Personal data processing policy

Controllers’ identification and contact

• IT Sistemas y Soluciones S.A.S., NIT 901197078-8.
• COLCO S.A.S., NIT 901336267-0.
• Address: Carrera 11 # 71-41, Bogotá, Colombia, 110231. [PENDIENTE: confirm each company’s registered domicile and address]
• Email: info@it2s.com.co · Phone: +57 322 749 7587.

Data we process

What you type in the site’s forms (name, company, tax ID, ID document, email, phone, city and the details of your assessment, advice, quote, PQRS, newsletter, order or payment request) and the data of the business relationship (contracts, invoicing and payments). Payments are processed by the Wompi gateway: this site never receives or stores card numbers or account details. We do not ask for sensitive data; in a habeas data request we ask for a copy of your ID only to verify your identity. The site is not aimed at minors.

Purposes

• To handle your assessment, advice and quote requests, and your petitions, complaints, claims and habeas data requests.
• To enter into and perform contracts, provide and invoice the services, and collect and manage payments (including any direct debit you authorize).
• If you authorize it with double opt-in, to send you commercial information and security alerts.
• To keep proof of your authorizations and acceptances.
• To protect the site and prevent fraud.
• To meet legal, accounting and tax obligations.

Processors and transfers

We share only what is necessary with processors acting on our behalf: the Wompi payment gateway, our Opta business management system, the site’s hosting provider [PENDIENTE: provider name and server country] and the email provider [PENDIENTE: name and country]. If any of them processes data outside Colombia, the international transmission or transfer will follow article 26 of Law 1581 of 2012. [PENDIENTE: confirm whether there are international transfers]

Your rights as data subject

Under article 8 of Law 1581 of 2012 you can:

• Know, update and correct your personal data.
• Request proof of the authorization you gave us.
• Be informed of how we use it.
• Revoke the authorization and request the deletion of your data where there is no legal or contractual duty to keep it.
• Access your data free of charge.
• Decline to answer questions about sensitive data or data of minors.
• File complaints with the Superintendence of Industry and Commerce (SIC), after completing the inquiry or claim process with us (art. 16).

Who handles your requests

[PENDIENTE: department or role responsible for personal data requests, e.g. Data protection officer]. Reach it through this site’s PQRS form, «habeas data» type, or at info@it2s.com.co.

Procedure: inquiries and claims

• Inquiries (knowing your data or the proof of authorization, art. 14): we answer within 10 business days of receipt. If that is not possible, we tell you why and give a new date, no more than 5 additional business days.
• Claims (update, correct, delete or revoke, art. 15): include your identification, a description of the facts, your address and any supporting documents. If something is missing we ask for it within 5 days; if you do not send it within 2 months, the claim is deemed withdrawn. We answer within 15 business days of receipt; if that is not possible, we tell you why and give a new date, no more than 8 additional business days.
• Before answering we verify your identity (copy of your ID) so we never hand your data to someone else.

Authorization and proof

Every form asks for your express authorization before it is sent. As proof (art. 9, Law 1581) we keep the exact text you accepted, its version and fingerprint, the date and time, the channel (form, order, payment, direct debit, newsletter or cookies) and the record it belongs to. For the newsletter we also keep the confirmation from your email. You can request that proof with a habeas data PQRS, «Proof of authorization» right.

Cookies

The use of cookies and your choice by category are explained in this site’s cookie policy.

Security

Personal data is stored encrypted and only authorized staff can access it, from a panel protected with two-factor authentication.

Retention and validity of the databases

We process data for as long as is reasonable and necessary for each purpose and keep it afterwards only when a legal or contractual rule requires it. [PENDIENTE: retention periods per database: sales requests, PQRS, customers and invoicing, newsletter, payments and direct debit] Proof of authorizations is kept while the data is processed and for the period the law requires. [PENDIENTE: validity of the databases]

National Database Registry

[PENDIENTE: confirm whether IT2S or COLCO must register their databases in the SIC National Database Registry (RNBD). Since Decree 090 of 2018 the duty applies to companies with total assets above 100,000 UVT. If it applies, state here that the databases are registered.]

Effective date and changes

This policy is effective from [PENDIENTE: effective date] (version [PENDIENTE: version number]). We will tell you about substantial changes before they apply, on this page and, if we have your email, by email; if the purpose of processing changes we will ask for a new authorization.