Company name: CAVELIER ABOGADOS S.A.S.
‍NIT : 860041367 - 3 
Address: Carrera 4 No.  72 A - 35, Edificio Siski Bogota -  Colombia 
Contact us: (601) 3473611
habeasdata@cavelier.com  

Pursuant to Law 1581 of 2012 and its regulatory decrees, which established the personal data protection regime, CAVELIER ABOGADOS S.A.S. (hereinafter, THE FIRM) as the data controller, adopts this Policy for the Processing of Personal Data (hereinafter, THE POLICY).

SCOPE

In accordance with Law 1581 of 2012, THE POLICY shall apply to the processing of personal data from all databases owned by THE FIRM, whether physical or digital, or the processing of which has been entrusted to it. It shall also apply to data collected through www.cavelier.com.The information collected in these databases includes personal data necessary to develop the purposes set forth in THE POLICY and registered with the Superintendence of Industry and Commerce. Sensitive data, corresponding to the employees’ biometric data, is used only to verify their identity upon entering the facilities and to preserve the information of THE FIRM.

USE AND PURPOSE OF PERSONAL DATA PROCESSING

THE FIRM as anentity respectful of the constitutional right of all persons to know, updateand rectify the information collected about them in databases or files, acknowledgesthat the Owners of personal data havethe right to mechanism to exercise these rights, and comply with their dutiesand responsibilities. Therefore, THE FIRM uses, collects, records and stores  personal data to perform the following actions:
 

1. To fulfill the activities integral to its corporate purpose.

2. To offer its products and/or services, either by physical or electronic means.

3. To confirm the references of partners, board members, employees, former employees, customers (active and inactive), suppliers and correspondents.

4. To update information on partners, board members, employees, former employees, customers (active and inactive), suppliers and correspondents.

5. To send commercial and binding contractual information to partners, members of the board of directors, employees, former employees, customers (active and inactive), suppliers and correspondents.

6. To verify compliance with social protection, parafiscal and other applicable regulations of partners, members of the board of directors, employees, former employees, customers (active and inactive), suppliers and correspondents.

7. To develop and implement occupational health and safety prevention and promotion programs based on medical and occupational health information.

8. To verify the identity of employees upon entering the facilities and preserve the information of THE FIRM.

9. To support external and internal audit processes.

10. To perform judicial and extrajudicial processes in which THE FIRM is a party or intervenes.

11. To collect personal data through automated mechanisms to generate records of visitor activity. THE FIRM may only use such information to ensure the security of personnel, information and assets.

12. To provide information to public entities when required in the exercise of their legal functions.

13. Transmit information from THE COMPANY to host it, store it, make backup copies and recover it on third-party servers. Carry out analysis of the information collected on the website www.cavelier.com for marketing purposes and respond to requests submitted through it.

14. To analyze the information collected on www.cavelier.com for marketing purposes and respond to requests submitted through it.

15. To publish in mass media, such as through www.cavelier.com, social networks managed by THE FIRM, internal communications, and press. This purpose may or may not include the publication images.

16. Any others that may be valid in accordance with applicable regulations.

References mentioned in paragraph 3 include, but are not limited to, the following: control lists (National and International Lists), consultation information centers, Clinton List, Procuraduría, Contraloría, Policía Nacional, DIJIN, among others. Databases provided by third parties may be used for this purpose.

THE FIRM will not sell, license, transmit or disclose the Personal Data collected in its databases except when required for the purposes stated in this Policy or in cases where: i) its Data Subject or whoever is authorized by law expressly authorizes it, ii) in the event of a merger, consolidation, acquisition, divestiture or other restructuring process of THE FIRM, iii) it  is required to host, store, make backup copies and recover THE FIRM’s information on third-party servers.

In the internal handling of the Data, these may be known by the authorized personnel of THE FIRM, which includes the General Assembly of Shareholders, Board of Directors, Statutory Auditor, Board of Directors and Management, as well as the employees who in the exercise of their roles require access to such information.

THE FIRM may subcontract third parties to develop activities that require the processing of Personal Data. When this occurs, such third parties shall be required toprotect the Personal Data in the terms required by law and in their capacity as Data Processors of THE FIRM's Databases.  

The analysis of data collected through www.cavelier.com may be executed by tools provided by third parties. The use of this website will be understood as an authorization to the processing of yourpersonal data, including those data collected through cookies, which may betransmitted or transferred to third parties and processed in accordance withthe data policy of these third parties, which may be consulted as indicated on www.cavelier.com.

RIGHTS OF DATA HOLDERS

In accordance with the provisions of Article 8 of Law 1581 of 2012, the following are the rights of the holders of personal data:
‍
a. Know, update, cancel and rectify personal data with the Data Controller or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
b. Request proof of the authorization granted to the Data Controller except when expressly exempted as a requirement for the Processing.
c. To be informed by the Data Controller or the Data Processor, upon request, regarding the use made of their personal data.
‍d. File complaints before the Superintendence of Industry and Commerce forviolations of the provisions of Law 1581 of 2012 and other regulations thatmodify, add or complement it. e.     To revoke the authorization and/or request thedeletion of the data when the processing breaches constitutional and legalprinciples, rights and guarantees.
‍f. Access free of charge to your personal data thathave been subject to Processing.

PROCEDUREFOR EXERCISING YOUR RIGHTS AS A DATA HOLDER 

Pursuant to Section 20 of Decree 1377 of 2013 therights of the holders established in Law 1581 of 2012, may be exercised before THE FIRM by the following persons:

‍a. By the Data Holder, who must sufficiently prove to THE FIRM his or her identity.
‍b. By the assignees of the Data Holder, who must prove such capacity beforeTHE FIRM.

c. By the representative and/or attorney of the Data Holder, upon accreditation before THE FIRM of the representation or power of attorney.
‍d. By provision in favor of or for another.

The holder shall prove his condition by means ofa copy of his identity card or therelevant document, which may be provided in physical or digital media. If theholder is represented by a third party, the respective power of attorney expresslyindicating the powers attributed by the principal must be provided, and theattorney-in-fact must also prove his identity in the terms indicated.  

In accordance withthe provisions of sections 14 and 15 of Law 1581 of 2012, to exercise yourrights as a Data Holder , any of the mechanisms set forth below may be usedbefore THE FIRM:

Content of the petition and correction:

The Holders, their assignees, their representatives or attorneys-in-fact, who consider that the information contained in the databases of THE FIRM should be subject to correction, updating or deletion, consultation or when they notice the alleged breach of any of the duties contained in the law, may submit a request to THE FIRM which shall be processed under the following rules:
 

1. The request shall be formulated by means of a written request addressed to THE FIRM, with the identification of the Holder, the description of the facts that give rise to the claim, the indication of the e-mail or address where the applicant will receive answers and accompanying the documents that he/she wishes to assert.

2. If the claim is incomplete, THE FIRM will require the interested party within five (5) business days after receipt of the claim to correct the faults.After two (2) months from the date of the request made by THE FIRM, without the applicant submitting the required information, THE FIRM shall understand that the claim has been withdrawn.

3. Pursuant to Article 21 of Regulatory Decree 1377 of 2013, personal data may be consulted free of charge at least once every calendar month, and whenever there are substantial modifications to THE POLICY that motivate new consultations.For consultations whose frequency is greater than one per calendar month, THE FIRM may charge the data holder for the costs of shipping, reproduction and, if applicable, certification of documents.

Enabled Channels:

The channels enabled free of charge to receive requests related to Personal Data are the following:

• E-mail: habeasdata@cavelier.com

The opening hours will be from Monday to Friday from 08:00 a.m. to 12:00 m. and from 02:00 p.m. to 06:00 p.m.

The procedure for both inquiries and complaints will be as follows:

1. If the person who receives the request within THE FIRM is not competent to resolve it, he/she shall transfer it to the corresponding person within a maximum term of two (2) business days and inform the interested party of the situation.
2. Once the request is received in the area in charge, it must verify that the content of the request is complete in accordance with the provisions of this policy and the applicable regulations. In case of finding shortcomings, it shall contact the Holder or the person who has submitted the request within five (5) working days following the receipt of the claim, so that it can be corrected.
3. Once THE COMPANY receives the completed claim, the area in charge shall include in the database a legend indicating: "claim in process" and the reason for the claim, within a term not exceeding two (2) business days. Said legend shall be maintained until the claim is decided.
4. The area in charge shall respond to the Holder in accordance with the terms herein indicated, to the e-mail address indicated by the Holder or the authorized person when making the consultation or claim.

Terms:

1. The maximum term for answering queries is ten (10) working days from the receipt of the request. When it is not possible to attend the consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.
2. The maximum term to address claims by THE FIRM shall be fifteen (15) business days from the day following the date of receipt. When it is not possible for THE FIRM to attend the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first term.

Unit in charge of handling requests, inquiries and complaints

The department in charge of processing queries, complaints, claims and petitions related to the treatment and protection of the Personal Data Holders handled by THE FIRM in its databases, shall be the General Secretary.

ENTRY INTO FORCE OF THE TREATMENT POLICY

This Personal Data Processing Policy is effective as of December eighteenth (18) of twenty twenty-three (2023).

Sincerely,

CAVELIER ABOGADOS S.A.S.