Data Protection Policy

The following Personal Data Protection Policy of Arrubla Devis Asociados S.A.S. (hereinafter “Arrubla Devis”) is in force from June 2017, for the necessary time required to develop the purposes of the processing of personal data previously authorized by the holders and its available to all interested parties as stated by Statutory Law 1581 of 2012 and its regulatory decrees. 

The personal data in custody of Arrubla Devis, as responsible and/or in charge of the information as the case may be, will be treated in compliance with the Colombian legal system and practices related to personal data protection. The purposes of the processing of personal data by Arrubla Devis are as follows:

I. Employees, Former Employees and Candidates

a) Carrying out selection and contracting processes.
b) Payroll payment, social security benefits, management of employee folders and other labor procedures necessary for the initiation, execution and termination of the employment relationship.

II. Current and former customers, prospects and people who have provided their contact details through the website and social networks

a) Sending of service quotes. 
b) Execution of legal consulting and legal representation activities, if applicable.
c) Answering emails and other communications.
d) Billing process. 
e) Sending advertising, commercial and marketing information, updates and newsletter, among other types of information of interest.

III. Suppliers and contractors:

a) Contacting suppliers in order to request offers and quotes or to contract goods and/or services necessary for the development of the company.
b) Registration of suppliers.
 
IV. Video surveillance

Management of security incidents within the facilities against people, property and the physical and technological infrastructure. It is expressly stated that all of the material obtained through video surveillance at Arrubla Devis and, therefore, the personal data collected, will be kept exclusively for a term of twenty-five (25) calendar days from their capture and will then be permanently deleted.
 
V. General

Manage all of the necessary information for the correct operation of Arrubla Devis and fulfill its corporate, tax and accounting obligations, among others.

To achieve the purposes described above, Arrubla Devis may collect, preserve and store, directly or through a third party, one or more databases, whether physical or electronic. With the authorization granted for the treatment of personal data, it is understood that Arrubla Devis will have the broadest powers to carry out said treatment, in accordance with the law and the provisions of this policy, without affecting the rights of the holders.
 
The holders of the information or the legally authorized persons have the right to know, update and rectify their personal data, to be informed about the use that is given to it, to revoke the authorization and/or request the deletion of the data, when applicable and to access it free of charge. They also have the right to file complaints with the Superintendency of Industry and Commerce for infraction of the law and to exercise the pertinent actions regarding habeas data.
 
When inquiries and claims are required, the following procedure must be undertaken: 

Inquiries
 
Inquiries regarding personal data must be submitted in writing by the holders or by legally authorized persons (demonstrating a legitimate interest) at the email or correspondence address indicated in the final part of this policy. The inquiries will be answered within ten (10) business days from the date of receipt.
 
However, when it’s not possible to answer the inquiry within said term, the interested party will be informed of this situation and the reasons for the delay before the expiration of the ten (10) days In this case, the date in which the inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first term, must also be communicated. 
 
Claims
 
The holders or legally authorized persons (demonstrating a legitimate interest) who consider that the information contained in Arrubla Devis’ database must be subject to correction, updating or deletion, or that they notice an alleged breach of any of the duties contained in Law 1581 of 2012 or another norm that substitutes or regulates it, may submit a written claim through any of the channels provided for this purpose; This must contain the following information:

•    Name and identification of the holder.
•    The precise and complete description of the facts that give rise to the claim.
•    The physical or electronic address to send the response and report on the status of the process.
•    The documents and other evidence that is intended to be asserted.
 
If the claim is incomplete, Arrubla Devis will require the interested party within five (5) business days of receipt to remedy the requirements. Two (2) months after the date of the request, without the petitioner presenting the requested information, it will be understood that he has withdrawn from it. Once the complete claim has been received, Arrubla Devis will include in the respective database a legend that accompanies the Personal Data indicating “claim in process” and the reason for it, in a term no longer than two (2) business days. This legend will remain until the claim is decided.
 
The maximum term to attend the claim will be fifteen (15) business days counted from the day following the date of its receipt, and if it is not possible to answer within said term, Arrubla Devis will inform the interested party of the reasons for the delay and the date on which it will be attended, without exceeding, in any case, the eight (8) business days following the expiration of the first term.
 
To make requests, queries and claims, or to exercise your rights, you can contact the administrative area of the company through the landline (4) 3229884 and the email arrubladevis@arrubladevis.com or by physical mail to our offices located in the city of Medellín at Carrera 37 No. 2 Sur - 34 and in the city of Bogotá at Calle 70 Bis No. 4 - 54. The personal data collected will remain in our databases for as long as necessary for the purposes set forth herein, without prejudice to the rights of the holders.