Data Processing Policy

POLICY FOR THE PROCESSING OF PERSONAL DATA OF TWO CLICKS

Two Clicks, domiciled at Address Two Clicks, has established this privacy and personal data protection policy which regulates the collection, storage, administration and protection of information received by all customers, suppliers, consumers, contractors, debtors , creditors, employees and related parties. For the purposes of this policy, the following shall be taken into account:

DEFINITIONS

Privacy notice: it is the document that appears in any physical, electronic or any other format generated by the person responsible for the processing of personal data, which is made available to the user, for the processing of their personal data. In the privacy notice, the Owner of the information is informed of the existence of these information treatment policies that will be applicable to him, the way to access them and the purposes and rights for the treatment that will be given to the personal data provided by him.

Authorization: it is the prior and express consent of the user, to carry out the processing of their personal data.
Database: is the set of all personal data that has been authorized by its Users and that will be subject to the treatment established by this policy.
Personal data: it is any information linked or that can be associated to a user.
Private data: data that due to its intimate or reserved nature is only relevant to the user.
Sensitive data: are those data that affect the privacy of the user or whose improper use may generate discrimination for reasons of racial or ethnic origin, political orientation, religious or philosophical convictions, membership of unions, social organizations, human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data.
Responsible for the treatment: for the purposes of this policy, it is Two Clicks. who handles the personal data of its users, in accordance with the provisions of the Law and in this document.
Treatment Manager: is the natural person designated by the person responsible for the processing of personal data (Two Clicks).
Owner: natural person whose information is and who has freely and voluntarily expressed to Two Clicks their authorization for their personal data to be processed.
Treatment: it is any operation on personal data, such as the collection, storage, use, circulation, modification, clarification or deletion of said data.

PRINCIPLES IN THE PROCESSING OF PERSONAL DATA

As a fundamental premise of this policy, Two Clicks respects the privacy of each of the natural or legal persons who provide their personal information through the different information collection channels established for this purpose. Two Clicks guarantees that it has adequate and safe storage mechanisms and systems. The information is collected, processed and used in accordance with current data protection and privacy regulations.

However, Two Clicks is not responsible for any consequence derived from the improper entry of third parties into the database and/or for any technical failure in the operation and/or conservation of data in the information storage system.

The data provided by the Holder must be clear, truthful, verifiable and exact, so that their treatment can be equally reliable.

Confidentiality in the processing of personal data is another of the guiding principles of this policy, since all officials with access to the databases are obliged to maintain strict confidentiality in their handling.

All data stored and processed by Two Clicks must have the prior and express authorization of its owner, which must be granted freely and voluntarily. Notwithstanding this principle, authorization will not be required in the following events:

Information required by a public or administrative entity in the exercise of its legal functions or by court order.
Data of a public nature.
Cases of medical or health urgency.
Treatment of information authorized by the Law for historical, statistical or scientific purposes.
Data related to the civil registry of people.

Personal data will be included in a database and will be used for the following purposes:

Coding in our systems, the link requests as clients and/or suppliers.
Inform about new products or services.
Comply with obligations contracted with our customers, suppliers, and employees.
Achieve efficient communication related to our products, services, offers, promotions, alliances, studies, contests, content, as well as those of our related companies, and to facilitate general access to their information.
Provide our services and products.
Inform about the launch of new products or services, or changes in them.
Evaluate the quality of the service.
Conduct internal research on consumer habits.
Consult, report, process and transfer information to risk centers.
TREATMENT OF PERSONAL DATA OF MINORS: The Treatment of data of minors must comply with and respect their rights. In case of processing Personal Data of minors, Two Clicks will observe the applicable regulations and will accept the pronouncements of the Constitutional Court in this matter.

TREATMENT OF SENSITIVE DATA: since Two Clicks. collects biometric data, such as surveillance videos, photographs, fingerprints, and among others that can be considered sensitive data, it will guarantee that the treatment of this information will be carried out seeking to establish mechanisms that improve its attention processes and in compliance with the provisions contained in Law 1581 of 2012 and Chapter 25 of Decree 1074 of 2015.

DUTIES AND RIGHTS

3.1. Rights of the Owner of the information:

Know, update and rectify your personal data before those responsible for the treatment or those in charge of the treatment. This right may be exercised, among others, against partial, inaccurate, incomplete, divided, misleading data, or those whose treatment is expressly prohibited or has not been authorized.
Request proof of the authorization granted to the controller except when expressly excepted as a requirement for processing, in accordance with the provisions of this policy.
To be informed by the person in charge of the treatment or the person in charge of the treatment, upon request, regarding the use that has been given to your personal data.
Submit to the Superintendence of Industry and Commerce, complaints for violations of the provisions of the Law.
Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the treatment. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the treatment, the person in charge or in charge has incurred in conduct contrary to the Law and the Constitution.
Free access to your personal data that has been processed.

3.2 Duties of the person responsible for the processing of personal data:

Guarantee the Owner, at all times, the full and effective exercise of the right of habeas data.
Request and keep, under the conditions provided by Law, a copy of the respective authorization granted by the Holder.
Duly inform the Holder about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
Guarantee that the information provided to the person in charge of the treatment is true, verifiable, complete, exact, updated, verifiable and understandable.
Update the information, communicating in a timely manner to the person in charge of the treatment, all the news regarding the data that has previously been provided and adopt the other necessary measures so that the information provided to it is kept updated.
Rectify the information when it is incorrect and communicate what is pertinent to the person in charge of the treatment.
Demand from the person in charge of the treatment at all times, respect for the security and privacy conditions of the information of the Holder.
Process the queries and claims made by the Holders of the information in the terms indicated in the law.
Inform the person in charge of the treatment when certain information is under discussion by the Holder, once the claim has been filed and the respective procedure has not been completed.
Inform at the request of the Owner, about the use given to his data.
Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.
Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
Duties of the person in charge of the processing of personal data:

3.3 Duties of the person in charge of the processing of personal data:

Guarantee the Owner, at all times, the full and effective exercise of the right of habeas data.
Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
Timely update, rectify or delete the data.
Update the information reported by those responsible for treatment within five (5) business days from its receipt.
Process the queries and claims made by the Holders of the information.
Register in the database the legend "claim in process" when appropriate.
Insert in the database the legend "information under judicial discussion", once notified by the competent authority about judicial processes related to the quality of personal data.
Refrain from circulating information that is being controversial by the Holder and whose blocking has been ordered by the Superintendence of Industry and Commerce.
Allow access to information only to people who may have access to it.
Inform the Superintendence of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the Holders.
Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

RESPONSIBLE AREA AND PROCEDURES FOR DATA CONSULTATION AND FOR THE SUBMISSION OF CLAIMS:

The area responsible for queries, complaints and claims will be the Marketing area:

The Holders or their successors in title may consult the personal information of the Holder that rests in the database.
The person in charge of the treatment or person in charge of the treatment must provide the Holder with all the information contained in her individual record or that is linked to her identification.
The consultation will be made through email and the other contact information contained in the privacy notice published on the website www.tw0clicks.com and which in any case is attached to this policy as Annex 1.
The query will be answered within a maximum term of ten (10) business days from the date of receipt thereof. When it is not possible to respond to the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the query will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.
The Owner or his successors in title who consider that the information contained in a database must be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the Law, may file a claim with the person responsible for the data processing, through the communication channels established in the privacy notice. For the purposes of presenting claims, the following procedure must be followed and the following requirements must be met:

The claim must contain at least: the identification of the Holder, the description of the facts that give rise to the claim, the address and accompanying, the documents that you want to assert.
If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the failures. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim.
In the event that the person who receives the claim is not competent to resolve it, he will notify the corresponding person within a maximum term of two (2) business days and inform the interested party of the situation.
Once the complete claim is received, a legend that says "claim in process" and the reason for it will be included in the database, within a term of no more than two (2) business days. Said legend must be maintained until the claim is decided.
The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt.
When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. The Owner or successor in title may file a complaint with the Superintendence of Industry and Commerce once the consultation or claim process has been exhausted before Two Clicks.

EFFECTIVE DATE: This Personal Data Policy was created on March 15, 2019.

Any change that occurs with respect to this policy will be reported through the email address: support@tw0clicks.com