Data Processing Policy

SHOP LATIN VIBES PERSONAL DATA PROCESSING POLICY

SHOP LATIN VIBES, with address at SHOP LATIN VIBES Address, has established this privacy and personal data protection policy, which regulates the collection, storage, administration, and protection of information received from all customers, suppliers, consumers, contractors, debtors, creditors, employees, and related parties. For the purposes of this policy, the following will be taken into account:

DEFINITIONS
Privacy notice: a document, in any physical or electronic medium or any other format generated by the data controller, made available to the user for the processing of their personal data. The privacy notice informs the Data Subject about the existence of these applicable data processing policies, how to access them, and the purposes and rights for the processing of their provided personal data.
Authorization: the user's prior and express consent to process their personal data.
Database: the collection of all personal data that has been authorized by its Users and will be subject to the processing established by this policy.
Personal data: any information linked to or that can be associated with a user.
Private data: data that, due to its intimate or reserved nature, is only relevant to the user.
Sensitive data: data that affects the user's privacy or whose improper use can lead to discrimination based on racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations, or those promoting the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
Data Controller: for the purposes of this policy, it is SHOP LATIN VIBES, which handles the personal data of its users, in accordance with the provisions of the Law and this document.
Data Processor: the natural person designated by the data controller (SHOP LATIN VIBES).
Data Subject: the natural person whose information it is and who has freely and voluntarily expressed to SHOP LATIN VIBES their authorization for their personal data to be processed.
Processing: any operation on personal data, such as collection, storage, use, circulation, modification, clarification, or suppression of such data.

PRINCIPLES IN PERSONAL DATA PROCESSING
As a fundamental premise of this policy, SHOP LATIN VIBES respects the privacy of each natural or legal person who provides their personal information through the various information collection channels established for this purpose. SHOP LATIN VIBES guarantees that it has adequate and secure storage mechanisms and systems. Information is collected, processed, and used in accordance with current information protection and privacy regulations.
However, SHOP LATIN VIBES is not responsible for any consequences derived from the improper entry of third parties into the database and/or for any technical failure in the operation and/or preservation of data in the information storage system.
The data provided by the Data Subject must be clear, truthful, verifiable, and accurate, so that its processing can be equally reliable.
Confidentiality in the processing of personal data is another guiding principle of this policy, as all officials with access to databases are obliged to maintain strict confidentiality in handling them.
All data stored and processed by SHOP LATIN VIBES must have the prior and express authorization of its owner, which must be granted freely and voluntarily. However, this principle will not require authorization in the following events:
Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
Public data.
Cases of medical or health emergency.
Information processing authorized by Law for historical, statistical, or scientific purposes.
Data related to the civil registry of persons.
Personal data will be included in a database and will be used for the following purposes:
To encode in our systems the requests for affiliation as clients and/or suppliers.
To inform about new products or services.
To comply with obligations contracted with our clients, suppliers, and employees.
To achieve efficient communication related to our products, services, offers, promotions, alliances, studies, contests, content, as well as those of our associated companies, and to facilitate general access to their information.
To provide our services and products.
To inform about the launch of new products or services, or changes to them.
To evaluate service quality.
To conduct internal studies on consumption habits.
To consult, report, process, and transfer information to credit bureaus.
PROCESSING OF PERSONAL DATA OF MINORS: The processing of data of minors must observe compliance with and respect for their rights. In the case of processing Personal Data of minors, SHOP LATIN VIBES will observe the applicable regulations and will adhere to the pronouncements of the Constitutional Court on this matter.
PROCESSING OF SENSITIVE DATA: given that SHOP LATIN VIBES collects biometric data, such as surveillance videos, photographs, fingerprints, and others that may be considered sensitive data, it will guarantee that the processing of this information will be carried out seeking to establish mechanisms that improve its service processes and in compliance with the provisions contained in Law 1581 of 2012 and chapter 25 of Decree 1074 of 2015.

DUTIES AND RIGHTS
3.1. Rights of the Data Subject:
To know, update, and rectify their personal data before the data controllers or data processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented data, data that leads to error, or data whose processing is expressly prohibited or has not been authorized.
To request proof of the authorization granted to the data controller unless it is expressly exempted as a requirement for processing, in accordance with the provisions of this policy.
To be informed by the data controller or data processor, upon request, regarding the use made of their personal data.
To file complaints with the Superintendency of Industry and Commerce for infringements of the provisions of the Law.
To revoke the authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that in the processing, the controller or processor has engaged in conduct contrary to the Law and the Constitution.
To access their personal data that has been processed free of charge.

3.2 Duties of the data controller:
To guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.
To request and keep, under the conditions provided by Law, a copy of the respective authorization granted by the Data Subject.
To duly inform the Data Subject about the purpose of the collection and the rights they have by virtue of the authorization granted.
To keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized use or access, or fraudulent use.
To guarantee that the information provided to the data processor is truthful, verifiable, complete, accurate, updated, verifiable, and understandable.
To update the information, communicating in a timely manner to the data processor, all new developments regarding the data previously provided and to adopt other necessary measures to keep the information provided to it updated.
To rectify the information when it is incorrect and communicate the relevant information to the data processor.
To require the data processor at all times to respect the security and privacy conditions of the Data Subject's information.
To process inquiries and claims submitted by the Data Subjects in the terms indicated in the law.
To inform the data processor when certain information is under discussion by the Data Subject, once the claim has been submitted and the respective procedure has not been finalized.
To inform, at the Data Subject's request, about the use made of their data.
To inform the data protection authority when security codes are violated and there are risks in the administration of the Data Subjects' information.
To comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

3.3 Duties of the data processor:
To guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.
To keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized use or access, or fraudulent use.
To timely update, rectify, or delete data.
To update the information reported by the data controllers within five (5) business days from its receipt.
To process inquiries and claims submitted by the Data Subjects.
To register the legend "claim in process" in the database when applicable.
To insert the legend "information in judicial dispute" in the database, once notified by the competent authority about judicial processes related to the quality of personal data.
To refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the Superintendency of Industry and Commerce.
To allow access to information only to persons who may have access to it.
To inform the Superintendency of Industry and Commerce when security codes are violated and there are risks in the administration of the Data Subjects' information.
To comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
RESPONSIBLE AREA AND PROCEDURES FOR DATA CONSULTATION AND FOR SUBMITTING CLAIMS:
The area responsible for inquiries, complaints, and claims will be the Marketing department:
Data Subjects or their successors may consult the personal information of the Data Subject held in the database.
The Data Controller or Data Processor must provide the Data Subject with all information contained in their individual record or linked to their identification.
The consultation will be made via email and the other contact details listed in the privacy notice published on the website www.tutienda.com and which in any case is attached to this policy as Annex 1.
The consultation will be answered within a maximum period of ten (10) business days from the date of receipt. If it is not possible to answer the consultation within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their consultation will be answered, which in no case may exceed five (5) business days following the expiration of the initial term.
The Data Subject or their successors who consider that the information contained in a database should be corrected, updated, or deleted, or when they notice the alleged non-compliance with any of the duties contained in the Law, may submit a claim to the data controller, through the communication channels established in the privacy notice. For the purpose of submitting claims, the following procedure must be followed and the following requirements must be met:
The claim must contain at least: the identification of the Data Subject, a description of the facts giving rise to the claim, the address, and accompanying documents that are to be asserted.
If the claim is incomplete, the interested party will be required within five (5) days following the receipt of the claim to correct the deficiencies. If two (2) months have passed since the date of the request, without the applicant submitting the required information, it will be understood that they have withdrawn the claim.
In the event that the person receiving the claim is not competent to resolve it, they will transfer it to the appropriate party within a maximum of two (2) business days and inform the interested party of the situation.
Once the complete claim is received, the legend "claim in process" and the reason for it will be included in the database within a maximum of two (2) business days. This legend must be maintained until the claim is decided.
The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of its receipt.
If it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial term. The Data Subject or successor may file a complaint with the Superintendency of Industry and Commerce once they have exhausted the consultation or claim process before SHOP LATIN VIBES.
EFFECTIVE DATE: This Personal Data Policy was created on March 15, 2019.
Any changes to this policy will be communicated through the email address: soporte@shoplatinvibes.com