KMEDIA.CO PERSONAL DATA PROCESSING POLICIES

This document establishes the Personal Data Processing Policies of the Kmedia Company, in compliance with the provisions of the National Constitution, article 15, in Law 1581 of 2012 and Decree 1377 of 2013, guaranteeing the appropriate general mechanisms for the protection of personal data, collected, in order to allow its owners to exercise the right of Habeas Data, for the knowledge of the general public and all owners of personal data that kmmedia.co possesses or may possess. It has been decided to publish this policy on the organization's website www.kmedia.co 

1- Responsible: 

Kmedia.co is a legally constituted private legal entity, whose contact information is as follows:

Address: Calle 58 #3D-41 Floor 2 Bogotá, Colombia

Email: principal@kmedia.co

Telephone: (1) 702 2000

2- Definitions:
to) Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data; (Law 1581/12).
b) Database: Organized set of personal data that is subject to Processing; (Law 1581/12).
c) Personal information: Any information linked or that can be associated with one or more specific or determinable natural persons; (Law 1581/12).
d) public data: It is the data that is not semi-private, private or sensitive. Public data are considered, among others, data relating to the marital status of people, their profession or trade, and their status as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial rulings that are not subject to confidentiality. (Decree 1377/2013).
and) Sensitive Data: Sensitive data is understood to be data that affects the privacy of the owner or whose improper use may lead to discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations. , human rights or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data, among others, the capture of still images or on the move, fingerprints, photographs, iris, voice, facial or palm recognition, etc.
F) Treatment Manager: Natural or legal person, public or private, who, by themselves or in association with others, carries out the Processing of personal data on behalf of the Data Controller; (Law 1581/12)
g) Responsible for the Treatment: Natural or legal person, public or private, who alone or in association with others, decides on the database and/or the Processing of the data; (Law 1581/12).
h) Headline: Natural person whose personal data is the subject of Treatment; (Law 1581/12).
Yo) Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion. (Law 1581/12).
j) Notice of Privacy: Verbal or written communication generated by the Controller, addressed to the Owner for the Processing of their personal data, through which they are informed about the existence of the information Processing policies that will be applicable to them, the way to access them. and the purposes of the Treatment that is intended to be given to personal data. (Decree 1377 of 2013).

3- Principles for the Processing of personal data. In the development, interpretation and application of the law, the following principles will be applied, in a harmonious and comprehensive manner: (Law 1581/12 art 4)
to) Principle of legality in matters of data processing: The Treatment referred to in this Law is a regulated activity that must be subject to what is established in it and in the other provisions that develop it; 
b) Purpose principle: The Treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Owner; 
c) Principle of freedom: Treatment can only be carried out with the prior, express and informed consent of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that requires consent; 
d) Principle of truth or quality: The information subject to Treatment must be true, complete, accurate, updated, verifiable and understandable. The Processing of partial, incomplete, fragmented or misleading data is prohibited; 
and) Transparency principle: In the Treatment, the right of the Owner to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of data that concerns him or her must be guaranteed; 
F) Principle of restricted access and circulation: The Treatment is subject to the limits derived from the nature of the personal data, the provisions of this Law and the Constitution. In this sense, the Treatment may only be carried out by persons authorized by the Owner and/or by the persons provided for in this law; 

Personal data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide knowledge restricted only to the Owners or authorized third parties in accordance with this law; 
g) Safety principle: The information subject to Treatment by the Data Controller or Data Processor referred to in this law must be handled with the technical, human and administrative measures that are necessary to provide security to the records, avoiding their adulteration, loss, consultation, unauthorized or fraudulent use or access; 
h) Confidentiality principle: All persons involved in the Processing of personal data that are not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks included in the Processing has ended, and may only supply or communicate of personal data when this corresponds to the development of the activities authorized in this Law and in the terms of the same.  

Without prejudice to the exceptions provided for in the law, the Treatment requires the prior and informed authorization of the Owner, which must be obtained by any means that can be subject to subsequent consultation.

If the Personal Data Processing System has not achieved its maximum scope or new processing of personal data is generated that had not been included initially, it will be understood that the document through which a person provides personal data information is the authorization to execute the treatment and in such case, that will be the limitation of the treatment that may be given, and any purpose other than that proposed as the objective of said documentary source is prohibited.

4. Database content 

In the Kmedia databases, it stores general information such as full name, identification number and type, gender and sometimes contact data (email, physical address, landline and mobile phone), in general this is data necessary to the execution of a service contract, which is the activity carried out by Kmedia, in accordance with its main corporate purpose. 

Based on this and depending on the nature of the database, Kmedia may have specific data required for the processing to which the data will be subjected. The databases of employees and contractors also include information on work and academic history, sensitive data required by the nature of the employment relationship (photography, family group composition, biometric data, blood type, among others). 

Additionally, it should be considered that the affiliate databases through the linking contract modality include financial and accounting information and sensitive data necessary for the type of contractual relationship that is celebrated (photographs, family group formation, academic data, description of movable and immovable property, main domicile, etc.). 

Sensitive information may be stored in the databases with prior authorization from the owner, in compliance with the provisions of articles 5 and 7 of Law 1581 of 2012.

4.1. Cases in which authorization is not necessary. The authorization of the Owner will not be necessary when it comes to: (Law 1581/12 art. 10)

a) Information required by a public or administrative entity in the exercise of its legal functions or by court order; 
b) Data of a public nature; 
c) Cases of medical or health emergency;
d) Processing of information authorized by Law for historical, statistical or scientific purposes;
e) Data related to the Civil Registry of Persons. 

Whoever accesses personal data without prior authorization must in all cases comply with the provisions contained in the law. 

5. Treatment and Purposes of the databases.

5.1. Treatment 

The information contained in the Kmedia databases is subject to different forms of treatment, such as collection, exchange, updating, processing, reproduction, compilation, storage, use, systematization and organization, all of them partially or totally in compliance with the purposes established here.

The information may be delivered, transmitted or transferred to public entities, business partners, contractors, affiliates, subsidiaries, solely for the purpose of fulfilling the purposes of the corresponding database. 

In any case, the delivery, transmission or transfer will be made after signing the commitments that are necessary to safeguard the confidentiality of the information. 

Personal information, including sensitive information, may be transferred, transmitted or delivered to third countries, regardless of the security level of the regulations that regulate the handling of personal information. In compliance with legal duties, Kmedia may provide personal information to judicial or administrative entities, when required. 

Kmedia will ensure the correct use of personal data of minors, guaranteeing that the applicable legal requirements are complied with and that all processing is previously authorized and justified in the best interests of the minors.

5.2. Purpose of database processing: The personal data that Kmedia collects, stores, uses, circulates and deletes will be used for any of the following purposes:

1. 1. Human resource: Data processing will be carried out for the recruitment of personnel, evaluation of performance of functions, retirement or termination of the legal relationship with the company (includes, among others, employees, interns and applicants for positions). 
   2. Exercise of the company's corporate purpose: Kmedia will have databases of its clients and suppliers, in order to provide greater efficiency in the provision of its services, for the implementation of marketing and commercialization policies.

• Compliance with legal order: Kmedia must maintain an updated database of all suppliers.

• Administrative and Accounting: The company will save and maintain information in a database to comply with its obligations as a public limited company and other financial and accounting functions.

6. Rights of the owners: In accordance with the provisions of article 8 of Law 1581 of 2012, the owners may: 

• Know, update and rectify your personal data in front of Kmedia, the Managers. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Processing is expressly prohibited or has not been authorized. 
• Request proof of the authorization granted to kmmedia, except when expressly excepted as a requirement for Treatment, in accordance with the provisions of article 10 of Law 1581 of 2012.
• Be informed by Kmedia or the Processor, upon request, regarding the use that has been given to your personal data. Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of this Law and other regulations that modify, add or complement it. Revoke the authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights and guarantees.
• The revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that the ENTITY or the Person in Charge have engaged in conduct contrary to this Law and the Constitution. 
• Free access to your personal data that has been processed. 

6.1 Obligations of the entity 

 The ENTITY must:

• • Guarantee to the Holder, at all times, the full and effective exercise of the right of habeas data.
  • Request and keep, under the conditions provided for in this law, a copy of the respective authorization granted by the Owner. 
  • Duly inform the Owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted.
  • Maintain the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
  • Guarantee that the information provided to the Processor is true, complete, accurate, updated, verifiable and understandable.
  • Update the information, communicating in a timely manner to the Data Processor, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it remains updated. 
  • Rectify the information when it is incorrect and communicate the pertinent information to the Manager. 
  • Provide the Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of this law. 
  • Demand that the Manager at all times respect the security and privacy conditions of the Owner's information. 
  • Process queries and claims formulated in the terms indicated in this law.
  • Adopt an internal manual of policies and procedures to guarantee adequate compliance with this Law and, especially, to respond to queries and complaints.
  • Inform the Manager when certain information is under discussion by the Owner, once the claim has been submitted and the respective process has not been completed.
  • Inform at the request of the Owner about the use given to their data; 
  • Inform the data protection authority when violations of security codes occur and there are risks in the administration of the Owners' information.
  • Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce. 

7. Person or area responsible for handling requests, queries and claims before whom the owner of the information can exercise their rights to know, update, rectify and delete the data and revoke the authorization.

Any query, request, complaint or claim related to the handling of personal data, in applications of the provisions of Law 1581 of 2012 and Decree 1377 of 2013, are handled through the following means:

Kmedia.co

Email: principal@kmedia.co

Address: Calle 51 AN° 5 – 06 Bogotá, Colombia

Telephone line: (1) 702 2000

8. Procedures

Any procedure that is carried out or required must contain, in addition to the request or request, the complete identification of the petitioner, the accreditation to make the request, that is: being the owner of the personal data or being formally authorized to be able to make the request, ( attached the authorization support), the means to be able to issue a response both via email and physically, in any case when the petitioner is not the owner of the personal data, the request must be made in writing to the address of the main domicile of The company and the terms will only count from the moment of arrival of the physical request to the organization.

1. a) Presentation and responses to queries 

The owners of personal data that appear in the Kmedia databases, or their successors in title, may consult the data that the information will provide in the terms provided in the applicable legislation. Any request for consultation, correction, update or deletion must be submitted via email principal@kmedia.co.

Queries will be answered within a period of ten (10) business days from the date of receipt of the respective request. When it is not possible to attend to the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended to, which in no case may exceed five (5) business days following the expiration of the first term, as governed by article 14 of Law 1581 of 2012.

1. b) Presentation and response to complaints and claims

Claims must be made via email principal@kmedia.co.

If the claim is incomplete, the interested party will be required to correct the deficiencies within five (5) days following receipt of the claim. After two (2) months from the date of the request, without the applicant presenting the required information, it will be understood that the claim has been abandoned.

In the event that the person who receives the claim is not competent to resolve it, he or she will forward it to the appropriate person within a maximum period of two (2) business days and will inform the interested party of the situation.

Once the complete claim is received, a legend that says "claim in process" and the reason for it will be included in the database within a period of no more than two (2) business days. Said legend must be maintained until the claim is decided.

The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. 

9. Database validity 

Kmedia's Personal Information Processing Policies will be effective as of the first day (01) of July 2017. The ENTITY reserves the right to modify them, under the terms and with the limitations provided by law. 

The databases managed by Kmedia will be maintained indefinitely, while it develops its purpose, and as long as it is necessary to ensure compliance with legal obligations, particularly labor and accounting, the data may be deleted at any time at the request of its owner. as long as this request does not contradict a legal obligation of Kmedia or an obligation contained in a contract between Kmedia and the Owner.