners (Legal Representatives, Power of Attorney, Causahabientes or others) informing about the exclusive purpose of its treatment.

    However, INVERSIONES LUNATI S.A.S., will use and treat the data classified as sensitive, when:

    1. The Data Subject has given his/her explicit authorization to such Processing, except in those cases where by law the granting of such authorization is not required.
    2. The Processing is necessary to safeguard the vital interest of the Data Subject and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.
    3. The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.
    4. The processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted.

     

    In addition to the above, INVERSIONES LUNATI S.A.S. shall comply with the following obligations:

     

    1. Inform the holder that since it is sensitive data, he/she is not obliged to authorize its processing.
    2. Inform the holder explicitly and in advance, in addition to the general requirements of authorization for the collection of any type of personal data, which data subject to processing are of a sensitive nature and the purpose of the processing, and obtain express consent.
    3. Not to make any activity conditional on the holder providing sensitive personal data (unless there is a legal or contractual cause to do so).

     

    • MINORS.

    The processing of personal data of children and adolescents is prohibited except in the case of data of a public nature, in accordance with the provisions of Article 7 of Law 1581 of 2012, and when such processing complies with the following requirements:

    1. That it responds to and respects the best interests of children and adolescents.
    2. To ensure respect for their fundamental rights.

    Once the above requirements have been met, the legal representative of the child or adolescent must grant authorization after the minor has exercised his or her right to be heard, an opinion that will be assessed taking into account the maturity, autonomy and capacity to understand the matter.

    All persons responsible and in charge involved in the processing of personal data of children and adolescents shall ensure the proper use of such data. For this purpose, the principles and obligations set forth in Law 1581 of 2012 and Articles 2.2.2.2.25.1.1. and s.s., of Decree 1074 of 2015 shall apply.

    Notwithstanding the foregoing, it should be noted that the family and society must ensure that those responsible and in charge of the processing of personal data of minors comply with the obligations established in Law 1581 of 2012 and in Articles 2.2.2.25.1.1. and s.s., of Decree 1074 of 2015. Now, in accordance with the provisions of the Political Constitution of Colombia in its Art. 44 and Art. 45 and in accordance with the Code of Children and Adolescents - Law 1098 of 2006, the rights of minors must be interpreted and applied in a prevalent manner and, therefore, must be observed with special care.

    1. RIGHTS OF THE HOLDERS OF PERSONAL DATA.

    INVERSIONES LUNATI S.A.S., recognizes and guarantees to the holders of personal data the following rights:

    1. To know, update and rectify their personal data with respect to the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized;
    2. Request proof of the authorization granted to the Data Controller except when expressly exempted as a requirement for the Processing.
    3. To be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been made of their personal data;
    4. To file before the Superintendence of Industry and Commerce complaints for violations of the provisions of this law and other regulations that modify, add or complement it;
    5. To revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the processing. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has incurred in conduct contrary to this law and the Constitution;
    6. Access free of charge to your personal data that have been subject to Processing.

    The rights of the Holders established may be exercised by the following persons:

    1. By the Data Subject, who must prove his or her identity sufficiently by the different means made available by the responsible party.
    2. By their successors in title, who must prove their status as such.
    3. By the representative and/or attorney-in-fact of the Holder, upon accreditation of the representation or power of attorney.
    4. By stipulation in favor of or for another.

    The rights of children or adolescents shall be exercised by the persons who are empowered to represent them.

    1. DUTIES OF DATA CONTROLLERS.

    Data Controllers shall comply with the following duties, without prejudice to the other provisions of this law and others governing their activity:

    1. Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data;
    2. Request and keep, under the conditions provided for in this law, a copy of the respective authorization granted by the Holder;
    3. Duly inform the Data Subject about the purpose of the collection and the rights he/she has by virtue of the authorization granted;
    4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access;
    5. Ensure that the information provided to the Data Processor is truthful, complete, accurate, updated, verifiable and understandable;
    6. Update the information, communicating in a timely manner to the Data Processor, all developments regarding the data previously provided and take other necessary measures to ensure that the information provided to it is kept up to date;
    7. Rectify the information when it is incorrect and communicate the pertinent to the Data Processor;
    8. To provide to the Data Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of this law;
    9. To require the Data Processor at all times to respect the security and privacy conditions of the Data Subject's information;
    10. To process the consultations and claims formulated under the terms set forth in this law;
    11. Adopt an internal manual of policies and procedures to ensure adequate compliance with this law and, in particular, for the handling of inquiries and complaints;
    12. Inform the Data Processor when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not been completed;
    13. Inform upon request of the Data Subject about the use given to his/her data;
    14. Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the Data Holders.
    15. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

     

    1. DUTIES OF DATA PROCESSORS.

    Data Processors shall comply with the following duties, without prejudice to the other provisions of this law and others governing their activity:

     

    1. Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data;
    2. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access;
    3. Timely update, rectification or deletion of data under the terms of this law;
    4. Update the information reported by the Data Controllers within five (5) business days from its receipt;
    5. To process the queries and claims formulated by the Holders under the terms set forth in this law;
    6. Adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, for the attention of queries and claims by the Holders;
    7. Register in the database the legend "claim in process" in the form regulated in the present law;
    8. Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of the personal data;
    9. Refrain from circulating information that is being disputed by the Holder and whose blocking has been ordered by the Superintendence of Industry and Commerce;
    10. Allow access to information only to those who can access it;
    11. Inform the Superintendence of Industry and Commerce when there are violations to the security codes and there are risks in the administration of the information of the Holders;
    12. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

     

    1. TREATMENT POLICIES OF PERSONAL DATA.

     

    • AUTORIZATION

    When data other than those of a public nature are processed, INVERSIONES LUNATI S.A.S. must request prior authorization for the processing of personal data by any means that can be used as evidence. However, and depending on the case, the authorization may be part of a format, form, contract, among others.

    Now, in relation to private personal data, the description of the purpose of data processing will be informed through the same specific document or attachment. However, INVERSIONES LUNATI S.A.S., will inform the owner of the data as follows:

    1. The processing to which your personal data will be subjected and the specific purpose of such processing.
    2. The rights you have as a holder.
    3. The web page, e-mail, physical address and other means of communication through which you may submit queries, complaints and/or claims to the data controller or data processor.

     

    • GRANTING OF THE AUTHORIZATION.

    The authorization may be recorded in a physical or electronic document, data message, or in any other format that guarantees its subsequent consultation, and by means of which it may be unequivocally concluded that, in the absence of the holder's conduct, the data would never have been stored in the database.

    The authorization will be generated by INVERSIONES LUNATI S.A.S., and will be made available to the holder prior to the processing of personal data.

    • PROOF OF AUTHORIZATION.

    INVERSIONES LUNATI S.A.S., will use the mechanisms it deems appropriate to demonstrate how and when it obtained the authorization from the holder (s) of the personal data for the processing of these. Thus, to comply with the above, Inversiones Lunati S.A.S. may establish physical or electronic files for this purpose.

     

    • CASES IN WHICH AUTHORIZATION IS NOT REQUIRED.

     

    The authorization of the owner of the data will not be necessary in the case of:

     

    1. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
    2. Data of a public nature.
    3. Cases of medical or sanitary emergency
    4. Processing of information authorized by law for historical, statistical or scientific purposes.
    5. Data related to the civil registry of persons

     

    1. OTHER RIGHTS.

     

    • RIGHT OF ACCESS TO INFORMATION.

    INVERSIONES LUNATI S.A.S., will guarantee the right of access to information in accordance with the provisions of Law 1581 of 2012, only to the holders of personal data, upon accreditation of the identity of the holder and legitimacy, making available to it, at no cost, the respective personal data processed, through any means of communication, including electronic media that allow direct access to the holder.

    However, access to the data shall be subject to the provisions of Article 2.2.2.2.25.4.2. of Decree 1074 of 2015.

    • RIGHT OF CONSULTATION.

    INVERSIONES LUNATI S.A.S., will guarantee the holder of the personal data the right of consultation in accordance with the provisions of Law 1581 of 2012. However, for this purpose, Inversiones Lunati S.A.S., will establish control measures to securely identify the owner of the personal data that makes the inquiry or request.

    With respect to the attention of requests for consultation of personal data, Inversiones Lunati S.A.S., will attend and process requests for consultation, within a maximum period of ten (10) working days from the date of receipt. In the event that a consultation request cannot be answered within the aforementioned term, the interested party will be informed before the expiration of the term the reasons why no response has been given to the consultation, which in no case may exceed five (5) working days following the expiration of the first term.

    • RIGHT TO CLAIM

    The Holder of private personal data may claim the correction, updating or deletion of such data when he/she notices an alleged breach of any of the duties and principles contained in this manual or in the existing or future regulations on Personal Data Protection.

    In accordance with the above, the claim may be submitted by the holder, taking into account the information indicated in Article 15 of Law 1581 of 2012. However, if the claim is incomplete, the holder may complete it within five (5) business days following the receipt of the claim, in order to correct the faults or errors. Now, if after two (2) months from the date of the requirement, without the applicant submitting the requested information, it will be understood that the claim has been abandoned. In the event that Inversiones Lunati S.A.S., for any situation is not competent to hear the claim will proceed to transfer it to the appropriate person within a maximum period of two (2) working days and inform the interested party of the situation. However, once Inversiones Lunati S.A.S., has received the complete claim, it proceeds to resolve the claim within a maximum period of fifteen (15) working days, counted from the day following the date of receipt. Finally, if it is not possible to address the claim within the indicated term, the interested party will be informed of this circumstance, alluding to the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) working days following the expiration of the first term.

     

    • RIGHT TO RECTIFY AND/OR UPDATE DATA.

    INVERSIONES LUNATI S.A.S., is obliged to rectify and update at the request of the holder, the personal information that is incomplete or inaccurate, in accordance with the procedure and terms indicated above, however, in requests for rectification and / or updating of data, the holder must indicate the corrections to be made and provide documentation to support your request.

     

    • RIGHT TO THE DELETION OF DATA.

    The Data Subject has the right, at any time, to request the deletion of his/her personal data, however, the following must be taken into account:

     

    1. That the data is not being processed in accordance with the principles, duties and obligations provided for in the current regulations on Personal Data Protection.
    2. That the data are no longer necessary or relevant for the purpose for which they were collected.
    3. That the period necessary for the fulfillment of the purposes for which they were collected has been exceeded.

    This deletion implies the total or partial elimination of personal information as requested by the owner of the data, however, it should be noted that the right of deletion is not an absolute right, since Inversiones Lunati SAS may deny or limit the exercise of this right when:

     

    1. The owner of the data has a legal or contractual duty to remain in the database.
    2. The deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
    3. The data is necessary to protect the legally protected interests of the holder; to carry out an action in the public interest, or to comply with an obligation legally acquired by the holder.
    4. The data are data of a public nature and correspond to public records, the purpose of which is to make them public.

     

    • RIGHT TO REVOKE THE AUTHORIZATION FOR DATA PROCESSING.

    Any holder of personal data may revoke consent to the processing of such data at any time, as long as it is not prevented by a legal or contractual provision.

    However, the right of revocation is not an absolute right and, therefore, Inversiones Lunati S.A.S., may deny or limit the exercise thereof when:

     

    1. The owner of the data has a legal or contractual duty to remain in the database.
    2. The revocation of the processing authorization hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
    3. The data is necessary to protect the legally protected interests of the holder; to carry out an action in the public interest, or to comply with an obligation legally acquired by the holder.
    4. The data are data of a public nature and correspond to public records, the purpose of which is to make them public.

     

    • DATA PROTECTION IN CONTRACTS.

    In all contracts that Inversiones Lunati S.A.S. may sign, it shall include clauses that determine in a prior and general manner the authorization in the processing of personal data related to the execution of each contract, which includes the authorization to collect, modify or correct the personal data of the corresponding holder.

     

    • TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES.

    In cases where Inversiones Lunati S.A.S., in the development of any of its functions, involves the transfer of personal data to third countries, shall be governed by the following conditions:

     

    1. The transfer of personal data to third countries will only be carried out when there is corresponding authorization from the holder and prior authorization from the SIC's Personal Data Delegation.
    2. Any processing that involves the transmission of data outside Colombian territory is considered an international transfer, whether it is a transfer of data or the purpose of providing a service to the data controller outside Colombia.
    3. Likewise, prior authorization must be obtained from the delegate for Personal Data Protection of the Superintendence of Industry and Commerce, when international transfers of data to countries that do not provide a certain level of protection are planned. This authorization may only be granted if adequate guarantees are obtained, such as contracts based on the standard clauses approved by the SIC, or the Binding Corporate Rules.
    4. The international transfer of data may be made upon request, establishing the purpose, the groups of interested parties or holders of personal information, the data to be transferred and the documentation that incorporates the guarantees required to obtain the authorization; which contains a description of the specific security measures to be adopted, both by Inversiones Lunati SAS and by the Responsible or Responsible for the data at its place of destination.
    5. Inversiones Lunati SAS will not request authorization when the international transfer of data is covered by any of the exceptions provided for in the Law and its Regulatory Decree.

     

    • GENERAL PROVISIONS.

    The following is established for the protection of personal, sensitive data and data of minors.

     

    1. Inversiones Lunati S.A.S., will obtain and use the personal data in the development of its corporate purpose, to comply with its legal duties and to attend in due form the relationship established with the owner of the data; in such a way that it will avoid requesting information unrelated to such purposes.
    2. Inversiones Lunati S.A.S., will use personal data in accordance with the purposes for which such data are obtained.
    3. The personal data will correspond to those of its employees, students, parents, clients, suppliers, administrators, and in general to those of all persons with whom it has a civil, labor or commercial relationship.
    4. Inversiones Lunati S.A.S., will obtain and use personal data whenever it is authorized to do so.
    5. Whenever the authorization of the holder is required for the processing of personal data, Inversiones Lunati S.A.S., shall:
      • Inform the owner about the purpose of such treatment and obtain the express and informed consent.
      • Obtain authorization prior to the processing of personal data.
      • Request the authorization through any means that allows its adequate conservation, as well as its later consultation.
    6. In the events that Inversiones Lunati S.A.S., requires to use personal data for a purpose other than the one initially informed, a new authorization must be obtained from the owner of the data.
    7. In the processing of data of minors, Inversiones Lunati S.A.S., will take into account the best interests of the same, as well as the prevalence of their rights. Additionally, in the events in which the rights of such minors are exercised by a third party, Inversiones Lunati S.A.S., will verify that the third party is authorized by law to do so.
    8. In the event that the information collected corresponds to Sensitive Data, Inversiones Lunati S.A.S., will inform the holder about the sensitive nature of the data provided and about the possibility of providing or not such information.
    9. Inversiones Lunati S.A.S., will ensure that the personal data in its files and databases are stored and managed in reasonable conditions of security and confidentiality.
    10. Personal data are confidential, except for those that are public.
    11. It is the responsibility of all employees of Inversiones Lunati S.A.S. to ensure the confidentiality and security of the information and to ensure that third parties who access it are also responsible for it.
    12. The duty of confidentiality of employees with respect to personal data to which they have access extends beyond the end of the activity carried out by the latter in connection with the processing.
    13. Inversiones Lunati S.A.S., will inform the competent authorities in the terms indicated by the Law the relevant situations related to the administration of personal data that are subject to processing by it.
    14. Inversiones Lunati S.A.S., will keep the files or databases containing personal data for the period required or permitted by current regulations.
    15. Inversiones Lunati S.A.S., will ensure that the databases containing personal data processed by them are registered under the terms of current regulations.
    16. Inversiones Lunati S.A.S., will incorporate to its processes the mechanisms so that the holders of personal data that it manages can know, update, rectify and delete their Personal Data, as well as to revoke the authorization that such holders have granted for its use, provided that such revocation according to the legal system is appropriate, that is, provided that the revocation of the authorization does not violate a legal or contractual duty.
    17. The procedures shall be adjusted in such a way that the consultations or claims of the holders are attended in a clear, simple and timely manner, and in any case, in a term that may not exceed the term provided for in the regulations in force.
    18. In internal procedures, Inversiones Lunati S.A.S., will adopt security measures in order to: i. avoid damage, loss, alteration, theft or destruction of personal data; ii. prevent the unauthorized use, access or treatment thereof; and iii . Incorporate personal data security criteria as an integral part of the acquisition, development and maintenance of information systems.

     

    1. PROCEDURE FOR EXERCISING THE RIGHT TO KNOW, UPDATE, RECTIFY, DELETE AND REVOKE THE AUTHORIZATION TO USE DATA.

    Any inquiry or claim regarding the rights of data owners may be filed in writing at Carrera 16 No. 109 - 34 Office 201 in the city of Bogotá, D.C., or by e-mail to lunatidian@hotmail.com attaching a photocopy of the identity document of the owner and a document that also proves its ownership according to law.

    Notwithstanding the foregoing, the rights of access, updating, rectification, deletion and revocation of the authorization of personal data are very personal and must be exercised only by the Data Holder. However, the owner may act through a legal representative or attorney-in-fact, in which case, such condition must be verified.

    Finally, when the terms established in Law 1581 of 2012 and in the other rules that regulate or complement it are fulfilled, the owner of the data who is denied, totally or partially, the exercise of the rights of access, updating, rectification, suppression and revocation may bring such situation to the attention of the National Authority for the Protection of Personal Data of the Superintendence of Industry and Commerce - Delegation for the Protection of Personal Data.

     

    • PROCEDURES

     

    • REQUESTS

    For the attention of petitions, a request must be filed, either physically or electronically, which must contain at least the following: date of request, facts, petitions, photocopy of identification document, physical and electronic address for notifications and telephone number. If acting through a legal representative or attorney-in-fact, such condition must be evidenced with an authentic or authenticated document proving such circumstance.

    Once the request has been filed with all the requirements, it will be answered within a maximum term of ten (10) working days from the date of its receipt. In the event that a request for consultation cannot be answered within the aforementioned term, the interested party shall be informed before the expiration of the term, the reasons for not answering the request, which in no case may exceed five (5) business days following the expiration of the first term.

     

    • INQUIRIES

    For the attention of consultations, a request must be filed, either physically or electronically, which must contain at least the following: date of request, facts, requests, photocopy of identification document, physical and electronic address for notifications and telephone number. If acting through a legal representative or attorney-in-fact, such condition must be evidenced with an authentic or authenticated document proving such circumstance.

    Once the request has been filed with all the requirements, it will be answered within a maximum term of ten (10) working days from the date of its receipt. In the event that a request for consultation cannot be answered within the aforementioned term, the interested party shall be informed before the expiration of the term, the reasons for not answering the request, which in no case may exceed five (5) business days following the expiration of the first term.

     

    • CLAIMS.

    The owner of the data who considers that the information contained in a database should be corrected, updated or deleted or when they notice the alleged breach of any of the duties contained in the regulations on Personal Data Protection, may file a complaint with the data controller, taking into account the provisions of Article 15 of Law 1581 of 2012 and in particular the following:

     

    1. If the claim is incomplete, the holder may complete it within five (5) business days following the receipt of the claim so that the faults can be corrected. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.
    2. In the event that the person who receives the claim is not competent to resolve it, it will be transferred to the corresponding person within a maximum term of two (2) business days and the interested party will be informed of such situation.

    In accordance with the above, it should be noted that the owner of the information may exercise his rights at any time, subject to compliance with the duly established requirements and in particular to the following:

     

    1. In requests for rectification and updating of personal data, the holder must indicate the corrections to be made and provide the documentation supporting the request.
    2. When the request is formulated by a person other than the owner and it is not accredited that he/she is acting in legitimate representation, it will be considered as not filed.

    On the other hand, the holder of the personal data has the right, at any time, to request the deletion of his personal data when:

     

    1. Consider that they are not being treated in accordance with the principles, duties and obligations set forth in the regulations in force.
    2. Are no longer necessary or relevant for the purpose for which they were collected.
    3. The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.

    Finally, for the attention of claims, rectifications, updating or deletion of data, the claim must be formulated, either in physical or electronic media by request addressed to Inversiones Lunati S.A.S., which must contain at least the following: date of request, clear and detailed description of the facts that give rise to the claim, photocopy of the identification document, physical and electronic address for notifications and telephone number. If acting through a legal representative or attorney-in-fact, such condition must be evidenced with an authentic or authenticated document that proves such circumstance.

    Now, the maximum term to address the claim will be fifteen (15) working days from the day following the date of receipt. When it is not possible to address the claim within that period, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

     

    • REVOCATION OF AUTHORIZATION.

    Any holder of personal data may revoke, at any time, the consent to the processing of such data as long as it is not prevented by a legal or contractual provision.

    In accordance with the above, for the attention of the request for revocation of authorizations, it must be made in writing, either in physical or electronic form by request addressed to Inversiones Lunati SAS, which must contain at least the following: date of request, clear and detailed description of the facts that give rise to the claim, photocopy of the identification document, physical and electronic address for notifications and telephone number. If acting through a legal representative or proxy must prove such condition with authentic or authenticated document proving such circumstance.

    Now, the maximum term to address the claim will be fifteen (15) working days from the day following the date of receipt. When it is not possible to address the claim within that period, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

     

    1. RESPONSIBLE FOR ATTENDING TO REQUESTS, INQUIRIES AND COMPLAINTS.

    INVERSIONES LUNATI S.A.S., an entity with its main address in the city of Bogotá, D.C., shall be responsible for the attention of requests, queries and claims.

    The data of INVERSIONES LUNATI S.A.S., for the receipt of requests, inquiries and complaints is as follows:

     

    Address:Carrera 16 No. 109 - 34 Office 201
    E-mail address:lunatidian@hotmail.com
    Phone:4746655

     

    1. LEGAL FRAMEWORK.

    This Manual has been prepared in accordance with the following standards: i). Political Constitution of Colombia; ii). Law 1266 of 2008; iii). Law 1581 of 2012; and iv) Decree 1074 of 2015.

     

    1. CONTACT US.

    In order to request more information, you may contact INVERSIONES LUNATI S.A.S., through the following communication channels:

     

    • By means of written communication to the following address: Carrera 16 No. 109 - 34 Office 201 - Bogotá, D.C.
    • By means of written communication through the following e-mail: lunatidian@hotmail.com
    • Phone number: 4746655

     

    1. VALIDITY.

    This Policy is effective as of March 12, 2023.

    However, Inversiones Lunati S.A.S., may modify the terms and conditions of this policy as part of the effort to comply with the obligations established by Law 1581 of 2012, regulatory decrees and other rules that complement, modify or repeal the contents of this document. In cases where this occurs the new document will be published on the website of Inversiones Lunati SAS: https://latucha.com/