Policy of treatment of protection of personal data of the holders and cardholders

In compliance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, the PLATFORM ONLINE PAGOS ELP adopts this policy for the processing of personal data, which will be informed to all holders of the data collected or that in the future are obtained in the exercise of transactional, commercial or labor activities. In this way, EN LINEA PAGOS ELP states that it guarantees the rights of privacy, intimacy, good name and autonomy in the processing of personal data, and consequently all its actions will be governed by the principles of legality, purpose, freedom , veracity or quality, transparency, access and restricted circulation, security and confidentiality. All people who, in the development of different transactional activities through our platform, will come to supply EN LINEA PAGOS ELP with any type of information or personal data, will be able to know, update and rectify it.

I. IDENTIFICATION OF THE RESPONSIBLE FOR THE TREATMENT: ONLINE PAGOS ELP, hereinafter referred to as. THE PLATFORM.

II. DOMICILE AND ADDRESS: THE PLATFORM is domiciled in the city of Medellín, and its main headquarters are located in Medellín.

III. LEGAL FRAMEWORK Political Constitution.

IV. AREA OF APPLICATION

V. This policy will be applicable to the personal data registered in any database of EN LINEA PAGOS ELP. whose owner is a natural person.

III. AREA OF APPLICATION

This policy will be applicable to personal data registered in any LA PLATAFORMA database whose owner is a natural person.

IV. DEFINITIONS

For the purposes of this policy and in accordance with current regulations regarding the protection of personal data, the following definitions will be taken into account:

Authorization: Prior, express and informed consent of the Holder to carry out the Processing of personal data.

Privacy notice: Verbal, electronic or written communication generated by the Responsible Party, addressed to the Owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable, the form to access them and the purposes of the treatment that is intended to give personal data.

Database: Organized set of personal data that is subject to treatment.
Successor: person who has succeeded another due to the death of the latter (heir).
Personal data: Any information linked to or that may be associated with one or more specific or determinable natural persons.

Public data: It is the data that is not semi-private, private or sensitive. Public data, among others, are data related to the marital status of individuals, their profession or trade and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, gazettes and official gazettes and duly enforceable judicial decisions that are not subject to reservation.

Sensitive data: Sensitive data is understood to be those that affect the privacy of the Holder or whose improper use may generate discrimination, such as revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, organizations social, human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.

Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, carries out the Treatment of personal data on behalf of the Responsible for the Treatment.

Responsible for the Treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or the Treatment of the data.

Owner: Natural person whose personal data is subject to Treatment.
Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion.

Transfer: the data transfer takes place when the person in charge and / or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is inside or outside from the country.

Transmission: processing of personal data that implies the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a treatment by the person in charge on behalf of the person in charge.

V. PRINCIPLES

For the purposes of guaranteeing the protection of personal data, THE PLATFORM will harmoniously and comprehensively apply the following principles, in the light of which the treatment, transfer and transmission of personal data must be carried out:

Principle of legality regarding data processing: Data processing is a regulated activity, which must be subject to current and applicable legal provisions governing the subject.

Principle of purpose: the personal data processing activity carried out by THE PLATFORM or to which it has access, will obey a legitimate purpose in accordance with the Political Constitution of Colombia, which must be informed to the respective owner of the personal data.

Principle of freedom: the processing of personal data can only be carried out with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that relieves consent.

Principle of truthfulness or quality: the information subject to the processing of personal data must be truthful, complete, exact, updated, verifiable and understandable.

The Processing of partial, incomplete, fractioned or misleading data is prohibited.

Principle of transparency: In the processing of personal data, THE PLATFORM will guarantee the Holder his right to obtain at any time and without restrictions, information about the existence of any type of information or personal data that is of interest or ownership.

Principle of access and restricted circulation:
The processing of personal data is subject to the limits derived from their nature, from the provisions of the law and the Constitution. Consequently, the treatment can only be done by people authorized by the owner and / or by the people provided by law. Personal data, except for public information, may not be available on the internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the holders or authorized third parties in accordance with the law. For these purposes the obligation of THE PLATFORM, will be a medium.

Security principle: the information subject to treatment by THE PLATFORM, must be handled with the technical, human and administrative measures that are necessary to grant security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

Principle of confidentiality: All the people who in THE PLATFORM, administer, manage, update or have access to information of any kind found in Databases, are obliged to guarantee the reservation of the information, for which they undertake to preserve and keep strictly confidential and not reveal to third parties, all the information that they come to know in the execution and exercise of their functions; Except in the case of activities expressly authorized by the data protection law. This obligation persists and will be maintained even after the end of your relationship with any of the tasks included in the Treatment.

SAW. RIGHTS OF THE INFORMATION HOLDER

In accordance with the provisions of current regulations applicable to data protection, the following are the rights of the holders of personal data:

to. Access, know, update and rectify your personal data in front of the PLATFORM in its capacity as data controller. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized Request proof of the authorization granted to the PLATFORM for the treatment of data , by any valid means, except in cases where authorization is not necessary.

b. Be informed by THE PLATFORM, upon request, regarding the use that has been given to your personal data.

c. Present before the Superintendency of Industry and Commerce, or the entity that will act in its place, complaints for infractions to the provisions of Law 1581 of 2012 and the other regulations that modify, add or complement it, after consulting or requesting the PLATFORM .

d. Revoke the authorization and / or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees.

and. Free access to your personal data that has been processed, at least once every calendar month, and each time there are substantial modifications to this policy that motivate new consultations.

These rights may be exercised by:

The owner, who must prove her identity sufficiently by the different means that THE PLATFORM makes available to her. The successor in title of the owner, who must prove such quality.

The representative and / or attorney-in-fact of the owner, prior accreditation of the representation or power of attorney.
Another in favor or for which the owner has stipulated.

VII. DUTIES OF THE PLATFORM AS RESPONSIBLE AND IN CHARGE OF THE PROCESSING OF PERSONAL DATA

THE PLATFORM recognizes the ownership of personal data held by people and consequently they can exclusively decide on them.

Therefore, THE PLATFORM will use the personal data for the fulfillment of the purposes expressly authorized by the owner or by current regulations.

In the treatment and protection of personal data, THE PLATFORM will have the following duties, without prejudice to others provided for in the provisions that regulate or come to regulate this matter:

to. Guarantee the holder, at all times, the full and effective exercise of the right to habeas data.

b. Request and keep a copy of the respective authorization granted by the owner for the processing of personal data.

c. Properly inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted.

d. Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

and. Guarantee that the information is truthful, complete, accurate, updated, verifiable and understandable.

F. Timely update the information, thus attending to all the news regarding the owner's data. Additionally, all the necessary measures must be implemented so that the information is kept up to date.

g. Rectify the information when it is incorrect and communicate the pertinent.

h. Respect the security and privacy conditions of the owner's information.

i. Process inquiries and claims formulated in the terms indicated by law.

J. Identify when certain information is under discussion by the owner.

k. Inform at the request of the owner about the use given to their data.

l. Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the holders.

m. Comply with the requirements and instructions issued by the Superintendency of Industry and Commerce on the particular issue.

n. Use only data whose treatment is previously authorized in accordance with the provisions of Law 1581 of 2012.

or. Ensure the proper use of the personal data of children and adolescents, in those cases in which the processing of their data is authorized.

p. Register in the database the legend “claim in process" in the way that is regulated by law.

q. Insert in the database the legend “information in judicial discussion" once notified by the competent authority about judicial processes related to the quality of personal data.

r. Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendency of Industry and Commerce

s. Allow access to information only to people who can have access to it.

t. Use the personal data of the owner only for those purposes for which it is duly empowered and respecting in any case the current regulations on the protection of personal data.

VIII. AUTHORIZATION AND CONSENT OF THE HOLDER

THE PLATFORM requires the free, prior, express and informed consent of the owner of the personal data for the treatment thereof, except in the cases expressly authorized by law, namely:

to. Information required by a public or administrative entity in the exercise of its legal functions or by court order.

b. Data of a public nature.

c. Cases of medical or health emergency.

d. Treatment of information authorized by law for historical, statistical or scientific purposes.

and. Data related to the Civil Registry of Persons

Manifestation of authorization

The authorization to THE PLATFORM for the processing of personal data will be granted by:

The owner, who must sufficiently prove her identity by the different means that THE PLATFORM makes available to her.

The titleholder's successors, who must prove such quality.

The representative and / or attorney-in-fact of the owner, prior accreditation of the representation or power of attorney.

Another in favor or for which the owner has stipulated.

Means to grant authorization

THE PLATFORM will obtain authorization through different means, including the physical, electronic document, data message, Internet, Websites, Telephone IVR, SMS or in any other format that in any case allows obtaining consent through unequivocal behaviors through which it is concluded that had it not been supplied by the owner or the person entitled to do so, the data would not have been stored or captured in the database. The authorization will be requested by THE PLATFORM prior to the processing of personal data.

Proof of authorization

THE PLATFORM will keep the proof of the authorization granted by the holders of the personal data for its treatment, for which it will use the mechanisms available at its present time as well as adopt the necessary actions to maintain the record of the form and date and in which she got this one. Consequently, THE PLATFORM may establish physical files or electronic repositories made directly or through third parties hired for this purpose. Revocation of the authorization.

The owners of the personal data may at any time revoke the authorization granted to THE PLATFORM for the processing of their personal data or request the deletion of them, as long as a legal or contractual provision does not prevent it. THE PLATFORM will establish simple and free mechanisms that allow the owner to revoke her authorization or request the deletion of her personal data, at least by the same means by which she granted it. For the above, it should be taken into account that the revocation of consent can be expressed, on the one hand, in a total way in relation to the authorized purposes, and therefore THE PLATFORM must cease any activity of data processing; and on the other partially in relation to certain types of treatment, in which case it will be these on which the treatment activities will cease, such as for advertising purposes, among others. In the latter case, THE PLATFORM may continue to process personal data for those purposes in relation to which the owner has not revoked their consent.

IX. TREATMENT TO WHICH THE DATA WILL BE SUBMITTED AND PURPOSE OF THE SAME

The processing of personal data of any person with whom THE PLATFORM has established or establishes a relationship, permanent or occasional, will be carried out within the legal framework that regulates the matter and by virtue of its status as Payment Gateway, and will be all necessary for the fulfillment of the corporate mission. In any case, personal data may be collected and processed to:

to. Develop the mission of THE PLATFORM in accordance with its statutes

b) Comply with the provisions of the Colombian legal system in labor and social security matters, among others, applicable to former employees, current employees and candidates for future employment.

c. Conduct surveys related to the services or goods of THE PLATFORM

d. Develop programs in accordance with its statutes

F. Keep in contact

g. Inform about job opportunities, fairs, seminars or other studies locally and internationally

h. Promote research in all fields including scientific

i. Fulfill all its contractual commitments.

Sensitive data

In the case of sensitive personal data, THE PLATFORM may use and process them when:

to. The owner has given her explicit authorization, except in cases where the granting of said authorization is not required by law.

b. The treatment is necessary to safeguard the vital interest of the Holder and he is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.

X. PRIVACY NOTICE

The Privacy Notice is the physical document, electronic or in any other format, made available to the owner to inform her about the processing of her personal data. Through this document, the owner is informed of the information related to the existence of the information processing policies of THE PLATFORM and that will be applicable, the way to access them and the characteristics of the treatment that is intended to be given to the data personal. The privacy notice must contain, as a minimum, the following information:

to. The identity, address and contact information of the person responsible for the treatment.

b. The type of treatment to which the data will be subjected and the purpose of the same.

c. The rights of the holder

d. The general mechanisms provided by the person in charge so that the owner is aware of the information processing policy and the substantial changes that occur in it. In all cases, you must inform the owner how to access or consult the information processing policy.

and. The optional nature of the response to questions about sensitive data

Claims

The Holder or her successors in title who consider that the information contained in a database should be subject to correction, updating or deletion, or when they notice the alleged breach of any of the duties contained in the law, they may file a claim with THE

1. The Holder's claim will be formulated by means of a request addressed to the PLATFORM at the email servicioalcliente@enlineapagos.com, with the holder's identification, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want enforce. If the claim is incomplete, the interested party will be required within five (5) days after receiving the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

In the event that whoever receives the claim is not competent to resolve it, it will transfer it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation.

2. Once the complete claim is received, it will be classified with the label “claim in process" and the reason for it, within a term not exceeding two (2) business days. Said label will be kept until the claim is decided.

3. The maximum term to attend the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first finished.

Request for update and / or rectification

The PLATFORM will rectify and update, at the request of the owner, the information of the latter that turns out to be incomplete or inaccurate, in accordance with the procedure and the terms indicated above, for which the following will be taken into account:

1. The owner must submit the request to the email servicioalcliente@enlineapagos.com indicating the update and / or rectification to be made and will provide the documentation that supports their request.

2. THE PLATFORM may enable mechanisms that facilitate the exercise of this right to the owner, as long as they benefit him. Consequently, electronic or other means that it considers pertinent may be enabled, which will be informed in the privacy notice and will be made available to interested parties on the website.

d. Request for deletion of data The owner of personal data has the right to request LA PLATAFORMA its deletion (elimination) in any of the following events:

1. Consider that they are not being treated in accordance with the principles, duties and obligations set forth in current regulations.

2. They are no longer necessary or relevant for the purpose for which they were collected.

3. The period necessary for the fulfillment of the purposes for which they were collected has been exceeded. This deletion implies the total or partial elimination of personal information in accordance with what is requested by the owner in the records, files, databases or treatments made by THE PLATFORM. However, this right of the owner is not absolute and consequently THE PLATFORM may deny the exercise of it when:

to. The owner has a legal or contractual duty to remain in the database.

b. The elimination of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

c. The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner.

XIII. NATIONAL REGISTRY OF DATABASE

THE PLATFORM, reserves, in the events contemplated in the law and in its statutes and internal regulations, the power to maintain and catalog certain information that resides in its databases or databases, as confidential in accordance with current regulations, its statutes and regulations, all of the above and in accordance with the fundamental and constitutional right of each person.

THE PLATFORM, will proceed in accordance with current regulations and regulations issued by the National Government for this purpose, to register its databases, before the National Registry of Databases (RNBD) that will be administered by the Superintendency of Industry and Commerce. The RNBD., Is the public directory of the databases subject to Treatment that operate in the country; and that it will be of free consultation for citizens, in accordance with the regulations issued by the National Government for that purpose.

XIV. INFORMATION SECURITY AND SECURITY MEASURES

In compliance with the security principle established in the current regulations, THE PLATFORM will adopt the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

RESPONSIBLE AND IN CHARGE OF THE PROCESSING OF PERSONAL DATA

THE PLATFORM will be responsible for the processing of personal data.

XVII. VALIDITY

This policy is effective as of November 1, 2013 and leaves without effect the regulations or special manuals that may have been adopted by administrative bodies in THE PLATFORM.

ONLINE PAYMENTS ELP