Privacy Policy and Personal Data Protection

1. Introduction

In accordance with Article 15 of the Political Constitution of Colombia, which states: "All persons have the right to personal and family privacy and to their good name, and the State must respect and enforce these rights. Similarly, they have the right to know, update, and rectify the information that has been collected about them in databases and archives of public and private entities. The collection, processing, and circulation of data shall respect the freedom and other guarantees enshrined in the Constitution."
In accordance with the provisions of Law 1581 of 2012, regulated by Decree 1377 of 2015, Decree 1074 of 2015, supplemented by Decree 255 of 2022, S&J FULL SERVICES S.A.S., identified with Tax ID No. 814000064-4, whose main address is in the Municipality of Orito – Putumayo, in an effort to guarantee and protect the fundamental rights of workers and, in general, of the different people who provide personal data to the company, adopts this personal data policy, which is regulated by the aforementioned regulations and other related regulations that govern the matter.

2. Objective

The main purpose of this policy is to inform individuals in general of their fundamental right to have personal information provided to S&J FULL SERVICES S.A.S. processed in accordance with the guidelines established in current regulations.
In addition, inform data subjects of the guidelines established by the company for the collection, storage, use, circulation, deletion, and rectification of information held by the company.

3. Responsible for the processing of personal data

S&J FULL SERVICES S.A.S., identified with Tax ID No. 814000064-4, whose main address is KM 0.7 ZONA INDUSTRIAL VIA ECOPETROL Municipality of Orito – Putumayo, email: sjfs@sjfs.com.co.
Therefore, S&J FULL SERVICES S.A.S., as the entity responsible for processing personal data, delegates the processing of personal data to the Quality department, which will be responsible for complying with this policy. It will also be responsible for handling complaints, claims, inquiries, and reports submitted by data subjects and/or those who are entitled to do so, in accordance with the provisions of Law 1581 of 2012.

4. Definition of keywords

In developing this policy, the key concepts listed below will be used and should be interpreted in accordance with the definitions of Law 1581 of 2012, transcribed here:

  • Authorization: Prior, express, and informed consent of the Data Subject to carry out the Processing of personal data.
  • Personal data: Any information linked or that may be associated with one or more specific or identifiable individuals..
  • Habeas Data: Fundamental right that stipulates that all persons have the right to personal privacy, to a good reputation, and to know, update, and rectify the information that has been collected about them in different databases and in the files of public and private entities (Ruling T – 238 of 2018)..
  • Data Controller: Natural or legal person, public or private, who, alone or in association with others, decides on the basis of the data and/or the processing of the data..
  • Headline: Natural person whose personal data is subject to processing.
  • Treatment: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

5. Sensitive data

In accordance with the provisions of Law 1581 of 2012, sensitive data is considered to be data that affects the privacy of the owner or whose misuse may lead to discrimination. Therefore, such data may only be used by S&J FULL SERVICES S.A.S., as the entity responsible for the processing of personal data, in cases previously authorized by law or when written authorization has been obtained from the owner of the information.

6. Rights of data subjects

In accordance with the provisions of Article 8 of Law 1581 of 2012, the owner of personal data shall have the following rights::

  • a) To know, update, and rectify your personal data held by S&J FULL SERVICES S.A.S., as the entity responsible for processing personal data. This right may be exercised, among other things, in relation to partial, inaccurate, incomplete, fragmented, or misleading data, or data whose processing is expressly prohibited or has not been authorized.
  • b) Request proof of the authorization granted to S&J FULL SERVICES S.A.S., as the entity responsible for the processing of personal data, except when expressly exempted as a requirement for processing.
  • c) To be informed by S&J FULL SERVICES S.A.S., as the entity responsible for processing personal data, upon request, regarding the use that has been made of your personal data.
  • d) File complaints with the Superintendency of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add to, or supplement it.
  • e) Revoke authorization and/or request the deletion of data when the principles, rights, and constitutional and legal guarantees are not respected in the processing. The revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that S&J FULL SERVICES S.A.S., as the entity responsible for the processing of personal data, has engaged in conduct contrary to this law and the Constitution.
  • f) Access your personal data that has been processed.

7. Authorization of the Holder

Prior to this, the owner of the information must provide written consent for the processing of personal data, in accordance with the provisions of Law 1581 of 2012 and regulatory decrees.
Similarly, the owner may revoke the authorization at any time by filing a complaint; however, this will not take effect while there is a legal or contractual obligation to remain in the database.

8. Exceptions to authorization

The authorization referred to above shall not be required in the following cases:

  • • Information required by a public or administrative entity in the exercise of its legal functions or by court order;.
  • • Public data.
  • • Medical or health emergencies.

9. Duties of the data controller

S&J FULL SERVICES S.A.S., As the entity responsible for processing personal data, you must comply with the following duties, in accordance with the provisions of Article 17 of Law 1581 of 2012, without prejudice to the provisions of other related regulations governing this matter:

  • a) Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
  • b) Request and retain, under the conditions set forth in this policy, a copy of the respective authorization granted by the Owner.
  • c) Properly inform the Data Subject about the purpose of the collection and the rights they have by virtue of the authorization granted.
  • d) Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
  • e) Update the information, taking into account any new information provided by the data subjects regarding the data previously provided to you, and take any other necessary measures to ensure that the information provided to you remains up to date.
  • f) Correct information when it is incorrect.
  • g) Process inquiries and complaints made in accordance with the terms set forth in this policy or, failing that, in accordance with the terms established in Law 1581 of 2012.
  • h) Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

10. Purpose for which the information will be used and procedures established for inquiries, complaints, and requests for deletion.

10.1. Purpose of the information.

&J FULL SERVICES S.A.S. As the entity responsible for processing personal data, it will use the information provided by the owners exclusively for the purposes authorized and provided for in this Policy, especially for the fulfillment of the corporate purpose.