ÁGILEX EXPRESS SAS Privacy and Personal Data Processing Policy

Considerations

In accordance with the provisions of the Law No. 1581 of 2012 partially regulated by Decree 1377 of 2013 and Decree 886 of 2014, provisions compiled in the Single National Decree on the Trade, Industry, and Tourism Sector No. 1074 of 2015 (Articles 2.2.2.25.1.1. through 2.2.2.26.3.4), this document hereby adopts the POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA for the purpose of protecting the personal information provided by members, suppliers, customers, employees, and any other individual from whom AGILEX EXPRESS SAS., collects or processes personal information.

The purpose of the Data Processing Policy is to protect the constitutional right to Habeas Data, which all individuals have to access, update, and correct the information that has been collected and stored in the various databases of AGILEX EXPRESS SAS., as well as the other constitutional rights, freedoms, and guarantees referred to in Articles 15 and 20 of the National Constitution.

Likewise, the aim is to inform data subjects of their rights and the channels available for them to exercise those rights, which include: the rights to access, rectify, update, delete, and object to the processing of personal information handled by AGILEX EXPRESS SAS., through inquiries or complaints.

DEFINITIONS

In accordance with current regulations (Laws 1266 of 2008 and 1581 of 2012), the following definitions are adopted:

Authorization: Prior, express, and informed consent from the Data Subject to process personal data.

Privacy Notice: A verbal or written communication addressed to the data subjects whose personal data is being processed by the company, informing them of the existence of the personal data processing policies that will apply to them, how to access those policies, and the purposes for which their personal data will be used.

Personal Data Database: An organized set of personal data that is processed by a natural or legal person.

Personal information: Any information concerning or related to specific or identifiable individuals.

Personal information: This refers to personal data that, due to its intimate or private nature, is relevant to the data subject.

Public information: This refers to personal data classified as such under the Constitution and the law, and which has not been classified as private or semi-private personal data. Public data includes, among other things, information regarding a person’s marital status, profession or occupation, status as a businessperson or public servant, and any information that can be obtained without restriction. By its nature, public data may be contained, among other sources, in public records, public documents, official gazettes, and official bulletins;

Sensitive information: This refers to personal data that affects the data subject’s privacy and whose misuse could lead to discrimination, such as data revealing racial or ethnic origin, political views, religious or philosophical beliefs, membership in labor unions, social organizations, human rights organizations, or organizations that promote the interests of any political party or that safeguard the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.

Semi-Private Data: It is personal information that is known and of interest to both the data subject and a specific group of people or society in general; therefore, it is not of an intimate, confidential, or public nature.

Data Controller: A natural or legal person, whether public or private, who, either alone or in association with others, processes personal data on behalf of the Data Controller; 

Data Controller: A natural or legal person, whether public or private, who, either alone or in association with others, makes decisions regarding data and/or the processing of data;

Habeas data: It is the right of the data subject to require the data controllers to grant access to, include, exclude, correct, add to, update, and certify the data, as well as to restrict its disclosure, publication, or transfer.

Treatment: Any operation or set of operations performed on personal data, such as collection, storage, use, disclosure, or deletion.

Broadcast: It is the Disclosure of personal data when the purpose is for the processor to carry out processing on behalf of the controller.

Transfer: It occurs when the controller and/or processor of personal data sends the information or personal data to a recipient, who in turn is a controller and is located either within or outside the country.

Data Subject: A natural person whose data is being processed. In the context of this personal data processing policy, data subjects may include: (i) subscribers/customers of the company’s services; (ii) suppliers; and (iii) any individuals not affiliated with AGILEX EXPRESS SAS whose personal data is being processed.

 

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

In accordance with Title II of Statutory Law 1581 of 2012, AGILEX EXPRESS, in processing the information collected from and obtained about its users, customers, employees, suppliers, partners, subcontractors, and any other third parties (hereinafter the «Data Subjects»), in the course of its business operations and activities in Colombia, whether such information constitutes Personal Data and/or Credit-Related Personal Data (hereinafter «Protected Information»), respects and will continue to respect the rights of each of these individuals by applying and ensuring compliance with the following guiding principles of this Policy:

1. Principle of legality: In the processing of protected information, the current and applicable provisions governing such processing and other related fundamental rights shall apply.

1. Principle of Purpose: The processing of personal data must serve a legitimate purpose in accordance with the Constitution and the law, and the data subject must be informed of that purpose.

1. Principle of freedom:The processing of personal data may only be carried out with the prior, express, and informed consent of the data subject. Personal data that is not in the public domain may not be collected or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives the requirement for consent.

1. Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of data that is partial, incomplete, fragmented, or misleading is prohibited.

1. Principle of Transparency: In the processing of personal data, the data subject’s right to obtain, at any time and without restriction, information from the data controller or data processor regarding the existence of data concerning him or her must be guaranteed.

1. Safety Principle:The information subject to processing by the Data Controller or Data Processor referred to in Statutory Law 1581 of 2012, must be handled using the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, or unauthorized or fraudulent consultation, use, or access.

1. Confidentiality Principle: All persons involved in the processing of personal data that is not of a public nature are required to ensure the confidentiality of the information, even after their involvement in any of the processing activities has ended; they may only provide or disclose personal data when such disclosure is necessary for the performance of activities authorized by Statutory Law 1581 of 2012 and in accordance with its provisions.

1. Principle of Restricted Access and Movement: The processing is subject to the limitations arising from the nature of the personal data, the provisions of Statutory Law 1581 of 2012, and the Constitution. Accordingly, processing may only be carried out by persons authorized by the Data Subject and/or by the persons specified in the aforementioned law.

1. Confidentiality Principle: All persons involved in the processing of personal data are required to ensure the confidentiality of the information, even after their involvement in any of the tasks related to such processing has ended. 

RIGHTS OF DATA SUBJECTS

In compliance with the fundamental guarantees enshrined in the Constitution and the law, and without prejudice to the provisions of other regulations governing this matter, data subjects shall specifically have the rights provided for in Law 1581 of 2012, namely, but not limited to those described in Article 8, and all regulations that govern, supplement, or complement it, including:

• Right of Access to their personal information that is being processed.
• Right to an Update of the personal data being processed.
• Right to Rectification of the personal data being processed. 
• Right to Object that personal data be processed
• Right to Request Deletion of personal data when the processing fails to comply with constitutional and legal principles, rights, and safeguards.
• Right to Request a Test of the consent granted for the processing.
• Right to Withdraw Consent for the processing of personal data.
• Right to File Complaints and Claims before the Superintendency of Industry and Commerce for violations of the provisions of Statutory Law 1581 of 2012 and any other regulations that amend, supplement, or add to it. 
• Right to Request compliance with the orders issued by the Superintendency of Industry and Commerce
• Right to Be Informed by the data controller and/or data processor regarding the use and processing of personal data, as well as any changes and updates to privacy policies, security measures, and purposes.

AGILEX EXPRES SAS guarantees the security and confidentiality of information when it is being processed, as well as compliance with the guiding principles of the applicable policies.

AGILEX EXPRESS SAS'S OBLIGATIONS REGARDING THE PROCESSING OF INFORMATION

In accordance with the Regulatory Framework, the legal provisions governing its legal relationships with Data Subjects, and in particular, the specific obligations it assumes toward Data Subjects, AGILEX EXPRESS SAS has a general duty in the processing of Protected Information to respect and guarantee at all times the rights of Data Subjects, ensuring—where applicable and depending on the nature of the information used—the confidentiality, privacy, security, and integrity of such information.

The products and/or services offered by Pink and the Insured Parties are available only to individuals who have the legal capacity to enter into contracts. 

AGILEX EXPRESS SAS has the following specific obligations when acting as the Data Controller for Personal Data and Credit-Related Personal Data, among others:

• To guarantee the Data Subject, at all times, the full and effective exercise of the right to access personal data.

• Request and retain a copy of the relevant authorization granted by the Data Subject when processing Personal Data.

• Properly inform the Data Subject of the purpose of the data collection and the rights to which he or she is entitled by virtue of the authorization granted.

• Provide information, upon the data subject's request, regarding the company's use of their personal data.

• Store the information under the necessary security conditions to prevent its tampering, loss, unauthorized or fraudulent access, use, or disclosure.

• Ensure that the information provided to the Data Controller is truthful, complete, accurate, up-to-date, verifiable, and understandable.

• Update the information. Correct the information if it is incorrect.

• Respect for the security and privacy of the Data Subject's information.

• Process inquiries and complaints in accordance with this policy.

• Notify the data protection authority when security breaches occur and there are risks associated with the management of data subjects' information.

AGILEX EXPRESS SAS will not collect, store, or process sensitive data unless it is strictly necessary.

Method of Collecting Users’/Customers’ Personal Data: 

The collection of personal data from potential users and users of AGILEX EXPRESS SAS It will be carried out in the following ways:

• By completing digital forms to register for and purchase insurance-related products or services through its website or messaging apps such as WhatsApp.

PURPOSES OF DATA PROCESSING

• Purpose of Processing the Personal Data of Partners, Users, and Customers

The collection, storage, use, and/or dissemination of the personal data of users and/or customers of AGILEX EXPRESS SAS, Its primary purpose is to provide the services offered and/or contracted.

Likewise, in order to carry out the company’s corporate purpose, data processing will be focused on the following purposes:

• Organize, catalog, classify, divide or separate, and store personal data within the systems and files of AGILEX EXPRESS SAS.

• Development of the business relationship between the data subject, the partner, the customer, and AGILEX EXPRESS SAS.

• To provide the services offered by the company, we channel the product and service needs of insurance companies.
• Follow up with clients, based on their specific needs, in order to offer an alternative way to access the products and services provided by companies in the insurance industry.

• To send information regarding offers, updates, news, newsletters, forums, events, advertising, marketing, and sales. This may be done through channels such as email, phone calls, push notifications, text messages (SMS), and offers for products and/or services found through the company’s commercial channels.

• To maintain a historical record of information for the purpose of ensuring customer satisfaction by offering various products and services or renewing those already purchased.

• Develop marketing strategies by analyzing user behavior in response to offers, sending promotions, sharing industry-related updates, extending invitations to company events or events hosted by third parties in the insurance industry, and sending periodic campaigns about products and services.

• Conducting market research and market segmentation.

• Conduct satisfaction and service offering surveys to evaluate service and customer care through the channels provided for that purpose.

• Carry out the necessary steps to handle user requests, complaints, and claims, and forward them to the departments responsible for providing the appropriate responses.

AUTHORIZATION AND CONSENT OF THE DATA SUBJECT

Consent and authorization from the data subject are requirements established by Colombian law, which must be granted to the parties responsible for processing personal data. Consent for the use of the data must be prior, express, and informed. In other words, the The data subject must provide clear and specific consent in advance for the processing of the data, understanding the potential consequences.

Individuals who wish to use any of the services offered by the company or its platforms must register and consent to the processing of their personal data in order to use them. Therefore, information regarding this policy will be provided through our customer service channels, and the full text of the policy will be available on the AGILEX EXPRESS SAS website. Customers must accept this policy when requesting a service, or, if using the service, must have the user’s authorization.