TIN: 900.562.689 – 1
ADDRESS: Avenida El Dorado No. 90 – 10, Piso 3.

LEGAL REGULATION AND SCOPE OF APPLICATION: This Personal Data Processing Policy has been drawn up in accordance with the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013 and further complementary provisions and will be applied by CARVAJAL INFORMACIÓN IMPRESA S.A.S regarding the collection, storage, use, circulation, erasure and all those activities that constitute processing of personal data.

DEFINITIONS: For the purpose of the execution of this policy and in accordance with legal regulations, the following definitions shall apply: a) Authorization: Prior express and informed consent of the Owner to carry out the personal data Processing; b) Privacy Notice: Physical, electronic or any other format document generated by the Controller that is made available to the Owner prior his/her personal data processing. In the Privacy Notice the Owner is informed of the existence of data processing policies that are applicable, of the way to access said policies and of the intended purpose of the processing that will performed upon personal data; c) Database: Organized group of personal data subject to Processing; d) Personal datum: Any information linked or that can be associated to one or more identified or identifiable natural person; e) Public datum: Is the datum qualified as such according to the mandates of the law or of the Political Constitution and that which is not semi-private, private or sensitive. The data relative to the person’s marital status, profession or trade, to their capacity as trader or public servant and that which can be obtained without any reservation whatsoever, is among other, public. Due to their nature, public data can be contained in public registries, public documents and official journals, among others; f) Private datum: Is the datum that due to its intimate or reserved nature is relevant only to the Owner; g) Sensitive data: Sensitive data is understood as that which affects the intimacy of the Owner or that which, wrongfully used, may generate his/her discrimination, such as that which reveals racial or ethnic origin, political orientation, religious or philosophical convictions, trade-union membership, social organizations, human rights organizations or those which promote the interests of any political party or that safeguard the rights and guarantees of opposing political parties, as well as the data concerning health, sex life and biometric data; h) Data processor: Natural or legal person, public or private, who directly or in association with others, performs the Processing of personal data on behalf of the Data Controller; i) Data Controller: Natural or legal person, public or private, who directly or in association with others, decides on the database and/or the data Processing; j) Owner: Natural person whose personal data are subject to the Processing; k) Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or suppression of said data.

PURPOSE OF PERSONAL DATA COLLECTION AND PERSONAL DATA PROCESSING: CARVAJAL INFORMACIÓN IMPRESA S.A.S. shall make use of personal data to: a)Execute the existing contractual relation with their clients, suppliers and workers, including payment of contractual obligations and the exercise of the rights derived thereof; b)Provide the services and/or products required by the users; c) Inform about new products or services and/or about changes in them; d) Evaluate the quality of service; e) Perform internal studies regarding consumption habits; f) Send commercial, advertising or promotional information regarding products and/or services, events and/or commercial -or not- promotions to the physical, electronic mail, cell phone or mobile device, via text message (SMS and/or MMS) or through any other analog and/or digital communication media created or to be created, with the purpose of promoting, inviting, directing, executing, informing and in general, conducting commercial or advertising campaigns, promotions or contests performed by CARVAJAL INFORMACIÓN IMPRESA S.A.S. and/or by third parties; g) Develop the selection, evaluation and hiring process, as well as the required processes to fully comply with the labor relationship, including the granting of benefits; h) Support internal or external audit processes; i) Register employee and/or pensioner (active and inactive) in CARVAJAL INFORMACIÓN IMPRESA S.A.S. databases; j) Those indicated in the authorization given by the owner of the data or described in the respective privacy notice, as the case may be; k) Provide, share, send or deliver personal data to subsidiary, related or subordinate companies of CARVAJAL S.A. located in Colombia or any other country in the event that said companies require the information for the purposes herein indicated; l) Provide the personal data to insurance companies when strictly necessary to cover the risks of CARVAJAL INFORMACIÓN IMPRESA S.A.S. Regarding the data collected directly at the secure entry points, taken from the documents provided by the people to security personnel and obtained from video recordings made within or outside CARVAJAL INFORMACIÓN IMPRESA S.A.S. facilities, it will be used for security of the people, goods and facilities of CARVAJAL INFORMACIÓN IMPRESA S.A.S. and shall be used as proof in any kind of process.

If a personal datum is provided, said information will be used solely for the purposes herein described, and therefore, CARVAJAL INFORMACIÓN IMPRESA S.A.S. shall refrain from selling, licensing, transmitting, or disclose it, unless: (i) express authorization to do so exists; (ii) it is necessary to allow the contractors or agents to provide the entrusted services; (iii) it is necessary with the purpose of providing our services and/or products; (iv) it is necessary to disclose it to the entities that provide marketing services on behalf of CARVAJAL INFORMACIÓN IMPRESA S.A.S. or to other entities with which there are joint market agreements; (v) the information is related to the fusion, consolidation, acquisition, divestment, or other restructuring process of the partnership; (vi) it is permitted or required by law.

CARVAJAL INFORMACIÓN IMPRESA S.A.S. may subcontract third parties for processing specific functions or information. When indeed third parties are subcontracted to process personal information or personal information is provided to third-party service providers, CARVAJAL INFORMACIÓN IMPRESA S.A.S. cautions said third-parties about the need to protect said personal information with appropriate security measures, forbids the use of the information for their own purposes and requests that this personal information not be disclosed to others.

PRINCIPLES APPLICABLE TO PERSONAL DATA PROCESSING: The personal data processing in CARVAJAL INFORMACIÓN IMPRESA S.A.S. shall be governed by the following principles: a) Principle of purpose: The processing of collected personal data must obey a legitimate purpose, which must be informed to the Owner; b) Principle of freedom: The Processing can only be carried out with the prior, express and informed Consent of the Owner. The personal data shall not be obtained or divulged without prior authorization, or in absence of legal or judicial mandate to relieve consent; c) principle of truthfulness or quality: The information subject to Processing shall be truthful, complete, accurate, up to date, verifiable and comprehensible. Processing of partial, incomplete, fractionated or misleading data will not be performed; d) Transparency principle: In the Processing the Owner must be guaranteed his right of obtaining from CARVAJAL INFORMACIÓN IMPRESA S.A.S. at any time and unfetteredly, information regarding the existence of the data that concerns him/her; e) Principle of access and restricted circulation: The Processing is subject to the limits deriving from the nature of the personal data, of the provisions of existing law and the Constitution. The personal data, except for public information, shall not be available in Internet or other advertising or mássive communication channels, unless access is technically controllable to provide a restricted knowledge to the Owners or authorized third parties only; f) Security principle:The information subject to Processing on the part of CARVAJAL INFORMACIÓN IMPRESA S.A.S. shall be protected by means of technical, human and administrative measures necessary to grant security to the records preventing their alteration, loss, consultation, use or unauthorized or fraudulent access; g) Confidentiality Principle: All persons involved in the Processing of personal data are required to guarantee the discretion regarding the information, even after finalizing their relation with any task involving the Processing.

FIRST PARAGRAPH: In the event of collection of sensitive personal data, the Owner may refuse to authorize its Processing.

RIGHTS OF OWNERS OF PERSONAL DATA SUBJECT TO PROCESSING ON THE PART OF CARVAJAL INFORMACIÓN IMPRESA S.A.S.: The owners of the personal data shall directly or through their representative and/or proxy or his successor in title, exercise the following rights, regarding the personal data that is object of processing by CARVAJAL INFORMACIÓN IMPRESA S.A.S.: a) Right of access: Under which the owner shall access the personal data under the control of CARVAJAL INFORMACIÓN IMPRESA S.A.S., for the purpose of consulting them for free at least once every calendar month, and every time there are substantial modifications to the Information Processing Policies that motivate new consultations; b) Rights to update, rectify and suppress: Under which the owner shall request the update, rectification and/or suppression of the personal data object of the processing, in such way that the purpose of the processing is met; c) Right to request proof of authorization: Except in the events in which, according to the current legal regulations, the authorization to perform the process is not required; d) Right to be informed regarding the use of personal data; e) Right to submit complaints before the Superintendence of Industry and Commerce: for infringements of the provisions in the current legal regulations on personal data processing; f) Right to require compliance of orders issued by the Superintendence of Industry and Commerce.

FIRST PARAGRAPH: For the purpose of exercising the aforementioned rights both the owner as the person who represents him/her shall demonstrate his/her identity and, if so, the role by virtue of which he/she represents the owner. 

SECOND PARAGRAPH: The rights of minors shall be exercised through the people who are authorized to represent them.

DUTIES OF CARVAJAL INFORMACIÓN IMPRESA S.A.S.: All those obliged to comply with this policy shall bear in mind that CARVAJAL INFORMACIÓN IMPRESA S.A.S. is obligated to perform duties imposed by law on this regard. Thus, the following obligations must be fulfilled: A. Duties when acting as controller: (i) Request and preserve copy of the authorization granted by the owner under the conditions provided in this policy. (ii) Inform the owner in a clear and sufficient manner about the purpose of the data collection and of his/her rights related to the granted authorization.  (iii) Inform upon the owner's request about the use given to his/her personal data. (iv) Handle the enquiries and complaints formulated according to the terms stated in this policy. (v) Ensure that the principles of truthfulness, quality, security and confidentiality according to the terms stated in the following policy. (vi) Store the information under the security conditions required to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (vii) Update the information when necessary. (viii) Rectify personal data when appropriate. B. Duties when acting as Processor of personal data. When processing data on behalf of other entity or organization (Data Controller) it should fulfill the following duties: (i) Determine if the Data Controller is authorized to provide the personal data that it will process as Processor (ii) Ensure the owner, at all times, the full and effective exercise of the right to hábeas data. (iii) Store the information under the security conditions required to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access. (iv) Opportunely update, rectify or remove data. (v) Update the information reported by the Data Controller within the next five (5) business days after its receipt. (vi) Handle the queries and complaints formulated by the owners according to the terms stated in this policy. (vii) Record the label “claim in process” on the database as determined in this policy. (viii) Insert in the database the label “information under legal dispute” once notified by the competent authority about judicial processes related to the quality of personal data. (ix) Refrain from circulating information that is being controverted by the owner and that has been blocked by the Superintendence of Industry and Commerce. (x) Allow the accessing of information solely to persons authorized by the owner or empowered under the law for such effect. (xi) Inform the Superintendence of Industry and Commerce when security codes have been breached with risk to the owners’ information management. (xii) Follow the instructions and requirements set forth by the Superintendence of Industry and Commerce.  C. Duties when doing the data processing through a Processor (i) Supply the Data Processor solely with the personal data for which the processing has prior authorization. For the purpose of national or international transmission of data, a personal data transmission contract must be concluded or contractual clauses agreed upon in conformity with the provisions of article 25 of Decree 1377 of 2013. (ii) Guarantee the information provided to the Data Processor is truthful, complete, exact, updated, verifiable and comprehensible. (iii) Inform the Data Processor in a timely manner about all the changes in the information previously provided and adopt any other measures necessary so that the information is up to date.  (iv)Inform the Data Processor in a timely manner about the rectification done on personal data so that it can proceed to make the appropriate adjustments. (v) Require the Data Processor to observe the owners’ information security and privacy conditions at all times. (vi) Inform the Data Processor when a given information is under discussion by the owner, once a complaint is presented and the respective procedure is not finalized.  D. Duties regarding the Superintedencia de Industria y Comercio: (i) Report any violation of security codes and the existence of risks in the management of the owner’s information. (ii) Follow the instructions and requirements issued by the Superintendencia de Industria y Comercio.

AUTHORIZATION REQUEST TO THE OWNER OF PERSONAL DATA: Before and/or at the time of collecting personal data, CARVAJAL INFORMACION IMPRESA S.A.S. must request the data owner his/her authorization to collect and process it, indicating the final end for which the data is required, using for this purpose automated technical resources, oral or written media that allow proof of the authorization to be stored and/or of the unambiguos conduct described in article 7º of Decree 1377 of 2013. Such authorization will be requested for the necessary and reasonable time in order to satisfy the needs that gave rise to the request of the data and, in any case, observing the legal provisions that rule the matter.

PRIVACY NOTICE: In the event that CARVAJAL INFORMACIÓN IMPRESA S.AS. can not make this data processing policy available to the owner, it shall publish the privacy notice attached to this document, text that will be kept for later consultation by the data owner and/or the Superintendence of Industry and Commerce.

TIME LIMITATIONS ON PERSONAL DATA PROCESSING: CARVAJAL INFORMACIÓN IMPRESA S.A.S. shall only collect, store, use or circulate the personal data during the reasonable and necessary time, according to the purposes that justified the processing, meeting the provisions applicable to the matter concerned and to the administrative, accounting, taxation, judicial and historical aspects of information. Once the purpose(s) of the processing are fulfilled and without prejudice of legal norms that provide otherwise, it shall proceed to suppress the personal data in its possession. Notwithstanding the aforesaid, personal data must be stored when required for the fulfillment of a legal or contractual obligation.

RESPONSIBLE AREAS AND PROCEDURES FOR THE EXERCISE OF PERSONAL DATA OWNERS RIGHTS: The rights of the owners may be exercised through the channels that have been enabled to this end. Through the e-mail

The personal data owner or his/her representative may formulate or send his/her request, complaint or claim, Monday to Friday, from 8:00 a.m. to 5:00 p.m. using the phone numbers or the mail addresses as follows:






Avenida El Dorado # 90-10


Jenifer Alexandra Guio Cortes

Yeimi Yineth Fernández Vargas

The request, complaint or claim must have the Owner’s identification, the description of the facts that give rise to the complaint, the address, and attach the documents under claim. If the claim is not complete, the interested person shall be summoned to amend the failures within the next five (5) days to the reception of the claim. Should the missing information from the claimant not be received after two (2) months from the date of the requirement, it will be understood that he/she has desisted from the claim. In case that the person who receives the claim is not competent to solve it, he/she will forward it to the corresponding person in a maximum term of two (2) business days and will inform the situation to the interested person. Once the complete claim has been received, the label “claim in process” will be included in the database together with the reason for said claim, in a term no longer than two (2) business days. Said label shall be kept until the claim has been decided. The maximum time frame to process a claim will be fifteen (15) business days beginning on the day immediately after the receipt date. When it is not possible to process the claim within said time frame, the interested person shall be informed of the reasons for the delay and of the date in which his/her claim will be solved, which in any case shall not exceed eight (8) business days after the expiration of the first term.

DATA COLLECTED BEFORE THE ISSUING OF DECREE 1377 OF 2013: In accordance with numeral 3rd of article 10 of Decree 1377 of 2013, CARVAJAL INFORMACIÓN IMPRESA S.A.S. shall publish a notice on its official web page addressed to personal data owners, to the effect of making public this personal data processing policy and the way to exercise the rights as owners of personal data logged in the data bases of CARVAJAL INFORMACIÓN IMPRESA S.A.S.

SECURITY MEASURES: In compliance with the security principle established in Law 1581 of 2012, CARVAJAL INFORMACIÓN IMPRESA S.A.S. shall adopt the technical, organizational and administrative measures necessary to grant the safety of the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access. Personnel who carry out data processing shall implement the established protocols to the end of guaranteeing information security.

ENTRY INTO FORCE DATE: This Personal Data Policy was created the day 19th of February of 2016 and entries into force starting on the 25th of February of 2016. Any change regarding this policy shall be informed in the web page:  

Kind regards,