Privacy policy
In compliance with the colombian Law 1581 of 2012, which establishes provisions for the protection of personal data, CARLO CARRIZOSA SAS, as the data controller, provides general guidelines in this matter:
1. GENERAL INFORMATION:
The data controller for your personal data is CARLO CARRIZOSA SAS, a company identified with Tax ID 901230582-1, located at Carrera 11 # 86-32 Office 102, Bogotá D.C., Colombia and mobile: +57 3209413745, email: info@carlocarrizosa.com.
2. DEFINITIONS:
For the purpose of interpreting the document and in accordance with legal regulations, the following definitions shall apply.
- Authorization: Prior, express, and informed consent of the Data Subject to carry out the Processing of personal data.
- Database: An organized set of personal data that is subject to Processing.
- Personal Data: Any information linked to or that can be associated with one or more identified or identifiable natural persons.
- Data Processor: Natural or legal person, public or private, who, on their own or in association with others, carries out the Processing of personal data on behalf of the Data Controller.
- Data Controller: Natural or legal person, public or private, who, on their own or in association with others, decides on the database and the Processing of the data.
- Data Subject: Natural person whose personal data is subject to Processing.
- Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, disclosure, or deletion.
Through this policy, CARLO CARRIZOSA SAS, in compliance with its legal and regulatory obligations, seeks to effectively guarantee the constitutional protection of the personal and family privacy of all citizens by establishing instruments and controls aimed at providing appropriate treatment to the information it manages.
This policy establishes the terms, conditions, and purposes under which CARLO CARRIZOSA SAS, as the data controller of personal data obtained through its various customer service channels, processes the information of all individuals who, at any time due to the activities carried out by the entity, have provided personal data (hereinafter referred to as "Data Subject").
These terms and conditions apply to any registration of personal data carried out in person and/or online as a result of the commercial activity of specialized activities in fabric design, clothing, footwear, and other fashion items, textile product weaving, retail and wholesale trade of textile products, and garment manufacturing. The Data Subject provides their information freely and voluntarily and acknowledges that they have read and expressly accepted these terms and conditions.
At the end of this document, you will find CARLO CARRIZOSA SAS's Guidelines for the Processing and Protection of Personal Data for your reference.
The authorization for the processing of your personal data allows CARLO CARRIZOSA SAS to collect, transfer, store, use, disclose, delete, share, update, and transmit, in order to fulfill the following purposes:
CUSTOMERS: a) Coordinate logistics and registration with relevant entities. b) Prepare documents such as sales invoices, debit notes, credit notes, and receipts. c) Collection of outstanding balances. d) Address or formalize any type of process requested by you (certifications and references). e) Offer and inform you about the product portfolio.
SUPPLIERS: a) Coordinate logistics and contracted work. b) Prepare documents such as sales invoices for the purchase or acquisition of products or services, debit or credit notes.
- c) Payments through check, cash, transfer, and electronic payment. d) Handling claims related to purchases and/or services.
EMPLOYEES: a) Operational and registration activities. b) Address or formalize any type of process requested (certifications and references). c) Payroll management. d) Social security affiliations, occupational risk management entities, parafiscal contributions (family compensation fund, SENA, ICBF), pension and severance funds, other employee benefits affiliations such as funeral plans, health and life insurance policies, and payroll deductions.
SHAREHOLDERS: a) Registration with regulatory bodies. b) Notices for monthly and annual meetings. c) Regular internal communication. d) Dividend payments.
The Data Subject is informed of the rights provided by the laws on personal data protection, which are listed below, and CARLO CARRIZOSA SAS guarantees these rights through compliance with the defined process:
- To know, update, and rectify their personal data in relation to the Entity. This right can be exercised, among others, in relation to partial, inaccurate, fragmented, misleading data, or data whose processing is expressly prohibited or has not been authorized.
- Request proof of the authorization granted to the Entity when expressly exempted as a requirement for Processing, in accordance with the provisions of Article 10 of colombian Law 1581 of 2012.
- Be informed by the Entity, upon request, regarding the use that has been given to their personal data; File complaints with the Superintendence of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add to, or complement it.
- Revoke the authorization and/or request the deletion of the data when the Processing does not comply with constitutional and legal principles, rights, and guarantees. The revocation and/or deletion shall be applicable when the Superintendence of Industry and Commerce has determined that the Entity or the Data Processor have engaged in conduct contrary to this law and the Constitution.
To exercise these rights, you should take into account the following information:
- For inquiries regarding personal data, requests for authorization, or information about the use of data, you can make the inquiry in person at the office of CARLO CARRIZOSA SAS. The inquiry should be made through communication addressed to CARLO CARRIZOSA SAS, including the full name of the data subject, a description of the inquiry, residential address, and contact telephone number.
Regardless of the mechanism used to submit inquiry requests, they will be addressed within a maximum period of ten (10) business days from the date of receipt. If it is not possible to address the inquiry within this timeframe, the interested party will be informed before the expiration of the ten (10) days, stating the reasons for the delay and indicating the date on which the inquiry will be addressed. In no case shall this period exceed five (5) business days following the expiration of the initial deadline.
- To submit a request for correction, update, or deletion of data, or to file a complaint regarding alleged non-compliance with the duties of CARLO CARRIZOSA SAS related to Data Protection, you can submit the request in writing and in person at the corresponding office or through the website under the "Data Protection Policy" section or via email. The request or complaint should be communicated to CARLO CARRIZOSA SAS, including the full name of the data subject, a description of the facts giving rise to the request or complaint, residential address, contact telephone number, and any supporting documents.
If the request or complaint is incomplete, you will be notified within five (5) days after receiving the complaint to remedy the deficiencies. If two (2) months have passed since the date of the request for additional information, and the applicant has not provided the requested information, it will be assumed that they have withdrawn the complaint. If the recipient of the complaint is not competent to resolve it, they will forward it to the appropriate party within a maximum period of two (2) business days and inform the interested party of the situation.
Requests for data update, correction, rectification, or deletion will be responded to within fifteen (15) business days, starting from the day following the receipt of the complete complaint. If it is not possible to address the request within this timeframe, the interested party will be informed before the expiration of the mentioned period about the reasons for the delay and the date when the complaint will be addressed. In no case shall this period exceed eight (8) business days following the expiration of the initial time frame.
CARLO CARRIZOSA SAS is committed to ensuring the proper use and treatment of personal data contained in its databases, preventing unauthorized access by third parties who may access, alter, compromise, disclose, and/or destroy the information stored therein.
To this end, it has security protocols and access controls in place for information systems, storage, and processing.
Access to the different databases is restricted, even for employees and collaborators. All staff members are committed to confidentiality and appropriate handling of the databases, following the guidelines on information processing established by law.
CARLO CARRIZOSA SAS requests the necessary data for accounting and commercial purposes. In the case of employees, the data is required for legal affiliations.
In some cases, additional and sensitive information may be requested, which is voluntarily provided by the data subject.
Once the data is provided personally at the office, through a phone call, physical or electronic mail, mobile device, or any other analogous or digital means, it is stored in an accounting software with access keys, which is protected by antivirus software to prevent digital crimes. Only authorized personnel who have signed confidentiality agreements can access the data, provided it is necessary to perform their job functions.
CARLO CARRIZOSA SAS reserves the right to modify its policies and guidelines for the processing of personal data unilaterally at any time. Any changes will be published and announced. In addition, previous versions of this personal data processing policy will be preserved.
The data subject, by accepting this personal data processing policy, acknowledges being aware that CARLO CARRIZOSA SAS may provide this information to affiliated and allied entities, as well as to judicial or administrative bodies and other governmental entities that, in the exercise of their functions, request such information. The data subject also agrees that their information may be subject to internal or external auditing processes carried out by companies responsible for this type of control. The foregoing is subject to the confidentiality of the information.
10. VALIDITY OF THE PRIVACY POLICY AND DATA PROCESSING:
The Personal Data Processing Policy was approved on March 23rd, 2023, by the legal representative with the approval of the Extraordinary General Assembly and comes into effect starting from April 1st of the current year. Any changes that occur regarding this policy will be notified through email and/or personally at the facilities.