Privacy and Personal Data Protection Policy of LTM3 SAS
The following is the Privacy and Personal Data Protection Policy (hereinafter the Privacy Policy) applicable to persons who provide their personal data (hereinafter the ‘Data Subject’) to the company LTM3 SAS (hereinafter ‘LTM3’, ‘The Company’ or We‘), which will be included in LTM3’s databases and will be subject to Processing by said company.
The right to Habeas Data according to the law is the right of every person to know, update and rectify the information that has been collected about him/her in files and data banks of public or private nature and it guarantees all citizens the power of decision and control over their Personal Information.
In this Privacy Policy, The Company defines the general guidelines that are taken into account in order to protect the Personal Data of the Data Subjects (hereinafter ‘The Data Subjects’ or ‘You’), the purpose of the collection of the information, the rights of the Data Subjects, the area responsible for dealing with complaints and claims, as well as the procedures that must be exhausted to know, update, rectify and delete the information.
The legal framework defined shall be the following, without prejudice to the laws, decrees and in general regulations that clarify, replace or modify them:
-
Constitución Política, artículo 15;
-
Ley 1266 de 2008, Ley 1581 de 2012 y Ley 2300 de 2023;
-
Decretos Reglamentarios 1727 de 2009 y 2952 de 2010;
-
Decreto Reglamentario parcial No 1377 de 2013; y
-
Sentencias de la Corte Constitucional C – 1011 de 2008, y C - 748 del 2011
1. Data Controller and Data Processor:
LTM3 S.A.S., a company domiciled in the city of Bogotá D.C., established by Private Document of Shareholders' Meeting of May 31, 2010, registered in the Chamber of Commerce of Bogotá D.C. on June 4, 2010, with Commercial Registration Number 01997626 and NIT No. 900.361992-4.
The Data Controllers will be all those third parties to whom The Company transmits the data of the Data Subjects.
The Data Processors shall be all those third parties to whom The Company transfers the data of the Data Controllers. The Processors shall be subject to this Privacy Policy and shall carry out the Processing in the manner strictly ordered by The Company, with the consent of the Data Subjects. Likewise, The Company, on occasions, will act as Data Processor whose responsible parties are The Company's clients; in these cases, the Processing carried out on such data shall be subject to the instructions and the Privacy and Data Processing Policy of the client, as well as to the principles that govern the right of Habeas Data in Colombia; in any case, it shall ensure, to the greatest extent possible, the conservation and security of the information, using reasonable and suitable technical and technological means for this purpose.
2. Scope of the Privacy Policy
This Privacy Policy shall apply to all Databases and/or files containing Personal Data that are subject to Processing by LTM3, in the events in which it is considered responsible and/or in charge of the Processing of Personal Data of natural persons, in accordance with the provisions of the Statutory Law 1581 of 2012, Decree 1377 of 2013 and other regulations that hereinafter modify and/or add to them.
3.Definitions:
3.1. Personal Data: Any information linked or that can be associated with one or more specific or determinable natural persons (hereinafter ‘Personal Data’ or ‘Personal Information’).
3.2. Database: Any organised collection of Personal Data that is the subject of Processing.
3.3. Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.
3.4. Data Processor: Natural or legal person, public or private, that by itself or in association with others, carries out the Processing of Personal Data on behalf of the Controller.
3.5. Controller: Natural or legal person, public or private, who alone or in association with others, decides on the Database and/or the Processing of the data.
3.6. Data Subject: Natural person whose Personal Data is the subject of Processing.
3.7. Transmission of Data: Transmission of Personal Data that involves the communication thereof within or outside the territory of the Republic of Colombia when the purpose of the Processing is carried out by the Processor on behalf of the Controller.
3.8. Transfer of Data: The transfer of data takes place when the Controller and/or Processor of the Processing of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is the Controller of the Processing and is located inside or outside the country.
3.9. Sensitive Data: Sensitive data is understood to be data that affects the privacy of the Data Controller or whose improper use may affect the privacy of the Data Controller or the potential to generate discrimination against the Data Controller.
3.10. Public Data: Data that are not semi-private, private or sensitive. Data relating to the marital status of individuals, their profession or trade and their status as merchants or public servants, among others, are considered public data.
3.11. Cookies: these are data files that are generated in the browser and hard drive of computers, smartphones, tablets or any other device from which the Holder accesses a website. By means of this data, information is collected about the preferences and actions of the Data Subject when browsing. This data is also used to personalise the data subject's experience.
4. Processing of Personal Data by LTM3:
LTM3, in the development of its corporate purpose and economic activity, acts as Controller and/or Processor of personal data contained in its databases. Consequently, it collects, stores, uses, transmits, transfers and deletes personal data of natural persons with whom it has or has had some kind of relationship, whatever its nature (civil, commercial and/or labour); among which are included, but not limited to suppliers, contractors, workers, former workers, creditors, customers (tenants, users, guests), debtors, customers and shareholders. through different means such as physical or virtual media (hereinafter the ‘Personal Information’).
I. POTENTIAL CUSTOMERS:
For the purposes of carrying out its commercial activity, the Company collects information from natural persons, as well as the personal data of natural persons linked to legal persons.
The Company collects data through different channels such as, but not limited to, registration on the Company's website, as well as calls by the Data Subjects to our contact numbers, booking through our electronic means or third parties. The Processing of Personal Data of potential customers that is collected is subject to this Data Processing Policy, whereby Data Subjects expressly authorise the use of their Personal Data for some or all of the following purposes:
1. Registration in The Company's systems.
2. Fulfilment of the obligations undertaken by us.
3. Strengthening business relationships by sending relevant information about The Company's products and business conditions.
4. Preparation and delivery of reports requested by State entities.
5. Contacting you in the event of any problem or inconvenience with your registration.
6. Maintain statistical and administrative controls.
7. To store and classify the information provided by the Registrants for easy identification.
8. Consult, compare and evaluate all the information about the Data Subject stored in judicial or security background databases legitimately constituted, of state or private, national or foreign nature, or any commercial or service database that allows to comprehensively establish their commercial behaviour, including consultations in credit bureaus, lists for the prevention and control of money laundering and financing of terrorism.
9. Analyse, process, evaluate and compare the information provided by the holders.
10. Sending information of interest and invitations to events scheduled by The Company.
11. To comply with Colombian or foreign law and the orders of judicial and/or administrative authorities.
12. To comply with all obligations arising from the commercial or pre-contractual relationship with the Data Subjects.
13. To dispose of the personal information provided at the time of entering into the contract in order to comply with the obligations arising therefrom.
14. Contact the potential customer to offer products and/or services, send advertising or promotions of interest offered by Us, and in general to develop our corporate purpose.
15. Sending emails with general commercial information.
16. To make marketing communications, promotions and direct marketing campaigns by any means, whether virtual or physical. If you prefer, you may request to be removed from lists for the sending of promotional or advertising information.
17. Conduct internal studies to understand profiles, interests, behaviour, demographics, segmentations in order to understand the needs of the Data Subject, their interests and, consequently, provide better benefits and services based on the information provided.
18. Prevention and detection of fraud and other illegal activities.
19. Processing information on physical and digital media, ensuring the correct registration and use of The Company's websites, our marketing campaigns and special activities.
20. To send the Registrants emails as part of a news or Newsletter or updates related to our economic activity and services. In each email sent there is the possibility to request to be unsubscribed from this email list to stop receiving them, in accordance with the provisions of this Privacy Policy.
21. To authorise and monitor the entry and stay of individuals in the facilities of The Company. For the fulfilment of this purpose, The Company may also collect sensitive data related to the state of health of the holders requesting entry, vaccination cards, etc., in order to comply with the biosecurity measures established within the framework of the Occupational Health and Safety Management System.
22. To comply with legal obligations.
23. To contact the Data Controller in the event of any kind of problem or inconvenience
with the information provided; or in order to update contact details.
24. For other activities to be carried out by virtue of the
pre-contractual or commercial relationship
II. CUSTOMERS:
For the purposes of performing the services offered, The Company collects Personal Information of
natural persons, as well as Personal Information of legal representatives, some employees, contractors and/or subcontractors of clients - legal persons. Such collection is carried out through the conclusion and execution of contracts, through the registration of suppliers in the electronic invoicing platform used by The Company.
The Processing of Personal Data collected from customers is subject to this Privacy Policy, therefore, customers expressly authorize the use of their Personal Information for the purposes indicated herein and in the manner indicated herein. All Personal Data collected is necessary for the correct execution of the contractual obligations acquired, both by the client and by the Company. The Company collects personal and contact data from the natural persons with whom it contracts, as well as from natural persons who legally represent and/or are linked to The Company's clients, who, in general terms, are usually legal entities, whether or not they are incorporated in Colombia.
Bearing in mind that the relationship with customers - Legal Entity has an eminently commercial nature, The Company shall understand that any contact data it collects in this context is of a public nature when it concerns data used by persons in their capacity as traders. Furthermore, The Company shall understand that the provision of any contact data by any of its customers has been previously authorised to them by its owner.
The uses that We will make of your Personal Information, which you expressly consent to by registering as a customer on our Databases and providing us with your Personal Information, are set out below. The collection of Personal Information enables The Company's obligations to be fulfilled.
1) Customer registration in The Company's systems.
2) Fulfilment of obligations undertaken by us.
3) Processing of invoices.
4) Processing of payments made in favour of The Company and verification of outstanding balances.
5) Strengthening of business relations, sending relevant information about The Company's products and business conditions.
6) Preparation and delivery of reports requested by State entities.
7) To contact you in the event of any problem or inconvenience with your registration.
8) Maintain statistical and administrative controls.
9) To store and classify the information provided by the Registrants for easy identification.
10) Consult, compare and evaluate all the information about the Data Subject stored in judicial or security background databases legitimately constituted, of state or private, national or foreign nature, or any commercial or service database that allows to comprehensively establish their commercial behavior, including consultations in credit bureaus, lists for the prevention and control of money laundering and financing of terrorism.
11) Analyse, process, evaluate and compare the information provided by the Data Subjects.
12) Sending information of interest and invitations to events programmed by The Company.
13) To comply with Colombian or foreign law and the orders of judicial and/or administrative authorities.
13) To comply with Colombian or foreign law and the orders of judicial and/or administrative authorities.
14) Issuance of certifications relating to the relationship between the Data Subject and The Company.
15) Control of taxes related to the existing contractual relationship.
15) Control of taxes related to the existing contractual relationship.
16) To fulfil all obligations arising from the contractual relationship with Data Subjects, if any.
17) To dispose of the personal information provided at the time of signing the contract in order to comply with the obligations arising therefrom.
18) To carry out the billing, portfolio, collection and payment processes for products and services that have been provided by The Company and to send invoices either electronically, physically or by mail.
19) To contact the client to offer new products and services to the client.
20) Sending emails with commercial information in general or about current contractual relations.
21) To make marketing communications, promotions and direct marketing campaigns by any means, whether virtual or physical. If you prefer, you may request to be removed from lists for the sending of promotional or advertising information.
22) Internal research to understand profiles, interests, behaviour, demographics and segmentation for marketing and commercial purposes.
23) Conduct internal research to understand profiles, interests, behaviour, demographics and segmentation for marketing and commercial purposes.
24) Preventing and detecting fraud and other illegal activities
25) Processing information in physical and digital media, ensuring the correct
registration and use of The Company's websites, our marketing campaigns and special activities.
registration and use of The Company's websites, our marketing campaigns and special activities.
26) To send to the Data Subjects e-mails as part of a news or Newsletter or updates related to our economic activity and services. In each e-mail sent there is the possibility to request to be unsubscribed from this e-mail list in order to stop receiving them, in accordance with the provisions of this Privacy Policy.
27) To carry out marketing communications, promotions and direct marketing campaigns by any means, whether virtual or physical. If the holder prefers, he/she may request to be excluded from the lists for the sending of promotional or advertising information.
28) Authorise and monitor the entry and stay of individuals in the facilities of The Company. For the fulfilment of this purpose, The Company may also collect sensitive data related to the state of health of the owners requesting entry, vaccination cards, etc., in order to comply with the biosecurity measures established within the framework of the Occupational Health and Safety Management System.
29) To comply with legal obligations.
30) To contact the Holder in the event of any kind of problem or inconvenience with the information provided; or in order to update contact details.
31) For other activities that must be carried out by virtue of the commercial relationship.
31) For other activities that must be carried out by virtue of the commercial relationship.
III. HUMAN RESOURCES:
The Company processes the Personal Information of candidates, third parties linked for the provision of services, workers and their family groups and retired workers:
a. Candidate: Any natural person who expresses, by themselves or through a third party, by any physical or electronic means known or to be known, their interest in participating in selection processes carried out by The Company. The submission of your Personal Information, which may include, among others: (i) contact details; (ii) socioeconomic data; (iii) academic history; (iv) employment history; and, (v) third party data; implies, by itself, the unequivocal authorisation to The Company to process your personal data in accordance with this Privacy Policy.
By accepting this Privacy Policy, the Candidate, as Holder of the information, authorises The Company and the third parties that The Company designates, to carry out the Processing of the same, partially or totally, including the collection, storage, recording, use, circulation, processing, suppression, transmission and/or transfer to third parties under the terms of this Privacy Policy, for the purposes described in it and, especially, for:
1. The sending of e-mails, information related to selection processes, administration of vacancies available in The Company, recruitment processes and/or any other type of information directly and indirectly related to the fulfilment of the obligations related to the administration of Human Resources.
2. To carry out processes of verification and consultation of the veracity of information, personal and/or employment references, disciplinary and/or judicial records or those related to restrictive risk lists, prevention of money laundering, corruption and financing of terrorism.
3. Consult and update the information and personal data, at any time, as long as the information is kept in the Database.
4. Authorise and monitor the entry and stay of persons in the Company's facilities. For the fulfilment of this purpose, The Company may also collect sensitive data related to the state of health of the holders requesting entry, in order to comply with the biosecurity measures established within the framework of the Occupational Health and Safety Management System.
b. Third party linked for the provision of services: This is the natural person who provides services or supports the execution of some of The Company's processes through non-employment contracts or who is at the service of a contractor or supplier of goods and services, whether natural or legal person, who has entered into a civil or commercial contract with The Company, and who by reason of any of these contracts performs tasks or functions of operational, technical, administrative or commercial support (hereinafter, ‘Linked Third Party’).
The Personal Information of the Related Third Party may be obtained directly from the Related Third Party or through another natural or legal person who, in any case, has the express authorisation of the Related Third Party. The submission of the Personal Information of the Third Party Partner, which may include, among others: (i) contact details; (ii) socio-economic data; (iii) academic history; (iv) employment history; and, (v) data of other natural persons; implies, by itself, the unequivocal authorisation to The Company to carry out the processing of their personal data in accordance with this Privacy Policy.
By accepting this Privacy Policy, the Related Third Party, acting as the Data Subject, expressly authorises The Company or the third parties determined by it, to carry out the Processing of Personal Information, partially or totally, including the collection, storage, recording, use, circulation, processing, suppression, transmission and/or transfer to third parties under the terms of this Privacy Policy, for the purposes described therein and, especially, for:
1. Send information related to the processes and procedures of the administration of Human Resources, as well as any type of information directly and indirectly related to the execution of its functions on behalf of The Company
2. Directly manage and operate the selection and recruitment processes.
3. Verify the veracity of the information provided, consult personal and/or employment references, as well as consult the official portals for disciplinary and/or judicial records.
4. To consult and update the information and personal data, at any time, in order to keep such information up to date.
5. Authorise and monitor the entry and stay of persons on the Company's premises. For the fulfilment of this purpose, The Company may also collect sensitive data related to the state of health of the holders requesting entry, in order to comply with the biosecurity measures established within the framework of the Occupational Health and Safety Management System.
6. To carry out activities related to the administration of Human Resources, for example: affiliations and payments to the General System of Social Security and parafiscal, payroll and occupational health and safety issues.
7. Payment of wages and, in general, fulfilment of obligations under the employment contract.
8. Notifying authorised contacts in the event of an emergency during working hours or in the course of work
7. Payment of wages and, in general, fulfilment of obligations under the employment contract.
8. Notifying authorised contacts in the event of an emergency during working hours or in the course of work
9. Planning of business activities.
10. Sending information related to Human Resources administration processes and procedures, as well as any type of information directly and indirectly related to the performance of their duties for the benefit of The Company.
11. To consult and update the information and personal data, at any time, in order to keep such information up to date.
For the fulfilment of The Company's obligations as an employer, it is necessary to collect from the Employees the Personal Information of their family group.
The Personal Information will be treated with the maximum possible care.
This data will be processed with the highest security measures known and ensuring that the use of such information corresponds only to the fulfilment of the obligations that correspond to The Company as an employer. The data of the family group of the Workers shall be stored for the same term as the data of the Workers are kept, even when they become part of the database of retired workers, with the understanding that most of the data of the family group are collected to comply with purposes related to social security, social security and social security.
d. Retired Worker: This is the natural person who had an employment relationship with The Company, which ended for any of the legal causes established in the labour law. The processing of the data and Personal Information of Retired Workers is exempt from authorisation as it constitutes a legal obligation of the companies by virtue of Article 2.2.44.6.13 of Decree 1072/1992.
2.2.44.6.13 of Decree 1072 of 2015; which does not prevent its processing from adhering to the principles of the Colombian personal data protection regulations.
The purposes of this Processing are:
1. Issuance of certificates and other employment documents.
2. Archiving of documents relating to the Occupational Health and Safety Management System.
3. Responding to requests from governmental entities.
4. Filing of documents and responses to the entities of the General Social Security System.
5. Preparation of statistics and historical records of the Company.
By virtue of the foregoing, the data of Retired Workers shall be processed solely for the purposes indicated in Decree 1072 of 2015 or any regulation that amends or adds to it, and for the term established therein.
IV. SUPPLIERS (PRODUCTS AND SERVICES):
For the fulfilment of its activities and projects, The Company uses suppliers of products and services. The suppliers may be natural persons or legal entities.
a. Supply of products: The Personal Information of suppliers who are natural persons will be included in a Company database. Contracts entered into with natural persons shall constitute an unequivocal authorisation for the processing of their personal data by The Company. The processing of personal information shall be carried out in accordance with this Policy in terms of protection measures and authorised processing.
Also, for the execution of the contracts described in this section that are concluded with legal entities, The Company will receive Personal Information about, among others, employees, contractors, subcontractors and/or managers of the legal entity. This transfer of personal data is necessary for the performance of the contract; likewise, in such cases, The Company shall, as far as possible, endeavour to ensure that the supplier delivers only the corporate data of the individuals. The Company will incorporate such information in a Database and will treat it in accordance with the provisions of this Privacy Policy
Privacy Policy regarding protection measures and authorised processing for the purposes described for this type of information. The data will be kept by The Company for the duration of its commercial relationship with the supplier and, subsequently, for the duration of The Company's corporate purpose.
b. Provision of Services: The data of natural persons who provide their services directly for The Company or who do so through a contract entered into with a legal entity shall be processed in accordance with the provisions of the section on Related Third Parties.
In the event that the Data Subjects described in this chapter must enter the facilities of The Company to carry out the purpose for which they were hired, The Company shall collect sensitive data related to the state of health of the Data Subjects requesting entry in order to authorise and monitor the entry and stay of individuals in the facilities of The Company; the foregoing, in order to comply with the biosecurity measures established in the framework of the Occupational Health and Safety Management System.
V. SHAREHOLDERS:
By virtue of the provisions throughout the Colombian Code of Commerce, as well as the Colombian accounting standards, the shareholders of The Company have the legal obligation to register their Personal Data at the domicile of the company. To this extent, The Company will incorporate in its Databases, the Personal Information and contact details of Shareholders in order to guarantee their rights within the company. These data are collected and stored in accordance with the regulations on corporate matters; therefore, the authorisation of the Data Controllers for the Processing is understood to have been granted unequivocally from the moment of the beginning of their participation in the company. The personal data stored are those determined by Colombian law; these data may be updated at the request of the Data Controllers.
Shareholder information will be processed in accordance with the provisions of this Privacy Policy and, primarily, for the following purposes:
Such information will be processed in accordance with the provisions of this Privacy Policy and, primarily, for the following purposes:
Such as
1. To carry out any notation or transaction related to shareholder status.
2. To call ordinary and extraordinary meetings, as well as any other meeting required for the development of the Company's corporate purpose.
3. To attend to shareholder service and attention tasks.
4. To comply with any of the obligations contracted with our shareholders.
5. To inform shareholders of any relevant situation regarding the products or services offered by the Company.
6. Prevent, detect and monitor any activity or information that could be construed as fraud, unfair dealing or breach of confidentiality.
5. Use of the Privacy and Information Protection Policy:
5.1. LTM3 informs all holders of the Personal Data provided to it, either electronically or manually, that the Processing thereof shall be subject to this Privacy Policy. Consequently, if a Data Subject does not agree with this Privacy Policy, he/she will not be able to provide any information to be registered in one of LTM3's Databases.
5.2. LTM3 is committed to the security and proper use of the personal data provided to it and, consequently, is obliged to give them the appropriate uses and to maintain the confidentiality required for them in accordance with the provisions of this Privacy Policy and the existing legislation on the subject.
5.3. Personal Information may be transferred to its subsidiaries, affiliates and subordinates, as well as to real estate operators, third parties and judicial or administrative authorities, whether natural or legal persons, Colombian or foreign, in those events in which the transfer or transmission of the data is necessary to carry out the uses and activities authorized by the Holders in accordance with the corporate purpose of LTM3. In all events, such information will be kept under strict confidentiality and will be subjected to a rigorous treatment, respecting the rights and guarantees of its Holders.
5.4. In all events, LTM3 may collect information that is in the public domain to supplement the databases. Such information will be given the same treatment as indicated in this Privacy Policy.
5.5. Specifically, but without limitation, We may use service providers and data processors working on behalf of The Company in the conduct of our business and activities. Such services may include, but are not limited to, system hosting and maintenance services, analytics, email messaging, marketing activities, collection and/or portfolio or insurance policy management, delivery, payment transaction management, and credit and address checks. Consequently, the authorisation granted to The Company for the processing of your personal data includes the power to transmit your data to the necessary third parties in order for them to perform the services described above. In this case, The Company, in its capacity as Data Controller, will include in the contracts it enters into, the obligations inherent to a third party Data Processor.
It is important to clarify that The Company has taken and will take all necessary actions to ensure that both service providers and processors working on our behalf, as well as other authorised third parties in accordance with this Privacy Policy, protect, in all events, the confidentiality of the Personal Information in their charge.
5.6 The Data Subject shall be responsible, in any case, for the veracity of the data provided, and The Company reserves the right to exclude from the registered services any Data Subject who has provided false data.
The Company may collect information that is in the public domain to supplement the databases; such information will be given the same treatment indicated in this Privacy Policy, however, the treatment of the latter will not be subject to obtaining authorization from the Data Subject.
5.6 The duration of the Processing of Personal Information shall depend on the fulfillment of the purpose for which it was collected, therefore, the Personal Information provided by the Data Controllers shall remain in the corresponding Database and shall be processed until the purpose is fulfilled and, in any case, for a maximum term of twenty (20) years, counted from the date of the last Processing. The above to allow compliance with legal and/or contractual obligations, especially in accounting, labour, fiscal and tax matters; or, for all the time necessary to comply with the provisions applicable to the matter in question, the administrative, accounting, fiscal, legal and historical aspects of the information or, in any event provided for by law and the provision of the service.
6. Effects of the Authorisation:
6.1 For all purposes, it is understood that the express and informed authorisation granted by the Data Controllers in favour of LTM3 for the Processing of their Personal Data, whatever the means (written, oral or through unequivocal conduct), implies the understanding and full acceptance of the entire content of this Privacy Policy.
6.2 It is essential to state that, in the event of a sale, merger, consolidation, change in corporate control, substantial transfer of assets, reorganisation or liquidation of the Company, the latter may transfer the Personal Information to the parties of the Company.
6.2 It is essential to state that, in the event of a sale, merger, consolidation, change in corporate control, substantial transfer of assets, reorganisation or liquidation of The Company, The Company may transfer Personal Information to the parties involved, for which it is deemed authorised under this Privacy Policy.
6.3 Cases in which The Company does not require Authorisation for the Processing of the Data in its possession:
6.3.1.
When the information is requested from The Company by a public or administrative entity that is acting in the exercise of its legal functions or by court order.
When data of a public nature are involved because they are not protected by the scope of application of the regulation.
Events of medical or sanitary urgency duly verified.
In those events where the information is authorised by law to fulfil historical, statistical and scientific purposes.
When it concerns data related to the civil registry of persons because this information is not considered as data of a private nature.
When it concerns data related to the civil registry of persons because this information is not considered as data of a private nature.
Any others described in the applicable laws.
6.4 To whom information may be provided by The Company without the need for the Data Controller's authorisation
6.4 To whom information may be provided by The Company without the Data Controller's authorisation
1. To the Data Subjects, their heirs or representatives at any time and by any means when requested by The Company.
2. To the judicial or administrative entities in the exercise of their functions that make a request to the company for the information to be handed over.
3. To third parties that are authorised by any Law of the Republic of Colombia.
4. To third parties to whom the Data Subject expressly authorises the provision of the information and whose Authorisation is provided to the Company, in accordance with this Privacy Policy.
6.5 If, in the end, The Company does not have the authorization of the Data Subject to process the Personal Data in accordance with the terms and conditions set out in this Privacy Policy and requires it, as established in the Colombian legislation on habeas data, The Company will proceed to definitively delete all the Data for which it does not have authorization.
In the same way, if The Company no longer needs to use the Personal Data, the Personal Data will be deleted in its entirety.
6.6 Likewise, if the Data Subject does not want The Company to continue processing the Personal Data, he/she must inform The Company, through the procedures determined in the regulations on Personal Data Protection, which are also specified in this Privacy Policy. In any case, when a Data Subject requests the deletion of his/her Personal Data, or expresses his/her will to revoke the authorisation for the Processing of his/her Personal Data, The Company shall process his/her request according to the procedure determined in this Policy and, at the end of such procedure, shall determine whether, based on the type of relationship held with The Company and the continuity thereof, the deletion of the Data is appropriate or not. This decision shall be fully reasoned and a copy of the decision shall be delivered to the Data Subject within the established legal term.
7. Personal Information Collected:
Personal Information that LTM3 may collect and subject to Processing includes, but is not limited to the following:
a. Full name of the Data Subject;
b. Identification
c. Date of birth;
d. Nationality;
e. Domicile;
f. Contact address;
g. Contact telephone numbers;
h. E-mail address;
i. Bank accounts;
j. Financial Information;
k. Tax Information;
l. Employment Information;
m. Information on experience and track record in the field;
n. Socio-economic information;
o. Information on economic activities
p. Information on bank and/or commercial references
q. Vehicle number plate number
r. Credit history
s. Information from credit bureaus on money laundering control and terrorism prevention.
t. Information relating to social security
u. Medical information.
v. Such other information as is necessary for the performance of contractual or legal obligations.
8. Purposes and Uses of the Information:
The Company, Related and/or Related Parties, in the development of its object and its relations with third parties, understood by these users, employees, suppliers, creditors, customers, stakeholders among others; constantly collects data to carry out various purposes and uses within which the following can be framed, without prejudice to the others described in other sections of this Privacy Policy.
A los datos personales que le sean suppliedos a LTM3 se les dará un Tratamiento conforme a las siguientes finitos para el uso de la información, segun le applique a cada Titular, y que al acceptar la misma Usted expressamente autoriza:
a. Análisis de la Información Personal por parte de LTM3, sus vinculadas y/o thirdos subcontratados para fines internals de la empresa;
b. Darle Tratamiento a la información en medias físicas y digitales, ensuring the correct registration and the utilization of the web pages of LTM3 and its links;
c. Incluir y darle Tratamiento a la información acquirada en virtud de la relación existente entre los Titulares y LTM3, cualquiera que sea su naturaleza jurídica (labor, civil, commercial); d. Contact the Titular in the event that you generate some type of problem or inconvenience with the Personal Information;e. Contact the Titular to offer new products and/or services, show publicity or promotions of interest offered by LTM3;
f. Contactar al Titular para que participate (bien sea como asistente o como contratistas o provideros) en nuevos productos y/o servicios promovidos por LTM3 y/o sus clientes;
g. Enviar a los Titulares correos electronicos como parte de una newsi o Newsletter. En cada email envoyado existe la possibility de solicitar no estar inscrito en esta lista de correos electronicos para dejar de recibilors. Para esto el Titular debá notificar por escrito físico ó por vía e-mail al correo reservas@8010urbanliving.com
h. Enviar al Titular información sobre productos y/o servicios basados en la información que se obtenga de sus habitos de consumo;
i. Efectuar communications de mercado, promociones y campañas de marketing directo por cualquier medio bien be virtual o físico. If the holder prefers it, he can request that he be excluded from the lists for the sending of promotional or advertising information;
j. Prevent y detecter el fraude, así como otras actividades illegales;
Paragrafo: Se clara que en relación con la información de terceos relacionados con referencias bancarias y/o commerciales que los providos, contratistas, trabajadores, creedores, arrendatarios, usuarios, huéspedes, deudores, clientes y accionistas provean serán sólo utilizados para efectos de corroborar referencias y el responsable de otorgarlos garantia que tiene el derecho de darnos esta información para tales fines por lo que mantendrá indemne a LTM3 sobre cualquier reclamation de terceos en relación con el uso de dicha información para la corroboración de referencias.
k. Pagos de créditos, salarios, honorarios y control de los impuestos relacionados con el vínculo contractual existente.
l. Analyze the behavior and preferences of the Owners inside the web page and other virtual platforms of the Company and improve the navigation experience of the Owner.
m. Cualquier otra finalidad que llegue a resultar en desarrollo del contrato o la relación comercial entre La Empresa y el Titular.
n. Búsqueda de un conocimiento más cercano con todos sus collaborators, clientes, usuarios, providers, empleados y terceros Vinculados.
o. Activities of georeferencing and statistical studies.
p. Store biometric data in the form of entry accesses, identifications, compliance for participation in events, among others.
q. Suportar los procesos de audit de la empresa
Here's the translation of the provided text: ---On some occasions, we may share your Personal Information with affiliated companies and/or third-party companies to carry out the development of the Company's purpose, for the development of promotional events, or for the dissemination of activities carried out by the company. We may also share your information if the Company reasonably believes it is necessary to protect itself, any of its users, or the general public.
9. Rights of Personal Information Holders:
You, as the holder of the Personal Information provided to LTM3, shall have the following rights:
(i) To know, update, and correct your personal data with the Company or the individuals or legal entities that the Company designates as Responsible for the Processing of your personal data. This right may be exercised, among other things, regarding partial, inaccurate, incomplete, misleading data, or data whose processing is expressly prohibited or has not been authorized;
(ii) To request proof of the authorization granted to the Company, except when expressly exempted by law as a requirement for Processing;
(iii) To request information about the use that has been made of your Personal Information;
(iv) To be informed by the Company or any of the companies Responsible for the Processing of Personal Data, upon request, about the existence of data concerning you and the use that has been made of your personal data;
Here is the English translation of the additional text: ---(v) To revoke authorization and request the deletion of data when it is not being used in accordance with authorized purposes, provided there is no legal obligation for the Data Subject to remain in the Company’s Databases;
(vi) To submit inquiries and complaints regarding Personal Information. Your inquiries or complaints will be addressed within a maximum of ten (10) business days. If it is not possible to resolve your inquiry or complaint within this time frame, you will be informed of the situation, and the response time may be extended by up to five (5) additional business days. The response to your inquiries or complaints may be delivered by any physical or electronic means;
(vii) To file complaints with the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other laws that modify, add to, or complement it; and
(viii) To access your personal data, which has been subject to Processing, free of charge.
10. Confidentiality of Personal Information:
10.1 The Personal Information provided by the Data Subjects will only be used by LTM3, its affiliates, and authorized third parties for such purposes, in accordance with the authorization and the Privacy Policy. The Personal Information will not, under any circumstances, be used for purposes other than those for which it was provided. Therefore, LTM3 will endeavor to protect the privacy of Personal Information and keep it under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access, as well as respecting the rights of the Data Subjects.
10.2 If for any reason a competent authority requests the disclosure of Personal Information, LTM3 will notify its Data Subject of such a situation.
10.3 This obligation of confidentiality of Personal Information shall have an unlimited duration, meaning the :
11. Processing of Personal Information of Minors:
11.1 In accordance with Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, LTM3 will process the Personal Information of children and adolescents, respecting their best interests and ensuring, in all cases, the protection of their fundamental rights and minimum guarantees.
11.2 In any situation where it is necessary to process the Personal Information of minors, LTM3 will obtain the corresponding Authorization from the legal representative of the child or adolescent, after allowing the minor to exercise their right to be heard. The minor’s opinion will be taken into account, considering their maturity, autonomy, and ability to understand the content of the authorization and the Processing of their Personal Data.
11.3 In cases where our Surveillance System captures biometric data of minors, such data will be handled with utmost caution, and its consultation will be subject to the strictest confidentiality. In any case, when it is necessary to review the recordings, the images involving minors will be anonymized.
11.4 The Personal Information of minors collected as part of the Data Processing of their parents, who may be Employees, Retired Workers, or Linked Third Parties, will be handled in accordance with the uses and purposes described in this Privacy Policy and solely for the purpose of making the necessary registrations with the entities of the General Social Security System.
11.5 It is also the Company’s duty to inform you about the responsible use and Processing of minors' data and the protection of children and adolescents' data. For this purpose, the following regulations will apply:
“Article 7°. Rights of children and adolescents. The Processing must ensure respect for the overriding rights of children and adolescents. The Processing of personal data of children and adolescents is prohibited, except for data of a public nature. It is the responsibility of the State and educational institutions of all kinds to provide information and train legal representatives and guardians about the potential risks that children and adolescents face regarding the improper Processing of their personal data, and to provide knowledge about the responsible and safe use of their personal data by children and adolescents, their right to privacy, and the protection of their personal information and that of others. The National Government shall regulate this matter within six (6) months following the enactment of this law.
Article 12. Special requirements for the Processing of children’s and adolescents' personal data. The Processing of children’s and adolescents' personal data is prohibited, except for data of a public nature, in accordance with Article 7 of Law 1581 of 2012, and when such Processing complies with the following parameters and requirements:
1. It must respond to and respect the best interests of children and adolescents.
2. It must ensure respect for their fundamental rights. Once these requirements are met, the legal representative of the child or adolescent will grant authorization after the minor has exercised their right to be heard, with their opinion being considered based on their maturity, autonomy, and ability to understand the matter.”
According to the Colombian Constitutional Court, minors’ Personal Data may be processed as long as it does not endanger the prevalence of their fundamental rights and clearly responds to the realization of the principle of their best interest. Without prejudice to compliance with the foregoing, the collection and any use of minors’ data recorded in the Company’s Databases or requested will require the express Authorization of the child’s or adolescent’s legal representative. The Company will facilitate the possibility for representatives to exercise the rights of access, cancellation, rectification, and objection to the data of their wards.
11.6 If you are under eighteen (18) years of age, please do not enter any Personal Information through our website without the express consent and participation of both parents or a guardian. Every Responsible Party and Processor involved in the Processing of Personal Data of children and adolescents must ensure the proper use of such data. To this end, the principles and obligations established in Law 1581 of 2012 must be applied. Families and society must ensure that those Responsible for and in charge of Processing minors' Personal Data comply with the obligations established in Law 1581 of 2012.
12. Sensitive Data:
12.1 The Company collects, analyzes, and stores sensitive data such as the health information of its employees and the personal data of their families to fulfill its obligations as an employer. These purposes may be carried out by the Company and/or by any third party it designates, in which case the third party will act as the Company’s data processor and may only process the data for the purposes described herein and according to the Company’s instructions.
12.2 For the processing of sensitive data, especially for storage, the Company will use the best-known techniques for information protection and encryption to prevent, to the greatest extent possible, any loss, damage, or unauthorized access to such information. It is also guaranteed that the information will be used for the purposes described in this Policy, and while sensitive information may be transmitted to fulfill these purposes, it will not be transferred to third parties.
13. Procedure for Inquiries, Rectification, and Complaints:
13.1 Inquiry: Inquiries and requests from Data Subjects will be addressed within a maximum of ten (10) business days, counted from the date of receipt. If it is not possible to resolve the inquiry within this time frame, the Data Subject will be informed of the situation at the notification address included in the respective inquiry, and the response time may be extended by up to five (5) additional business days. Responses to inquiries or complaints submitted by Data Subjects may be delivered by any physical or electronic means.
13.2 Corrections and Complaints: When the Data Subject or their successors believe that their information should be corrected, updated, or deleted, or when they notice an alleged failure by LTM3 to fulfill its obligations regarding Personal Data Protection as established in the applicable legislation and this Privacy Policy, they may file a complaint in the following manner:
a. A written request must be submitted regarding the specific requirement;
b. If the complaint is incomplete, LTM3 will request the interested party to complete and correct their request within five (5) days of receiving the complaint:
i. If two (2) months pass from the date of the request without a response from the applicant, the claim will be considered withdrawn.
ii. If the person receiving the complaint is not competent to resolve it, the complaint will be forwarded to the appropriate party within two (2) business days, and the applicant will be informed of the transfer.
c. If the complaint is received in full or subsequently completed, a "PENDING CLAIM" notice must be included in the database within two (2) business days.
d. LTM3 will resolve the complaint within a maximum of fifteen (15) business days from the day after it is received. If it is not possible to resolve the inquiry within this time, the Data Subject will be informed of the delay, the reasons, and the expected response date at the notification address they included in the complaint. In any case, the response time cannot exceed eight (8) additional business days after the expiration of the first period. The response to complaints submitted by Data Subjects may be provided by any physical or electronic means.
13.3 Request for Data Deletion When a request for data deletion is made, it cannot be carried out in the following cases: (i) when it is a legal obligation to retain the data; (ii) when the Data Subject has contractually agreed to allow its use; (iii) when retaining the data is necessary to safeguard the interests of the Data Subject or the Public Interest; or, (iv) when deletion would hinder or obstruct the duties of administrative or judicial authorities.
13.4 Revocation of Authorization When a Data Subject wishes to revoke the authorization they have given for the use of their personal data, they must inform the Data Controller clearly if the revocation is total or partial. Partial revocation occurs when the Data Subject expresses that they wish to revoke authorization for the processing of their personal data for certain specific purposes, such as receiving advertising, communications, updates, etc. Total revocation occurs when the Data Subject requests that the processing of their personal data cease entirely for all authorized purposes. In any case, such revocation will not apply when the processing of Personal Data is mandatory due to a legal requirement or to fulfill contractual obligations.
14. Contact - Responsible Party:
If you have any questions or concerns about this Privacy Policy or the processing and use of your Personal Information, please direct your inquiries, requests, complaints, or claims to:
a. Email: reservas@8010urbanliving.com.
b. Written request to the LTM3 Administrative Department, Carrera 10 No. 80-36, Bogotá, D.C.
Cookie Policy:
The Company may implement different types of Cookies, both proprietary and third-party, with various purposes to provide a better and more personalized experience. These cookies can be classified into the following categories:
Necessary: Essential for the normal functioning of the website.
Functional: Non-essential cookies that enable features like sharing website content through social networks, collecting feedback, and other features.
Performance: Used to understand and analyze key website performance metrics to enhance the user experience.
Analytical: Help understand how visitors interact with the website, providing information such as page traffic, most viewed content, etc.
Advertising: Used to promote personalized ads, offers, and marketing campaigns by tracking visitors across websites.
The purposes and handling of the data collected through cookies are described in this Cookie Policy. The Data Subject grants consent for the use of cookies through:
Explicit acceptance of the cookie notice displayed on the website and other virtual platforms of the Company.
The Data Subject may disable all non-essential cookies for the website's functionality. At any time, cookies can be deleted, browser settings can be adjusted to request approval before storing cookies, or the storage of cookies can be entirely prevented. However, this process is different for each browser and must be done individually for each browser used. Disabling cookies may reduce functionality or prevent certain features from working. The Data Subject can disable cookies to stop the Company from collecting data during website use, though this may impair navigation functionality. You can consult our Cookie Policy at the following link: www.8010urbanliving.com
16. Closed-Circuit Television (CCTV) Surveillance:
The Company has installed closed-circuit surveillance systems in its offices, where the Company's social activities are conducted. The surveillance cameras record 24/7 in the areas within their range. The Company ensures that no cameras violate the privacy of Data Subjects, as cameras have not and will not be installed in bathrooms, changing rooms, or lactation areas, among others.
The images captured by the CCTV cameras are stored for thirty (30) days unless a judicial or administrative authority requires the Company to retain them for a longer period. The purposes of collecting images through CCTV include, but are not limited to:
1. Ensuring the safety of individuals and facilities within the offices.
2. Using the images to prevent and, if necessary, verify criminal behavior, in which case the images will be handed over to the relevant authorities.
3.Assessing risk factors in the offices.
4. Reconstructing accidents to verify the circumstances and risk factors to mitigate existing dangers and prevent recurrence.
5. Submission to insurance companies.
The Company ensures that access to the images recorded by the CCTV system is restricted to trained personnel and/or competent authorities. For further inquiries, you may request a copy of our Video Surveillance Manual.
17. Related Documents:
Cookie Policy.
Video Surveillance Manual.
Security Policy.
18. Summary of Changes from the Previous Version:
Section Modification
Introduction: Development of Habeas Data rights and Regulatory Framework
1: Added definition of Controller
3.11: Included definition of Cookies
4: Categories of Data Subjects
5: Development of Data Usage
6: Includes authorization for transmission in case of mergers and details cases where authorization is not required
8: Developed new purposes
11: Developed Minors' Data Processing
13: Data Deletion and Revocation
15: Cookie Policy
16: CCTV Surveillance
19. Modifications to the Privacy Policy:
LTM3 is fully authorized to modify this Privacy Policy. Any changes will be communicated to the Data Subjects of Personal Information, either electronically or physically. Providing authorization and registering on the Website will be considered an express manifestation of acceptance of the Privacy Policy.
20. Effective Date:
This Privacy Policy is effective from the date of its signing and remains in effect indefinitely.
