Personal data processing manual

• 1991 Political Constitution of Colombia, Article 15
• Law 1266 of 2008: which establishes the general provisions of the Habeas Data and regulates the treatment of information contained in personal databases.
• Regulatory Decree 1727 of 2009: which establishes the form in which the operators of financial, credit, commercial, service and third country information databases must present the information of the holders of the information.
• Law 1581 of 2012: which establishes general provisions are issued for the protection of personal data. Regulatory Decree 2952 of 2010: which regulates Articles 12 and 13 of Law 1266 of 2008. Regulatory Decree 1377 of 2013: which partially regulates Law 1581 of 2012.
• Regulatory Decree 886 of 2014: which regulates Article 25 of Law 1581 of 2012, regarding the National Database Registry.
• Regulatory Decree 1074 of 2015: which establishes the Single Regulatory Decree of the Commerce, Industry and Tourism Sector is issued. Rulings of the Constitutional Court C- 1011 of 2008, and C-748 of 2011.

PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA

In order to guarantee the protection of personal data, CSA Aeronautical Solutions will apply the following principles in a harmonious and comprehensive manner, in the light of which the processing, transfer and communication of personal data must be carried out:

Principles relating to the collection of personal data

1. Principle of freedom: Unless otherwise provided by law, data may only be collected only with the prior, explicit and informed consent of the data subject. Personal data may not be obtained or disclosed without the prior consent of the data subject, or in the absence of a legal or judicial mandate that waives The data subject must be informed in a clear, sufficient and prior manner of the purpose of the information provided and therefore, no data may be collected without a clear indication of the purpose of the data. No deceptive or fraudulent means may be used to collect or process personal data.
2. Principle of collection limitation: Only personal data that is strictly necessary for the fulfillment of the purposes of the processing should be collected, so that the collection and disclosure of data that is not closely related to the purpose of the processing is prohibited. Accordingly, every reasonable effort should be made to limit the processing of personal data to the minimum necessary. In other words, the data must be: (i) adequate, (ii) relevant and (iii) proportionate to the purposes for which they are intended.

Principles related to using personal data

1. Principle of purpose: The processing of personal data collected must be carried out for a legitimate purpose, which must be communicated to the Data Subject.
2. Principle of temporariness: Personal data shall be kept only for as long as is reasonable and necessary to fulfill the purpose of the processing and the legal requirements or instructions of supervisory and control authorities or other competent authorities. Once the purpose of the processing has been fulfilled, the Data will be deleted.
3. Principle of non-discrimination: It is prohibited to carry out any act of discrimination on the basis of the information collected in the databases or files.

Principles related to the quality of information

1. Principle of truthfulness or quality: Information subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. Partial, incomplete, fragmented or misleading data will not be processed.

Principles related to the protection, access and transfer of personal data

1. Principle of transparency: The right of the Data Subject to obtain from CSA Soluciones Aeronáuticas, at any time and without restriction, information on the existence of data concerning him/her, must be guaranteed in the Processing;
2. Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of the personal data, the provisions of this law and the Constitution. Personal data, except for public information, and as provided for in the authorization granted by the data owner, may not be made available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide limited knowledge only to data owners or authorized third parties;
3. Security principle: The information that is subject to processing by CSA Soluciones Aeronáuticas shall be protected through the use of technical, human and administrative measures that are necessary to guarantee the security of the records, avoiding their alteration, loss, consultation, use or unauthorized or fraudulent access;
4. Principle of confidentiality: All persons involved in the Processing of personal data are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the Processing. FIRST PARAGRAPH: In the event that sensitive personal data is collected, the Data Subject may refuse to authorize its Processing.

CONTENTS OF THE DATABASES
CSA Aeronautical Solutions’ databases store general information such as full name, identification number and type, gender and contact information (email, physical address, home and cell phone). In addition to these, and depending on the nature of the database, CSA Aeronautical Solutions may have specific data required for the processing to which the data will be subjected. The databases of employees and contractors include, in addition to information on employment and academic history, sensitive data required by the nature of the employment relationship (photograph, composition of the family group, biometric data). Sensitive data may be included in the databases with the prior authorization of the owner, in accordance with the provisions of articles 5 and 7 of Law 1581 of 2012.

PURPOSE

The purpose of the information collected by CSA Soluciones Aeronáuticas is to allow the proper development of its business as a company that collects, transports and treats hazardous waste. In addition, CSA Soluciones Aeronáuticas keeps the information necessary to comply with its legal obligations, mainly in accounting, corporate and labor matters. Information about current or former customers, suppliers, partners and employees is kept in order to facilitate, promote, enable or maintain labor, civil and commercial relations and to inform about new products and/or services.

RIGHTS OF THE HOLDER OF THE INFORMATION

• To know, update and rectify their personal data. This right may be exercised in the event of partial, inaccurate, incomplete, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or not authorized.
• Request proof of the authorization granted to CSA Soluciones Aeronáuticas, except when it is expressly excluded as a condition of the Processing, in which case it would not be necessary.
• Upon request, CSA Aeronautical Solutions will inform you of the use made of your personal data.
• To file a complaint with the Superintendency of Industry and Commerce for violation of the provisions of Law 1581 of 2012 and any other regulation that may modify, add or supplement it.
• To revoke the authorization and/or request the cancellation of the personal data when the Processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or cancellation will be carried out when the Superintendence of Industry and Commerce has determined that, in the processing, the controller or processor has engaged in conduct contrary to Law 1581 of 2012 and the Constitution.
• Access free of charge to their personal data that have been processed.

You can exercise your rights by writing to the following e-mail address: info@csa.aero.

DUTIES OF CSA Aeronautical Solutions AS RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

• Guarantee the Data Subject the full and effective exercise of the right to habeas data at any time.
• Request and keep a copy of the respective authorization granted by the Data Subject, under the conditions provided for by this law. Duly inform the Data Controller of the purpose of the collection and of the rights to which he/she is entitled by virtue of the authorization granted.
• Keep the information under the security conditions necessary to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
• Ensure that the information provided to the Data Controller is true, complete, accurate, up-to-date, verifiable and comprehensible.
• Update the information, communicating to the Data Processor in a timely manner, of any new developments with respect to the data previously provided and taking any other necessary measures to ensure that the information provided to the Data Processor is kept up to date.
• Rectify the information if it is inaccurate and provide the relevant information to the Data Processor.
• Provide the Data Processor, if applicable, only with data whose Processing has been previously authorized in accordance with the provisions of this law.
• To require from the Data Processor at all times, the respect of the security and privacy conditions of the data subject’s information. To deal with requests and claims made in accordance with the provisions of this law.
• Adopt an internal manual of policies and procedures to ensure adequate compliance with this law and, in particular, to deal with requests and complaints.
• Inform the Data Controller when certain information is under discussion by the Data Subject, once the complaint has been filed and the respective process has not been completed.
• Inform the Data Subject upon request, about the use of his or her data.
• Inform the Data Protection Agency of any breach of security or risk in the management of the data subject’s information..
• Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

PERSONS TO WHOM THE INFORMATION CAN BE SUPPLIED

Information that complies with the conditions established by the Law may be communicated to the following persons:

• To the holders, their legal successors (in case of their absence) or their legal representatives.
• To public or administrative bodies in the exercise of their legal functions or by court order. To third parties authorized by the holder or by law.

AREA OF RESPONSIBILITY AND PROCEDURE FOR EXERCISING THE RIGHTS OF THE HOLDER

CSA Aeronautical Solutions, as the party responsible for the processing of your data, undertakes to respect the confidentiality of your personal data and to guarantee the exercise of your right to access to your data. To this end, CSA Aeronautical Solutions has designated a person in charge of receiving, processing and resolving your claims, for matters related to your personal data collected.

The contact information is:

• Name of responsible area: Administrative area
• E-mail: info@csa.aero

PROCEDURES FOR EXERCISING THE RIGHTS OF DATA SUBJECTS

The holders of Personal Data, regardless of the type of relationship they have with CSA Soluciones Aeronáuticas may exercise their rights to access, update, rectify and delete the information and/or revoke the authorization granted, in accordance with the following procedures:

1. Procedure for requesting proof of the authorization granted. The request must be to CSA Soluciones Aeronáuticas through the contact details provided herein, indicating at least the full name of the holder of the information and its identification number, the location or physical or electronic address to which a reply should be sent. Once the request has been received, a copy of the authorization will be sent within ten (10) working days from the day following the date of receipt of the request. If it is not possible to deal with the request within this period, the interested party shall be informed of the reasons for the delay and of the date on which it will be dealt with; which shall in no case exceed eight (8) working days following the expiry of the initial
2. Procedure for updating the information. The holder of the Personal Data who is interested in updating the information provided and under Processing by CSA Soluciones Aeronáuticas or the Data Processor may send the updated information through any of the channels established for this purpose such as the website, email of the area responsible for the Processing of Personal Data.
3. Procedure for rectification and cancellation of information and/or revocation of authoriz.

If the owner of the information intends to rectify, delete and/or revoke the authorizations for the Processing of Personal Data, he/she shall submit a request in accordance with the following:

• The request must be addressed to CSA Soluciones Aeronáuticas, with the identification of the Holder, the description of the facts that give rise to the request, the address and the accompanying documents to be asserted.
• If the application is incomplete, the interested party will be asked to correct the deficiencies within five (5) days of receipt of the request. If two (2) months have elapsed from the date of the request without the applicant submitting the required information, the request shall be deemed to have been
• If the person receiving the request is not competent to deal with it, he/she shall, within a maximum of two (2) days, inform the person concerned of the situation.
• Upon receipt of the complete request, a legend stating “request in process” and the reason for the request will be added to the database, within a maximum of two (2) business This legend will be maintained until the request is decided.

MODIFICATION OF CSA Soluciones Aeronáuticas PERSONAL DATA PROCESSING POLICY

CSA Soluciones Aeronáuticas may, at its discretion, modify its personal data processing policy.

INFORMATION SECURITY

In accordance with current legislation, CSA Soluciones Aeronáuticas will adopt the necessary technical, human and administrative measures to prevent the alteration, loss, unauthorized or fraudulent use of or access to the information covered by this policy.

VALIDITY

This policy has been approved after the issuance of Law 1581 of 2012 and modified to incorporate some aspects established by Decree 1377 of 2013 and Decree 1074 of 2015, for which reason it will enter into force as of 10 October 2019 .

The validity of the database will be the reasonable and necessary time to fulfill the purposes of the processing, taking into account the provisions of Article 11 of Decree 1377 of 2013.