Personal Data Processing Policy

Code POL-01 · Version 01 · Dated 21/06/2024 · Controlled Web Copy · Reference translation

Reference translation. The official, legally binding document is the Spanish original (Política de Privacidad y Tratamiento de Datos Personales, code POL-01, version 01, dated 21/06/2024). In case of any discrepancy, the Spanish text prevails.

All natural and legal persons who provide information to Velaquimicos S.A.S. acknowledge and accept its Privacy and Personal Data Processing Policy, available at www.velaquimicos.com or on request at info@velaquimicos.com.

For VELAQUIMICOS S.A.S the preservation, protection, integrity and confidentiality of the personal data of its customers, staff and suppliers is of the highest importance. This policy establishes how the information supplied through our channels — website, email, WhatsApp, telephone and others — is stored and processed, in accordance with the personal data protection regime applicable in each territory where we operate.

Chapter I — General provisions

Article 1. Definitions.

Terms are used as defined in Article 3 of Colombian Law 1581 of 2012: Authorisation, Privacy notice, Database, Personal data, Private data, Sensitive data, Processor, Data controller, Data subject (Titular) and Processing.

Article 2. Purpose.

To regulate the collection, handling and processing of personal data carried out by VELAQUIMICOS S.A.S., in order to guarantee and protect the fundamental right of habeas data of its workers, former workers, visitors, customers, users and suppliers, pursuant to Article 17(k) of Law 1581 of 2012.

Article 3. Scope.

This policy applies to personal data held in the databases managed by VELAQUIMICOS S.A.S. The information collected may include, in whole or in part:

• Full name.
• Type and number of identification document.
• Nationality and country of residence.
• Date of birth.
• Marital status.
• Landline and mobile contact numbers (personal and/or work).
• Home and electronic addresses (personal and/or work).
• Personal and professional references.
• Academic certificates.
• Financial information.

This data may be stored and/or processed on servers located in data centres, whether owned by the company or contracted from third-party providers, which is authorised by visitors, customers, users and suppliers upon acceptance of this Privacy Policy.

Article 4. Accuracy of information.

Data subjects must supply truthful personal data. VELAQUIMICOS S.A.S. presumes the accuracy of the information supplied and does not verify, nor assume the obligation to verify, the identity of data subjects or the accuracy, validity, sufficiency or authenticity of the data provided. It therefore accepts no liability for damages arising from inaccurate information, including damages caused by identical names or identity theft.

Article 5. Applicable law.

This policy was prepared under Colombian Law 1581 of 2012 (general provisions for the protection of personal data) and Decree 1377 of 2013 (partially regulating Law 1581 of 2012).

Article 6. Purposes of processing.

Information is used to process, confirm, fulfil and provide the services and/or products acquired; to promote and advertise our activities, products and services; to carry out transactions; to report to national or international supervisory, police or judicial authorities, banks and insurers; and for internal administrative and/or commercial purposes such as market research, audits, accounting reports, statistical analysis and invoicing; as well as to notify the status of a selection process.

Chapter II — Authorisation

Articles 7–8.

Collection, storage, use, circulation or deletion of personal data requires the free, prior, express and informed consent of the data subject. Authorisation may be given in physical or electronic form (email, WhatsApp) or in any other format allowing subsequent verification, and must be given before processing begins, in accordance with Law 1581 of 2012.

Chapter III — Rights and duties

Article 9. Rights of the data subject.

Under Article 8 of Law 1581 of 2012 you have the right to:

• a) Know, update and rectify your personal data held by VELAQUIMICOS S.A.S.
• b) Request proof of the authorisation granted.
• c) Be informed, on request, about the use made of your personal data.
• d) File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of Law 1581 of 2012, once the enquiry or claim procedure before the controller has been exhausted.
• e) Withdraw authorisation and/or request deletion of the data where processing does not respect constitutional and legal principles, rights and guarantees.
• f) Access your personal data free of charge.

Article 10. Duties of VELAQUIMICOS S.A.S.

The company undertakes to guarantee habeas data at all times; to keep information under the security conditions necessary to prevent tampering, loss, or unauthorised or fraudulent consultation, use or access; to carry out updates, rectifications and deletions within the terms of Articles 14 and 15 of Law 1581 of 2012; to handle enquiries and claims; to insert the legend “information under judicial discussion” where notified; to refrain from circulating disputed information blocked by the SIC; to restrict access to authorised persons only; to report security breaches to the SIC; and to comply with SIC instructions.

Chapter IV — Access, enquiry and claim procedures

Article 11. Right of access.

You may exercise your rights to know, update, rectify and delete your personal data by writing to info@velaquimicos.com or calling +57 (601) 727 1812 or +57 321 334 1998. Your request must include: full name; document type; document number; telephone; email; country; and subject.

Article 12. Response to enquiries.

Enquiries are answered within a maximum of ten (10) business days from receipt. Where that is not possible, you will be informed before the 10 days expire, with the reasons for the delay and the date of response, which may not exceed five (5) further business days.

Article 13. Claims.

Claims are submitted by email to info@velaquimicos.com, identifying the data subject and describing the facts. If the claim is incomplete, you will be asked within five (5) days to complete it; if two (2) months pass without a response, the claim is deemed withdrawn. Claims are answered within a maximum of fifteen (15) business days from the day after receipt, extendable by up to eight (8) further business days with prior notice.

Article 14. Rectification, update and deletion.

At any time and free of charge, you or your representative may request rectification, updating or deletion of your personal data, subject to proof of identity. Deletion may be refused where a legal or contractual duty requires the data to remain, where deletion would obstruct judicial or administrative proceedings, or where the data is needed to protect legally protected interests.

Article 15. Withdrawal of authorisation.

You may withdraw consent at any time unless a legal provision prevents it, by writing to info@velaquimicos.com or calling +57 (601) 727 1812. Withdrawal may be total (all consented purposes) or partial (specific processing, e.g. advertising or market research); please state which.

Chapter V — Information security

Articles 16–17.

VELAQUIMICOS S.A.S. has adopted the technical, human and administrative measures necessary to secure records against tampering, loss, and unauthorised or fraudulent consultation, use or access. Third parties engaged by the company are bound by the same policies and by confidentiality agreements. Mandatory security procedures cover staff duties, incident notification and response, backups and recovery, periodic controls, and continuous review. Nevertheless, the data subject assumes the risks inherent to transmitting information over the internet.

Chapter VI — Final provisions

Article 18. Amendments.

VELAQUIMICOS S.A.S. reserves the right to modify or update this policy at any time in response to legislative developments, internal policies or new service requirements.

Article 19. Retention.

Information supplied by customers and users is retained for up to twenty (20) years from the date of last processing, to allow compliance with legal and/or contractual obligations, particularly in accounting, fiscal and tax matters, and — for former employees and contractors — employment law matters.

Download the policy (PDF, Spanish)