PERSONAL DATA PROTECTION POLICY

INTRODUCTION:

PINTUCO SA and its related companies (Oceanic Paints SAS and Pintuco Foundation, hereinafter “Companies”), communicate their Personal Data Protection Policy to their interest groups.

The personal data in custody of the Companies, which gives it the status of responsible party and / or manager as appropriate, will be treated in compliance with the principles and regulations provided for in Colombian laws, the existing national legislation and good practices applicable to the regime of personal data protection, in accordance with what is determined by the Personal Data Protection Policy.

PERSONAL DATA PROTECTION POLICY

PINTUCO SA and its related companies (Oceanic Paints SAS and Pintuco Foundation, hereinafter “Companies”), communicate their Personal Data Protection Policy to their interest groups

The personal data in custody of the COMPANY, in its capacity as responsible and / or charged as the case may be, will be treated in compliance with the principles and regulations under Colombian law, the national legislation existing and good practices applicable to the regime protection of personal data, in accordance with what is determined by the Personal Data Protection Policy defined  as follows.

It will be optional to answer questions about sensitive data or about the data of boys, girls and adolescents.

The Personal Data held by the companies will be treated in accordance with the following general purposes:

• For the fulfillment of the obligations and / or commitments derived from the relations, contractual or not, existing with its interest groups.
• For compliance with legal obligations that involve personal data of its interest groups.
• For commercial management and relationship with its interest groups.
• For the prospective analysis of trends and preferences of its interest groups in relation to their goods and / or services.
• To know prospectively the needs of its interest groups in order to innovate and meet these.
• To communicate to our interest groups information about goods, services, publications, training events, business activities and advertising associated with the business activity, whether for goods and / or services.
• To deploy corporate social responsibility activities to its interest groups.
• To be treated by The Company, its subsidiaries, subordinates, related and linked under corporate, contractual or legal relations.
• To share it between them or third parties and provide data, directly or through public entities that exercise surveillance and control functions, on compliance or breach of legal and contractual obligations.

Any person who is part of one of the interest groups, in their capacity as owner or legitimately authorized, in relation to the processing of their personal data, has the right to exercise the actions that the law recognizes in the matter of protection of personal data and habeas data, namely:

• Know, update and rectify their personal data in front of the Responsible of the Treatment or In Charge of the Treatment. This right may be exercised, among others against partial, inaccurate, incomplete, fractional, error-inducing data, or those data whose Treatment is expressly prohibited or has not been authorized.
• Request proof of the authorization granted to the Responsible of the Treatment, except when expressly excepted as a requirement for Treatment, in accordance with the provisions of article 10 of Law 1581 of 2012.
• Be informed upon request, by the Responsible of the Treatment or in Charge of the Treatment, regarding the use given to the personal data.
• File complaints with the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it.
• Revoke the authorization and / or request deletion of the data when the Constitutional and legal principles, rights and guarantees are not respected in the Treatment. The revocation and / or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Responsible of the Treatment or in Charge have incurred in conduct contrary to the law and the Constitution.
• Access free of charge to your personal data that have been subject to Treatment. ( article 11 law 1581 of 2012)

The databases will be valid for the period in which the purpose or purposes of the treatment are maintained, which in any case will be a reasonable term.

The Companies reserve the right to modify their Personal Data Protection Policy at any time. In case of making substantial changes in the content of this policy regarding the identification of the person in charge and the purpose of processing personal data, which may affect the content of the authorization, you will be informed through a mass publication through the media that the Companies consider pertinent.

For the exercise of habeas data, the holder of the personal data or whoever demonstrates a legitimate interest as indicated in current regulations, may do so through the link found at the end of our Personal Data Protection Policy or by accessing the https website : www.pintuco.com.co in the CONTACTANOS (CONTACT US) section . Anyone who exercises the right of Habeas Data must provide the contact information in advance in order to process and handle your request and deploy the charges for the exercise of your rights.

Having received the request for the Habeas Data exercise ,  the Company will answer within the legal term of ten (10) working days, which may be extended by five (5) extra working days, previous notifying whoever has exercised this right in accordance with the provisions of the law.

The Treatment of personal data carried out by the Company pursuant to this policy will be based on standard procedures and instructions adopted by this institution for compliance with applicable legislation to protection of personal information.

To access the right of Habeas Data and have a response to your request you must click on the following link CONTACTANOS – (CONTACT US).

Revision Date: 2020/01/10