arrow-left-lightarrow-leftarrow-right-lightarrow-rightarrow-thin-left arrow-thin-right browser-search cup heart indicator laptop layers layout-4boxes layout-sideleft mail-heart mail map-pin mixer mouse nav paintbucket pencil-ruler phone picture play video

Personal Data Protection and Processing Policy

1. Introduction

In compliance with data protection and privacy regulations, this Personal Data Protection and Processing Policy is hereby adopted to protect the personal information provided by all data subjects who maintain any type of relationship with CONTRACT WORKPLACES.

2. Purpose

The purpose of this Personal Data Protection and Processing Policy is to establish practices, mechanisms, and guidelines for the protection and proper processing of personal data collected, stored, and used by CONTRACT WORKPLACES in furtherance of its corporate purpose, in accordance with applicable laws in each country.

3. Scope

The principles and provisions set forth in this policy apply to any database in the custody of CONTRACT WORKPLACES, whether acting as Data Controller or Data Processor.

All employees and contractors of all companies comprising CONTRACT WORKPLACES are required to know and comply with each and every provision contained in this Policy.

4. Definitions

To ensure data subjects understand the terms used throughout this Policy, the following definitions regarding personal data and privacy are provided:

  • Personal data: Any information relating or linked to identified or identifiable natural persons.
  • Data subject: The natural person whose personal data is subject to processing.
  • Personal database: An organized set of personal data subject to processing by a natural or legal person.
  • Sensitive data: Data affecting the data subject’s privacy, the misuse of which could lead to discrimination. Sensitive data includes, among others, health data, sexual orientation, racial and ethnic origin, political opinions, and religious, philosophical, or moral convictions.
  • Private data: Data that, due to its intimate or reserved nature, is relevant only to the data subject.
  • Semi-private data: Data that is known to and of interest not only to the data subject but also to a specific group of persons or society in general, and is therefore neither intimate, confidential, nor public in nature.
  • Public data: Data designated as such by constitutional or statutory law that is not classified as private or semi-private.
  • Consent (Authorization): Prior, express, and informed consent given by the data subject to carry out the processing of personal data.
  • Privacy Notice: Verbal or written communication addressed to data subjects whose personal data is being processed by the company, informing them of the existence of the data processing policies applicable to them, how to access them, and the purposes for which their personal data will be used.
  • Data Controller: A natural or legal person, whether public or private, who individually or jointly with others decides on the processing of personal data.
  • Data Processor: A natural or legal person, whether public or private, who individually or jointly with others performs the processing of personal data on behalf of the Data Controller.
  • Processing: Any operation or set of operations performed upon personal data, such as collection, storage, use, circulation, or deletion.
  • Database Custodian: A natural person within the company who safeguards personal databases.
  • Inquiries: Requests made by the data subject or by persons authorized by law or by the data subject to access information concerning the data subject held in databases or archives.
  • Transmission: The communication of personal data when its purpose is the performance of processing activities by the processor on behalf of the controller.
  • Transfer: Occurs when the controller and/or processor of personal data sends the information or personal data to a recipient who is, in turn, a data controller, located within or outside the country.
  • Complaint or Claim: A statement of dissatisfaction submitted by the data subject or their successor-in-interest who considers that information contained in a database should be corrected, updated, or deleted, or who notes an alleged breach of any statutory duties.

5. Applicable Principles

The processing of personal data shall be governed by the following principles:

  • Principle of legality: The processing of personal data shall be governed by the applicable laws of each country regulating the matter.
  • Principle of purpose: The processing of personal data must serve a legitimate purpose, which must be communicated to the data subject.
  • Principle of freedom (Consent): The processing of personal data may only be carried out with the prior, express, and informed consent of the data subject.
  • Principle of accuracy (Truthfulness): The information subject to processing must be true, complete, accurate, up to date, verifiable, and understandable.
  • Principle of transparency: The data subject has the right to access information regarding data concerning them at any time and without restrictions.
  • Principle of security: The Controller and/or Processor must implement the necessary measures to prevent data from being altered, lost, consulted, used, accessed, deleted, or disclosed by unauthorized persons or by authorized persons in a fraudulent manner.
  • Principle of confidentiality: All persons involved in the processing of personal data are required to treat the information as confidential, even after the contractual relationship or link between the data subject and CONTRACT WORKPLACES has ended.
  • Principle of restricted access and circulation: Personal data may only be processed by personnel authorized by CONTRACT WORKPLACES.
  • Principle of temporality (Data retention): The retention period for personal data processed by CONTRACT WORKPLACES shall be that necessary to achieve the purpose(s) for which it was collected.

6. Rights of Data Subjects

Pursuant to fundamental legal protections, data subjects may exercise the following rights:

  • Right of access to their personal information subject to processing.
  • Right to update their personal data subject to processing.
  • Right to rectify their personal data subject to processing.
  • Right to object to the processing of their personal data or request its cessation.
  • Right to request the deletion of personal data.
  • Right to request proof of the consent granted for processing.
  • Right to revoke consent for the processing of personal data.
  • Right to file complaints and claims.
  • Right to be informed by the controller and/or processor regarding the use and processing of their personal data, as well as modifications and updates to protection policies, security measures, and purposes.

7. Access Channels

Data subjects may exercise their rights of access, update, rectification, objection, and deletion through the following channels:

Country: Colombia
Entity: Contract Workplaces Colombia S.A.S.
Email: [email protected]
Phone: 7461226

Country: Panama
Entity: Contract Workplaces Panamá S.A.
Email: [email protected]
Phone: 5072009570

All other countries: Contact [email protected]

8. Processing and Purposes of Personal Databases

The collection and processing of personal data by CONTRACT WORKPLACES serve the following purposes:

1) Website Users:

  • Contacting the user to provide information regarding the products offered by CONTRACT WORKPLACES.
  • Contacting the user to schedule an appointment with a representative of CONTRACT WORKPLACES and provide tailored consultation.
  • Sending communications and information about CONTRACT WORKPLACES products and events when the user has subscribed to the company newsletter or authorized it through other means.
  • Collecting information through cookies and analytics tools to improve website quality and navigation, track site traffic and clicks on links for various products and services offered by CONTRACT WORKPLACES, identify user preferences, assess advertising effectiveness, identify site errors, determine users’ access locations, detect whether a user is a new or returning visitor, and deliver interest-based and behavioral advertising.

Should any other processing purposes arise, prior, express, and informed consent will be requested from the Data Subject.

2) Children and Adolescents:

CONTRACT WORKPLACES shall ensure that in processing the personal data of children and adolescents, their fundamental rights are respected, and information is used exclusively in their best interests, in compliance with applicable laws and regulations.

For the processing of data of minors, prior, express, and informed consent must be obtained from their legal representative, taking into account the views of the minor data subjects in light of their maturity, autonomy, and capacity, assessed on a case-by-case basis.

Furthermore, personal data of children and adolescents collected by CONTRACT WORKPLACES shall be subject to security controls and restricted access to ensure effective protection.

The processing of data of children and adolescents shall be limited to registration and enrollment procedures for employees’ children under 18 years of age.

If data is to be used for any other purpose, prior, express, and informed consent will be requested from their authorized legal representatives, explaining the intended purposes.

9. Procedure for Inquiries, Complaints, and Claims

To ensure the protection of the rights of access, update, rectification, cancellation, deletion, and objection by the Personal Data Subject or legally authorized parties (i.e., their heirs and accredited legal representatives), CONTRACT WORKPLACES makes available the communication channels set forth in Section 7 of this Policy. All communications, inquiries, complaints, and/or claims must include the following details and documentation to be processed:

a) A clear description of the inquiry or claim.
b) Address and contact details of the applicant or claimant.

10. Processing of Sensitive Data

CONTRACT WORKPLACES will not collect, store, or process sensitive data unless strictly necessary. If such a circumstance arises, no processing will be conducted without the prior, informed, and express consent of the data subject, except where such consent is not required by law.

Answering questions involving sensitive data is optional. Sensitive data may not be processed for purposes other than those expressly authorized by the data subject.

Access to, circulation of, and processing of sensitive data shall be restricted, limited, and governed by strict security measures in accordance with applicable regulations.

11. Security Measures

In compliance with the principle of security, CONTRACT WORKPLACES has implemented the technical, organizational, and administrative measures necessary to ensure record security and prevent unauthorized or fraudulent alteration, loss, consultation, use, or access.

Access to information within CONTRACT WORKPLACES is strictly limited to authorized personnel and teams on a need-to-know basis.

12. Third-Party Processing – Data Processors

Whenever CONTRACT WORKPLACES entrusts the processing of a database to a third party or grants third parties access to its databases for the provision of a specific service, the following requirements must be observed:

  • Any third-party processor must comply with the requirements set forth in the data protection laws of the respective country and all other applicable regulations.
  • All data processing carried out by a third party other than CONTRACT WORKPLACES must be governed by a written contract expressly stating that data processing will be conducted strictly in accordance with CONTRACT WORKPLACES’ instructions and exclusively for authorized contractual purposes. The processor may not use the data for any other purpose or disclose it to third parties without authorization.
  • The contract must stipulate the mandatory security measures to be implemented by the processor, including the return or secure destruction of information upon completion of the services.
  • The contract must establish that, in the event of a breach, the processor shall be liable to the data subject and relevant authorities for any unauthorized use or processing of the data.
  • If the data processor needs to subcontract third parties to deliver part of the agreed services, it must obtain prior, express, written authorization from CONTRACT WORKPLACES. Subcontracting will only proceed if the subcontractor assumes the same obligations as the primary processor.
  • The contract must further establish confidentiality obligations regarding information accessed by the processor, which shall remain in full force and effect even after the termination or expiration of the agreement.

13. Amendments and Changes

CONTRACT WORKPLACES reserves the right to unilaterally modify this Policy at any time. We will notify users of such changes by updating the content on our website.

Hablemos Contacto

    Subscribe to our News