POLICY OF TREATMENT OF PERSONAL DATA PROTECTION OF THE OWNERS

Cachuchas Y Camisetas Good Will S.A.S.
In compliance with the provisions of the Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, the Cachuchas Y Camisetas Good Will S.A.S adopts this policy for the processing of personal data, which will be informed to all holders of the data collected or obtained in the future in the exercise of commercial or labor activities.
In this way, Cachuchas Y Camisetas Good Will S.A.S. declares that it guarantees the rights of privacy, intimacy, good name and autonomy in the treatment of personal data, and consequently all its actions will be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality.
All persons who, in the development of different contractual, commercial or labor activities, among others, whether permanent or occasional, may provide Cachuchas y camisetas Good Will S.A.S. with any type of information or personal data, may know, update and rectify it.

I. IDENTIFICATION OF THE DATA CONTROLLER

COMPANY NAME: CACHUCHAS Y CAMISETAS GOOD WILL S.A.S., hereinafter referred to as GOOD WILL, an advertising and business apparel company.
ADDRESS AND ADDRESS: GOOD WILL has its domicile in the city of Bogotá at carrera 10ª # 19-29 sur in Bogotá Colombia.
E-MAIL: calidad@capsgoodwill.com.co

II. LEGAL FRAMEWORK

Constitution, Article 15. Law 1266 of 2008
Law 1581 of 2012
Regulatory Decrees 1727 of 2009 and 2952 of 2010, Partial Regulatory Decree 1377 of 2013.
Rulings C – 1011 of 2008, and C – 748 of 2011, of the Constitutional Court.

III. SCOPE OF APPLICATION

This policy shall be applicable to personal data registered in any GOOD WILL database whose owner is a natural person.

IV. DEFINITIONS

For the purposes of this policy and in accordance with the regulations in force regarding personal data protection, the following definitions shall be taken into account:
Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of personal data.
Privacy Notice: Verbal or written communication generated by the Controller, addressed to the Data Subject for the processing of his personal data, by means of which he is informed about the existence of the information processing policies that will be applicable, the way to access them and the purposes of the processing that is intended to be given to the personal data.
Data Base: Organized set of personal data that is subject to processing.
Causee: a person who has succeeded another by reason of the death of the latter.
(heir).
Personal data: Any information linked or that can be associated to one or several determined or determinable natural persons.
Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data related to the marital status of individuals, their profession or trade, and their status as merchants or public servants. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins and duly executed court rulings that are not subject to confidentiality.
Sensitive data: Sensitive data is understood as that which affects the privacy of the Data Subject or whose improper use may generate discrimination, such as that which reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations or that promotes the interests of any political party or that guarantees the rights and guarantees of the following: (i) the data subject’s personal data; (ii) the data subject’s personal data; and (iii) the data subject’s personal data.
opposition political parties, as well as data related to health, sex life, and biometric data.
Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller.
Data Controller: Natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the processing of the data.
Data Subject: Natural person whose personal data is the object of processing.
Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
Transfer: the transfer of data takes place when the person responsible and/or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is responsible for the processing and is located inside or outside the country.
Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when the purpose of the processing is carried out by the processor on behalf of the controller.
V. PRINCIPLES
In order to guarantee the protection of personal data, GOOD WILL will apply the following principles in a harmonious and comprehensive manner, in light of which the processing, transfer and transmission of personal data must be carried out:
Principle of legality in data processing: Data processing is a regulated activity, which shall be subject to the legal provisions in force and applicable to the subject.
Principle of purpose: the personal data processing activity carried out by GOOD WILL or to which it has access, shall obey a legitimate purpose in accordance with the Political Constitution of Colombia, which shall be informed to the respective owner of the personal data.
Principle of freedom: the processing of personal data can only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that relieves consent.
Principle of truthfulness or quality: the information subject to personal data processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.
Principle of transparency: In the processing of personal data, GOOD WILL will guarantee the Data Subject’s right to obtain at any time and without restrictions, information about the existence of any type of information or personal data that is of interest or ownership.
Principle of restricted access and circulation: The processing of personal data is subject to the limits derived from the nature of the data, the provisions of the law and the Constitution. Consequently, the processing may only be carried out by persons authorized by the owner and/or by the persons provided for by law. Personal data, except for public information, may not be made available on the Internet or other means of mass dissemination or communication, unless access is technically controllable in order to provide restricted knowledge only to the owners or third parties authorized in accordance with the law. For these purposes GOOD WILL’s obligation shall be one-half.
Security principle: the information subject to treatment by GOOD WILL, shall be handled with the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
Principle of confidentiality: All persons at GOOD WILL who administer, manage, update or have access to information of any kind contained in databases, are obliged to guarantee the confidentiality of the information, and therefore undertake to keep and maintain strictly confidential and not disclose to third parties, all information that they come to know in the performance and exercise of their duties, except in the case of activities expressly authorized by the data protection law. This obligation persists and will be maintained even after the end of your relationship with any of the tasks that comprise the Processing.

VI. RIGHTS OF THE HOLDER OF THE INFORMATION

In accordance with the provisions of the current applicable regulations on data protection, the following are the rights of the holders of personal data:
a. Access, know, update and rectify your personal data against GOOD WILL in its capacity as data controller. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
b. Request proof of the authorization given to GOOD WILL for the processing of data, by any valid means, except in cases where authorization is not required3.
c. Be informed by GOOD WILL, upon request, regarding the use it has made of your personal data.
d. To file before the Superintendence of Industry and Commerce, or the entity acting in its stead, complaints for violations of the provisions of Law 1581 of 2012 and other rules that modify, add or complement it, after consultation or request to GOOD WILL.
e. To revoke the authorization and/or request the deletion of the data when the processing does not respect the constitutional and legal principles, rights and guarantees.
f. Access free of charge to your personal data that have been subject to processing, at least once every calendar month, and every time there are substantial modifications to this policy that motivate new consultations.
These rights may be exercised by:
– The holder, who must prove his/her identity sufficiently by the different means made available by GOOD WILL
– The assignees of the holder, who must prove their status as such.
– The holder’s representative and/or attorney-in-fact, upon proof of representation or power of attorney.
– Other in favor of or for which the holder has stipulated.
VII. DUTIES OF GOOD WILL AS DATA CONTROLLER AND PROCESSOR OF PERSONAL DATA
GOODWILL recognizes the ownership of personal data held by individuals and consequently they alone can decide on them. Therefore, GOOD WILL will use personal data for the fulfillment of the purposes expressly authorized by the owner or by the regulations in force.
In the processing and protection of personal data, GOODWILL shall have the following duties, without prejudice to others provided for in the provisions that regulate or come to regulate this matter:
a. Guarantee the holder, at all times, the full and effective exercise of the right of habeas data.
b. Request and keep a copy of the respective authorization granted by the holder for the processing of personal data.
c. Duly inform the owner about the purpose of the collection and the rights he/she has by virtue of the authorization granted.
d. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
e. Ensure that the information is truthful, complete, accurate, up-to-date, verifiable and understandable.
f. To update the information in a timely manner, thus taking care of all the novelties with respect to the holder’s data. In addition, all necessary measures must be implemented to ensure that the information is kept up to date.
g. Rectify the information when it is incorrect and communicate the pertinent.
h. Respect the security and privacy conditions of the holder’s information.
i. To process queries and claims formulated in the terms established by law.
j. Identify when certain information is under discussion by the owner.
k. Inform upon request of the owner about the use given to their data.
l. Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the owners.
m. Comply with the requirements and instructions issued by the Superintendence of
Industry and Commerce on the particular subject.
n. Use only data whose processing is previously authorized in accordance with the provisions of Law 1581 of 2012.
o. Ensure the proper use of personal data of children and adolescents, in those cases in which the processing of their data is authorized.
p. Record in the database in the case follow-up the legends “claim in process” in the manner regulated by law.
q. Insert in the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of the personal data.
r. Refrain from circulating information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce.
s. Allow access to information only to those who can access it.
t. Use the holder’s personal data only for those purposes for which it is duly authorized and respecting in any case the current regulations on personal data protection.

VIII. AUTHORIZATION AND CONSENT OF THE HOLDER

GOOD WILL requires the free, prior, express and informed consent of the owner of the personal data for the processing of such data, except in cases expressly authorized by law, namely:
a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
b. Data of a public nature.
c. Cases of medical or sanitary emergency.
d. Processing of information authorized by law for historical, statistical or scientific purposes.
e. Data related to the Civil Registry of Persons
Manifestation of authorization
The authorization to GOOD WILL for the processing of personal data will be granted by:
– The holder, who must prove his/her identity sufficiently by the different means made available by GOOD WILL
– The successors of the holder, who must prove their status as such.
– The holder’s representative and/or attorney-in-fact, upon proof of representation or power of attorney.
– Other in favor of or for which the holder has stipulated.
Means for granting authorization
GOOD WILL will obtain the authorization through different means, including physical or electronic documents, data messages, Internet, Websites, or any other format that in any case allows obtaining consent through unequivocal conduct through which it can be concluded that if the consent had not been given by the owner or the person entitled to do so, the data would not have been stored or captured in the database.
The authorization will be requested by GOOD WILL prior to the processing of personal data.
Proof of authorization
GOOD WILL will keep the proof of the authorization granted by the owners of the personal data for its processing, for which it will use the mechanisms currently available to it, as well as adopt the necessary actions to keep the record of the form and date in which it was obtained. Consequently, GOOD WILL may establish physical files or electronic repositories made directly or through third parties contracted for this purpose.
Revocation of authorization.
The holders of personal data may at any time revoke the authorization granted to GOOD WILL for the processing of their personal data or request the deletion of such data, provided that this is not prevented by a legal or contractual provision. GOOD WILL will establish simple and free mechanisms that allow the holder to revoke their authorization or request the deletion of their personal data, at least by the same means by which it was granted.
For the above, it should be taken into account that the revocation of consent may be expressed, on the one hand, in a total manner in relation to the authorized purposes, and therefore GOOD WILL must cease any data processing activity; and on the other hand, in a partial manner in relation to certain types of processing, in which case
These will be the ones on which the processing activities will cease, such as for advertising purposes, among others. In the latter case, GOOD WILL will be able to continue to
processing personal data for those purposes for which the owner has not revoked his consent.

IX. TREATMENT TO WHICH THE DATA WILL BE SUBJECTED AND THE PURPOSE OF SUCH TREATMENT.

The processing of personal data of current and potential clients, employees, former employees, retirees, suppliers, contractors, or any person with whom GOOD WILL has established or establishes a relationship, permanent or occasional, will be carried out within the legal framework that regulates the matter and by virtue of its status as a Colombian company and will be all those necessary for the fulfillment of the corporate mission.
In any case, personal data may be collected and processed for:
a. To send information related to promotions, news, content by area of interest, products and other goods or services offered by GOOD WILL.
b. To develop GOOD WILL’s mission in accordance with its corporate bylaws.
c. Comply with the regulations in force in Colombia for apparel companies, including, but not limited to, any requirement of the Ministry of Labor, accrediting entities or local authorities.
d. Comply with regulations applicable to suppliers and contractors, including but not limited to tax and commercial regulations.
e. Comply with the provisions of the Colombian labor and social security laws, among others, applicable to former employees, current employees and candidates for future employment.
f. Conduct surveys related to GOOD WILL services or goods.
g. Develop products and services in accordance with its corporate bylaws
h. Keep current and potential suppliers and customers in touch with different corporate and commercial information.
i. Inform about employment opportunities and/or different products
j. Encourage the professional and personal growth of our employees.
k. Fulfill all contractual commitments with our customers.
Sensitive Data
In the case of sensitive personal data, GOOD WILL may use and process them when:
a. The owner has given his explicit authorization, except in those cases where the law does not require the granting of such authorization.
b. The processing is necessary to safeguard the vital interests of the Data Subject and the Data Subject is physically or legally incapacitated. In these events, the legal representatives must give their authorization.
c. The processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association or any other non-profit organization.
profit motive, whose purpose is political, philosophical, religious or trade union, provided that they relate exclusively to their members or to persons who maintain regular contact with them by reason of their purpose. In these events, the data may not be provided to third parties without the owner’s authorization.
d. The Processing refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.
e. The processing has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the holders must be adopted.
Notwithstanding the exceptions provided by law, the processing of sensitive data requires the prior, express and informed authorization of the owner, which must be obtained by any means that may be subject to subsequent consultation and verification.

X. PRIVACY NOTICE

The Privacy Notice is the physical document, electronic or in any other format, made available to the holder to inform him/her about the processing of his/her personal data. Through this document, the holder is informed of the existence of GOOD WILL’s information processing policies that will be applicable to him/her, how to access them and the characteristics of the processing that is intended to be given to the personal data.
The privacy notice shall contain, at a minimum, the following information:
a. The identity, address and contact details of the data controller.
b. The type of processing to which the data will be subjected and its purpose.
d. The general mechanisms provided by the responsible party so that the holder is aware of the information processing policy and the substantial changes that occur in it. In all cases, it must inform the holder how to access or consult the information processing policy.
e. The optional nature of the response to questions about sensitive data

XI. GUARANTEES OF THE RIGHT OF ACCESS

In order to guarantee the data owner’s right of access, GOOD WILL will make available to the data owner, upon proof of identity, legitimacy, or personality of his representative, at no cost or expense whatsoever, in a detailed and itemised manner, the
The respective personal data through all types of media, including electronic media that allow the holder direct access to them. Such access must be provided without limit and must allow the holder the possibility of knowing and updating them online.

XII. PROCEDURE FOR HANDLING QUERIES, CLAIMS, REQUESTS FOR RECTIFICATION, UPDATING AND DELETION OF DATA

a. Consultations:
Holders or their successors in title may consult the personal information of the holder held by GOOD WILL, who will provide all the information contained in the individual record or that is linked to the identification of the Holder.
With respect to the attention of requests for consultation of personal data GOOD WILL guarantees:
– Enable electronic means of communication or other means it deems pertinent.
– Establish forms, systems and other simplified methods, which shall be informed in the privacy notice.
– Use the customer service or claims services it has in operation.
– In any case, regardless of the mechanism implemented for the attention of consultation requests, they will be attended within a maximum term of ten (10) business days from the date of receipt. When it is not possible to attend the consultation within said term, the interested party shall be informed before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term.
– Inquiries may be sent to calidad@capsgoodwill.com.co
b. Claims
The Data Subject or his/her assignees who believe that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the law, may file a complaint with GOOD WILL, which will be processed under the following rules:
1. The Holder’s claim shall be formulated by means of a request addressed to GOOD WILL to the e-mail calidad@capsgoodwill.com.co or by means of a written communication addressed to the Quality department, with the identification of the holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that the holder wishes to make.
worth. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, if the applicant does not submit the required information, it will be understood that the claim has been abandoned.
In the event that the person who receives the claim is not competent to resolve it, he/she will transfer it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation.
2. Once the complete claim has been received, this, in a term no longer than two (2) business days. This label will be maintained until the claim is decided.
3. The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to meet the
Within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
c. Request for update and/or rectification
GOOD WILL will rectify and update, at the holder’s request, the information of the holder that proves to be incomplete or inaccurate, in accordance with the procedure and terms indicated above, for which purpose it will take into account:
1. The holder shall send the request to the e-mail calidad@capsgoodwill.com.co or in a physical medium addressed to the quality department indicating the update and/or rectification to be made and shall provide the documentation supporting his/her request.
GOOD WILL may enable mechanisms that facilitate the exercise of this right to the holder, provided that they benefit the holder. Consequently, electronic or other means may be enabled as deemed appropriate, which will be informed in the privacy notice and will be made available to interested parties on the website.
d. Request for deletion of data
The holder of the personal data has the right to request GOOD WILL its deletion (removal) in any of the following events:
1. Consider that they are not being treated in accordance with the principles, duties and obligations set forth in the regulations in force.
2. Are no longer necessary or relevant for the purpose for which they were collected.
3. The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.
This deletion implies the total or partial elimination of personal information as requested by the holder in the records, files, databases or processing carried out by GOOD WILL. However, this right of the holder is not absolute and therefore GOOD WILL may deny the exercise of the same when:
a. The owner has a legal or contractual duty to remain in the database.
b. The deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.
c. The data is necessary to protect the legally protected interests of the holder; to carry out an action in the public interest, or to comply with an obligation legally acquired by the holder.

XIll. INFORMATION SECURITY AND SECURITY MEASURES

In compliance with the security principle established in the current regulations, GOOD WILL will adopt the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

XlV. USE AND INTERNATIONAL TRANSFER OF PERSONAL DATA AND PERSONAL INFORMATION BY GOOD WILL

In compliance with GOOD WILL’s corporate mission and strategic development plan, and taking into account the nature of the permanent or occasional relationships that any holder of personal data may have with GOOD WILL, GOOD WILL may transfer and transmit, even internationally, all personal data, provided that the applicable legal requirements are met; and consequently, by accepting this policy, the holders expressly authorize the transfer and transmission, even internationally, of personal data. The data will be transferred, for all relationships that may be established with GOOD WILL.
For the international transfer of personal data of the owners, GOOD WILL will take the necessary measures so that third parties are aware of and agree to comply with this policy, with the understanding that the personal information they receive may only be used for matters directly related to GOOD WILL and only while it lasts and may not be used or intended for a different purpose or purpose. For the international transfer of personal data, the provisions of Article 26 of Law 1581 of 2012 shall be observed.
The international transmissions of personal data carried out by GOOD WILL, will not require to be informed to the owner or to have his consent when there is a contract for the transmission of personal data in accordance with Article 25 of the Decree.
1377 of 2013.
GOOD WILL may also share personal information with governmental or other public authorities (including, but not limited to, judicial or administrative authorities, tax authorities and criminal, civil, administrative, disciplinary and fiscal investigative bodies), and third parties involved in legal proceedings.
and their accountants, auditors, attorneys and other advisors and representatives, because it is necessary or appropriate: (a) to comply with applicable laws, including laws other than those of your country of residence; (b) to comply with legal processes; (c) to respond to requests from public and governmental authorities, and to respond to requests from public and governmental authorities other than those of your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, yours or those of others; and (g) to obtain the applicable indemnities or limit the damages that may affect us.

XV. CONTROLLER AND PROCESSOR OF PERSONAL DATA

GOOD WILL will be responsible for the processing of personal data.
The Quality Department will be in charge of the processing of personal data on behalf of GOOD WILL.

XVI. CURRENT

This policy is effective as of February 5, 2019 and supersedes any special regulations or manuals that may have been adopted by commercial and/or administrative bodies at GOOD WILL.