The Fundación El Remanente
Personal data treatment policy

The Fundación El Remanente

Personal data treatment policy

1. La fundación El Remanente is a non-profit organization, established on September 26, 2008, which aims to contribute to the understanding of the problems of the community, directing them to the relations of children and adults, in family, educational, social and institutional spaces, strengthening them in principles, values and accepting the commitment to themselves, with care for the proper development of life.

The Fundación El Remanente

NIT: 900243121 0

Dirección: Carrera 13 c # 9-68 sur Barrio Los Ducales II sector, Soacha, Cundinamarca.

Teléfono: (+57) 3164951569

E-mail: administracion@fundacionelremanente.org

2. INTRODUCTION

La fundación El Remanente, in compliance with the provisions of the Statutory Law 1581 of 2012, adopts this policy for the processing of personal data, which will be made known to all holders of the data collected or obtained in the future in the fulfilment of its corporate purpose.

Thus, the Fundación El Remanente states that it guarantees the rights of privacy, intimacy and good name in the processing of personal data, and consequently all its actions will be governed by the principles of legality in data processing, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality.

All persons who, in the course of the activities of the Fundación El Remanente, whether permanent or occasional, may provide any type of information or personal data, may know the information collected, update it, rectify it and/or ask for it to be deleted.

The present Personal Data Processing Policy applies to all personal data bases currently in use or that may be created in the exercise of the corporate purpose of the El Remanente Foundation. El Remanente Foundation reserves the right to modify, at any time, unilaterally, its policies and procedures for the treatment of personal data, for legal or institutional reasons. Any change will be made known to the owners of the information in a timely manner.

The Fundación El Remanente will proceed, in accordance with the current regulations and the regulations issued by the National Government, to register its databases with the National Registry of Databases (RNBD), which will be administered by the Superintendence of Industry and Commerce.

3. DEFINITIONS

Authorization: prior, express and informed consent of the holder to carry out the processing of personal data.

Privacy notice: verbal or written communication generated by the responsible party, addressed to the holder for the processing of personal data, through which he/she is informed about the existence of the information processing policies that will be applicable, the way to access them and the purposes of the processing that is intended to be given to the personal data.

Database: organized set of personal data that is subject to processing.

Causahabient: a natural or legal person who has succeeded or substituted another, the causer, by any legal title in the right of another.

Personal data: any information linked or that can be associated to one or several determined or determinable natural persons.

Private data: data that, due to its intimate or reserved nature, is only relevant to the owner. It is similar to sensitive data.

Public data: data that is not semi-private, private or sensitive. Public data includes, among others, data relating to the marital status of individuals, their identity card number, their profession or trade, and their status as a merchant or public servant. By their nature, public data may be contained, among others, in public records, public documents, gazettes, official gazettes and duly executed court rulings that are not subject to confidentiality. The processing of this data may be carried out without the prior authorization of the owner, but the processing of such data must adhere to the principles and duties enshrined in Law 1581 of 2012.

Semi-private data: semi-private data is data that is not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of persons or to society in general, such as financial and credit data of commercial activity or services referred to in Law 1266 of 2008.

Sensitive data: data that affect the holder's privacy or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.

Data Processor: natural or legal person, public or private, that by itself or in association with others, carries out the processing of personal data on behalf of the data controller.

National Registry of Databases (RNBD): is the public directory of databases subject to processing operating in the country. The registry will be administered by the Superintendence of Industry and Commerce and will be freely consulted by citizens.

Data Controller: natural or legal person, public or private, who alone or in association with others, decides on the database and/or the processing of data.

Data subject: Natural person whose personal data is the object of processing.

Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

The processing of personal data shall be guided by the following principles:

Principle of legality in data processing: it is a regulated activity that must be subject to the provisions of Law 1581 of 2012 and other provisions that develop it.

Principle of purpose: it must obey a legitimate purpose, which must be informed to the owner.

Principle of freedom: can only be exercised with the prior, express and informed consent of the owner. Personal data may not be obtained or disclosed without prior authorization, with the exception of the existence of a legal or judicial mandate.

Principle of truthfulness: no partial, incomplete, fractioned or misleading personal data may be processed; in this sense, personal data must be truthful, complete, accurate, updated, verifiable and understandable for its processing.

Principle of transparency: the owner of the personal data shall have the right to obtain information about the existence of his data.

Principle of restricted access and circulation: subject to the limits derived from the nature of the personal data and the provisions of Law 1581 of 2012 and other provisions that develop it. Therefore, the treatment may only be done by persons authorized by the holder and/or by persons authorized in the applicable legislation.

Principle of security: the information subject to treatment by the responsible or in charge shall be handled with the technical, human and administrative measures necessary to provide security to the records, avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

Principle of confidentiality: all persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the processing, and may only provide or communicate personal data when this corresponds to the development of the activities authorized in Law 1581 of 2012 and under the terms of the same.

Principle of necessity and proportionality: the personal data recorded in a database must be strictly necessary for the fulfillment of the purposes of the processing informed to the owner. In this sense, they must be adequate, relevant and in accordance with the purposes for which they were collected.

Principle of temporality or expiration: the period of conservation of personal data will be the period necessary to achieve the purpose for which they have been collected. The holder's information may not be provided to users or third parties when it no longer serves the purpose for which it was obtained.

Principle of integral interpretation of constitutional rights: the regulations shall be interpreted in such a way as to adequately protect constitutional rights, such as habeas data, the right to a good name, the right to honour, the right to privacy and the right to information. The rights of the owners shall be interpreted in harmony and in balance with the right to information provided for in Article 20 of the Constitution and with the other applicable constitutional rights.

4. RIGHTS OF THE OWNERS OF THE INFORMATION

The holders of personal data in the databases of the Fundación El Remanente shall have the following rights:

- Access, know, update and rectify and/or request the deletion of your personal data. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.

- Request proof of the authorization granted for data processing.

- Be informed by the entity, upon request, regarding the use that will be made of your personal data.

— To cancel the authorization and/or request the deletion of the data when the treatment does not respect the constitutional and legal principles, rights, and guarantees.

- Access free of charge to your personal data that have been processed whenever there are substantial modifications to this policy.

- File before the Superintendence of Industry and Commerce, or the entity that takes its place, complaints for violations of the provisions of Law 1581 of 2012 and other rules that modify, add or complement it, after consultation or request to the Fundación El Remanente.

The above rights may be exercised by the owner of the information or their assignees, who must prove their identity to the Fundación El Remanente

Rights of children and adolescents.

In the processing of information, the fundamental and prevailing rights of minors and adolescents shall be respected under the terms set forth in Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013 and other rules governing the matter.

The Fundación El Remanente will provide training to parents, legal representatives or guardians of children and adolescents on its Personal Data Processing Policy and on the risks faced by children and adolescents regarding the improper processing of their personal data. In addition, El Fundación El Remanente will make known its Child Protection Policy established at the organizational level to guarantee the rights of children and adolescents who participate in the activities of its corporate purpose.

5. DUTIES OF the Fundación El Remanente AS RESPONSIBLE AND LIABLE FOR THE PROCESSING OF PERSONAL DATA

- Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.

- Request and keep a copy of the respective authorization granted by the holder for the processing of personal data.

- Duly inform the owner about the purpose of the collection of his/her data, as well as the rights he/she has in relation to the authorization granted.

- Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.

- Ensure that the information is truthful, complete, accurate, up-to-date, verifiable and understandable.

- Rectify the information when it is incorrect and communicate the pertinent.

- Respect the security and privacy conditions of the holder's information.

- Process inquiries and claims formulated in the terms established by law.

- Inform upon request of the owner about the use given to their data.

- Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the owners.

• Comply with the requirements and instructions issued by the Superintendency of Industry and Commerce on the particular topic.

• Use only data whose processing is previously authorized in accordance with the provisions of Law 1581 of 2012.

- Ensure the proper use of personal data of children and adolescents.

- Allow access to information only to those who can access it.

6. AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA BY THE HOLDER OF THE INFORMATION

For the processing of information by the Fundación El Remanente, prior express and informed authorization of the owner is required, prior to the processing of personal data.

The authorization for the processing of personal data will be granted to the Fundacion El Remanente by the owner of the information, their parents, representatives and/or proxies, through a written document prepared by the foundation, or in any other format that allows obtaining consent through unequivocal behaviors through which it is concluded that had it not been carried out by the owner or the person legitimized for it, the data would not have been stored or captured in the database.

At the time of requesting authorization from the owner, the Fundacion El Remanente will inform them in a clear and express manner about the treatment to which their personal data will be subjected and the purpose of it, the optional nature of the response to the questions that are asked, when these are about sensitive data or about the data of girls, boys and adolescents, the rights that assist them as the owner and the identification, physical or electronic address and telephone of the person responsible for data processing.

Circumstances in which authorization is not necessary (Law 1581 of 2012, Article 10): the owner’s authorization will not be necessary when it comes to:

1. Information required by a public or administrative entity in the exercise of its legal functions or by court order

2. Data of a public nature

3. Cases of medical or health emergency

4. Processing of information authorized by law for historical, statistical or scientific purposes

5. Data related to the Civil Registry of people

7. TREATMENT TO WHICH PERSONAL DATA WILL BE SUBJECTED AND PURPOSE

The treatment of personal data of program participants, applicants, employees, and suppliers, or any person with whom the El Remanente foundation has or may have a relationship, whether permanent or occasional, will be done within the legal framework that regulates the matter

The Fundación El Remanente does not disclose, sell or rent to third parties the personal information provided by the owners of its databases and is directly responsible for the processing of information. Personal data may be collected and processed for:

• Develop the mission of the El Remanente foundation

• Comply with the requirements and internal regulations of the Programs implemented by the Fundación El Remanente at the local level

• Maintain an internal control that facilitates the operation, administration and monitoring of the Programs.

• Comply with legal, accounting and tax requirements established by the different governmental entities that regulate the operations of non-profit entities in Colombia.

• Send information related to the work of the Fundacion El Remanente to Program participants, new applicants, employees, and suppliers (existing and future).

• Comply with the legal provisions established in labor and social security matters, for current employees and future job candidates.

• Conduct surveys related to the activities carried out by the Fundacion El Remanente

8. PROCEDURE TO KNOW, CLAIM (update, rectify and delete data) AND REVOKE AUTHORIZATION

The owners of personal data, their parents, proxies and/or legal representatives may at any time and at no cost know, update, rectify and delete data, submit claims and revoke authorization through a written request addressed to the Fundacion El Remanente or to its email address. administracion@fundacionelremanente.org. The written request must contain the identification of the owner, residence address, telephone, a description of the facts that give rise to the claim. The request must be accompanied by the documents that you want to enforce.

The owner of the information may request the deletion of their personal data when they consider that they are not being treated in accordance with the principles, duties and obligations provided for in current regulations, when they have ceased to be necessary or relevant for the purpose for which they were collected and when the necessary period for the fulfillment of the purposes for which they were collected has been exceeded.

The owner of the information may request the revocation of the authorization in a total or partial manner. When it is partial, the Fundacion El Remanente will cease the data processing activity requested by the owner and may continue processing personal data for those purposes in relation to which the owner has not revoked the authorization.

The Fundacion El Remanenete sets a maximum period of 10 business days, counted from the day after the receipt of the request, to respond to requests for updating, rectification, claims, data deletion and revocation of authorization. When it is not possible to attend to the request within this term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case may exceed five (5) business days following the expiration of the first term.

9. INFORMATION SECURITY AND SECURITY MEASURES

In compliance with the security principle established in current regulations, the Fundacion El Remanente will adopt the necessary technical, human and administrative measures to provide security to personal data records, preventing their adulteration, loss, consultation, unauthorized or fraudulent use or access.

10. VALIDITY OF THE PERSONAL DATA TREATMENT POLICY

This policy is effective from the current date.