Colegios Colombianos S.A.S, is a commercial company committed to the legal, proper and ethical treatment of personal data of stakeholders with whom it relates. To that extent in response to the provisions of paragraph k) of Article 17 of Law 1581 of 2012, Colegios Colombianos S.A.S, has adopted this internal manual of policies and procedures to ensure proper compliance with the law and especially for the attention of queries, updates, complaints and requests from the owners of personal data that are processed by Colegios Colombianos S.A.S.
Article 1.- Definitions.
For purposes of the application of the rules contained herein, and taking into account the definitions contained in Law 1581 of 2012 and its regulatory decrees, the following definitions shall apply:
(a) Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of personal data;
(b) Privacy Notice: Physical document, electronic or in any other format generated by the data controller that is made available to the Data Subject for the processing of his/her personal data. The Privacy Notice communicates to the Data Subject the information regarding the existence of the information processing policies that will be applicable to him/her, the way to access them and the characteristics of the processing that is intended to be given to the personal data;
(c) Database: Organized set of personal data that is subject to Processing;
(d) Personal Data: Any information linked or that may be associated to one or several determined or determinable natural persons;
(e) Private Data: Data which, due to its intimate or reserved nature, is only relevant to the data owner;
(g) Sensitive Data: Sensitive data is understood as that which affects the privacy of the Data Subject or whose improper use may generate discrimination, such as that which reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data;
(h) Data Processor: Natural or legal person, public or private, that by itself or in association with others, carries out the Processing of personal data on behalf of the Data Controller;
(i) Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Processing of the data;
(j) Data Subject: Natural person whose personal data is the object of Processing;
(k) Processing: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion thereof;
(l) Transmission: Processing of personal data that involves communication of the same within or outside the territory of the Republic of Colombia when the purpose of the Processing is carried out by the Processor on behalf of the Controller;
(m) Transfer: The transfer of data takes place when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is the Data Controller and is located inside or outside the country.
Article 2.- Purpose.
This document complies with the provisions of paragraph k) of Article 17 of Law 1581 of 2012, which regulates the duties of those responsible for the processing of personal data, among which is to adopt an internal manual of policies and procedures to ensure compliance with the Law.
Therefore, this manual regulates all organizational processes in which Colegios Colombianos S.A.S. has any responsibility.
Article 3.- Purpose and purpose.
The purpose and purpose of this manual is to establish the rules applicable to the processing of personal data that are subject to treatment by Colegios Colombianos S.A.S., in the development of its corporate purpose, in compliance with the provisions of Article 10 and following of Decree 1377 of 2013, regulating Law 1581 of 2012.
Article 4.- Applicable Law.
This manual complies with the provisions contained in Law 1581 of 2012, Decree 1377 of 2013, Decree 886 of 2014, and other regulations that complement, add, modify or replace them.
Article 5.- Databases.
The policies and procedures contained in this manual apply to the Databases managed by the company, which shall be registered in accordance with the provisions of Decree 886 of 2014 and External Circular No.002 of 2015. Thus, Colegios Colombianos S.A.S. in compliance with the above will update the information recorded in the National Registry of Databases:
- Within the first ten (10) working days of each month, from the date of registration of the Database, changes are madesustanciales en la información registrada.
- Annually, between January 2 and March 31, beginning in 2020.
Substantial changes are those related to the purpose of the Database, the Data Processor, the channels of attention to the Data Subject, the classification or types of Personal Data stored in each Database, the security measures implemented, the Policy for the Processing of Personal Data, and the international transfer and transmission of Personal Data.
Personal Data stored in each Database, the information security measures implemented, the Personal Data Processing Policy, and the international transfer and transmission of Personal Data.
Additionally, within the first fifteen (15) working days of the months of February and August of each year, from its registration, Colegios Colombianos S.A.S. will update the claims submitted by the Data Controllers, referred to in number (i) of literal (g) of numeral 2.1 of External Circular No.2 of 2015.
Article 6.- Principles.
The principles that shall govern this manual, its interpretation and application, and in general all procedures, processes and Processing of Personal Data are the following:
(a) Principle of legality: the processing referred to in this law is a regulated activity that must be subject to the provisions set forth herein and in the other provisions that develop it;
(b) Principle of purpose: The processing of personal data collected by Colegios Colombianos S.A.S. must obey a legitimate purpose of which the Data Subject must be informed;
(c) Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves the consent;
(d) Principle of truthfulness or quality: The information subject to Processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited;
(e) Principle of transparency: The right of the Data Subject to obtain from Colegios Colombianos S.A.S. at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed in the Processing;
(f) Principle of restricted access and circulation: Processing may only be carried out by persons authorized by the Data Controller and/or by the persons provided by law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties;
(g) Principle of security: The information subject to processing by Colegios Colombianos S.A.S., must be protected through the use of technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access;
(h) Principle of confidentiality: All persons involved in the processing of personal data are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the processing.
Article 7.- Authorization.
The collection, storage, use, circulation and deletion of Personal Data by Colegios Colombianos S.A.S. requires the free, prior, express and informed consent of the Data Controllers. Colegios Colombianos S.A.S., in its capacity as Responsible for the Processing of Personal Data, has provided the necessary mechanisms to obtain the authorization of the Data Controllers, at the latest at the time of the collection of their data, ensuring in any case that it is possible to verify the granting of such authorization.
Article 8.- Purposes of collection.
Colegios Colombianos S.A.S. will treat the Personal Data it collects, stores, uses, circulates and deletes, in execution of its corporate purpose with the following purposes:
(a) Fulfillment of the obligations acquired under the contracts entered into with our suppliers, strategic allies and customers, as well as the administration, provision, expansion and improvement of the services to which our End Users have decided to subscribe.
(b) Sending updates of services by traditional and electronic means, commercial information about the services offered by Colegios Colombianos S.A.S. and its allies, now and in the future.
(c) To develop internal studies on the interests, behavior and demographics of the Registrants, with the objective of sending updates on services that meet their needs and interests, to better serve and provide related information to both our customers and end users.
(d) Analyze the pages most visited by end users, the searches performed in order to improve our commercial and promotional initiatives, and improve our content offerings, customize such content and services according to the particular needs of our customers and end users.
(e) Registration of elements on which the user clicks, frequency of use of certain features of the platform and URL's or IP's through which you access the services provided by Colegios Colombianos S.A.S. with the aim of improving and streamlining the interaction with our customers and end users
(f) Send information or text messages about new services, advertising or promotions, banners, of interest to our end users and / or customers, news about the portals that are part of the commercial portfolio of Colegios Colombianos S.A.S., in addition to any other information that we deem appropriate and that fits the needs and preferences of end users and / or customers.
(g) Use the information stored in databases and flat files in order to understand user behavior and to modify the efficiency of the platform and create new features or platforms that meet specific needs.
(h) Use the information stored in databases and flat files to send correspondence, emails or telephone contact to suppliers, customers and / or end users, in the development of commercial, industrial, advertising, promotional, marketing studies focused on the activity that develops and executes Colegios Colombianos S.A.S. and its business partners.
(i) To share them or send them to third parties with whom it makes alliances or contracts for commercial purposes related to the execution of the activities included within the corporate purpose of Colegios Colombianos S.A.S. provided that it is guaranteed that these third parties will treat the Personal Data under the same standards set forth herein and in the applicable law.
Article 9.- Mechanisms and form of granting the Authorization for the Processing of Personal Data.
Colegios Colombianos S.A.S. will treat the Personal Data it collects, stores, uses, circulates and deletes, in execution of its corporate purpose for the following purposes:
The Authorization may be recorded in a physical, electronic document or in any other format that allows guaranteeing its subsequent consultation, or by means of a suitable technical or technological mechanism by means of which it can be unequivocally concluded, that in the absence of a conduct of the Data Subject, the Personal Data would never have been collected and stored in the Database.
The Authorization procedure ensures that the Data Subject has been informed that his personal information will be collected, processed and used for specific and known purposes, and the right to request access, updating, rectification and deletion of his Personal Data at any time, through the mechanisms made available by Colegios Colombianos S.A.S. as stated in this policy. The above in order for the Holder to make informed decisions regarding their Personal Data and control the use of their personal information.
The Authorization is a statement that informs the Data Subject of the Personal Data:
(a) Who collects your Personal Information (Controller or Processor).
(b) What is collected (data to be received).
(c) What it collects the data for (the purposes of the processing).
(d) How to exercise rights of access, correction, updating or deletion of personal data provided.
(e) Inform the Holder that since it is sensitive data (if applicable) he/she is not obliged to authorize its processing.
Article 10.- Proof of Authorization.
Colegios Colombianos S.A.S. will adapt the necessary measures to maintain records or suitable technical or technological mechanisms of when and how it obtained the Authorization by the Holders for the Processing of the same, for the time required from case to case, according to the rules of protection of Personal Data.
Article 11.- Minimum content of the Privacy Notice.
The Privacy Notice, as a minimum, shall contain the following information:
(a) The identity, address and contact details of the Data Controller;
(b) The type of Processing to which the Personal Data will be submitted and the purpose thereof;
(c) The rights of the Data Subject;
(d) The general mechanisms provided by the Controller for the Data Controller to inform the Data Subject about the information processing policy and any substantial changes therein or in the corresponding Privacy Notice. In all cases, the Controller must inform the Data Subject how to access or consult the information processing policy.
(e) Notwithstanding the foregoing, when sensitive Personal Data is collected, the Privacy Notice shall expressly state the optional nature of the response to questions concerning this type of data.
Rights and Duties
Article 12. Rights of the data owner.
The Data Subject may request that their personal information is not published or delivered by Colegios Colombianos S.A.S. to its affiliates and / or subsidiaries, and / or third parties, by sending an email to the address email@example.com in which case Colegios Colombianos S.A.S. will not publish or deliver such information, unless it is required by court order or to protect property rights or any other right or guarantee Colegios Colombianos S.A.S.
The Holder of the Personal Data contained in our Databases, shall have the right to:
(a) Know, update and rectify their Personal Data before Colegios Colombianos S.A.S., in its capacity as Data Controller. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading data, or those whose treatment is expressly prohibited or has not been authorized.
(b) Solicitar prueba de la autorización otorgada al Responsable del Tratamiento salvo cuando expresamente se exceptúe como requisito para el Tratamiento, de conformidad con lo previsto en el artículo 10 de la presente ley;
(c) Be informed by the Data Controller or the Data Processor, upon request, regarding the use made of their personal data;
(d) File complaints before the Superintendence of Industry and Commerce for violations of the provisions of this law and other rules that modify, add or complement it;
(e) To revoke the authorization and/or request the deletion of the data when the processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has incurred in conduct contrary to this law and the Constitution;
(f) Access free of charge to their personal data that have been subject to Processing. Any other defined in Law 1581 of 2012, and its regulations.
Article 13. Duties of Colegios Colombianos S.A.S., in relation to the Processing of Personal Data.
Colegios Colombianos S.A.S., will keep in mind at all times that the Personal Data are the property of the persons to whom they refer and that only they can decide about them. In this sense, it will make use of them only for those purposes for which it is duly empowered, and respecting in any case Law 1581 of 2012, Decree 1377 of 2013 and Decree 886 of 2014 and other applicable rules on personal data protection.
In accordance with the provisions of Article 17 of Law 1581 of 2012 and Articles 21 and 22 of Decree 1377 of 2013, Colegios Colombianos S.A.S., is committed to permanently comply with the following duties in relation to the processing of Personal Data when acting as Data Controller:
(a) Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data;
(b) Request and keep, under the conditions provided for in this law, a copy of the respective authorization granted by the Data Subject;
(c) Duly inform the Data Subject about the purpose of the collection and the rights he/she is entitled to by virtue of the authorization granted;
(d) Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
(e) Ensure that the information provided to the Data Processor is truthful, complete, accurate, updated, verifiable and understandable;
(f) Update the information, communicating in a timely manner to the Data Processor, all developments regarding the data previously provided and take other necessary measures to ensure that the information provided to the Data Processor is kept up to date;
(g) Rectify the information when it is incorrect and communicate the pertinent to the Data Processor;
(h) Provide to the Data Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of this law;
(i) Require the Data Processor at all times to respect the security and privacy conditions of the Data Subject's information;
(j) To process the queries and claims formulated under the terms set forth in this law;
(k) Adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, for the handling of queries and claims;
(l) Inform the Data Processor when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not been completed;
(m) Inform at the request of the Data Subject about the use given to his/her data;
(n) Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the Data Subject's information; and
(o) Comply with the instructions and requirements given by the Superintendence of Industry and Commerce.
When Colegios Colombianos S.A.S. acts in its capacity as Data Processor, it shall have the following duties:
(a) Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data;
(b) Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access;
(c) Update, rectify or delete data in a timely manner under the terms of this law;
(d) Update the information reported by the Data Controllers within five (5) business days from its receipt;
(e) To process the queries and claims made by the Data Controllers under the terms set forth in this law;
(f) Adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, for the handling of queries and claims by the Data Controllers;
(g) Register in the database the legend "claim in process" in the form regulated in the present law;
(h) Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial proceedings related to the quality of the personal data;
(i) Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce;
(j) Allow access to the information only to the persons who may have access to it;
(k) Inform the Superintendence of Industry and Commerce when there are violations to the security codes and there are risks in the administration of the information of the Data Controllers; and (l) Inform the Superintendence of Industry and Commerce when there are violations to the security codes and there are risks in the administration of the information of the Data Controllers.
(l) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
In the event that the qualities of Data Controller and Data Processor concur in the same person, he/she shall be required to comply with the duties provided for each.
Access, Consultation and Complaint Procedure
Article 14. Right of Access.
The power of disposal or decision that the Holder has over the information that concerns him, necessarily entails the right to access and consult if his personal information is being processed, as well as the scope, conditions and generalities of such processing.
In this way, Colegios Colombianos S.A.S., must guarantee the right of access to the Holder in three ways:
(a) The first implies that the Data Subject may know the effective existence of the treatment to which their Personal Data are subjected.
(b) The second, that the Data Subject may have access to their Personal Data that are in possession of Colegios Colombianos S.A.S.
(c) The third implies the right to know the essential circumstances of the treatment, which translates into the duty of Colegios Colombianos S.A.S., to inform the Data Subject about the type of personal data processed and each and every one of the purposes that justify the treatment.
Paragraph - Colegios Colombianos S.A.S., will guarantee the right of access when, after accreditation of the identity of the Data Subject or personality of his representative, the detail of the Personal Data is made available to him, free of charge, through electronic means that allow the direct access of the Data Subject to them. Such access shall be offered without time limit and shall allow the Data Subject the possibility of knowing and updating them through the mechanisms set forth in this Policy.
Article 15.- Consultations.
In accordance with the provisions of Article 14 of Law 1581 of 2012 and Article 21 of Decree 1377 of 2013, the Holders or their assignees may consult the personal information of the Holder that is contained in any Database of Colegios Colombianos S.A.S. Consequently, Colegios Colombianos S.A.S., will guarantee the right of consultation, providing to the Holders, all the information contained in the individual record or that is linked to the identification of the Holder.
For the attention of requests for consultation of Personal Data, Colegios Colombianos S.A.S., guarantees:
(a) Enable electronic means of communication or others it deems relevant.
(b) Establish forms, systems and other simplified methods, which must be informed in the privacy notice.
(c) Use the customer service or complaint services it has in operation.
(d) In any case, regardless of the mechanism implemented for the attention of consultation requests, they will be attended within a maximum term of ten (10) working days from the date of their receipt. When it is not possible to attend the consultation within such term, the interested party shall be informed before the expiration of the ten (10) days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.
Article 16.- Claims.
In accordance with the provisions of article 15 of Law 1581 of 2012, the Data Subject or his/her assignees who consider that the information contained in a Database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, Decree 1377 of 2013 or any other applicable regulation, may file a claim with the Data Controller, which shall be processed under the following rules:
(a) The claim may be filed by the Data Subject, taking into account the information indicated in Article 15 of Law 1581 of 2012 and Article 9 of Decree 1377 of 2013. If the claim received does not have complete information that allows it to be processed, that is, with the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying documents to be asserted, the interested party will be required within five (5) days of receipt to remedy the faults. If two (2) months have elapsed from the date of the request without the applicant submitting the required information, it shall be understood that the claim has been withdrawn.
(b) If for any reason a claim is received that in reality should not be directed against Colegios Colombianos S.A.S., it will transfer, to the extent of its possibilities, to whom it corresponds within a maximum period of five (5) working days, and will inform the interested party of the situation.
(c) Once the complete claim has been received, the Database maintained by the Controller shall include a legend that reads "claim in process" and the reason for the claim, within a term no longer than five (5) business days of receipt of the complete claim. Said legend shall be maintained until the claim is decided.
(d) The maximum term to address the claim shall be fifteen (15) business days from the day following the date of its receipt. When it is not possible to deal with it within such term, the interested party shall be informed before the expiration of such term, the reasons for the delay and the date on which the claim will be dealt with, which in no case may exceed eight (8) business days following the expiration of the first term.
Article 17.- Implementation of procedures to guarantee the right to file claims.
At any time and free of charge, the Data Subject or his representative may request Colegios Colombianos S.A.S., the rectification, updating or deletion of their Personal Data, upon proof of identity:
(1) The rights of rectification, updating or deletion may be exercised by:
(a) The Data Subject or his/her assignees, upon proof of identity, or through electronic instruments that allow him/her to identify him/herself.
(b) By the representative and/or attorney-in-fact of the Data Subject, prior accreditation of the representation or power of attorney.
(c) By stipulation in favor of or for others.
(d) The rights of children or adolescents shall be exercised by the persons authorized to represent them. When the request is made by a person other than the Data Subject and it is not accredited that such person is acting on behalf of the Data Subject, it shall be deemed not to have been filed.
2) The request for rectification, update or deletion must be submitted through the means enabled by Colegios Colombianos S.A.S. indicated in the privacy notice and contain, at least, the following information:
(a) The name and address of the Holder or any other means to receive the response.
(b) The documents proving the identity or personality of its representative.
(c) The clear and precise description of the personal data with respect to which the Data Subject seeks to exercise any of the rights.
(d) If applicable, other elements or documents that facilitate the location of the personal data.
Paragraph one.- Rectification and updating of data. Colegios Colombianos S.A.S., has the obligation to rectify and update at the request of the Holder, the information of the latter that proves to be incomplete or inaccurate, in accordance with the procedure and terms outlined above. In requests for rectification and updating of personal data, the Holder must indicate the corrections to be made and provide documentation to support his request.
Colegios Colombianos S.A.S., is free to enable mechanisms that facilitate the exercise of this right, as long as they benefit the Data Subject. Consequently, it may enable electronic or other means it deems appropriate.
Colegios Colombianos S.A.S., may establish forms, systems and other simplified methods, which must be informed in the privacy notice and will be made available to interested parties on the website.
Whenever Colegios Colombianos S.A.S., makes available a new tool to facilitate the exercise of their rights by the Holders of information or modifies the existing ones, it will inform it through its website.
Paragraph two. Deletion of data. The Holder has the right, at any time, to request Colegios Colombianos S.A.S., the suppression (deletion) of their personal data when:
(a) He/she considers that the same are not being treated in accordance with the principles, duties and obligations provided in Law 1581 of 2012 and Decree 1377 of 2013.
(b) They are no longer necessary or relevant for the purpose for which they were collected.
(c) The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.
Paragraph three.- Exercise of the right of deletion. This deletion implies the total or partial elimination of personal information as requested by the Holder in the records, files, databases or processing carried out by Colegios Colombianos S.A.S. It is important to note that the right of cancellation is not absolute and the Controller may deny the exercise of the same when:
(a) The Data Subject has a legal or contractual duty to remain in the Database.
(b) The deletion of Personal Data would hinder judicial or administrative proceedings related to
(c) Fiscal obligations, the investigation and prosecution of crimes or the updating of administrative sanctions require keeping them.
(d) The data is necessary to protect the legally protected interests of the Data Subject; to carry out an action in the public interest, or to comply with an obligation legally acquired by the Data Subject.
In the event that the cancellation of the Personal Data is appropriate, Colegios Colombianos S.A.S., must operationally perform the deletion in such a way that the elimination does not allow the recovery of the information.
Article 18.- Revocation of consent.
The Owners of the Personal Data may revoke their consent to the processing of their Personal Data at any time, as long as it is not prevented by a legal or contractual provision. To this end, Colegios Colombianos S.A.S., shall establish simple, easily accessible and free mechanisms that allow the Data Subject to revoke their consent, at least by the same means by which it was granted and in the terms stipulated in Law 1581 of 2012, its regulatory Decrees and amending or complementary rules.
It should be taken into account that there are two ways in which the revocation of consent can be given. The first can be on the totality of the consented purposes, that is, that Colegios Colombianos S.A.S., must completely stop processing the data of the Data Subject; the second can occur on specific types of treatment, such as for advertising or market research purposes. With the second modality, that is, the partial revocation of consent, other purposes of the processing that the Controller, in accordance with the authorization granted, can carry out and with which the Data Subject agrees, are kept safe.
Therefore, at the time of submitting the revocation request, the Data Subject must indicate whether the revocation he/she intends to make is total or partial. In the second hypothesis, the data subject must indicate with which treatment the data subject does not agree.
There will be cases in which the consent, due to its necessary nature in the relationship between the Holder and the Controller for the fulfillment of a contract, by legal provision may not be revoked.
The mechanisms or procedures that Colegios Colombianos S.A.S., establishes to meet the requests for revocation of the consent granted may not exceed the deadlines set to meet the claims as stated in Article 15 of Law 1581 of 2012.
Article 19.- Security measures.
In development of the security principle established in Law 1581 of 2012, Colegios Colombianos S.A.S., shall adopt the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
Article 20.- Implementation of security measures.
Colegios Colombianos S.A.S., shall have security protocols of mandatory compliance for personnel with access to personal data and information systems.
The procedure must consider, at least, the following aspects:
(a) Training of personnel entering the Company about the Personal Data Processing Policy and the security mechanisms and protocols for the Processing thereof.
(b) Scope of application of the procedure with detailed specification of the protected resources.
(c) Measures, norms, procedures, rules and standards aimed at ensuring the level of security required by Law 1581 of 2012 and Decree 1377 of 2013.
(d) Functions and obligations of the personnel.
(e) Structure of the personal databases and description of the information systems that process them.
(f) Procedure for notification, management and response to incidents.
(g) Backup and recovery procedures for Personal Data.
(h) Periodic controls to be carried out to verify compliance with the provisions of the security procedure to be implemented.
(i) Measures to be adopted when a medium or document is transported, discarded or reused.
The procedure shall be kept up to date at all times and shall be reviewed whenever relevant changes occur in the information system or in its organization.
The content of the procedure shall at all times comply with the provisions in force regarding the security of Personal Data.
International Transfer and Transmission of Personal Data.
Article 21.- International Transmission and Transfer.
Colegios Colombianos S.A.S., during the development of its corporate purpose, and in order to provide an optimal service to its users, may make Transfer and Transmission of Personal Data of the Owners.
For the international transfer of Personal Data of the owners, Colegios Colombianos S.A.S. will take the necessary measures so that third parties know and undertake to observe this Policy, with the understanding that the personal information they receive may only be used for the purposes set out in this document. Likewise, it is understood that it may not be used or destined for a different purpose or end. For the International Transfer of Personal Data, the provisions of Article 26 of Law 1581 of 2012 shall be observed.
The international transfers of personal data made by Colegios Colombianos S.A.S., will not require to be informed to the Holder or have their consent when there is a contract for the Transfer of Personal Data in accordance with Article 25 of Decree 1377 of 2013.
By accepting this policy, the Data Subject expressly authorizes the transfer and transmission of Personal Data to other countries.
Article 22.- Responsible.
Colegios Colombianos S.A.S., designates the Information Technology Area or whoever takes its place, to comply with the function of personal data protection. The Information Technology or whoever takes its place, will process the requests of the Holders, for the exercise of the rights of access, consultation, rectification, updating, deletion and revocation referred to in Law 1581 of 2012. The above, if necessary, will be done with the support of the administrative area.
Colegios Colombianos S.A.S., designates the Legal Area as responsible for the adoption and implementation of the obligations set forth in Law 1581 of 2012.
Article 23.- Validity.
This Policy shall be effective as of its promulgation on December 19, 2019.