MANUAL FOR PERSONAL DATA PROTECTION POLICIES AND PROCEDURES FOR ATELIER 17 - 56 EMPLOYEES, CLIENTS, AND INTERESTED PARTIES 

This policy is issued in compliance with Decree 1377 of 2013 of Law 1581 of 2012, and norms that modify or add the personal data protection regime and seek to guarantee that ATELIER 17 - 56 , in its capacity as the person in charge of handling personal information, carries out its data treatment in strict compliance with the applicable regulations, guaranteeing the rights that the Holders of the data have. 

1. INFORMATION ABOUT THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA.

The company responsible for processing the personal data is:

• Business name: ATELIER 17 - 56
• Address: CL 29 # 17 56 / Montería-Córdoba / Colombia
• Email: info@atelier1756.com
• Telephone number : 7 8 9 9 0 5 6

1. TREATMENT TO WHICH THE PERSONAL DATA WILL BE SUBMITTED AND ITS PURPOSE.

In order to exercise its corporate purpose, ATELIER 17 - 56 processes the personal data of its employees, suppliers, customers, and product users. Likewise, in compliance with the applicable legislation, ATELIER 17 - 56, may be required to transmit or transfer said data to the indicated platforms and/or to the security systems implemented by it. 

In order to develop the principles of finality and freedom, the collection of personal data by ATELIER 17 - 56 will be limited to the personal data that is deemed relevant and appropriate for the purpose for which it is collected or required, in accordance with current regulations. Except in the cases that are expressly foreseen by the Law, personal data may not be collected without authorization from the Owner.  

Personal data is collected, stored, organized, used, circulated, transmitted, transferred, updated, rectified, removed, deleted, and managed according to the purpose or purposes of each type of Data Treatment, as indicated in Section 3 of this Policy Manual. 

2.1 Processing of  the Personal Data of Girls, Boys, and/or Adolescents 

The treatment of the Personal Data of children and/or adolescents which is public in nature will comply with the following parameters and requirements: 

1. a) That it responds to and respects the best interests of the children and adolescents.
2. b) That respect for their fundamental rights is ensured. 
3. c) That the minor’s opinion be valued when he has maturity, autonomy, and ability to understand the matter. 

Once the aforementioned requirements have been fulfilled, the legal representative of the child or adolescent may grant authorization for the Data Treatment, after the minor has exercised his or her right to be heard, an opinion which must be taken into account considering the minor’s maturity, autonomy, and ability to understand the matter. 

2.2 Treatment of Sensitive Data:

ATELIER 17 - 56 will strictly observe the legal limitations to the Treatment of Sensitive Data, for which it will ensure that: 

1. a) The Holder of the Data has given his explicit authorization for said treatment, except in cases where, by law, the granting of said authorization is not required. 
2. b) The Treatment of the Data is necessary to safeguard the vital interest of the Holder of the Data, and the latter is physically or legally incapacitated. In this event, the legal representatives must grant their authorization. 
3. c) The Treatment of the Data is carried out in the course of legitimate activities, and with due guarantees given by a Foundation, NGO, Association, or any other Non-Profit Organization, whose purpose is political, philosophical, religious, or regarding Labor Unions, provided that the Data is exclusively referred to the organization’s members or to persons who maintain are in regular contact with said organizations in order to carry out their purpose. In these events, the Data may not be provided to third parties without the authorization of the Holder. 
4. d) The Treatment of the Data refers to data that is necessary for the recognition, exercise, or defense of a right in a judicial process. 
5. e) The Treatment of the Data has a historical, statistical, or scientific purpose. In this event, the measures leading to the removal of the identity of the Holders must be adopted.

1. PURPOSES OF THE TREATMENT OF DATA.

The purposes of the Processing of Personal Data carried out by ATELIER 17 - 56 are the following: 

• Execution of contracts signed with ATELIER 17 - 56.
• Customer service and marketing.
• Sending information related to legal and regulatory developments of interest to  ATELIER 17 - 56 customers.
• Statistical information record of ATELIER 17 - 56 customers.
• Information record of contractor employees who provide services to ATELIER 17 - 56.
• Contract and offered or provided service statistics.
• Communication, consolidation, organization, updating, control, accreditation, assurance, statistics, reporting, maintenance, interaction, and management of the actions, information, and activities in which suppliers, contractors, and their employees are related or linked to ATELIER 17 - 56 in execution of the corresponding employment contract. 
• Communication in general, registration, training, authorizations, and for the management of activities or actions in which employees and their families relate to ATELIER 17 - 56.
• Accessing, consulting, comparing, and evaluating all the information on the Holders that is stored in the databases of any credit, financial, judicial background or legally constituted security center, be it of a state, private, national, or foreign nature.
• Investigating, verifying and validating the information provided by the Holders, with any information that ATELIER 17 - 56 legitimately has.
• Accessing, consulting, comparing, and evaluating all the information about the Holders that is stored in the databases belonging to credit risk, financial, court records, or lawfully constituted security centers, be it of a state, private, national, or foreign nature. 
• Offering ATELIER 17 - 56 products or services. 

In the event that ATELIER 17 - 56 is not in the capacity to carry out the treatment of data by its own means, it may transfer the collected data in order for it to be processed by a third party, after duly notifying the Holders of the collected data. The third party will then be in charge of the treatment of the data, and must guarantee suitable conditions of confidentiality and security of the information that has been transferred in order for it to be processed. 

1. RIGHTS THAT ASSIST YOU AS A HOLDER OF THE DATA.

In accordance with the provisions of Article 8 of Law 1581 of 2012, and Decree 1377 of 2013, the Holder of Personal Data has the following rights:

1. a) To know, update, and rectify your Personal Data regarding ATELIER 17 - 56 in its capacity as Data Controller . This right may be exercised against partial, inaccurate, incomplete, fractioned data that is misleading, or data whose treatment is expressly prohibited or has not been authorized.
2. b) To request proof of the authorization granted to ATELIER 17 - 56 in its capacity as Data Controller, save when expressly excepted as a requirement for the Treatment of Data, in accordance with the provisions of Article 10 of Law 1581 of 2012 (or in the norms that regulate, add, complement, modify, or repeal it), or when the continuity of the Data Treatment is occurring according to the provisions of Article 10, Section 4 of Decree 1377 of 2013. 
3. c) To be informed by ATELIER 17 - 56 regarding the use that has been given to your personal data, upon request. 
4. d) To submit complaints to the Superintendence of Industry and Commerce for infractions of the provisions of Law 1581 of 2012, once they have carried out the consultation or claim process before ATELIER 17 - 56.
5. e) To revoke the authorization and/or request the removal of the Data when the Data Treatment does not respect the principles, rights, and constitutional and legal guarantees. The revocation and/or removal will proceed when the Superintendence of Industry and Commerce has determined that the Person in Charge or the Person Responsible for the Data Treatment or has incurred in behaviors contrary to the law and to the Constitution in the Data Treatment process. 
6. f) To have access to your personal data that has been treated, free of charge. 

1. AREA RESPONSIBLE FOR THE ATTENTION OF PETITIONS, CONSULTATIONS, AND CLAIMS.

The Administrative and Financial Management Area of ATELIER 17 - 56 will be responsible for the attention of requests, queries, claims, complaints, or for the exercise of the rights of the Holder of Personal Data. 

1. PROCEDURE TO EXERCISE THE RIGHTS OF THE DATA HOLDER

6.1 Procedure for Access and Consultation.

The Data Holder, or his successors in title, may consult the information contained in the databases in possession of ATELIER 17 - 56, for which they must make the corresponding request via the company's email. 

In order to prevent unauthorized third parties from accessing the personal information of the Data Holder, it will be necessary to previously establish the identification of the Holder. When the request is made by a person other than the Holder, and it is not proven that this person acts on behalf of the latter, the request will be considered as not filed. 

The consultation will be attended within a maximum term of ten (10) business days starting from the date of reception. When it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their query will be answered, which in no case may exceed five (5) business days following the expiration of the first term. 

6.2 Procedure to Request the Updating, Correction, Removal, or Revocation of Authorization, or to File Claims

The Holder, or his successors, who consider that the information contained in ATELIER 17 - 56  databases must be subject to correction, updating, or removal, or in case notice the alleged breach of any of the duties contained in this law, may present a claim before ATELIER 17 - 56,  which will be processed under the following rules, in accordance with Article 15 of Law 1581 of 2012:

1756. a) The claim shall be made via an application filed before ATELIER 17-56 to the email address info@atelier1756.com. In order to prevent unauthorized third parties from accessing personal information of the owner of the data, you must first establish the identification of the Holder of the Data. When the request is made by a person other than the Holder, and it is not proven that they are acting on behalf of the latter, the application will be considered as not filed.
1757. b) The request must contain the following information:

(i) The identification of the Holder.

(ii) Contact details (physical and/or electronic address and contact telephone numbers).

(iii) The documents that prove the identity of the Holder or the representation of his representative.

(iv) The clear and precise description of the personal data over which the Holder seeks to exercise any of the rights. 

(v) The description of the facts that give rise to the claim. 

(vi) The documents that you want to assert. 

(vii) Signature, identification number, and fingerprint. 

(viii) Original filing.

1. c) If the claim is incomplete, ATELIER 17 - 56 will require the interested party to correct the incomplete information within five (5) days after receiving the claim. If two (2) months have elapsed from the date of the request, and the applicant still hasn’t completed the required information, it will be understood that the claim has been withdrawn.
2. d) If the Area that receives the claim is not competent to resolve it, it will transfer it to the appropriate party within a maximum term of two (2) business days, and will inform the interested party of the situation. 
3. e) Once the complete claim has been received, a legend will be included in the database that says “Claim Pending” and the reason for it, within a term that does not exceed two (2) business days. Said legend must be kept until the claim is decided. 
4. f) The maximum term to attend to the claim will be fifteen (15) business days, which start running from the day after the date of its reception. When it is not possible to attend to the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days after the expiration of the first term. 

6.3 Data Removal

The Holder of the Data has the right, at any time, to request ATELIER 17 - 56 to remove (delete) their personal data when:

2012. a) They consider that it is not being treated in accordance with the principles, duties, and obligations set forth in Law 1581 of 2012. 
2013. b) It is no longer necessary or relevant for the purpose for which they were collected.
2014. c) The period of time that is required for the fulfillment of the purposes for which it was collected has been exceeded. 
2015. d) This removal implies the total or partial elimination of personal information in accordance with what is requested by the Holder of the Data in the records, files, databases, or treatments carried out by ATELIER 17 - 56. 
2016. e) It is important to note that the right of cancellation is not absolute, and the person who is responsible can deny the exercise of the same when:

(i) The request to delete the data will not proceed when the Holder has a legal or contractual duty to remain in the database.

(ii) The deletion of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions. 

(iii) The data is necessary in order to preserve the legally protected interests of the Holder, to carry out an action based on public interest, or to fulfill an obligation that was legally acquired by the Holder. 

6.4 Revocation of Authorization.

The Holder of the Personal Data can revoke the consent to the Treatment of his or her personal Data at any time, as long as a legal provision does not prevent it.

1. SECURITY OF THE DATA.

In development of the principle of Security, ATELIER 17 - 56  has adopted reasonable technical, administrative, and human measures in order to protect the data of the Holders, and to prevent adulteration, loss, consultation, unauthorized use, or fraudulent access to the data. Access to personal data is restricted to its Holders and ATELIER 17 - 56 will not allow access to this information by third parties under other conditions than those announced herein, except for an express request from the Data Holder or legitimized persons, in accordance with national regulations. Notwithstanding the aforementioned, ATELIER 17 - 56  will not be responsible for any action tending to violate the security measures that were established for the protection of Personal Data. 

1. INTERNATIONAL USE AND TRANSFER OF PERSONAL DATA AND PERSONAL INFORMATION BY ATELIER 17 - 56

Depending on the nature of the permanent or occasional relationships that any person holding personal data may have with ATELIER 17 - 56, all of their information may be transferred abroad, subject to applicable legal requirements, with the acceptance of this Policy, which expressly authorizes the transfer of personal data. The information will be transferred for all the relationships that may be established with ATELIER 17 - 56. Without detriment to the obligation to observe and maintain the confidentiality of the information, ATELIER 17 - 56 will take the necessary measures so that these third parties know and commit to observe this Policy, with the understanding that the personal information they receive can only be used for matters directly related to their own relationship with ATELIER 17 - 56, and only while it lasts, and cannot be used or destined for a different end or purpose. 

ATELIER 17 - 56 may also exchange Personal Data with other governmental or public authorities (including, among others, judicial or administrative authorities, tax authorities, and criminal, civil, administrative, disciplinary, and fiscal investigation organisms), as well as third parties involved in their civil or legal proceedings, their accountants, auditors, lawyers, and other advisers and representatives, taking into account that it is necessary or appropriate in order to: 

• Comply with applicable laws, including laws other than those of your country of residence.
• Comply with legal processes.
• Respond to the requests made by public authorities and the national government and the government of countries other than your country of residence. 
• Enforce our Terms and Conditions. 
• Protect our operations. 
• Protect our rights, privacy, security, or property, yours, or those of third parties.
• Obtain recoveries or limit the damages that may affect us.

1. VALIDITY OF THE POLICY.

This Policy is effective as of April 23, 2020.

As a general rule, the term of the authorizations regarding the use of Personal Data is understood as the term of the commercial relationship or of the connection to the service, and during the exercise of the company's corporate purpose.