Habeas Data - Mundimotos

ARCO DOCUMENTS FOR THE DATA HOLDER (COMPLAINTS AND CLAIMS)

Content

1. Objective of the document
2. Legal basis and rights of the Holders
3. Definitions
4. Attention to Data Subjects
5. Procedures for exercising the rights of the Owner 5.1. Right of access or consultation
5.2. Rights to complaints and claims
6. Infractions and sanctions

1. Objective of the document

The purpose of this Protocol is to inform MUNDIAL DE REPUESTOS DE MOTOS SAS of the procedure to be followed to respond to access requests and complaints exercised under the rights of access, correction, deletion, revocation or infringement of the Owner of the personal data processed by the company.

MUNDIAL DE REPUESTOS DE MOTOS SAS will take the appropriate measures to disseminate this document to all persons within its organization who have access to personal data, so that they can inform the data subjects of the procedure to follow in these cases.

2. Legal basis and rights of the Holders

The right to Data Protection aims to allow all individuals to know, update, and rectify information collected about them in files or databases. This constitutional right is enshrined in Articles 15 and 20 of the Political Constitution; in Statutory Law 1581 of 2012, which establishes general provisions for the Protection of Personal Data (LEPD); and in Decree 1377 of 2013, which partially regulates the previous law.

Pursuant to Article 8 of the Personal Data Protection Act (LEPD) and Articles 21 and 22 of Decree 1377 of 2013, data subjects may exercise a series of rights regarding the processing of their personal data. These rights may be exercised by the following persons:

1. By the Holder, who must sufficiently prove his identity by the different means made available to him by the person responsible.

2. By their successors in title, who must prove such status.

3. By the representative and/or attorney of the Owner, upon prior accreditation of the representation or power of attorney.

4. By stipulation in favor of another and for another.

The rights of children and adolescents shall be exercised by persons empowered to represent them.

The rights of the Holder are the following:

Right of access or consultation: This is the Data Subject's right to be informed by the data controller, upon request, regarding the origin, use, and purpose for which their personal data has been collected.

Rights to Complaints and Claims. The Law distinguishes four types of complaints:

Correction request: the Data Subject's right to have partial, inaccurate, incomplete, fragmented, misleading data updated, corrected, or modified, or to have data whose processing is expressly prohibited or unauthorized.

Deletion request: the Data Subject's right to have data deleted if it is inadequate, excessive, or does not respect constitutional and legal principles, rights, and guarantees.

Revocation request: the Data Subject's right to revoke the authorization previously granted for the processing of his or her personal data.

Infringement claim: the Data Subject's right to request that a breach of data protection regulations be remedied.

Right to request proof of the authorization granted to the data controller: except when expressly exempted as a requirement for processing in accordance with the provisions of Article 10 of the LEPD.

Right to file complaints for violations with the Superintendency of Industry and Commerce: The Data Subject or legal successor may only file this complaint once they have exhausted the consultation or claim process with the data controller or data processor.

3. Definitions

Established in article 3 of Law 1581 of 2012 and article 3 of Decree 1377 of 2013

Authorization: Prior, express and informed consent of the Data Subject to carry out the processing of personal data.
Database: Organized set of personal data that is the object of processing.
Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons.
Public data: Data that is not semi-private, private, or sensitive. Public data includes, among others, data relating to a person's marital status, their profession or occupation, and their status as a merchant or public servant. By its nature, public data may be contained in, among other things, public registries, public documents, official gazettes and bulletins, and duly enforceable court rulings that are not subject to confidentiality.
Sensitive data: Sensitive data is understood to be that which affects the privacy of the Data Subject or whose improper use may lead to discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
Data processor: A natural or legal person, public or private, who, either alone or in association with others, processes personal data on behalf of the data controller.
Data controller: A natural or legal person, public or private, who, either alone or in association with others, decides on the database and/or the processing of data.
Data subject: Natural person whose personal data is being processed.
Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

4. Attention to Data Subjects

TRAINING FACILITATOR with CC No. 39389522, from MUNDIAL DE REPUESTOS DE MOTOS SAS, will be responsible for handling requests, queries and complaints before which the Data Owner may exercise their rights.

1571

5. Procedures for exercising the rights of the Owner

5.1. Right of access or consultation

According to Article 21 of Decree 1377 of 2013, the Data Subject may consult his or her personal data free of charge in two cases:

1. At least once every calendar month.
2. Whenever there are substantial modifications to the information processing policies that motivate new consultations.

For inquiries with a frequency greater than one per calendar month, MUNDIAL DE REPUESTOS DE MOTOS SAS may only charge the Owner the costs of shipping, reproduction, and, where applicable, certification of documents. Reproduction costs may not exceed the costs of recovering the corresponding material. To this end, the responsible party must provide proof of such expenses to the Superintendency of Industry and Commerce, upon request.

Data subjects may exercise their right to access or consult their data by writing to MUNDIAL DE REPUESTOS DE MOTOS SAS, either by email to PROTECCIONDATOS@MUNDIMOTOS.COM.CO, indicating "Exercise of the right of access or consultation" in the subject line, or by post to CALLE 38 # 52-30 MEDELLÍN, ANTIOQUIA. The request must contain the following information:

Name and surname of the Holder.
Photocopy of the Citizenship Card of the Holder and, where applicable, of the person representing him/her, as well as the document proving such representation.
Petition in which the request for access or consultation is specified.
Address for notifications, date and signature of the applicant.
Supporting documents for the request made, where applicable.

The Data Subject may choose one of the following methods of querying the database to receive the requested information:

On-screen display.
In writing, with a copy or photocopy sent by certified mail or not.
Telecopy.
Email or other electronic means.
Another system suitable for the configuration of the database or the nature of the treatment, offered by MUNDIAL DE REPUESTOS DE MOTOS SAS

Once the request has been received, MUNDIAL DE REPUESTOS DE MOTOS SAS will resolve the consultation request within a maximum period of ten (10) business days from the date of receipt. When it is not possible to respond to the consultation within this period, the interested party will be informed, stating the reasons for the delay and indicating the date on which their consultation will be attended to, which in no case may exceed five (5) business days following the expiration of the first term. These deadlines are established in article 14 of the LEPD.

Once the consultation process has been completed, the Owner or beneficiary may file a complaint with the Superintendency of Industry and Commerce.

5.2. Rights to complaints and claims

Data subjects may exercise their right to file a claim regarding their data by writing to MUNDIAL DE REPUESTOS DE MOTOS SAS, either by email to PROTECCIONDATOS@MUNDIMOTOS.COM.CO, indicating "Exercise of the right of access or consultation" in the subject line, or by post to CALLE 38 # 52-30 MEDELLÍN, ANTIOQUIA. The request must contain the following information:

Name and surname of the Holder.
Photocopy of the Citizenship Card of the Holder and, where applicable, of the person representing him/her, as well as the document proving such representation.
Description of the facts and request specifying the application for correction, deletion, revocation or inflation.
Address for notifications, date and signature of the applicant.
Documents supporting the request made that you wish to assert, where applicable.

If the claim is incomplete, the interested party will be required within five (5) days of receipt to correct the deficiencies. After two (2) months from the date of the request, if the applicant does not submit the required information, it will be understood that the claim has been withdrawn.

Once the complete claim has been received, a legend stating "claim in process" and the reason for the claim will be added to the database within a period of no more than two (2) business days. This legend must remain in effect until the claim is decided.

MUNDIAL DE REPUESTOS DE MOTOS SAS will resolve the consultation request within a maximum period of fifteen days.

(15) business days counted from the date of receipt thereof. When it is not possible to address the claim within this period, the interested party will be informed of the reasons for the delay and the date on which his/her claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Once the claim process has been exhausted, the Holder or beneficiary may file a complaint with the Superintendency of Industry and Commerce.

6. Infractions and sanctions

Pursuant to Chapter 2 of Statutory Law 1581 of 2012 on Data Protection, the Superintendency of Industry and Commerce may impose sanctions for noncompliance with data protection regulations on the data controller or data processor. The possible sanctions are:

Personal and institutional fines up to the equivalent of two thousand (2,000) minimum wages
monthly legal amounts in force at the time the sanction is imposed. Fines may be imposed successively as long as the breach that gave rise to them persists.
Suspension of treatment-related activities for up to a period of six (6) months.
The suspension act will indicate the corrective measures to be taken.
Temporary closure of processing-related operations once the suspension period has elapsed without the corrective measures ordered by the Superintendency of Industry and Commerce having been adopted.
Immediate and definitive closure of the operation involving the processing of sensitive data.

The forms for exercising the rights of the holders are found in the "Application Forms Folder."