1. SCOPE

The Personal Data Processing and Protection Policy set out below applies to all databases and/or files containing personal data processed by CIREC, acting as data controller and/or data processor.

2. GENERAL PROVISIONS

a. IDENTIFICATION OF THE PERSONAL DATA CONTROLLER

Centro Integral de Rehabilitación Colombia, domiciled at Carrera 54 No. 65-25, Barrio Modelo Norte, tax identification number (NIT) 860.066.767-4. Emailjulie.bejarano@cirec.org, Línea gratuita: (+571) 7953600.

b. DEFINITIONS

• Authorisation: the data subject's prior, express and informed consent to the processing of personal data.
• Database: an organised set of personal data subject to processing.
• Personal data: any information linked to, or that can be associated with, one or more identified or identifiable natural persons.
• Semi-private personal data: data that is neither intimate, restricted nor public in nature, and whose knowledge or disclosure may be of interest not only to the data subject but also to a group of people or to society in general. Processing such data requires the express authorisation of the data subject. For example: financial data, and data relating to social security bodies (EPS, AFP, ARL and family compensation funds).
• Sensitive personal data: data affecting the data subject's privacy, or whose improper use may lead to discrimination — such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions, social or human rights organisations, or organisations promoting the interests of any political party or guaranteeing the rights of opposition parties, as well as data relating to health, sexual life and biometric data.
• Private personal data: personal data that, by its intimate or restricted nature, is of interest only to the data subject, and whose processing requires their express authorisation. For example: level of education, traders' books, among others.
• Public personal data: personal data that legislation and the Constitution have expressly determined to be public and for whose collection and processing the data subject's authorisation is not required. For example: people's marital status, data held in the RUNT, data contained in final court judgments, among · Data Processor: a natural or legal person, public or private, who, alone or in association with others, processes personal data on behalf of the data controller.

c. PROCESSING AND PURPOSES

The databases held in physical and digital form at the offices of Centro Integral de Rehabilitación Colombia are intended for communication with data subjects, in order to transmit or transfer information and record their data for employment, commercial, administrative, financial and other purposes. This allows the organisation to better organise and collect its databases for the smooth running of all its operations.

Likewise, controllers, processors or third parties who have access to personal data by law or contract, or who may come to have such access, shall keep processing within the following purposes:

1. To manage all information necessary to comply with legal obligations.
2. To carry out the organisation's internal administrative processes.
3. To perform contracts entered into with any third party.

This personal data is handled strictly, securely and confidentially, as required by Colombian Law 1581 of 2012 and Decree 1377 of 2013. Should any other purpose be intended for the personal data, data subjects must be informed beforehand in order to request the corresponding authorisation, as applicable.

d. YOUR RIGHTS AS A DATA SUBJECT.

Under the law, data subjects have the following rights:

• To access, update and rectify their personal data with the organisation or with its data processors
• To request and/or revoke the authorisation granted to the organisation, except where the law states that no authorisation is required to process such information.
• To know which department or person appointed by the organisation they may address complaints, enquiries, claims and any other request regarding their personal data to.
• To be informed in advance of the use made of their personal data.

And any other rights set out in article 8 of Law 1581 of 2012.

e. PERSON OR DEPARTMENT RESPONSIBLE FOR HANDLING REQUESTS, ENQUIRIES AND CLAIMS.

Centro Integral de Rehabilitación Colombia assigns responsibility for responding to data subjects' requests, enquiries, complaints and claims to all staff who process personal data across its different areas, so that they respond within the timeframes set by law.

f. PROCEDURE FOR DATA SUBJECTS TO EXERCISE THEIR RIGHTS TO ACCESS, UPDATE, RECTIFY AND DELETE INFORMATION AND TO REVOKE AUTHORISATION.

Data subjects may access and exercise their rights as follows:

• For users who provide information by telephone, an automated message will inform them about Law 1581 of 2012, which sets out provisions for the protection of personal data.
• Where information is provided in person, a form will be issued containing the relevant information about the article cited above.
• Claims must be submitted in writing or by email, in accordance with the information contained in this document, and must include at least the following: identification of the data
  • identification of the data subject
  • the facts giving rise to the claim; the data subject's
  • the data subject's address
  • any documentation to be submitted as evidence

g. EFFECTIVE DATE OF THE INFORMATION PROCESSING POLICY AND VALIDITY PERIOD OF THE DATABASE.

The Personal Information Processing Policies of Centro Integral de Rehabilitación have been in force since 1 January 2018.