Política de privacidad

PRIVACY POLICY AND PERSONAL DATA PROCESSING OF BIOCIRCULO S.A.S

The following is the Privacy Policy and Personal Data Processing (hereinafter, the "Privacy Policy")applicable to individuals who provide their personal data to BIOCIRCULO S.A.S. (hereinafter "BIOCIRCULO"),which will be included in BIOCIRCULO's databases and will be subject to Processing by the company. BIOCIRCULO is a company that, among other activities, produces recycled raw materials for the plastic industry using post-consumer waste collected by the recycling chain (Recycling Associations). This Privacy Policy also governs the collection and/or processing of data performed by third-party Data Processors referenced by BIOCIRCULO (as defined below).

1. Data Controllers and Processors

The Data Controller of user data will be BIOCIRCULO, which may store, generate databases, collect, use, transmit, transfer, convey, assign, deliver, retain, process, exploit, commercialize, and/or delete data as outlined in this Privacy Policy.
The Data Processors will be all third parties to whom BIOCIRCULO transmits, transfers, conveys, assigns, delivers, and/or commercializes user data. These parties will adhere to this Privacy Policy and will process the data strictly as allowed by BIOCIRCULO, always with the consent of the Data Subjects.

2. Scope of the Privacy Policy

This Privacy Policy applies to all Databases and/or files containing Personal Data that are subject to Processing by BIOCIRCULO, its affiliates, subsidiaries, and assignees in cases where it is considered the Data Controller and/or Processor of Personal Data of natural persons, in accordance with the provisions of Statutory Law 1581 of 2012, Decree 1377 of 2013, and other norms that amend and/or supplement them.

3. Definitions

For the purposes of this Policy, the following terms shall be understood as defined in Article 3 of Law 1581 of 2012, as transcribed below:

Authorization. Prior, express, and informed consent of the data subject to carry out the processing of personal data;
Database. An organized set of personal data subject to processing;
Personal Data. Any information linked or that may be associated with one or more determined or determinable natural persons (hereinafter "Personal Data" or "Personal Information");
Data Subject or User. The natural person whose personal data is subject to processing;
Processing. Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion;
Data Transmission: Processing of Personal Data involving communication within or outside the territory of the Republic of Colombia for the purpose of processing by the Processor on behalf of the Controller;
Data Transfer. Data Transfer occurs when the Controller and/or Processor of personal data, located in Colombia, sends Personal Information or Personal Data to a receiver, who is also a Controller of Processing and is located either within or outside the country;
Sensible Data. Data that affects the privacy of the data subject or whose misuse may affect the privacy of the data subject or has the potential to lead to discrimination;
Public Data. Data that is not semi-private, private, or sensitive. Public data includes, among others, data related to a person's civil status, profession or occupation, and their status as a merchant or public servant.

Data Collected from All Users through Digital Media

When accessing any data collection media (hereinafter "Collection Media"), such as websites, platforms, mobile applications, among others, without needing to provide personal data, to offer a more personalized experience in using systems and services or offers, BIOCIRCULO collects and retains the following information about the Collection Media users (hereinafter "Visitors"), which will be used in accordance with this Privacy Policy (hereinafter "Cookies"), which Visitors expressly authorize:

The date and time of access to the Collection Media;
The IP address from which the Collection Media was accessed;
The number of the visiting user; and
Activities performed within the Collection Media through the use of Cookies such as information about their URL, which URL is accessed next, what browser is being used, which pages are visited, searches conducted, among others, to understand the interests, behavior, and demographics of Visitors.

Data Collected from Users of Voluntary Collection Media, Third-Party Contractors, and Employees

BIOCIRCULO, directly or through allied third parties, may collect user data through various digital or physical Collection Media or may obtain it from contractors, employees, or other third parties such as clients or participants in promotions, activities, events, among others, all in compliance with BIOCIRCULO's corporate purpose or any lawful related activities and activities carried out by BIOCIRCULO or allied third parties for advertising and other purposes, in which the following information may be collected, which is understood to be authorized by the Data Subjects under the conditions of this Privacy Policy:

User/Subject's first and last names;
Identification document;
Age;
Date of birth;
Gender;
Region, country, city of residence;
Cell phone number;
Email address;
Preferences for educational, financial, and any type of service and/or product consumption;
Credit and Financial Information;
Professional Information;
Tax Information;
Employment Information;
Socio-Economic Information;
Social stratum and number of people living in the household;
Preferences according to the provided/requested information;
Activities performed by the Subject and information provided regarding their interests, behavior, and demographics of the Subject and their family;
Bank and/or commercial references;
Information regarding the Subject's studies and the entities where they were completed, as well as general academic information;
Any other voluntarily provided by the Subject.

6. Processing of Personal Data by BIOCIRCULO

BIOCIRCULO, in the pursuit of its corporate purpose and economic activity, acts as the Data Controller of personal data in its databases. Accordingly, it collects, stores, uses, transmits, transfers, conveys, assigns, delivers, retains, processes, exploits, commercializes, and/or deletes personal data of natural persons with whom it has or has had some form of relationship, regardless of its nature (civil, commercial, and/or labor); including but not limited to suppliers, contractors, workers, consumers, creditors, debtors, clients, and shareholders.

7. Use of the Privacy Policy and Information Protection

BIOCIRCULO informs all data subjects whose Personal Data is provided, either electronically or manually, that its processing will be governed by this Privacy Policy. Therefore, if a data subject does not agree with this Privacy Policy, they should not provide any information to be recorded in BIOCIRCULO's Databases;
BIOCIRCULO is committed to the security and proper use of personal data provided and, consequently, undertakes to use it appropriately and maintain the required confidentiality in accordance with this Privacy Policy and existing legislation;
BIOCIRCULO is committed to complying with the obligation of secrecy of personal data and its duty to process it confidentially, and undertakes to take technical, organizational, and security measures necessary to prevent its alteration, loss, processing, or unauthorized access, in accordance with the law and international treaties signed by Colombia that govern the matter;
BIOCIRCULO has undertaken and will undertake all necessary actions to ensure that both service providers and processors working on behalf of the company, as well as affiliates, subsidiaries, commercial allies, and other authorized third parties in accordance with this Privacy Policy, protect the confidentiality of Personal Information in all cases; and
The User will be responsible for the truthfulness of the information provided, reserving BIOCIRCULO the right to exclude from registered services any User who has provided false data. BIOCIRCULO may collect information in the public domain to complement its databases. This information will be treated in the same manner as outlined in this Privacy Policy.

8. Authorized Uses

BIOCIRCULO's processing of Users' personal data involves collecting, storing, purging, using, analyzing, circulating, updating, cross-referencing with its own and/or third-party authorized information, exploiting, retaining, processing, transferring, transmitting, transferring, assigning, delivering, deleting, and/or commercializing contact data, consumption preferences in any market, and behavior on contact channels for the following purposes:

Facilitate the proper execution of data collection through Collection Media;
Conduct statistical studies to design improvements in services provided by BIOCIRCULO or its clients, partners, and affiliates, where applicable, as well as to conduct market and consumption studies. BIOCIRCULO, its affiliates, and/or third-party subcontractors may analyze Personal Information for the development and execution of their campaigns;
Manage basic administrative and management tasks, as well as contacts to fulfill BIOCIRCULO's corporate objectives. Information acquired through the relationship between the Data Subjects and BIOCIRCULO or its clients, affiliates, or partners, regardless of their legal nature (labor, civil, commercial, among others), may be processed;
Comply with contractual and/or legal obligations BIOCIRCULO has with its clients, employees, suppliers, authorized parties, assignees, licensees, affiliates, subordinated entities, and commercial allies, as well as with judicial or administrative authorities;
Inform by any means about current and future promotions, products, and services of BIOCIRCULO, as well as those of its clients, partners, or affiliates; events, promotional activities, and other commercial activities directly or indirectly related to BIOCIRCULO's activities; and/or promotions, products, and services promoted directly by BIOCIRCULO’s strategic commercial partners that provide added value to Users or third parties;
Send advertising material related to BIOCIRCULO's products and services, its authorized entities, clients, assignees, licensees, affiliates, and/or subordinated entities and strategic commercial partners;
Use the information for preparing, participating in, and developing contests, games, or promotional activities;
Use the information for preparing and developing advertising notices;
Analyze and measure the quality of the products and services offered by BIOCIRCULO, its authorized entities, assignees, licensees, affiliates, and/or subordinated entities;

Transfer, transmit, transmit, assign, deliver, and/or commercialize the provided information to its affiliates and subordinated entities, as well as to commercial allies, third parties, and judicial or administrative authorities, whether natural or legal persons, Colombian or foreign, so they can collect, store, use, transmit, transfer, transfer, assign, deliver, retain, process, purge, analyze, circulate, update, cross-reference with other information, exploit, commercialize, and/or delete the information for statistical, marketing, administrative, and legal activities necessary for their normal development of corporate objectives or any lawful activity related to this;
Transfer the provided information to third countries. The User agrees that the personal data provided through any Collection Media may be processed by BIOCIRCULO in the ways and for the purposes previously mentioned;
Contact the Data Subject if any issues or problems arise with the Personal Information;

Contact the Data Subject to participate (as an attendee, contractor, or supplier) in new products and/or campaigns promoted by BIOCIRCULO and/or its clients, partners, or affiliates;

Send the Data Subjects emails as part of a news, bulletin, or newsletter. Each email message sent includes the option to unsubscribe from this email list by following the indicated instructions; Newsletter. En cada mensaje de correo electrónico enviado existe la posibilidad de solicitar no estar inscrito en esta lista de correos electrónicos para dejar de recibirlos para lo cual deberá seguir las instrucciones indicadas,
Send the Data Subject information about products and/or services based on information obtained from their consumption habits;
Prevent and detect fraud, as well as other illegal activities.

It will be understood that by registering and/or providing their data through the Collection Media, the User gives explicit consent for the transfer, transmission, transfer, assignment, delivery, and/or commercialization of the data as set out in this Privacy Policy, and specifically for the uses detailed above.

9. Transfer to Third Parties

BIOCIRCULO may transfer, transmit, transfer, assign, deliver, and/or commercialize the Data Subjects' Personal Data as part of BIOCIRCULO’s assets to third-party commercial allies, clients, or affiliates for the purpose of allowing these third parties to process the data under the same terms and conditions established in this Privacy Policy. Specifically, but not limited to, BIOCIRCULO may use service providers and data processors working on its behalf. Such services may include system hosting and maintenance, encryption, analysis services, email messaging services, call center services, delivery services, payment transaction management, and credit and address checks, among others. Consequently, Data Subjects should understand that by providing information to BIOCIRCULO, they are automatically granting these third parties authorization to access their Personal Information.

Personal Information may be transferred, transmitted, transferred, assigned, delivered, and/or commercialized to affiliates, subordinated entities, third parties, and commercial allies, and to judicial or administrative authorities, whether natural or legal persons, Colombian or foreign, in cases where the transfer or transmission of data is necessary to carry out the uses and activities authorized by the Data Subjects in accordance with BIOCIRCULO’s corporate objectives or any lawful related activity. In all cases, such information will be maintained under strict confidentiality and subjected to rigorous Processing, respecting the rights and guarantees of its Data Subjects.

10. Effects of Authorization

For all purposes, it is understood that the express and informed authorization granted by Data Subjects to BIOCIRCULO for the Processing of their Personal Data, regardless of the Collection Media used (telephone, written, digital, electronic, oral, or through unequivocal behaviors), implies full understanding and acceptance of the entire content of this Privacy Policy and, therefore, expressly acknowledges that they authorize the use of their data for the purposes indicated here and in the manner specified, including transmitting, exploiting, and commercializing such information.

If a Data Subject provides Personal Information to BIOCIRCULO through telephone communications, its website, or any additional physical or electronic channel, with the understanding that such provision of Personal Information is entirely voluntary, the Data Subject grants BIOCIRCULO authorization to use such Personal Information according to the stipulations of this Privacy Policy.

In the event of a sale, merger, consolidation, change in corporate control, asset transfer, restructuring, insolvency, compulsory liquidation, or any type of insolvency process involving BIOCIRCULO, the latter may transfer Personal Information to the involved parties, for which it is understood to be authorized under this Privacy Policy.

11. Users' Rights and Procedures for Exercising Them

11.1. Rights

As the owner of Personal Data, the User has the following rights:

To know, update, and rectify their personal data in relation to BIOCIRCULO or other data processing entities mentioned in this Policy. This right may be exercised, among other cases, for partial, inaccurate, incomplete, fragmented data, or data that induces error, or those whose processing is expressly prohibited or not authorized;
To request proof of the authorization granted to BIOCIRCULO, unless expressly exempted by law as a requirement for processing (Article 10 of Law 1581 of 2012);
To be informed by BIOCIRCULO or any of the data processing entities, upon request, about the existence of data concerning them and the use that has been made of their personal data;
To file complaints with the Superintendency of Industry and Commerce for violations of Law 1581 of 2012 and other regulations that modify, add to, or complement it;
To revoke authorization and/or request the deletion of data when processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Superintendency of Industry and Commerce determines that the data controller or processor has engaged in conduct contrary to the law and the Constitution;
To access their personal data that has been processed, free of charge.

11.2. Procedure

The rights to know, update, rectify, and delete information, and to revoke authorization or request proof of authorization, may be exercised by submitting a written request to BIOCIRCULO by sending an email to contacto@biocirculo.com.

In the case of complaints, the procedure established in Article 15 of Law 1581 of 2012 will be followed.

As a prerequisite for processing any complaint or request, the identity of the claimant will be verified, who must be the data subject, their representative, or one of their successors.

A request or complaint must contain, at a minimum:

Identification of the Data Subject and the claimant (if different from the Data Subject);
Description of the facts giving rise to the complaint or request;
Physical or electronic notification address; and
Request or object of the complaint.

Requests or complaints will be addressed within a maximum term of ten (10) business days from the date of receipt, provided they meet the minimum requirements mentioned above. If it is not possible to respond within this term, the respective Data Subject will be informed of the delay, explaining the reasons for the delay and indicating the date by which the response will be provided, without exceeding five (5) business days following the expiration of the initial term.

If a request or complaint is submitted incomplete, the interested party will be notified within five (5) business days from receipt to complete and rectify their request. If two (2) months pass without the claimant addressing their request or complaint, it will be understood that they have withdrawn it.

If there is an unresolved complaint, the registered personal data of the Data Subject will be marked with the label: "Complaint in Process."

11.2.1. Request for Data Deletion

When requesting the deletion of data, this cannot be performed in the following cases: 1) When there is a legal obligation to retain it; 2) When the User has contractually agreed to allow its use; 3) When retaining the data is necessary to safeguard the User's interests or the Public Interest; 4) When deletion would hinder or obstruct the functions of administrative or judicial authorities.

11.2.2. Revocation of Authorization

When a User wishes to revoke the authorization given for the use of their personal data, they must inform the data controller clearly and with reasons, specifying whether the revocation is total or partial. Partial revocation occurs when the data subject indicates that they wish to revoke authorization for the processing of their personal data for specific purposes, such as sending advertising information or conducting consumption studies. Total revocation occurs when the data subject requests the complete cessation of personal data processing for all authorized purposes.

12. Procedure for Inquiries, Rectifications, and Complaints

Inquiry: Inquiries and requests from Data Subjects will be addressed within a maximum term of ten (10) business days from the date of receipt. If it is not possible to resolve the inquiry within this term, the Data Subject will be informed of this situation at the notification address included in the inquiry, and the response term may be extended by up to five (5) additional business days. Responses to inquiries or complaints presented by Data Subjects may be delivered by any physical or electronic means.

Rectifications and Complaints: When the Data Subject or their successors consider that their information needs to be corrected, updated, or deleted, or when they notice a presumed non-compliance by BIOCIRCULO with its duties under data protection legislation and this Privacy Policy, they may file a complaint as follows:

A written request must be submitted regarding the specific requirement;
If the complaint is incomplete, BIOCIRCULO will request the interested party, within five (5) days of receiving the request, to complete and rectify their petition;
1. If two (2) months pass from the date of the request without a response from the applicant, the request will be considered withdrawn;
2. If the recipient of the complaint is not competent to resolve it, it will be forwarded to the competent party to resolve it within a maximum of two (2) business days and will inform the applicant of this fact;
If the complaint is received complete or is completed later, a “legend” will be added to the database within two (2) business days indicating “COMPLAINT IN PROCESS”; “RECLAMO EN TRÁMITE”.
BIOCIRCULO will resolve the complaint within a maximum term of fifteen (15) business days from the day following its receipt. If it is not possible to resolve the inquiry within this term, the Data Subject will be informed of the delay, reasons, and response date at the notification address included in the complaint. In any case, the response term cannot exceed eight (8) business days following the expiration of the initial term. Responses to complaints presented by Data Subjects may be made by any physical or electronic means.

13. Confidentiality of Personal Information

The Personal Information provided by Data Subjects will be used by BIOCIRCULO, its affiliates, and authorized third parties for such purposes, as established in both the authorization and the Privacy Policy. BIOCIRCULO will seek to protect the privacy of Personal Information and maintain it under necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access, and to respect the rights of the Data Subjects.

If a competent authority requests the disclosure of Personal Information, BIOCIRCULO will notify the Data Subject of such a situation.

This obligation of confidentiality of Personal Information will last indefinitely, meaning the obligation persists over time. However, confidentiality will not apply to cases of assignment or transfer of Personal Data when carried out in accordance with this Privacy Policy.

14. Processing of Personal Information of Minors:

In accordance with Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, BIO CIRCULO will not process Personal Information of children and adolescents, respecting their best interests.

15. Requests from Authorities

BIOCIRCULO will cooperate with competent authorities to ensure compliance with laws related to industrial property, copyright, fraud prevention, and other matters.

Users of the Collection Media expressly authorize BIOCIRCULO to provide any personal information about them to comply with any requests from competent authorities, and to cooperate with such authorities as BIOCIRCULO deems necessary and appropriate in relation to any investigation of illicit activities, violations of consumer protection regulations, intellectual or industrial property rights violations, or any other illegal activities that could expose BIOCIRCULO to legal liability. Additionally, Users authorize BIOCIRCULO to disclose their names, addresses, city, region, postal code, country, mobile phone number, and email address to competent authorities in relation to the investigations they conduct.

16. Capacity to Accept the Terms and Conditions

The collection of Personal Data will only be accepted from individuals over 18 years of age, who are considered capable according to the law. If the User is not of legal age or is legally incapable, they should refrain from providing personal information.

20. Policy Changes

BIOCIRCULO reserves the right to review this Policy at any time. BIOCIRCULO will publish any changes to this Policy on its website. When significant changes are made to this Policy, the Data Subjects will be notified by sending a notice to the email address they have registered, before or at the latest at the time of implementation, informing them that they can review the new Policy on BIOCIRCULO’s website. The notice will specify the date from which the new Policy will be effective. When the change relates to the purposes of Processing, new authorization from the data subjects will be required to apply the changes.

21. Effective Date of the Information Processing Policy and Database Retention Period

This Policy will be effective from its publication date. The databases associated with this Policy may be processed for the maximum period authorized by applicable laws, or, if the law is silent on this matter, will remain effective indefinitely.

22. Contact Information of the Responsible Party

Address: Diagonal 16 # 115 – 25 , Bogotá, Colombia

Email: contacto@biocirculo.com