This document contains the Personal Data Processing Policy processed by RACAFÉ & CIA S.C.A which regulates the collection, storage, use, transmission, transfer and suppression of the data collected by RACAFÉ & CIA S.C.A. (hereinafter the "Company") according to the Statutory Law 1581 of 2012 and the Decree 1377 of 2013, which contain general provisions for the protection of personal data:
1. Information of the Data Controller of the personal data subject to processing
The company controlling the processing of the personal data is:
- • Company name: RACAFÉ & CIA S.C.A
- • City: Bogotá D.C
- • Address: CARRERA 11 No. 82 - 01 Piso 5
- • Email: atencionusuario@racafe.com
- Land line: 6118700
2. Processing to which the personal data will be submitted and its purpose:
Carry out the actions relevant for the company's corporate purpose in relation to the fulfilment of the purpose of the contract entered into with the data Subject.
- • Manage procedures (requests, complaints, claims).
- • Statistical, tax, accounting, financial and legal use of the Company.
- • Verification in credit reporting entities.
- • Personalize and improve products and services, extend marketing offers and publish products and services that could be of interest to me through electronic media and social networks.
- • Personalize and improve products and services, extend marketing offers and publish products and services that could be of interest to me through telephone.
- • Transmit and/or transfer my personal data to relationship marketing companies to conduct satisfaction surveys and to extend marketing offers.
3. Processing of sensitive data:
The Company will strictly observe the legal limitations when processing sensitive data, therefore it will ensure that:
a)The Data Subject has given his/her explicit authorization to such processing, except in cases where such authorization is not required by law.b)The Processing is necessary to safeguard the vital interest of the Data Subject and the Data Subject is physically or legally incompetent. In these events, the legal guardians shall grant their authorization.c)The Processing is carried out within lawful activities and with appropriate guarantees by a foundation, NGO, association or any other non-profit organization, with a political, philosophical, religious or trade union purpose, provided they refer exclusively to its members or to persons who maintain regular contacts based on their finality. In these events, data may not be supplied to third parties without the authorization of the Data Subject.d)The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a legal proceeding.e)The Processing has a historical, statistical or scientific purpose. In this event, measures aimed at suppressing the identity of the Data Subjects shall be adopted.
4. Video surveillance
The Company uses several video surveillance mechanisms installed in different places in its facilities or offices.
The information collected will be used for people, property and facilities security purposes. This information may be used as evidence in any type of proceeding before any type of authority and organization.
5. Processing of personal data of children and/or adolescents
The Processing of personal data of children and/or adolescents that have a public nature shall comply with the following parameters and requirements:
a)That it observes and respects the best interests of children and adolescents.b)That the respect of their fundamental rights is ensured.c)Consider the minor's opinion when he or she is mature, autonomous and capable enough as to understand the matter.
Once the above requirements are met, the children's or adolescent' legal guardian may authorize the Data Processing, provided the minor has exercised his or her rights to be heard, whose opinion must be considered when he or she is mature, autonomous and capable enough as to understand the matter.
6. Your rights as a Data Subject
According to Article 8 of Law 1581 of 2012 and Decree 1377 of 2013, the Subject of the personal data has the following rights. a) To know, update and rectify your personal data before the Company, in its condition of Data Controller. This right may be exercised regarding partial, inaccurate, incomplete, fractioned, or misleading data, or data whose processing is expressly prohibited or has not been authorized.b)To request evidence of the authorization granted to the Company, in its condition of Data Controller, except when expressly exempted as a requirement for the Processing, according to Article 10 of Law 1581 of 2012 (or to the rules that the regulate, add, complement, modify or supersede it), or when there is processing continuity according to section 4° of article 10 of Decree 1377 of 2013c)To be informed by the Company, upon request, of the use it has given to your personal data; d)To submit before the Superintendence of Industry and Commerce complaints for violations to the provisions of Law 1581 of 2012, after exhausting the consultation or claim procedure before the Company.e)To revoke the authorization and/or to request the suppression of the data if its Processing violates the constitutional and legal principles, rights and guarantees. The revocation and/or suppression shall proceed when the Superintendence of Industry and Commerce has determined that when Processing the Company has incurred in conducts contrary to the law and the Constitution.f)To have free access to your personal data that have been subject to Processing.
7. Department in charge of the attention of petitions, consultations and claims
The Customer Service Department of the company will be in charge of the attention of requests, consultations, claims, complaints, or for the exercise of the rights of the Subject of the personal data.
8. Procedure for exercising the rights of the Data Subject
8.1 Procedure for access and consultation
The Data Subject or his/her successors may consult the data in the Company's databases for which they must submit the corresponding request in writing and file it before the relevant department according to the previous section, from Monday to Thursday during the hours of 8:00 AM - 1:00 PM and 2:00 PM - 5:00 PM, and on Friday during the hours of 8:00 AM - 1:00 PM and 2:00 PM - 3:00 PM, at Carrera 11 No. 82 - 01 Piso 5, Bogotá D.C., or to the e-mail atencionusuario@racafe.com.
To prevent unauthorized third parties from accessing the Subject's personal data, it is necessary to previously identify the Data Subject. When the request is made by a person other than the Subject and it is not proven that such third person is acting on behalf of the Subject, the request will be deemed as non-existent.
The consultation will be answered within a maximum term of ten (10) business days, as of the date of receipt. When it is not possible to answer the consultation within said term, the interested party will be informed, including the reasons for such delay, and the date in which the consultation will be answered, which in no case may exceed five (5) business days following the expiration of the first term.
8.2 Procedure to request to update, correct, suppress, to revoke the authorization, or to file claims:
The Data Subject, or his/her successors, who consider that the information contained in the Company's database should be subject to correction, update or suppression, or when they notice a possible breach of any of the duties contained in this law, may file a claim before the Company, which will be processed under the following rules, according to Article 15 of Law 1581 of 2012:
a)The claim shall be filed by means of a request before the relevant Department of the Company from Monday to Thursday during the hours of 8:00 AM - 1:00 PM and 2:00 PM to 5:00 PM, and on Friday during the hours of 8:00 AM - 1:00 PM and 2:00 PM to 3:00 PM, at Carrera 11 No. 82 - 01 Piso 5, Bogotá D.C., or to the email atencionusuario@racafe.com.b)To prevent unauthorized third parties from accessing the Subject's personal data, it is necessary to previously identify the Data Subject. When the request is made by a person other than the Subject and it is not proven that such third person is acting on behalf of the Subject, the request will be deemed as non-existent.c)La solicitud debe contener como mínimo la siguiente información:
(i)The identification of the Subject.
(ii)Contact information (physical and/or electronic address and telephone numbers).
(iii)Documents proving the identity of the Subject, or the representation powers of his/her representative.
(iv)Clear and specific description of the personal data with respect to which the Subject seeks to exercise any of his/her rights.
(v)Description of the facts giving rise to the claim.
(vi)Documents submitted as evidence.
(vii)Signature, identification number and fingerprint.
(viii)Original filing.
d)If the claim is incomplete, the Company shall require the interested party within five (5) days following the receipt of the claim to correct it. If after two (2) months from the date of the requirement, the applicant fails to submit the information required, the claim shall be understood as withdrawne)If the Department that receives the claim is not in charge of deciding it, it shall transfer it to the appropriate person within a maximum term of two (2) business days and shall inform the interested party of the situation.f)Once the complete claim has been received, the wording "claim in process" and the claim's grounds shall be included in the database, within a term not exceeding two (2) business days. Said wording shall be in place until the claim is decided.
g)The maximum term to answer the claim shall be fifteen (15) business days as of the day following the date of receipt. When it is not possible to answer the claim within said term, the interested party will be informed of the reasons for the delay and the date in which the claim will be answered, which in no case may exceed eight (8) business days following the expiration of the first term.
8.3 Suppression of Data
The Subject has the right, at any time, to request the Company to suppress (remove) his/her personal data when:
a)He/she considers the data are not being processed according to the principles, duties and obligations contained in Law 1581 of 2012.b)The data are no longer necessary or relevant for the purpose for which they were collected.c)The period necessary to meet the purposes for which they were collected has been exceeded.
This suppression implies the total or partial elimination of the personal data as requested by the Subject from the records, files, databases or processes carried out by the Company.
It is important to take into account that the right of cancellation is not absolute and the Data Controller may deny its exercise when:a)This suppression implies the total or partial elimination of the personal data as requested by the Subject from the records, files, databases or processes carried out by the Company.b)The deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.c)The data are necessary to protect the legally protected interests of the Data Subject, to undertake an action for the benefit of the public interest, or to fulfill an obligation acquired by the Data Subject.
8.4 Revocation of the Authorization.
The Data Subject may revoke his/her consent to the Processing of his/her personal data at any time, provided that this is not prevented by a legal provision.
9. Validity of the Policy.
The Policy is effective as of the terms set forth in Decree 1377 of 2013. As a general rule, the term of the authorizations for the use of personal data is understood as equal to the term of the commercial relationship or the link to the service and during the exercise of the Company's corporate purpose.
10. Modifications to our Personal Data Processing Policy.
The Company reserves the right, at its sole discretion, to modify, alter, add or remove portions of this Policy at any time. We recommend that you review this policy each time you visit the Company's website: www.racafe.com.
