Triton
1.1 Objective – Data Processing ontroller. This document aims to formalize the information processing policies for personal data of all beneficiaries, employees, allied suppliers, and citizens who interact with SUPPLIER TRITON COLOMBIA “STC” LTD and the various services provided by the company as the data controller. SUPPLIER TRITON COLOMBIA “STC” LTD operates as a legal entity, identified with NIT 900152095 – 6, domiciled in Cartagena, Colombia, Mz A Lt 17 Urbanización El Country.
1.2 Scope – This policy applies to all databases and the personal data contained therein, for which SUPPLIER TRITON COLOMBIA “STC” LTD is responsible within the contextual framework of Law 1581 of 2012 and other regulations that may add, modify, complement, or regulate it. For the purposes of this policy, the terms listed below have the following meanings, which were taken from Law 1581 of 2012 and Decree 1377 of 2013:
a) Authorization: Prior, express, and informed consent of the Data Subject to carry out the Processing of personal data;
b) Privacy Notice: Verbal or written communication generated by the Data Controller directed to the Data Subject for the Processing of their personal data, informing them about the existence of the information processing policies applicable to them, how to access them, and the purposes of the Processing intended for personal data. The privacy notice is used only when it is possible to make the privacy policy available to the public;
c) Database: Organized set of personal data subject to Processing;
d) Personal Data: Any information related to or that can be associated with one or more specific or determinable natural persons; Certain personal data are part of the so-called “public data,” including those included in the Civil Registry. SUPPLIER TRITON COLOMBIA “STC” LTD, in order to comply with its legal and contractual obligations, requires the Processing of numerous personal data, including those of its employees, to which the provisions of Law 1581 of 2012 and its Regulatory Decree 1377 of 2012 apply, and consequently, this policy.
e) Private Data: Data that is relevant only to its holder. f) Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use may lead to discrimination, such as revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or promoting the interests of any political party, or guaranteeing the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
g) Data Processor: Natural or legal person, public or private, who, on their own or in association with others, processes personal data on behalf of the Data Controller;
h) Data Controller: Natural or legal person, public or private, who, on their own or in association with others, decides on the database and/or the Processing of data;
i) Data Subject: Natural person whose personal data is subject to Processing;
j) Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
k) Transfer: Data transfer takes place when the Data Controller and/or Data Processor of personal data, located in Colombia, sends information or personal data to a recipient, who in turn is the Data Controller and is located inside or outside the country.
l) Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when its purpose is to carry out Processing by the Data Processor on behalf of the Data Controller.
1.3. Processing of Personal Information. The personal data that SUPPLIER TRITON COLOMBIA “STC” LTD collects, stores, and processes in any other way are confidential and are only used in accordance with the guidelines set forth by the Constitution and the law that governs its activities, as well as in accordance with the following aspects of personal information processing: 3.1 This policy applies when the Data Subjects decide to provide their data directly to SUPPLIER TRITON COLOMBIA “STC” LTD, either directly or through managed projects, via any verbal, written, online, or physical means, and for those collected through any legal means, such as public databases, by the entity.
1.4. Processing of Personal Information in Communication, Press, or Blogs Activities. Similarly, in the communication, press, or blog activities carried out by the company, personal data of citizens related to their contact information or their images, audios, or videos are collected and stored. This information received by SUPPLIER TRITON COLOMBIA “STC” LTD is provided directly by the information owners and is processed in accordance with this policy within the contextual framework of Law 1581 of 2012 and regulatory norms, under the purposes established in the authorizations granted by the data subject.
1.5. SUPPLIER TRITON COLOMBIA “STC” LTD may conduct statistical, historical, and survey analyses based on the processed personal data. In such cases, it may provide the results to third parties, but when doing so, it will not provide personal information without the authorization of the data subjects. SUPPLIER TRITON COLOMBIA “STC” LTD may contact data subjects through electronic, telephone, and other electronic, physical, and/or personal means for the purposes outlined in this policy.
1.6. In no case will SUPPLIER TRITON COLOMBIA “STC” LTD alienate or deliver this information to a third party other than those mentioned in a general manner within the purposes, unless it is necessary for its proper fulfillment, based on contracts or agreements for the transmission or transfer of data, as necessary, either within the national territory or abroad. The entity may carry out the processing of data on its own servers or those provided by a third party specialized in the field, and these may be located in Colombia or other countries. In such cases, efforts will be made to have agreements that establish the obligations that these third parties must comply with, in addition to the requirement to comply with the entity’s privacy policies. SUPPLIER TRITON COLOMBIA “STC” LTD may conduct statistical, historical, and survey analyses based on the processed personal data. In such cases, it may provide the results to third parties, but when doing so, it will not provide personal information without the authorization of the data subjects.
1.7. Obligations of the Data Controller. SUPPLIER TRITON COLOMBIA “STC” LTD, as the Data Controller, complies with the following obligations, without prejudice to the other provisions of Law 1581 of 2012 and others governing its activity: a) Ensure the Data Subject’s full and effective exercise of the right to habeas data at all times; b) Request and keep, under the conditions established by law, a copy of the respective authorization granted by the Data Subject when necessary; c) Properly inform the Data Subject about the purpose of data collection and the rights granted to them by virtue of the authorization granted when necessary; d) Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access; e) Ensure that the information provided to the Data Processor is truthful, complete, accurate, up-to-date, verifiable, and understandable; f) Update the information by promptly informing the Data Processor of any changes regarding the data previously provided and take any necessary measures to ensure that the information provided to them remains up-to-date; g) Rectify the information when it is incorrect and communicate the relevant details to the Data Processor; h) Demand from the Data Processor at all times the respect for the security and privacy conditions of the data subject’s information; i) Process inquiries and complaints as stipulated by law; j) Adopt an internal manual of policies and procedures to ensure compliance with the law and, in particular, to address inquiries and complaints; k) Inform the data protection authority when there are violations of security codes and risks in the management of data subject information. l) Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
1.8. Data Subject Rights. The data subject, regarding whom SUPPLIER TRITON COLOMBIA “STC” LTDA is responsible for processing personal data, has the following rights: a) To know, update, and rectify their personal data in relation to SUPPLIER TRITON COLOMBIA “STC” LTDA. This right may be exercised, among others, in relation to partial, inaccurate, incomplete, split, misleading data, or data whose processing is expressly prohibited or has not been authorized. b) To request proof of the authorization granted to SUPPLIER TRITON COLOMBIA “STC” LTDA unless expressly excepted as a requirement for processing. c) To be informed by SUPPLIER TRITON COLOMBIA “STC” LTDA, upon request, about the use that has been given to their personal data. d) To file complaints with the Superintendence of Industry and Commerce for violations of the data protection law and other regulations that modify, add to, or complement it. e) To revoke the authorization and/or request the deletion of the data when the processing does not comply with constitutional and legal principles, rights, and guarantees. Revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that SUPPLIER TRITON COLOMBIA “STC” LTDA has engaged in conduct contrary to the law and the Constitution. f) To access their personal data that have been processed, free of charge.
1.9. Authorizations and Consent. The collection, storage, use, circulation, or deletion of personal data by SUPPLIER TRITON COLOMBIA “STC” LTDA is done with the prior free, express, and informed consent of the data subject, if it is mandatory.
2.0. Means to Grant Authorization. Authorization may be recorded in a physical document, electronic document, data message, voice recordings, Internet, website, suggestion box, in any other format that allows subsequent consultation, or through a suitable technical or technological mechanism that allows the expression or obtaining of consent via a click or double click, or by any other means that unequivocally indicates that, in the absence of an action by the data subject, the data would never have been captured and stored in the database. 4.0.. Proof of Authorization. SUPPLIER TRITON COLOMBIA “STC” LTDA uses the mechanisms it currently has to implement the necessary actions to maintain records or suitable technical or technological mechanisms for the preservation of authorization by the data subjects for the processing of their data. To comply with this, physical files or electronic repositories may be established directly or through third parties contracted for this purpose.
2.1. Photos, Videos, and Publications. In the course of the services provided by SUPPLIER TRITON COLOMBIA “STC” LTDA, photographic images and audio and video recordings may be captured of clients, as well as individuals interested in or beneficiaries of the services, whether by service providers/operators, contractors, or directly by SUPPLIER TRITON COLOMBIA “STC” LTDA. This photographic and video material is centralized by SUPPLIER TRITON COLOMBIA “STC” LTDA and is used for the purpose of (i) documenting the work carried out in the context of its services; (ii) publishing them in informational campaigns about the services through various media such as radio, television, and/or press; (iii) including them as part of printed, digital, or electronic audiovisual materials, as well as on the company’s websites and social media. There is a commitment to carefully review the information that will be published in any form so as not to infringe upon the dignity, privacy, or good name of any of the individuals appearing in such communications. On each occasion when authorizations for the processing of images, videos, and publications of the interested parties, potential beneficiaries, and beneficiaries of the projects are required, they must be aware and accept that they are not entitled to receive compensation or economic, commercial, or profit-based recognition, stating that the information will be used solely for the purposes outlined in this section. The provision, capture, and receipt of this information by its owners, in any form, does not transfer intellectual property or moral rights over it.
2.2. Handling of Requests, Inquiries, and Complaints. Responsible Department. SUPPLIER TRITON COLOMBIA “STC” LTDA, through the legal department, will handle all requests, inquiries, complaints, and/or claims by the information owner related to the rights established by law to know, update, rectify, or delete their personal data. In accordance with Article 14 of Law 1581 of 2012, inquiries will be addressed within a maximum period of ten (10) business days from the date of receipt thereof. When it is not possible to respond to the inquiry within that period, the interested party will be informed, stating the reasons for the delay and indicating the date on which the inquiry will be answered, which in no case may exceed five (5) business days following the expiration of the first term. In accordance with Article 15 of Law 1581, when the data subject or their successors believe that the information contained in a database should be corrected, updated, or deleted, or when they become aware of the alleged non-compliance with any of the duties set forth in the law, they may file a complaint with the Data Controller or the Data Processor. The complaint shall be made by means of a request addressed to the Data Controller or the Data Processor, identifying the data subject, describing the facts that give rise to the complaint, providing the address, and attaching the documents to be relied upon. If the complaint is incomplete, the interested party will be required, within five (5) days following receipt of the complaint, to rectify the shortcomings. If two (2) months have passed since the date of the request without the applicant providing the requested information, it shall be deemed that they have withdrawn the complaint. In the event that the party receiving the complaint is not competent to resolve it, they shall transfer it to the appropriate party within a maximum period of two (2) business days and inform the interested party of the situation. Once the complete complaint is received, a notation stating “complaint in progress” and the reason for it shall be included in the database, within a maximum period of two (2) business days. This notation shall be maintained until the complaint is resolved. Once the complete complaint is received, a note saying “complaint in progress” and the reason for it will be included in the database within a term not exceeding two (2) business days. This note must be maintained until the complaint is resolved. The maximum term for addressing the complaint will be fifteen (15) business days counted from the day following the date of its receipt. If it is not possible to address the complaint within this term, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial term.
It should be noted that as long as the Data Subject appears as a beneficiary of the services provided by SUPPLIER TRITON COLOMBIA “STC” LTDA or it is necessary to retain the information in order to adequately fulfill the company’s purpose, the information will be maintained, and the Data Subject will not have the authority to request the deletion of the information from the databases. If the request for removal is made after the legal or contractual relationship has ended and it is no longer necessary for the entity to retain the information to fulfill its obligations, the deletion of the data will mean that they cannot be accessed for the normal operations of the entity. However, they may be kept in its records for statistical, historical, knowledge of its officials, allies, operators, or to respond to requests from administrative or judicial authorities.
The company, in the development of its corporate purpose, relies on third parties who collaborate with the development of its activities and the proper functioning of the projects in which it participates. To that extent, it has instructed these third parties to ensure that the collection of personal information, whatever it may be, is always preceded by all relevant authorizations. However, in the event of non-compliance by these third parties with their obligations, it is not assumed by SUPPLIER TRITON COLOMBIA “STC” LTDA, which, in such cases, acts as a third party in good faith, so its actions will always be based on the belief that these third parties have the necessary authorizations to process the information in accordance with the purposes for which it is provided. In the event that the request made by the data subject or their successors relates to the authorizations existing for the processing of data collected by these third parties, SUPPLIER TRITON COLOMBIA “STC” LTDA will make its best efforts to address the request properly and, if unable to do so, will forward the request to the third parties responsible for collecting the information. However, in such cases, it will not be responsible for the content of the responses provided to the requests.
2.3. Procedure for the exercise of rights. Data subjects may make requests, inquiries, and/or complaints regarding their personal data processed by SUPPLIER TRITON COLOMBIA “STC” LTDA through the following mechanisms:
This Information Processing Policy is governed by the provisions of Law 1581 of 2012, Regulatory Decree 1377 of 2013, and other regulations amending them. 8.3. Effective Date. This policy comes into effect from September 2023. Personal data processed by SUPPLIER TRITON COLOMBIA “STC” LTDA will remain in the entity’s database until they fulfill the purposes for which they were collected. SUPPLIER TRITON COLOMBIA “STC” LTDA reserves the right to review and/or modify this Information Processing Policy at any time. SUPPLIER TRITON COLOMBIA “STC” LTDA will publish any changes to this policy on its website. When substantial changes are made to this policy, this fact will be communicated to the data subjects, and the date from which the new policy will apply will be indicated.”
