PERSONAL DATA PROCESSING POLICY

In order to comply with the provisions of Statutory Law 1581 of 2012, Decree 1074 of 2015 and other provisions that modify, add or complement them, TAURUS MARKETING BTL S.A.S., in its interest to make explicit its policies on the protection of personal data, establishes in this document the general provisions and necessary mechanisms that will guarantee the due application of the respective regulations,  In order to ensure all the rights that assist the holders, therefore, it informs the policy applicable to the entity for the treatment and protection of personal data.

The data controller is directly the company TAURUS MARKETING BTL S.A.S., identified with NIT 900952572-0, with address at Av Cr 19 # 118 – 30 Office 601 in the city of Bogotá D.C., email contacto@taurusmkt.com and web portal www.taurusmkt.com.

I. OBJECTIVE

To establish the criteria for the collection, storage, use, circulation and deletion of personal data, in order to protect the constitutional right of all persons to know, update and rectify the information that has been collected about them in databases or files owned  by TAURUS MARKETING BTL S.A.S., or whose processing has been entrusted to TAURUS MARKETING BTL S.A.S.,  and other constitutional rights, freedoms and guarantees, in accordance with Law 1581 of 2012 and Decree 1074 of 2015. TAURUS MARKETING BTL S.A.S., in all its actions, through its business units and by all means in which information is requested, physical, electronic, virtual, telephone access, via the web, etc., is committed to respect the rights of its customers, employees and third parties in general. Therefore, it adopts this policy manual of mandatory application in all activities involving the processing of personal data. These policies are mandatory and strictly complied with by all employees of TAURUS MARKETING BTL S.A.S., identified with Nit. 900952572-0.

II. SCOPE

This policy applies to all personal information registered in the databases of  TAURUS MARKETING BTL S.A.S., which acts as the data controller.

III. COMMITMENTS

This policy is mandatory and strictly complied with by TAURUS MARKETING BTL S.A.S., identified with Nit. 900952572-0.

IV. PROCESSING AND PURPOSE

The processing that TAURUS MARKETING BTL S.A.S., identified with NIT: 900952572-0, will  carry out with personal information will be as follows: The collection, storage, use, circulation of data, in compliance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, TAURUS MARKETING BTL S.A.S. Hereinafter, TAURUS MARKETING BTL adopts this policy for the processing of personal data, which will be informed to all the data subjects of the data collected or that in the future will be obtained in the exercise of all commercial or work activities established from any channel or medium. In this way, TAURUS MARKETING BTL states that it guarantees the rights of privacy, intimacy, good name and university autonomy, in the processing of personal data, and consequently all its actions will be governed by the principles of legality, purpose, freedom, veracity, quality, transparency, access and restricted circulation, security and confidentiality. All natural and/or legal persons who, in the development of different contractual, commercial, labor activities, among others, whether permanent or occasional, provide the company with any type of information or personal data, may know, update and rectify it.

The authorization for the processing of personal data allows TAURUS MARKETING BTL to collect, transfer, store, use, circulate, delete, share, update and transmit, for the purposes of fulfilling the objectives established by law in accordance with the nature of TAURUS MARKETING BTL S.A.S. In any case, the data subject will always have the option of revoking the authorization and/or requesting the deletion of the data. The data subject authorizes in a prior, express and informed manner the inclusion of their information in the databases managed by TAURUS MARKETING BTL when they make use of the www.taurusmkt.com website  and the other channels available for this purpose, as well as the processing and use of the same by TAURUS MARKETING BTL, its related, controlled or affiliated entities or by another entity with which it has a business relationship, in compliance with the purposes provided by the Law.

V. PROCESSING SENSITIVE DATA

The sensitive data collected will be treated strictly for the purposes authorized by the data subject, who will have the right to decide whether or not to provide the information considered sensitive.

The following is a list of sensitive data to be processed:

  • Racial or ethnic origin.
  • Political orientation.
  • Religious/philosophical convictions.
  • Membership of trade unions, social organizations, human rights organizations or political parties.
  • Health conditions
  • Sex life.
  • Biometric data (such as fingerprint, signature, and photo).

 

TAURUS MARKETING BTL will restrict the processing of sensitive personal data to what is strictly essential and will request prior and express consent from the data subjects informing them of the exclusive purpose of their processing. TAURUS MARKETING BTL uses and processes data classified as sensitive when:

  1. The processing has been expressly authorized by the data subject, except in cases where the granting of such authorization is not required by law.
  2. The processing is necessary to safeguard the vital interest of the data subject and data subject is physically or legally incapacitated. In these events, the legal representatives must grant the authorization.
  3. The processing refers to data that is necessary for the recognition, exercise or defence of a right in a legal process.
  4. The treatment has a historical, statistical or scientific purpose or, within the framework of improvement processes; the latter, provided that measures are adopted to suppress the identity of the data subjects or the data is dissociated, wich means that the sensitive data is separated from the identity of the data subject and is not identifiable or the owner of the sensitive data or data cannot be identified.

In addition to the above, TAURUS MARKETING BTL complies with the following obligations:

  1. Inform the data subject that because it is sensitive data, he or she is not obliged to authorize its processing.
  2. Inform the data subject explicitly and in advance, in addition to the general requirements of the authorization for the collection of any type of personal data, which data subject to processing are of a sensitive nature and the purpose of the processing, and obtain express consent.
  3. Not to condition any activity on the data subject providing sensitive personal data (unless there is a legal or contractual cause to do so).

 

TAURUS MARKETING BTL adheres to the general rule according to which the processing of sensitive data is prohibited by law except in the following cases:

  1. When the data subject has expressly authorized the processing.
  2. When the law does not require the exhaustion of said authorization.
  3. When the processing is necessary to safeguard the vital interest of the data subject.
  4. When the processing is carried out by a Foundation, NGO, association or any non-profit organization whose purpose is political, philosophical, religious or trade union.
  5. The processing is necessary for the recognition, exercise or defence of a right in a judicial proceeding.
  6. The processing obeys a historical, statistical or scientific purpose. In this case, the identities of the holders must be deleted.
VI. RIGHTS OF DATA SUBJECTS

The Data Subject is informed of the rights that the laws on the protection of personal data offer, which are listed below and that TAURUS MARKETING BTL guarantees them through compliance with the defined procedures:

  • Know, update and rectify your personal data.
  • Request proof of the authorization granted to the Entity[1].
  • To be informed by the Entity, upon request, regarding the use it has given to their personal data.
  • Submit to the Superintendence of Industry and Commerce complaints for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
  • Revoke the authorization and/or request the deletion of the data when the constitutional and legal principles, rights and guarantees are not respected in the processing. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that in the Processing, the Entity has engaged in conduct contrary to the law and the Constitution.
  • To access, free of charge, your personal data that has been subject to Processing, at least once each calendar month (if requested to do so by TAURUS MARKETING BTL), and whenever there are substantial modifications to the Policies established in this Manual that motivate new consultations.

The rights of the data subject may be exercised by the following persons: a) By the data subject, who must prove their identity in a sufficient manner by the different means available to TAURUS MARKETING BTL b) By their successors, who must prove such quality. c) By the representative and/or representative of the data subject, after accreditation of the representation or power of attorney. d) By public or administrative entities in the exercise of their legal functions or by court order. e) By the stipulation in favor of another or for another.

[1]  Law 1581 of 2012. Article 10. Cases in which authorization is not necessary. The authorization of the Owner will not be necessary in the case of: a) Information required by a public or administrative entity in the exercise of its legal functions or by court order; b) Data of a public nature; c) Cases of medical or health emergency; d) Processing of information authorized by law for historical, statistical or scientific purposes;   e) Data related to the Civil Registry of Persons.   Anyone who accesses personal data without prior authorisation must in any case comply with the provisions contained in this law. 

VII. ATTENTION TO QUERIES AND COMPLAINTS.

The area in charge of processing queries, complaints, claims and requests related to the processing and protection of the personal data of workers, customers, suppliers, and other data subjects of the personal data handled  by TAURUS MARKETING BTL S.A.S., in its databases, will be the administrative area, e-mail: contacto@taurusmkt.com.

 

TAURUS MARKETING BTL S.A.S., informs the data subject, that you can consult these terms and conditions in the link “Privacy Policy and Personal Data Processing” on our WEBSITE: www.taurusmkt.com

VIII. PROCEDURE FOR THE EXERCISE OF THE RIGHT OF HABEAS DATA

In compliance with the regulations on the protection of personal data, TAURUS MARKETING BTL S.A.S., presents the procedure and minimum requirements for the exercise of your rights:

For the filing and attention of your request, we ask you to provide the following information:

  • Full name and surname
  • Contact details (physical and/or e-mail adress and contact telephone numbers),
  • Means of receiving a response to your request,
  • Reason(s)/fact(s) giving rise to the complaint with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete, access information)
  • Signature (if applicable) and identification number.

The maximum term provided by law to resolve your claim is fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to attend to the claim within said term, TAURUS MARKETING BTL will inform the interested party of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. 

Once the terms indicated by Law 1581 of 2012 and the other rules that regulate or complement it have been complied with, the data subject who is denied, in whole or in part, the exercise of the rights of access, updating, rectification, deletion and revocation, may bring his case to the attention of the Superintendence of Industry and Commerce – Delegation for the Protection of Personal Data.

IX. ACCESS TO INFORMATION

The data subjects may consult the personal information that rests on them in the Databases whose processing is in charge of TAURUS MARKETING BTL and is not considered as exempt by Law. The Entity will provide them with all the information contained in the individual record or that is linked to the identification of the data subject. The query will be answered within a maximum term of ten (10) business days from the date of receipt of the same. When it is not possible to respond to the query within said period, the interested party will be informed, stating the reasons for the delay and indicating the date on which their query will be answered, which in no case may exceed five (5) business days following the expiration of the first term. Personal data may be consulted free of charge at least once every calendar month, if requested by the data subject  and whenever there are substantial modifications to the Policies established in this Manual that motivate new consultations.

X. EXCLUSIONS
  1. Databases or files maintained in an exclusively personal or domestic environment.
  2. Databases whose purpose is national security and defense and the prevention and control of money laundering and terrorist financing.
  3. Intelligence and counterintelligence databases.
  4. Journalistic databases and archives and other editorial content.
  5. Databases regulated by Law 1266 of 2008 (financial-credit data).
  6. DANE databases (Law 79 of 1993).
XI. DEFINITIONS

AUTHORIZATION: prior, express and informed consent of the data subject to carry out the processing of personal data.

PRIVACY NOTICE: verbal or written communication generated by the responsible party addressed to the data subject for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, the way to access them and the purposes of the processing that is intended to be given to the personal data.

DATABASE: an organised set of personal data that is subject to processing.

SUCCESSOR: person who has succeeded another by reason of the death of the latter (heir).

PERSONAL DATA: any piece of information linked to one or more specific or determinable persons or that can be associated with a natural or legal person.

PUBLIC DATA: it is the data that is not semi-private, private or sensitive. They are considered data

public, among others, data relating to the civil status of persons, their profession or trade and their status as merchants or public servants. By its nature, public data can be

contents, among others, in public registers, public documents, gazettes and official gazettes and

duly enforceable judicial judgments that are not subject to confidentiality.

SENSITIVE DATA: sensitive data is understood to be data that affects the privacy of the data subject  or whose improper use may lead to discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social or human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties.  as well as data relating to health, sex life, and biometric data.

ESSENTIAL DATA: these are understood as the personal data of the data subjects that are essential to carry out the activity of TAURUS MARKETING BTL S.A.S. The data of an indispensable nature must be provided by the holders of the same or those entitled to exercise these rights.

OPTIONAL DATA: are the data that TAURUS MARKETING BTL S.A.S. required to offer additional services in job offers, etc.

DATA PROCESSOR: natural or legal person, public or private, who by himself or in association with others, carries out the Processing of personal data on behalf of the Data Controller.

DATA PROTECTION LAW: is Law 1581 of 2012 and its regulatory decrees or the rules that modify, complement or replace them.

HABEAS DATA: the right of any person to know, update and rectify the information that has been collected about them in the database and in the files of public and private entities.

DATA CONTROLLER: natural or legal person, public or private, who by himself or in association with others, decides on the database and/or Processing of the data.

DATA SUBJECT: natural person whose personal data are subject to Processing.

PROCESSING: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

TRANSFER: Data transfer takes place when the controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the processing and is located inside or outside the country.

TRANSMISSION: processing of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a processing by the person in charge on behalf of the responsible party.

XII. PRINCIPLES

In the development, interpretation and application of Law 1581 of 2012, which dictates general provisions for the protection of personal data and the regulations that complement, modify or add to it, the following guiding principles will be applied in a harmonious and comprehensive manner:

a) PRINCIPLE OF LEGALITY: Data processing is a regulated activity that must be subject to the provisions of the law and the other provisions that develop it.

b) PURPOSE PRINCIPLE: the processing must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the data subject.

Regarding the collection of personal data, TAURUS MARKETING BTL S.A.S. will limit itself to those data that are pertinent and adequate for the purpose for which they were collected or requested; the General and Administrative Managers, etc., must inform the  data subject  the reason for which the information is requested and the specific use that will be given to it.

c) PRINCIPLE OF FREEDOM: the processing may only be exercised with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.

d) PRINCIPLE OF VERACITY OR QUALITY: the information subject to processing must be truthful, complete, exact, updated, verifiable and understandable. The processing of partial, incomplete, fragmented or misleading data is prohibited.

e) PRINCIPLE OF TRANSPARENCY: in the processing, the right of the data controller to obtain from the controller or the data processor, at any time and without restrictions, information about the existence of data concerning him/her must be guaranteed.

f) PRINCIPLE OF RESTRICTED ACCESS AND CIRCULATION: the processing is subject to the limits that derive from the nature of the personal data, the provisions of the law and the constitution.

In this sense, the processing may only be carried out by persons authorized by the data subject and/or by the persons provided for by law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the data subjects or third parties authorized by law.

g) SECURITY PRINCIPLE: the information subject to processing by TAURUS MARKETING BTL S.A.S., must be handled with the technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

h) PRINCIPLE OF CONFIDENTIALITY: TAURUS MARKETING BTL S.A.S., is obliged to guarantee the confidentiality of the information, even after the end of its relationship with any of the tasks included in the processing, being able to only provide or communicate personal data when this corresponds to the development of the activities authorized by law.

XIII. AUTHORIZATION FOR THE PROCESSING OF DATA OF CHILDREN AND ADOLESCENTS

In the Processing of data of children and adolescnets, respect for the prevailing rights of children and adolescents will be ensured. The Processing of personal data of children and adolescents is prohibited, except for data that are of a public nature. It is the task of the State and educational entities of all kinds to provide information and train legal representatives and guardians on the possible risks faced by children and adolescents with respect to the improper processing of their personal data, and to provide knowledge about the responsible and safe use by children.  of their personal data, their right to privacy and protection of their personal information and that of others. In cases in which TAURUS MARKETING BTL acts as the Person in Charge of the databases, the Responsible Party will be the guarantor of requesting the corresponding authorization from the Legal Representative of the children and adolescents and of guaranteeing TAURUS MARKETING BTL that the data is truthful, complete, accurate, updated, verifiable and understandable, in the terms of Law 1581 of 2012 and its regulatory decree.

XIV. AUTHORIZATION OF THE DATA SUBJECT

TAURUS MARKETING BTL has implemented mechanisms through technical means that facilitate the data subject to express it automatically; the authorization may be contained in a physical or electronic document, data message, by telephone, Internet, Websites, or in any other format that allows its subsequent consultation. Those obliged to comply with this policy must obtain from the data subject his/her prior, express and informed authorization to collect and process his/her personal data. This obligation is not necessary when it comes to information required by a public or administrative entity in the exercise of its legal functions or by court order, data of a public nature, cases of medical or health emergency, processing of information authorized by law for historical, statistical or scientific purposes and data related to the Civil Registry of Persons. TAURUS MARKETING BTL must keep proof of compliance with the provisions herein, and deliver a copy of it, at the request of the data subject, if requested. The Data Subject, by accepting this personal data processing policy, declares to be aware that TAURUS MARKETING BTL may provide this information to related or allied entities and to judicial or administrative entities and other State entities that, in the exercise of their functions, request this information. Likewise, it accepts that they may be subject to internal audit or external audit processes by companies in charge of this type of control. The foregoing, subject to the confidentiality of the information.

XV. PUBLIC DATA

TAURUS MARKETING BTL, warns that it processes personal data of a public nature and those contained in public registries without prior authorization of the data subject, the latter as it is a regulated public function recognized by law. This situation does not imply that the necessary measures are not adopted to guarantee compliance with the other principles and obligations contemplated in Law 1581 of 2012 and other regulations that regulate this matter.

XVI. INFORMATION SECURITY

TAURUS MARKETING BTL has security measures in place to protect the data of the Data Controllers and prevent their adulteration, loss, use and unauthorized access. TAURUS MARKETING BTL has an Information Security Incident Report Procedure, which specifies compliance with the requirements in terms of information security. In compliance with the principle of security established in current regulations, TAURUS MARKETING BTL will adopt the technical, human and administrative measures that are necessary to provide security to the records, preventing their adulteration, loss, consultation, use or unauthorized or fraudulent access.

XVII. MODIFICATIONS TO THE PERSONAL DATA PROCESSING POLICIES

TAURUS MARKETING BTL reserves the right to modify, at any time, unilaterally, its policies and procedures for the processing of personal data. Any changes will be posted and announced. In addition, previous versions of this personal data processing policy will be retained. The continued use of the services or non-disengagement from them by the Data Subject after the notification of the new guidelines constitutes acceptance of the same.

XVIII. NATIONAL DATABASE REGISTRY

TAURUS MARKETING BTL, will proceed in accordance with the current regulations and the regulations issued for this purpose by the National Government, to register its databases with the National Registry of Databases (NRD) which will be administered by the Superintendence of Industry and Commerce. The NRD., is the public directory of the databases subject to Processing that operate in the country; and that it will be freely consulted by citizens, in accordance with the regulations issued for this purpose by the National Government.

XIX. CLASSIFICATION OF THE DATABASES OF TAURUS MARKETING BTL S.A.S.

Customer Databases

They are manual or automated databases, which are structured, and which contain data of a public and private nature of legal and natural persons as merchants, which have voluntarily entered into a commercial relationship with the company.

Employee Databases

These are manual or automated databases, which contain data of natural persons who are linked to TAURUS MARKETING BTL for the purpose of processing them in compliance with legal and regulatory provisions. In this database, both private and public information, sensitive data and data of minors are incorporated. The processing of data for purposes other than the obligations arising from the employment relationship will require prior authorization from the data subject or his legal representative, as the case may be. Under no circumstances will TAURUS MARKETING BTL process sensitive data or data of minors without prior authorization.

Contractor and supplier databases

These are manual or automated databases, which contain data of natural persons who maintain a contractual and commercial relationship, whose processing is intended to comply with the contractual provisions stipulated by TAURUS MARKETING BTL for the acquisition of services and goods demanded by it for its normal operation or the fulfillment of some of its functions. This database contains personal, public, and private data, which are intended for the development of contractual relationships. The processing of this data for purposes other than the maintenance of the contractual relationship or the fulfilment of legal duties requires prior authorization from the data subject.

General Information Databases

These are manual or automated databases that contain personal information that is not public, sensitive or minor. They will be occasional for the fulfilment of specific purposes of TAURUS MARKETING BTL. The processing of these data will require prior authorization and information on the purposes of their processing, under the formats defined for this purpose by TAURUS MARKETING BTL or in general these physical databases containing personal information must be destroyed monthly to prevent their reproduction or improper use.

Inactive file databases

These are manual or automated databases that contain files or information of a personal and inactive nature collected in media other than those contained in the public records kept by TAURUS MARKETING BTL This information is stored under the archival and logistical principles defined in the Security Manual, guaranteeing its availability, location,  its integrity, confidentiality, and traceability of the information. The administration and conservation of the personal information stored in these databases will have the purpose of fulfilling the functions of TAURUS MARKETING BTL,  which will have the term of permanence established in the document retention tables indicated by the General Archive of the Nation and the other regulations that regulate the conservation of information.

Notwithstanding the foregoing, the data subjects stored in these databases may at any time exercise their rights of access, updating, rectification and deletion against the person responsible for the processing of this information in TAURUS MARKETING BTL.

XX. EFFECTIVE DATE

This policy is effective as of June 28, 2022.

The databases in which personal data will be recorded will be valid for the time in which the information is maintained and used for the purposes described in this policy. Once that purpose(s) is fulfilled and provided that there is no legal or contractual duty to keep your information, your data will be deleted from our databases.