1. Executive Summary:
Cárdenas Vega Asesores S.A.S., in compliance with the provisions of Law 1581 of 2012 on the protection of personal data, whose purpose is to “develop the constitutional right of all persons to know, update, and rectify information collected about them in databases or files,” hereby informs all its clients, suppliers, employees, and other persons whose personal data is contained in our databases that Cárdenas Vega Asesores S.A.S. respects the confidentiality and security of information and, therefore, is committed to safeguarding the data you have provided to us directly or through electronic means, among other mechanisms.
Cárdenas Vega Asesores S.A.S., in its capacity as holder of the information, guarantees that such information will be used solely in the strict exercise and development of its corporate purpose and, with your authorization, for the following purposes: maintaining communications; sending correspondence, messages, notices, certifications, or similar communications; providing or receiving services and/or products; evaluating service quality; and fulfilling contractual obligations with our clients, suppliers, and/or employees.
The purpose of this document is to provide data subjects and other interested parties with the policies governing the processing of information and personal data collected as part of the commercial activities carried out by Cárdenas Vega Asesores S.A.S. This document summarizes the rights established by law and the Constitution, the purposes of data processing, and the communication channels available for handling inquiries and complaints.
The data subject gives prior, express, and informed authorization for the processing of his or her personal data in accordance with this Policy.
2. Data Controller:
Cárdenas Vega Asesores S.A.S., a duly incorporated company identified by Tax Identification Number (N.I.T.) 900.688.400-0, with registered address at Carrera 17 # 150 - 52, Office 302, Bogotá, Colombia, whose website is www.cardenasvega.com and whose landline telephone numbers are (+57-1) 750 81 18 and 387 56 24, in compliance with the provisions of Law 1581 of 2012 and Decree 1074 of 2015, is the data controller responsible for processing the personal data of data subjects from whom it obtains authorization and shall make decisions regarding such data directly and independently.
3. General Provisions:
3.1. Legal Framework:
• Political Constitution of Colombia (Article 15)
• Law 1581 of 2012
• Law 1266 of 2008
• Decree 1074 of 2015
• Decree 1727 of 2009
• Colombian Constitutional Court Judgment C-1011 of 2008
• Colombian Constitutional Court Judgment C-748 of 2011
3.2. Sources of Information:
The data processed by Cárdenas Vega Asesores S.A.S., specifically the email addresses to which information has been sent, comes from the following sources: i) Clients and prospective clients of the company who have requested information about our services through our website, www.cardenasvega.com, or our email address,
3.3. Basic Terminology:
For the purposes of this Policy and in accordance with current personal data protection regulations, the following terminology shall apply:
Database: An organized collection of personal data subject to processing.
Data Subject: The natural person whose personal data is subject to processing.
Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.
Data Controller: A natural or legal person, public or private, who, acting individually or jointly with others, decides upon the database and/or the processing of personal data.
Data Processor: A natural or legal person, public or private, who, acting individually or jointly with others, processes personal data on behalf of the Data Controller.
User: A person involved in the processing of data.
Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among other information, data concerning a person's civil status, profession or occupation, and status as a merchant or public servant.
Private Data: Data that, due to its intimate or confidential nature, is relevant only to the data subject.
Sensitive Data: Data that affects the privacy of the data subject or whose improper use may result in discrimination, including data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations, or organizations promoting the interests of any political party or safeguarding the rights and guarantees of opposition political parties, as well as data concerning health, sex life, and biometric data.
Transmission: Communication of personal data within or outside Colombia for processing by a Data Processor on behalf of the Data Controller.
Transfer: Communication of personal data to another recipient who, in turn, acts as a Data Controller located outside Colombia.
Privacy Notice: Verbal or written communication issued to inform the data subject about the processing of his or her personal data; the policies adopted by Cárdenas Vega Asesores S.A.S. in this regard, including how to access such policies and the purposes for which personal data is intended to be processed.
4. Rights of Data Subjects:
Cárdenas Vega Asesores S.A.S. recognizes and guarantees the following rights of personal data subjects, in accordance with all provisions set forth in this Policy:
• To access, know, update, rectify, or delete their personal data held by Cárdenas Vega Asesores S.A.S., in its capacity as Data Controller or Data Processor.
• To request proof of the authorization granted for the processing of their data, except in cases exempted by law:
1. Medical or health emergencies.
2. Processing of information authorized by law for historical, statistical, or scientific purposes.
3. Data related to the civil registry of persons.
4. Information required by a public or administrative entity in the exercise of its statutory duties or pursuant to a court order.
5. Publicly available data.
6. Alternative mechanisms (Article 10 of Decree 1377 of 2013, compiled in Chapter 25 of Decree 1074 of 2015).
7. Pursuant to a statutory or judicial mandate.
• To receive information regarding the use of their personal data.
• To revoke authorization and/or request the deletion of data when the processing fails to comply with constitutional and statutory principles, rights, and guarantees.
• To know the department or person authorized by Cárdenas Vega Asesores S.A.S. before whom complaints, inquiries, claims, and any other requests concerning their Personal Data may be submitted.
• To file complaints with the Superintendence of Industry and Commerce for violations of the Law.
4.1. Rights of Children and Adolescents
When processing personal data, the prevailing rights of minors shall be respected.
The processing of minors' personal data, except for data that is public in nature, shall comply with the following requirements:
1. Serve and respect the best interests of minors.
2. Ensure respect for the fundamental rights of minors.
3. For the processing of the personal data of a child or adolescent, prior authorization must be granted by the minor's legal representative.
It is the responsibility of the State and educational institutions of all kinds to provide information and training to legal representatives and guardians regarding the potential risks faced by children and adolescents as a result of the improper processing of their personal data and to provide knowledge concerning the responsible and secure use of personal data by children and adolescents, their right to privacy, and the protection of their own personal information and that of others.
5. Duties as Data Controller or Data Processor:
In the processing and protection of personal data, Cárdenas Vega Asesores S.A.S. shall have the following duties, without prejudice to any other duties established in provisions that regulate or may subsequently regulate this matter:
• Guarantee the data subject all the rights mentioned above and any other rights established by law.
• Request and retain, under the conditions established by law, a copy of the authorization granted by the data subject.
• Safeguard information under the security conditions necessary to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
• Comply with the guiding principles governing the processing of personal data.
• Use the data subject's personal data solely for purposes for which it has been duly authorized and, in all cases, in compliance with current personal data protection regulations.
• Ensure the appropriate use of the personal data of children and adolescents in cases where the processing of such data is authorized.
6. Processing:
The information contained in the databases of Cárdenas Vega Asesores S.A.S. is subject to various forms of processing, including collection, storage, organization, use, circulation, transmission, transfer, updating, rectification, suppression, deletion, and, in general, the performance of any operation involving such data, in accordance with the purposes established in this Policy and for which authorization has been obtained.
The information is provided by the client through service request forms together with the corresponding request for authorization. In addition to the foregoing method, information is also collected through the website using the form designed for this purpose, together with the corresponding request for authorization.
The databases obtained by Cárdenas Vega Asesores S.A.S. are neither sold nor rented to third parties and are maintained with the highest possible level of privacy, with access restricted by username and password and controlled by an administrator.
Through this Policy, Cárdenas Vega Asesores S.A.S., in compliance with its statutory and regulatory duties, seeks to give effect to the constitutional guarantee of privacy protection for all citizens by establishing efficient instruments and controls to ensure the appropriate processing of the information it manages.
This Policy establishes the terms, conditions, and purposes under which Cárdenas Vega Asesores S.A.S., as the controller of personal data obtained through its various service channels, processes the information of all persons who, at any time and as a result of the activities carried out by the company, have provided personal data.
The data subject registers or provides his or her information freely and voluntarily and acknowledges having read and expressly accepted these terms and conditions.
Cárdenas Vega Asesores S.A.S. directly processes personal data; however, it reserves the right to delegate such processing to a third party.
The databases obtained by Cárdenas Vega Asesores S.A.S. are neither sold nor rented to third parties and are maintained with the highest possible level of privacy.
7. Purposes:
Personal data stored in the databases of Cárdenas Vega Asesores S.A.S. may be used for the following purposes:
1) Carrying out various procedures directly related to its corporate purpose.
2) Keeping data subjects and other interested parties informed about the conditions governing the provision of services.
3) Providing information about updates to our services.
4) Providing additional relevant information about our services.
5) Maintaining communication with data subjects with a view to providing better service.
6) Performing obligations arising from the contractual relationship between the company and the client.
7) Conducting employee recruitment, evaluation, and hiring processes.
8) Collecting outstanding accounts receivable.
9) Adopting measures to prevent unlawful activities and for other tax-related purposes in accordance with applicable law.
10) Providing, sharing, sending, or delivering personal data to affiliates, related companies, or subsidiaries of Cárdenas Vega Asesores S.A.S. located in Colombia or any other country, should such companies require the information for the purposes stated herein.
11) Supporting internal or external audit processes.
12) Sending commercial, advertising, or promotional information concerning products and/or services, events, and/or commercial or non-commercial promotions to physical or electronic addresses, mobile phones, or mobile devices via text messages (SMS and/or MMS), or through any other analogous and/or digital means of communication, whether currently existing or developed in the future, for the purpose of promoting, inviting, directing, carrying out, informing, and generally conducting commercial or advertising campaigns, promotions, or contests undertaken by Cárdenas Vega Asesores S.A.S. and/or third parties.
Information concerning current or former clients, suppliers, partners, and employees is retained for the purpose of facilitating, promoting, enabling, or maintaining employment, civil, and commercial relationships.
It is the client's duty to guarantee the accuracy of the data provided by the client and of any data for which the client is responsible. Cárdenas Vega Asesores S.A.S. reserves the right to take any necessary measures in the event that such data is false or inaccurate.
Cárdenas Vega Asesores S.A.S. has adopted available technical and administrative security measures to protect the data under its responsibility. However, the client must understand that such measures are not impenetrable and are subject to continuous review and improvement.
8. Term of Processing:
This Policy shall be effective as of October nineteenth (19), 2017, and the databases shall remain in effect for as long as the relevant purpose or purposes continue to exist or for such period as may be specifically required by a statutory, contractual, or judicial basis.
9. Authorization:
Authorization must be express, whether oral, written, or given through unequivocal conduct by the data subject that reasonably demonstrates that authorization has been granted. Such authorization must include the specific purposes of the processing for which consent is requested and must be obtained through any means that allows subsequent consultation.
Except in the cases established in Law 1581 of 2012 and Decree 1074 of 2015, as well as in any other regulations that regulate, supplement, implement, complement, amend, repeal, or replace them, where prior authorization from the data subject is required, Cárdenas Vega Asesores S.A.S. shall request such authorization when collecting the information.
9.1. Cases in Which the Data Subject's Authorization Is Not Required:
1. Medical or health emergencies.
2. Processing of information authorized by law for historical, statistical, or scientific purposes.
3. Data related to the civil registry of persons.
4. Information required by a public or administrative entity in the exercise of its statutory duties or pursuant to a court order.
5. Publicly available data.
6. Alternative mechanisms (Article 10 of Decree 1377 of 2013, compiled in Chapter 25 of Decree 1074 of 2015).
7. Pursuant to a statutory or judicial mandate.
10. Guiding Principles Governing Personal Data Processing:
Principle of Legality: The processing of data by Cárdenas Vega Asesores S.A.S. must serve legitimate purposes and comply with the provisions of the Law.
Principle of Purpose Limitation: Processing must be carried out in accordance with the purposes established in the information processing policies and solely for the performance of activities entrusted by the Data Controller or the data subject.
Principle of Freedom: Processing shall only be carried out with the prior, express, and informed consent of the data subject. Data may not be disclosed without prior consent or judicial authorization.
Principle of Accuracy or Quality: Processed information must be truthful, complete, accurate, updated, verifiable, and understandable.
Principle of Transparency: Cárdenas Vega Asesores S.A.S. guarantees all data subjects the right to access and know the information concerning them that is being processed.
Principle of Restricted Access and Circulation: Access to information shall be restricted according to the nature of the data, the authorizations granted by the data subject, and the procedures established in this manual.
Principle of Security: Information processed by Cárdenas Vega Asesores S.A.S. shall be protected through the technical, human, and administrative measures necessary to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
Principle of Confidentiality: Cárdenas Vega Asesores S.A.S. guarantees the confidentiality of information during and after the completion of data processing. Data may only be disclosed to third parties when permitted by law or with the prior authorization of the data subject.
11. Procedures for Data Subjects to Exercise Their Rights:
In compliance with personal data protection law and in accordance with the purpose of this Data Processing Policy, the rights of the data subject include the right to know, access, rectify, update, object to, and/or delete his or her personal data. These rights may be exercised in whole or in part by sending written notice to
12. Handling of Inquiries, Claims, and Requests:
To effectively address requests concerning the processing of personal data, the following communication channels are available to clients and data subjects for any questions, complaints, or requests associated with their rights under Law 1581 of 2012.
Email:
PBX in Bogotá: (+57-1) 750 81 18, 387 56 24
Correspondence address: Carrera 17 # 150 - 52, Office 302
These channels may be used by Personal Data Subjects or third parties authorized by law to act on their behalf for the purpose of exercising the following rights:
A). Inquiries: The Data Subject may consult his or her Personal Data free of charge. For this purpose, a request specifying the information sought may be submitted through any of the mechanisms indicated above.
The request shall be addressed by the Company within a maximum period of ten (10) business days from the date of receipt. If it is not possible to respond to the request within this period, the applicant shall be informed of the reasons for the delay and the date on which the inquiry will be addressed, which shall under no circumstances exceed five (5) business days following the expiration of the initial period.
B). Claims: In accordance with Article 14 of Law 1581 of 2012, when the Data Subject or his or her successors consider that information processed by the Company should be corrected, updated, or deleted, or when authorization should be revoked due to an alleged breach of any of the duties established by Law, they may submit a request to the Company, which shall be processed under the following rules:
The Data Subject or his or her successors must provide proof of identity, the identity of their representative, and the corresponding representation or stipulation for the benefit of another person. When the request is submitted by a person other than the Data Subject and it is not established that such person is acting on the Data Subject's behalf, the request shall be deemed not to have been submitted.
A request for rectification, updating, deletion, or revocation must be submitted through the channels made available by the Company and specified in this document and must contain, at a minimum, the following information:
a. The name and address of the Data Subject or any other means for receiving a response.
b. Documents establishing the identity of the applicant and, where applicable, the identity of the applicant's representative, together with the corresponding authorization.
c. A clear and precise description of the Personal Data in respect of which the Data Subject seeks to exercise any of his or her rights and the specific request being made.
The maximum period for responding to such a request shall be fifteen (15) business days from the day following its receipt. If it is not possible to respond within this period, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which shall under no circumstances exceed eight (8) business days following the expiration of the initial period.
If the claim is incomplete, the interested party shall be requested, within five (5) days following receipt thereof, to correct the deficiencies. If two (2) months elapse from the date of such request without the applicant providing the required information, the applicant shall be deemed to have withdrawn the claim. Once a complete claim has been received, a notation stating “claim pending” and the reason for the claim shall be entered in the Database within no more than two (2) business days. Such notation shall remain until the claim has been resolved.
C). Rectification and Updating: When claims seek rectification or updating, the Data Subject must specify the corrections to be made and provide documentation supporting the request.
D). Deletion: Personal Data shall be deleted through the total or partial removal of personal information, as requested by the Data Subject. However, the Company may refuse such request when the Data Subject is under a statutory or contractual obligation to remain in the Database.
13. Amendments:
Cárdenas Vega Asesores S.A.S. reserves the right to amend or update this Policy at any time and without prior notice. The updated version of the Policy shall always be available on the website www.cardenasvega.com, and any amendment shall take immediate effect upon publication on the website.
Personal Data that is stored, used, or transmitted shall remain in our Database, based on the principles of temporality and necessity, for as long as required to fulfill the purposes stated in this Policy for which such data was collected.