MacondoTek Personal Data Protection Policy

At MacondoTek, we are committed to protecting the privacy and security of the personal information of our employees, clients, and website visitors. This privacy and personal data processing policy describes our practices in accordance with Colombian Law 1581 of 2012 and Decree 1377 of 2013.

Definitions

To facilitate the understanding of this policy, the following definitions apply:

Data processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.
Data Controller: Any natural or legal person, public or private, who alone or jointly with others decides on the databases and/or the processing of personal data. The Controller defines the purpose and manner in which data is stored, collected, and managed, and requests and retains the authorization expressing the data subject’s consent.
Data Processor: A natural or legal person, public or private, who alone or jointly with others processes personal data on behalf of the Controller.
Authorization: Consent given by the owner or data subject whose information is to be included in a database. Such authorization must inform the data subject which personal data will be collected and the purposes for which it will be used.
Privacy Notice: The instrument through which the data subject is informed, at the time of data collection, of the applicable data processing policies, including at minimum: (a) the identity of the Controller, (b) the data subject’s rights, and (c) the channels available for the data subject to learn about the data processing policy.
Database: A set of personal data belonging to the same context, systematically stored for later use.
Personal data: Any information linked to or that can be associated with one or more identified or identifiable natural persons. Personal data may be classified into four categories: public, semi-private, private, and sensitive.
Public data: Data that is not semi-private or private in nature, including data contained in public documents, final judicial rulings not subject to confidentiality, and data relating to civil status.
Semi-private data: Information that is not intimate, reserved, or public, and whose knowledge or disclosure may interest not only the data subject but also a certain sector or group of persons or society in general, such as financial, credit, or commercial activity data.
Private data: Information of an intimate or reserved nature that may only be obtained and disclosed by judicial order or by decision of the data subject, such as merchants’ books, private documents, medical records, or information obtained through inspection of a domicile.
Sensitive data: Information that affects the data subject’s privacy or whose improper use may lead to discrimination, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, social or human rights organizations, data relating to health, sexual life, or biometric data.
Transfer: Occurs when the Controller and/or Processor, located in Colombia, sends personal data to a recipient who is also a Controller, whether inside or outside the country.
Transmission: Processing of personal data that involves communicating such data within or outside Colombian territory for the purpose of processing by a Processor on behalf of the Controller.

Data Controller

The data controller is MACONDOTEK COLOMBIA SAS, NIT No. 901.515.682, physically located at CALLE 166 No. 9-45, Bogotá, Colombia. Contact: +57 300 656 4290 / wilmar.fuquen@macondotek.com.

Duties of MacondoTek as Data Controller

In compliance with applicable law, MacondoTek Colombia SAS has the following duties:

Guarantee data subjects the full and effective exercise of their rights.
Request and retain a copy of the authorization granted by the data subject.
Inform data subjects about the use of their personal data.
Attend to queries and complaints submitted by data subjects.
Guarantee the security and confidentiality of personal data.
Implement appropriate technical, physical, and organizational security measures to protect personal data against loss, unauthorized access, disclosure, alteration, and destruction.
Not transfer or transmit personal data to third parties except when necessary to fulfill legal, regulatory, and contractual obligations, or with the prior consent of the data subject.

Personal Data Collected

We collect personal data from various sources, including:

Employees: Contact information, employment data, identification data, payroll, and social security data.
Clients: Contact information, identification data, and communication preferences.
Website visitors: Contact information and communication preferences.
Event attendees: Contact information, identification data, and communication preferences.

Purposes of Processing

We use the personal data collected to:

Manage our employment relationship with employees.
Provide services to our clients.
Communicate with website visitors and event attendees.
Fulfill our legal and regulatory obligations.

Data Subject Rights

Right of access: Data subjects have the right to obtain information about whether MacondoTek is processing their personal data and, if so, to access it.
Right of rectification: Data subjects have the right to request correction of inaccurate or incomplete personal data held by MacondoTek.
Right of deletion: Data subjects have the right to request the deletion of their personal data in certain circumstances, such as when the data is no longer needed for the purposes for which it was collected.
Right of objection: Data subjects have the right to object to the processing of their personal data in certain circumstances, such as when processing is carried out for direct marketing purposes.
Right to restriction of processing: Data subjects have the right to request restriction of processing of their personal data in certain circumstances, such as when the accuracy of the data is contested.
Right to data portability: Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance, where processing is based on consent and carried out by automated means.
Right to lodge a complaint: Data subjects have the right to lodge a complaint with the Superintendencia de Industria y Comercio if they believe their rights have been violated.

Procedures to Exercise Rights

Data subjects may exercise their rights by submitting a written request to MacondoTek at wilmar.fuquen@macondotek.com. The request must include:

Full name of the data subject.
Identification of the data subject (national ID, passport, etc.).
Clear and precise description of the personal data the subject wishes to access, correct, delete, object to, or port.
Reason for the request.
Date and signature of the data subject.

MacondoTek will respond within a maximum of fifteen (15) business days from receipt of the request. If the request does not meet legal requirements, MacondoTek will notify the data subject within five (5) business days so they may correct it. If no response is received within ten (10) business days thereafter, the request will be considered withdrawn.

Security Measures

MacondoTek has implemented appropriate technical, physical, and organizational security measures to protect personal data against loss, unauthorized access, disclosure, alteration, and destruction, including:

Limiting access to personal data to authorized personnel only.
Implementing security protocols in the processing of personal data.
Encrypting and protecting personal data through appropriate security measures.
Training staff on the importance of personal data protection.

Data Transfer and Transmission

MacondoTek does not transfer or transmit personal data to third parties except when necessary to fulfill legal, regulatory, and contractual obligations, or with the prior consent of the data subject.

When required to transfer or transmit personal data to third parties, we will implement appropriate measures to ensure protection of the data and compliance with applicable laws and regulations.

Validity and Updates

This privacy and personal data processing policy is effective from the date of its publication and may be updated periodically. We will notify data subjects of any significant changes to this policy.

Privacy Policy