In compliance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, PNG INC SAS adopts this policy for the processing of personal data, which will be informed to all owners of the data collected or that in the future are obtained in the exercise of the use of the PNG INC SAS software platform. In this way, PNG INC SAS declares that it guarantees the rights of privacy, intimacy, good name and autonomy, in the processing of personal data, and consequently all its actions will be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality. All persons who in the development of activities related to the use of the cafeteria software, whether permanent or occasional, come to provide PNG INC SAS with any type of information or personal data, may know, update and rectify it. I. IDENTIFICATION OF THE DATA CONTROLLER NAME OF THE ENTITY: PNG INC SAS, hereinafter referred to as PNG INC SAS, a company dedicated to the development of software and mobile applications, legally represented by Pedro Noguera Gonzalez, identified with citizen ID No. 7,481,963 of Barranquilla, creators of the software for school cafeterias PNG INC SAS. DOMICILE AND ADDRESS: PNG INC SAS is domiciled in the city of Barranquilla, and its main office is located at Carrera 73 No. 81 – 102. EMAIL: soporte@biofoodsoftware.com TELEPHONE: 304 446 4255 II. LEGAL FRAMEWORK Political Constitution, article 15. Law 1266 of 2008 Law 1581 of 2012 Regulatory Decrees 1727 of 2009 and 2952 of 2010, Partial Regulatory Decree 1377 of 2013 Judgments C - 1011 of 2008, and C - 748 of 2011, of the Constitutional Court III. SCOPE OF APPLICATION This policy will be applicable to personal data registered in any PNG INC SAS database whose owner is a natural person. IV. DEFINITIONS For the purposes of this policy and in accordance with current regulations on the protection of personal data, the following definitions will be taken into account:
Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data. Privacy notice: Verbal or written communication generated by the Controller, addressed to the Owner for the processing of their personal data, by which they are informed about the existence of the information processing policies that will be applicable to them, the way to access them and the purposes of the processing that is intended to be given to the personal data. Database: Organized set of personal data that is the object of processing. Successor in title: person who has succeeded another due to the death of that person (heir). Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons. Public data: Data that is not semi-private, private or sensitive. Public data is considered to include, among others, data relating to the marital status of people, their profession or trade and their status as a merchant or public servant. By its nature, public data may be contained in, among others, public records, public documents, official gazettes and bulletins and duly enforceable court rulings that are not subject to reservation. Sensitive data: Sensitive data is understood to be data that affects the privacy of racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data. Data Processor: Natural or legal person, public or private, that by itself or in association with others, carries out the processing of personal data on behalf of the Data Controller. Data Controller: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the processing of data. Owner: Natural person whose personal data is subject to Processing. Transfer: The transfer of data takes place when the person responsible for and/or in charge of processing personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the processing and is located inside or outside the country. Transmission: Processing of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia when its purpose is to carry out processing by the person in charge on behalf of the person responsible. V. PRINICIPALITIES In order to guarantee the protection of personal data, PNG INC SAS will apply in a harmonious and comprehensive manner the following principles, in light of which the processing, transfer and transmission of personal data must be carried out: Principle of legality regarding data processing: Data processing is a regulated activity, which must be subject to the current and applicable legal provisions governing the subject. Principle of purpose: the activity of processing personal data carried out by PNG INC SAS or to which it has access will obey a legitimate purpose in accordance with the Colombian Political Constitution, which must be informed to the respective owner of the personal data. Principle of freedom: the processing of personal data can only be carried out with the prior, express and informed consent of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that waives consent. The principles included in this document are taken from the regulations in force in Colombia that regulate the protection of personal data. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion. Principle of truthfulness or quality: the information subject to processing of personal data must be truthful, complete, accurate, up-to-date, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited. Principle of transparency: In the processing of personal data, PNG INC SAS guarantees the Owner the right to obtain, at any time and without restrictions, information about the existence of any type of information or personal data that is of interest to him or her or that he or she owns. Principle of restricted access and circulation: The processing of personal data is subject to the limits that arise from the nature of the data, the provisions of the law and the Constitution. Consequently, the processing may only be carried out by persons authorized by the owner and/or by the persons provided for in the law.
PEDRO NOGUERA GONZALEZ
Legal Representative
PNG INC SAS