Privacy & Data Protection policy

Howden Insurance Brokers S.A.
MANUAL OF PERSONAL DATA PROCESSING POLICIES

1. PURPOSE

The purpose of this Policy and Personal Data Processing Manual is to regulate the collection, storage, use, administration, circulation and transfer of personal data of employees, customers and suppliers of HOWDEN CORREDORES DE SEGUROS, for the purposes set forth in this document.

2. RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

HOWDEN CORREDORES DE SEGUROS, commercial company identified with NIT. 860.023.053 - 1, domiciled in the city of Bogotá D.C., located at Autopista Norte # 102 - 10 Piso 6, with telephone 6075500, website: https://www.howdencolombia.co/ and e-mail address [email protected], is the entity responsible for the processing of personal data of its employees, customers and suppliers.

3. TREATMENT AND PURPOSE

HOWDEN CORREDORES DE SEGUROS, in exercise of its corporate purpose, performs the collection, storage, management, use, circulation and transfer of personal data of its employees, customers and suppliers to fulfill the purposes set forth below.

By virtue of the development of its corporate purpose, HOWDEN CORREDORES DE SEGUROS, will transfer the personal data of its clients to its related companies, insurance companies, reinsurance companies, insurance brokers and reinsurance brokers, Colombian and foreign, in order for the latter to carry out the study of risks and evaluate the possibility of entering into insurance contracts.

Likewise, the personal data of its customers, suppliers and employees will be transferred to governmental or administrative entities when the law so provides and they will be processed to comply with the following purpose.

Clients:

• Offer and quote insurance policies and promotions;
• Collect policy premiums;
• To perform brokerage and insurance intermediation tasks with insurance companies, reinsurance companies, insurance brokers and reinsurance brokers, incorporated in Colombia or abroad, in order for them to carry out the risk study for the granting of insurance policies and to enter into the sale of insurance policies;
• To guide the procurement of insurance policies;
• Offering the renewal of insurance policies;
• Offering new products of insurance companies or prepaid medical companies or risk management companies (including occupational risk management).
• Offering promotions of products that are in any way related to insurance, prepaid medicine or risks.

4. RIGHTS OF THE HOLDERS OF PERSONAL DATA

• Customers, suppliers and employees of HOWDEN CORREDORES DE SEGUROS shall have the right to:
• Health, Labor Risk Administrators and Pension Funds;
• Execute the labor contract, which the employee has signed with HOWDEN CORREDORES DE SEGUROS and/or its related companies, in accordance with polyfunctional clauses;
• To carry out any type of administrative or judicial action before the Administrative and Judicial Authorities related to the labor contract entered into;
• Comply with labor obligations;
• Keep the information of the candidates' resumes with their professional profile for possible future hiring; * Verify compliance with the terms and conditions of the employment contract; * Keep the information of the candidates' resumes with their professional profile for possible future hiring;
• Verify compliance with the conditions of the workers to perform the assigned work;
• Carry out any type of administrative or judicial action related to the labor relationship.

Suppliers:

• Negotiate, enter into and execute contracts of a commercial nature;
• To obtain the resources and inputs required for the development of its corporate purpose; 
• To evaluate the proposals submitted and select the suppliers of the required goods and services;
• Evaluate the proposals submitted and select the suppliers of the required goods and services;
•  To pay for services rendered;
• To pay for the goods supplied;
• To offer and quote insurance policies and promotions;
• To carry out any type of administrative or judicial action related to the commercial relationship.
• To know, update and rectify your personal data before HOWDEN CORREDORES DE SEGUROS. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading data, or those whose processing is expressly prohibited or has not been authorized;
•  Request proof of the authorization granted to HOWDEN CORREDORES DE SEGUROS for the processing of data;
•  To be informed by HOWDEN CORREDORES DE SEGUROS or by the person in charge of the treatment, upon request, regarding the treatment that has been given to your personal data;
• To file before the Superintendence of Industry and Commerce complaints for violations of the provisions of this Manual and the applicable rules;
• To revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees.
• Access free of charge to personal data that have been processed.

5. PERSONAL DATA PROTECTION AREA OR GROUP

HOWDEN CORREDORES DE SEGUROS has made available to the Holders of personal data, the Operations Area. Therefore, the Holders of personal data may submit queries, request the update, rectification, deletion or revocation of the authorization, through the mail electrónico:[email protected], in the user service line: 6075500 or directly by written communication at the following address: Autopista Norte # 102 - 10 Piso 6.
Employees may submit queries, request the updating, rectification, suppression or revocation of the authorization of their personal data, to the Human Resources Area through the mail electró[email protected].

6. CONSULTATION PROCEDURE

The Holders of personal data or their successors may make inquiries to HOWDEN S.A. CORREDORES DE SEGUROS, regarding the personal data of the Holders that HOWDEN CORREDORES DE SEGUROS keeps in its databases, through the mechanisms provided in the preceding paragraph. If the consultation refers to a deceased holder, his relatives must submit the death certificate of the holder of the information and a copy of the civil registry proving the blood relationship or the oath before a notary of two people who prove the status of heirs of the deceased. In the case of de facto marital union, they must present an extra-judicial declaration.
In this way, HOWDEN CORREDORES DE SEGUROS will attend the consultations in a maximum term of ten (10) working days counted from the date of its reception. When it is not possible to attend the consultation within such term, the interested party shall be informed before the expiration of the ten (10) days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

7. PROCESSING OF CLAIMS

In case the Holders consider that the information contained in the databases of HOWDEN S.A. CORREDORES DE SEGUROS should be subject to correction, updating, deletion or revocation of the authorization of treatment, or if they noticed the alleged breach of any of the duties contained in Law 1581 of 2012, they may file a claim with HOWDEN CORREDORES DE SEGUROS, which will be processed under the following rules:
By means of a request addressed through the mechanisms provided by HOWDEN CORREDORES DE SEGUROS for such purpose, mentioned in numeral 5 of this Manual, with the identification of the holder, the description of the facts giving rise to the claim, the address, together with the documents they wish to assert. If the claim is incomplete, the interested party will be required within five (5) working days following receipt of the claim to correct the faults. After one (1) month from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been withdrawn. In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.

Once the complete claim has been received, a legend will be included in the database stating "claim in process" and the reason for the claim, within a term no longer than two (2) business days. This legend will remain until the claim is decided.
HOWDEN CORREDORES DE SEGUROS has a maximum term of fifteen (15) business days from the day following the date of receipt of the claim to attend to it. When it is not possible to address the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. The Titleholders or assignee may only file a complaint before the Superintendence of Industry and Commerce once the consultation or claim procedure has been exhausted before HOWDEN CORREDORES DE SEGUROS.

8. REVOCATION OF AUTHORIZATION AND DELETION OF DATA

The Holders of personal data may at any time request HOWDEN CORREDORES DE SEGUROS, the deletion of their personal data and / or revoke the authorization for the processing thereof, in the manner and terms described in paragraph 7 of this Manual.
The personal data of the Holders shall remain in the databases of HOWDEN CORREDORES DE SEGUROS until the date on which the purpose for which they were collected is fulfilled or until the day on which, by legal provision, they must be kept.
Upon expiration of the validity of the database, we will proceed to the deletion of personal data, however HOWDEN CORREDORES DE SEGUROS will retain personal data for compliance with legal or contractual obligations.

9. DUTIES OF THE DATA CONTROLLER

HOWDEN CORREDORES DE SEGUROS, recognizes that the ownership of personal data belongs to the Data Controllers and therefore only they can decide on them. In accordance with the provisions of Article 17 of Law 1581 of 2012, HOWDEN CORREDORES DE SEGUROS is committed to permanently comply with the following duties related to the processing of personal data:

• Guarantee the holder, at all times, the full and effective exercise of the right of habeas data;
• To request and keep a copy of the authorization granted by the holder;
• To duly inform the holder about the purpose of the collection and the rights he/she has by virtue of the authorizationgranted;
• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
• To guarantee that the information provided to private, public, governmental and judicial entities is truthful, complete, accurate, updated, verifiable and understandable;
• To update, rectify and delete personal data in a timely manner, communicating the news to the person in charge of the processing;
• To provide private, public, governmental and judicial entities, as the case may be, only data whose processing has been previously authorized;
• To process queries and claims formulated in the terms set forth in article 14 of Law 1581 of 2012.
  To inform, at the request of the holder, about the use and treatment given to his personal data; * To inform the protection authority about the use and treatment given to his personal data;
• To inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information and personal data of the owners;
• Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality or details of the personal data;
• Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce;
• Register in the database the legend "claim in process" when the holders of the personal data file claims under the terms of Law 1258 of 2012 or in numeral 6 of this Manual; * Refrain from circulating or using the personal data in any way that may affect the quality or details of the personal data;
• Refrain from using the personal data in any way that may affect the quality or details of the personal data;
• Refrain from circulating or using information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce;
• Allow access to information only to persons authorized by law or by judicial or administrative authority.

10. AUTHORIZATION HOWDEN CORREDORES DE SEGUROS

It undertakes to obtain authorization from its employees, customers and suppliers for the collection, storage, management, use, circulation, transfer or deletion of personal data, this authorization must be prior, express and informed, for which HOWDEN CORREDORES DE SEGUROS in its capacity as controller, has provided a written authorization form, which will be made available to the Data Controllers, prior to the processing of their personal data, which must be read and signed by the Data Controllers, and which is an integral part of this Manual and which is included in the customer acknowledgement form and in Annex No. 1 of this document. 1 of this document.
The collection of personal data will be limited to the relevant and adequate data to fulfill the purpose for which they are collected or required in accordance with the provisions of this Manual and current regulations.
HOWDEN CORREDORES DE SEGUROS, shall keep the proof of the authorization granted by the Holders of the personal data in order to process them.

11. PRIVACY NOTICE

The privacy notice is the physical, electronic or any other format document that is made available to the personal data owners, by means of which the existence of the information treatment policies that will be applicable, the way to access them and the characteristics of the treatment that is intended to be given to the personal data is informed. The privacy notice of HOWDEN CORREDORES DE SEGUROS, is an integral part of this Manual as Annex No. 2.

12. CONFIDENTIALITY AND CUSTODY OF INFORMATION

Except in the cases expressly provided for by law, personal data may not be collected without the authorization of the Holders. The processing of data includes the collection, storage, management, use, circulation or transfer, in the manner permitted by law and is carried out in accordance with the purpose set out in this Manual, for each database. Likewise HOWDEN CORREDORES DE SEGUROS, guarantees the confidentiality, freedom, security, veracity, transparency, access and restricted circulation of personal information provided by its employees, customers and suppliers, in observance of the principles of confidentiality and security contemplated in national laws.
In development of such principles, HOWDEN CORREDORES DE SEGUROS handles under strict technical measures, the information provided by its employees, customers and suppliers, ensuring the security of the records avoiding its adulteration, loss or unauthorized use. Likewise, HOWDEN CORREDORES DE SEGUROS guarantees the confidentiality of the information and its exclusive use in the development of its legal and contractual relations with the subjects of application of this policy.

13. MODIFICATION OF THE MANUAL HOWDEN CORREDORES DE SEGUROS

May modify this policy of treatment of personal data unilaterally, at any time, provided that the modification is associated with the fulfillment of its corporate purpose and is in accordance with the applicable regulations. For which HOWDEN CORREDORES DE SEGUROS, will communicate the modifications to the Holders of personal data in advance or at the time of implementation of these, through publication on its website: https://www.howdencolombia.co/ When the change of policy refers to the purpose of processing, a new authorization must be obtained from the Holders of personal data.

14. VALIDITY OF THE DATABASES

The databases of employees, customers and suppliers of HOWDEN CORREDORES DE SEGUROS, will be valid until the purpose of the processing of personal data is fulfilled, without prejudice to the personal data that must be retained under legal or contractual obligations.

15. VALIDITY OF THE PERSONAL DATA PROCESSING POLICY MANUAL

This Personal Data Processing Policy Manual shall be in force as of January 01, 2017.

PRIVACY NOTICE HOWDEN CORREDORES DE SEGUROS

HOWDEN CORREDORES DE SEGUROS, identified with NIT. 860.023.053 - 1, located at Autopista Norte # 102 - 10 Piso 6, Bogotá D.C., with telephone number 6075500, in its capacity as responsible for the treatment of personal data, informs that it will collect, store, manage, circulate and transfer your personal data to its related companies and to companies incorporated in Colombia and abroad, in the development of its corporate purpose, and for commercial, labor, statistical, historical and administrative purposes, among other purposes established in the Privacy Notice and in the Manual of Policies for the Treatment of Personal Data published in the web page:  www.howdengroup.com/co-en and www.howdengroup.com/co-es.

Calling your attention to the fact that as a Personal Data Holder, you have the right to update, rectify, delete or revoke the authorization, as well as to make inquiries and claims. For these purposes, the Company has provided the operations area to address your inquiries and complaints through the email: [email protected], the user service line 6075500 or directly to the following address: Autopista Norte # 102 - 10 Piso 6.
We clarify that the provision of personal data of children and adolescents, as well as other data considered sensitive, is optional.

Howden Reinsurance Brokers S.A.
MANUAL OF PERSONAL DATA PROCESSING POLICIES

1. PURPOSE

The purpose of this Policy and Personal Data Processing Manual is to regulate the collection, storage, use, administration, circulation and transfer of personal data of employees, customers and suppliers of HOWDEN RE CORREDORES DE REASEGUROS S.A., for the purposes set forth in this document.

2. RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

HOWDEN RE CORREDORES DE REASEGUROS S.A., commercial company identified with NIT. 900.165.868- 9, domiciled in the city of Bogotá D.C., located at Autopista Norte # 102 - 10 Piso 6, with telephone number 6075500, website: https://www.howdencolombia.co/ and e-mail address [email protected] is the entity responsible for the processing of personal data of its employees, customers and suppliers.

3. PROCESSING AND PURPOSE

HOWDEN RE CORREDORES DE REASEGUROS S.A., in the exercise of its corporate purpose, carries out the collection, storage, administration, use, circulation and transfer of the personal data of its employees, customers and suppliers in order to comply with the purposes set forth below.
By virtue of the development of its corporate purpose, HOWDEN RE CORREDORES DE REASEGUROS S.A., will transfer the personal data of its clients to its related companies and to Colombian and foreign insurance companies, reinsurance companies and reinsurance brokers, in the different reinsurance markets to which Howden Re Corredores de Reaseguros S.A. has access, in order for them to carry out the study of risks and evaluate the possibility of entering into reinsurance contracts.
Likewise, the personal data of its clients, suppliers and employees will be transferred to governmental or administrative entities when the Law so provides and the same will be processed to comply with the following purpose.

Clients:

• Offer and quote policies with reinsurance and promotions;
• To collect premiums for coverage notes;
• To carry out brokerage and reinsurance intermediation work with insurance companies, reinsurance companies, insurance brokers and/or reinsurance brokers incorporated in Colombia or abroad, so that they may carry out the risk study for the granting of policies with reinsurance and enter into the sale of policies with reinsurance;
• To guide the procurement of insurance policies with reinsurance;
• To offer the renewal of reinsurance policies;
• Offering new insurance and/or reinsurance products:
• Offering promotions or underwriting proposals backed by the reinsurance market with more competitive conditions than the local market.

Employees:

• Link them to the Labor Risks Social Security System before the Labor Risks Administrator;
• Link them to the Compensation Funds;
• Make payroll payments;
• Make the contributions to the Social Security System in Health, Labor Risks and Pensions, before the Health Promoting Entities, the Labor Risks Administrators and the Pension Funds; 
• Execute the labor contract with the Labor and Social Security Administration;
• Make the contributions to the Social Security System in Health, Labor Risks and Pensions, before the Health Promoting Entities, Labor Risks Administrators and the Pension Funds;
• To execute the labor contract, which the employee has signed with HOWDEN RE CORREDORES DE REASEGUROSS.A. and/or with its related companies in accordance with polyfunctional clauses;
• To carry out any type of administrative or judicial action before the Administrative and Judicial Authorities related to the labor contract entered into;
• Comply with labor obligations;
• Keep the information of the candidates' resumes with their professional profile for possible future hiring; * Keep the information of the candidates' resumes with their professional profile for possible future hiring;
• Verify compliance with the conditions of the workers to perform the assigned work;
• Perform any type of administrative or judicial action related to the labor relationship.

Suppliers:

• Negotiate, enter into and execute contracts of a commercial nature;
• To obtain the resources and supplies required for the development of its corporate purpose;
• Evaluate the proposals submitted and select the suppliers of the required goods and services;
• Evaluate the proposals submitted and select the suppliers of the required goods and services;
• To pay for services rendered;
• To pay for the goods supplied;
• To offer and quote insurance policies with reinsurance and promotions; * To offer and quote insurance policies with reinsurance and promotions;
• Carry out any type of administrative or judicial action related to the commercial relationship.

4. RIGHTS OF THE HOLDERS OF PERSONAL DATA

Customers, suppliers and employees of HOWDEN RE CORREDORES DE REASEGUROS S.A. shall have the right to:

• Know, update and rectify their personal data against HOWDEN RE CORREDORES DE REASEGUROS S.A. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose Processing is expressly prohibited or has not been authorized;
• To request proof of the authorization granted to HOWDEN RE CORREDORES DE REASEGUROS S.A. for the processing of the data;
• To be informed by HOWDEN RE CORREDORES DE REASEGUROS S.A. or by the person in charge of the processing, upon request, regarding the processing that has been given to your personal data;
• To file before the Superintendence of Industry and Commerce complaints for infringements to the provisions of this Manual and the applicable regulations;
• To revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees.
• Access free of charge to the personal data that have been subject to processing.

5. PERSONAL DATA PROTECTION AREA OR GROUP

HOWDEN RE CORREDORES DE REASEGUROS S.A. has made the Operations Area available to the Holders of personal data. Therefore, the Holders of the personal data may submit queries, request the updating, rectification, deletion or revocation of the authorization, through the e-mail: [email protected] of the user service line: 6075500 or directly through written communication at the following address: Autopista Norte # 102 - 10 Piso 6.
Employees may submit queries, request the updating, rectification, deletion or revocation of the authorization of their personal data, to the Human Resources Area through the e-mail [email protected].

6. CONSULTATION PROCEDURE

The Owners of the personal data or their assignees may make inquiries to HOWDEN RE CORREDORES DE REASEGUROS S.A., regarding the personal data of the Owners that HOWDEN RE CORREDORES DE REASEGUROS S.A. keeps in its databases, through the mechanisms provided in the preceding paragraph. If the consultation refers to a deceased holder, his/her relatives must submit the death certificate of the holder of the information and a copy of the civil registry proving the blood relationship or the oath before a notary public of two persons proving their status as heirs of the deceased. In the case of de facto marital union, they must present an extra-judicial declaration.
In this way, HOWDEN RE CORREDORES DE REASEGUROS S.A. will attend the consultations in a maximum term of ten (10) working days counted from the date of its receipt. When it is not possible to attend the consultation within such term, the interested party will be informed before the expiration of the ten (10) days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

7. PROCESSING OF CLAIMS

In case the Holders consider that the information contained in the databases of HOWDEN RE CORREDORES DE REASEGUROS S.A. should be subject to correction, updating, deletion or revocation of the authorization of treatment, or if they noticed the alleged breach of any of the duties contained in Law 1581 of 2012, they may file a claim with HOWDEN RE CORREDORES DE REASEGUROS S.A., which will be processed under the following rules:
By means of a request addressed through the mechanisms provided by HOWDEN RE CORREDORES DE REASEGUROS S.A. for such purpose, mentioned in numeral 5 of this Manual, with the identification of the holder, the description of the facts giving rise to the claim, the address, together with the documents they wish to assert. If the claim is incomplete, the interested party will be required within five (5) working days following receipt of the claim to correct the faults. After one (1) month from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been withdrawn. In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.
Once the complete claim has been received, a legend will be included in the database stating "claim in process" and the reason for the claim, within a term not exceeding two (2) business days. This legend will be maintained until the claim is decided.
HOWDEN RE CORREDORES DE REASEGUROS S.A. has a maximum term of fifteen (15) business days from the day following the date of receipt of the claim to attend to it. When it is not possible to attend the claim within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first term. The Titleholders or assignees may only file a complaint before the Superintendence of Industry and Commerce once they have exhausted the consultation or claim procedure before HOWDEN RE CORREDORES DE REASEGUROS S.A.

8. REVOCATION OF AUTHORIZATION AND DELETION OF DATA

The Holders of personal data may at any time request HOWDEN RE CORREDORES DE REASEGUROS S.A., the deletion of their personal data and / or revoke the authorization for the processing of these, in the manner and terms described in paragraph 7 of this Manual.
The personal data of the Holders shall remain in the databases of HOWDEN RE CORREDORES DE REASEGUROSS.A. until the date on which the purpose for which they were collected is fulfilled or until the day on which, by legal provision, they must be kept.
Once the validity of the database has expired, the personal data will be deleted; however, HOWDEN RE CORREDORESDE REASEGUROS S.A. will keep the personal data for the fulfillment of legal or contractual obligations.

9. DUTIES OF THE DATA CONTROLLER

HOWDEN RE CORREDORES DE REASEGUROS S.A., recognizes that the ownership of personal data belongs to the Data Controllers and therefore only they can decide on them. In accordance with the provisions of Article 17 of Law 1581 of 2012, HOWDEN RE CORREDORES DE REASEGUROS S.A. is committed to permanently comply with the following duties related to the processing of personal data:

• Guarantee the holder, at all times, the full and effective exercise of the right of habeas data;
• To request and keep a copy of the authorization granted by the holder;
• Duly inform the holder about the purpose of the collection and the rights he/she has by virtue of the authorization granted;
• To keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
• Guarantee that the information provided to private, public, governmental and judicial entities is truthful, complete, accurate, updated, verifiable and understandable;
• To update, rectify and delete personal data in a timely manner, communicating the news to the Data Processor;
• To provide private, public, governmental and judicial entities, as the case may be, only data whose processing is previously authorized;
• To process queries and claims formulated in the terms set forth in Article 14 of Law 1581 of 2012;
• Inform at the request of the holder about the use and treatment given to their personal data;
• Inform the data protection authority when there are violations to the security codes and there are risks in the administration of information and personal data of the owners;
• Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality or details of the personal data;
• Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce;
• Register in the database the legend "claim in process" when the owners of the personal data file claims under the terms of Law 1258 of 2012 or in paragraph 6 of this Manual;
• Refrain from circulating or using information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce;
• Allow access to the information only to persons authorized by law or by a judicial or administrative authority.

10. AUTHORIZATION HOWDEN RE CORREDORES DE REASEGUROS S.A.

Undertakes to obtain authorization from its employees, customers and suppliers for the collection, storage, administration, use, circulation, transfer or deletion of personal data, this authorization must be prior, express and informed, for which HOWDEN RE CORREDORES DE REASEGUROS S.A., in its capacity as data controller, has provided a written authorization form, which will be made available to the Holders, prior to the processing of their personal data, which must be read and signed by the Holders, and which must be read and signed by the Holders. in its capacity as data controller, has provided a written authorization form, which will be made available to the Data Controllers, prior to the processing of their personal data, which must be read and signed by the Data Controllers, and which is an integral part of this Manual and which is included in the customer acknowledgement form and in Annex No. 1 of this document. The collection of personal data will be limited to the relevant and adequate data to fulfill the purpose for which they are collected or required in accordance with the provisions of this Manual and current regulations. HOWDEN RE CORREDORES DE REASEGUROS S.A., shall keep the proof of the authorization granted by the Holders of the personal data in order to be able to process them.

11. PRIVACY NOTICE

The privacy notice is the physical document, electronic or in any other format that is made available to the holders of personal data, through which the existence of information processing policies that will be applicable, how to access them and the characteristics of the treatment that is intended to be given to personal data is reported. The privacy notice of HOWDEN RE CORREDORES DE REASEGUROS S.A., is an integral part of this Manual as Annex No. 2.

12. RESERVATION AND CUSTODY OF INFORMATION

Except in cases expressly provided for by law, personal data may not be collected without the authorization of the Data Controllers. The processing of data includes the collection, storage, management, use, circulation or transfer, in the manner permitted by law and is carried out in accordance with the purpose set out in this Manual, for each database. Likewise HOWDEN RE CORREDORES DE REASEGUROS S.A., guarantees the confidentiality, freedom, security, veracity, transparency, access and restricted circulation of the personal information provided by its employees, clients and suppliers, in observance of the principles of confidentiality and security contemplated in the national laws.
In development of such principles, HOWDEN RE CORREDORES DE REASEGUROS S.A. handles under strict technical measures, the information provided by its employees, clients and suppliers, guaranteeing the security of the records avoiding its adulteration, loss or unauthorized use. Likewise, HOWDEN RE CORREDORES DE REASEGUROS S.A. guarantees the confidentiality of the information and its exclusive use in the development of its legal and contractual relations with the subjects of application of this policy.

13. MODIFICATION OF THE MANUAL HOWDEN RE CORREDORES DE REASEGUROS S.A.

May modify this policy of treatment of personal data unilaterally, at any time, provided that the modification is associated with the fulfillment of its corporate purpose and is in accordance with the applicable regulations. For which HOWDEN RE CORREDORES DE REASEGUROS S.A., will communicate the modifications to the Holders of the personal data previously or at the time of their implementation, through publication on its website: www.howdengroup.com/co-en and www.howdengroup.com/co-es.
When the change in the policies refers to the purpose of the processing, a new authorization must be obtained from the Personal Data Holders.

14. VALIDITY OF THE DATABASES

The databases of employees, customers and suppliers of HOWDEN RE CORREDORES DE REASEGUROS S.A., shall remain in force until the purpose of the processing of personal data is fulfilled, without prejudice to the personal data that must be kept by virtue of legal or contractual obligations.

15. VALIDITY OF THE PERSONAL DATA PROCESSING POLICY MANUAL

This Personal Data Processing Policy Manual shall be effective as of January 01, 2017.

PRIVACY NOTICE HOWDEN RE CORREDORES DE REASEGUROS S.A.

HOWDEN RE CORREDORES DE REASEGUROS S.A., identified with NIT. 900.165.868 - 9, located at AutopistaNorte # 102 - 10 Piso 6 de Bogotá D.C., with telephone number 6075500, in its capacity as responsible for the treatment of personal data, informs that it will collect, store, manage, circulate and transfer your personal data to its related companies and to companies incorporated in Colombia and abroad, for commercial, labor, statistical, historical and administrative purposes, among other purposes established in the Privacy Notice and in the Manual of Policies for the Treatment of Personal Data published on the website: www.howdengroup.com/co-en and www.howdengroup.com/co-e
Calling your attention to the fact that, as a Personal Data Holder, you have the right to update, rectify, delete or revoke the authorization, as well as to make inquiries and claims before the Company's Operations Area through the e-mail: [email protected]

The user service line 6075500 or directly at the following address: Autopista Norte # 102 - 10 Piso 6.

We clarify that the provision of personal data of children and adolescents, as well as other data considered sensitive, is optional.

Proseguros S.A. Insurance Brokers
MANUAL OF PERSONAL DATA PROCESSING POLICIES

1. PURPOSE

This Policy Manual and Personal Data Processing, aims to regulate the collection, storage, use, management, circulation and transfer of personal data of employees, customers and suppliers of PROSEGUROS CORREDORES DE SEGUROS S.A., for the purposes set out in this document.

2. RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

PROSEGUROS CORREDORES DE SEGUROS S.A., commercial company identified with NIT. 860.024.858-6, domiciled in the city of Bogotá D.C., located at Autopista Norte # 102 - 10 Piso 6, with telephone 6075500, with website: https://www.howdencolombia.co/ and e-mail address [email protected], is the entity responsible for the processing of personal data of its employees, customers and suppliers.

3. TREATMENT AND PURPOSE

PROSEGUROS CORREDORES DE SEGUROS S.A., in exercise of its corporate purpose, carries out the collection, storage, administration, use, circulation and transfer of the personal data of its employees, clients, and suppliers to comply with the purposes set out below.
By virtue of the development of its corporate purpose, PROSEGUROS CORREDORES DE SEGUROS S.A., will transfer the personal data of its clients to its related companies and to insurance companies, reinsurance companies, insurance brokers and reinsurance brokers, incorporated in Colombia or abroad, in order for them to carry out the study of risks and to evaluate the possibility of entering into insurance contracts.
Likewise, the personal data of its customers, suppliers and employees will be transferred to governmental or administrative entities when the law so provides and they will be processed to comply with the following purpose.

Clients:

• Offer and quote insurance policies and promotions;
• Collect policy premiums;
• To perform brokerage and insurance intermediation tasks with insurance companies, reinsurance companies, reinsurance brokers and insurance brokers, incorporated in Colombia or abroad, in order for the latter to carry out the risk study for the granting of insurance policies and to enter into the sale of insurance policies;
• To guide the procurement of insurance policies;
• Offering the renewal of insurance policies;
• Offering new products of insurance companies or prepaid medical companies or risk management companies (including occupational risk management);
• Offering promotions of products that are in any way related to insurance, prepaid medicine or risk management; * Offering promotions of products that are in any way related to insurance, prepaid medicine or risk;
• Conducting market studies on the behavior of the insured, in which case their identity shall remain anonymous and shall never be exhibited individually but as part of an aggregate or collective;
• Conduct customer profiling studies to detect needs for insurance options or advice on risks of interest to the customer.

Employees:

•  Link them to the Labor Risks Social Security System before the Labor Risks Administrator;
• Link them to the Compensation Funds;
• Make payroll payments;
• Make the contributions to the Social Security System in Health, Labor Risks and Pensions, before the Health Promoting Entities, the Labor Risks Administrators and the Pension Funds;
• To execute the labor contract, which the employee has signed with PROSEGUROS CORREDORES DE SEGUROS S.A. and/or with its related companies, in accordance with polyfunctional clauses;
• To carry out any type of administrative or judicial action before the Administrative and Judicial Authorities related to the labor contract entered into;
• Comply with labor obligations;
• Keep the information of the candidates' resumes with their professional profile for possible future hiring;
• Verify compliance with the terms and conditions of the employment contract;
• Keep the information of the candidates' resumes with their professional profile for possible future hiring;
• Verify compliance with the conditions of the workers to perform the assigned work;
• Perform any type of administrative or judicial action related to the labor relationship.

Suppliers:

• Negotiate, enter into and execute contracts of a commercial nature;
• To obtain the resources and supplies required for the development of its corporate purpose;
• Evaluate the proposals submitted and select the suppliers of the required goods and services;
• Pay for the services rendered;
• To pay for services rendered;
• To pay for the goods supplied;
• To offer and quote insurance policies and promotions;
• Carry out any type of administrative or judicial action related to the commercial relationship.

4. RIGHTS OF THE HOLDERS OF PERSONAL DATA

Customers, suppliers and employees of PROSEGUROS CORREDORES DE SEGUROS S.A. have the right to:

• Know, update and rectify their personal data before PROSEGUROS CORREDORES DE SEGUROS S.A. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading data, or those whose Treatment is expressly prohibited or has not been authorized;
• To request proof of the authorization granted to PROSEGUROS CORREDORES DE SEGUROS S.A. for the processing of the data;
• To be informed by PROSEGUROS CORREDORES DE SEGUROS S.A. or by the person in charge of the treatment, upon request, regarding the treatment that has been given to their personal data;
• To file before the Superintendence of Industry and Commerce complaints for infringements to the provisions of this Manual and the applicable regulations;
• To revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees.
• Access free of charge to the personal data that have been subject to processing.
• By means of a request addressed through the mechanisms provided by PROSEGUROS CORREDORES DE SEGUROS S.A. for such purpose, mentioned in numeral 5 of this Manual, with the identification of the holder, the description of the facts that give rise to the claim, the address, together with the documents they wish to assert. If the claim is incomplete, the interested party will be required within five (5) working days following receipt of the claim to correct the faults. After one (1) month from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been withdrawn. In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.
• Once the complete claim has been received, a legend will be included in the database stating "claim in process" and the reason for the claim, within a term not exceeding two (2) business days. Said legend will be maintained until the claim is decided.

5. AREA OR GROUP FOR THE PROTECTION OF PERSONAL DATA PROSEGUROS

CORREDORES DE SEGUROS S.A. has made available to the Holders of personal data, the Operations Area. Therefore, the Owners of the personal data, may submit queries, request the updating, rectification, deletion or revocation of the authorization, through the mail electrónico:[email protected], the user service line: 6075500 or directly by written communication at the following address: Autopista Norte # 102 - 10 Piso 6.
Employees may submit queries, request the updating, rectification, deletion or revocation of the authorization of their personal data, to the Human Resources Area through the mail electró[email protected] .

6. CONSULTATION PROCEDURE

The Owners of the personal data or their assignees may make inquiries to PROSEGUROS CORREDORES DE SEGUROS S.A., regarding the personal data of the Owners that PROSEGUROS CORREDORES DE SEGUROS S.A. keeps in its databases, through the mechanisms provided in the preceding paragraph. If the consultation refers to a deceased holder, his relatives must submit the death certificate of the holder of the information and a copy of the civil registry proving the blood relationship or the oath before a notary public of two persons proving their status as heirs of the deceased. In the case of a common-law marriage, they must submit a declaration out of court.
In this way, PROSEGUROS CORREDORES DE SEGUROS S.A. will attend the consultations in a maximum term of ten (10) working days counted from the date of its reception. When it is not possible to attend the consultation within such term, the interested party shall be informed before the expiration of the ten (10) days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

7. PROCEDURE OF CLAIM

In case the Holders consider that the information contained in the databases of PROSEGUROS CORREDORES DE SEGUROS S.A. should be subject to correction, updating, deletion or revocation of the authorization of treatment, or if they noticed the alleged breach of any of the duties contained in Law 1581 of 2012, may file a claim with PROSEGUROS CORREDORES DE SEGUROS S.A., which will be processed under the following rules:

• PROSEGUROS CORREDORES DE SEGUROS S.A. has a maximum term of fifteen (15) working days counted from the day following the date of receipt of the claim to attend to it. When it is not possible to attend the claim within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first term. The Titleholders or assignees may only file a complaint before the Superintendence of Industry and Commerce once the consultation or claim process has been exhausted before PROSEGUROS CORREDORES DE SEGUROS S.A.

8. REVOCATION OF AUTHORIZATION AND DATA DELETION

The Holders of the personal data may request at any time to PROSEGUROS CORREDORES DE SEGUROS S.A., the deletion of their personal data and/or revoke the authorization for the processing of the same, in the manner and terms described in paragraph 7 of this Manual.
The personal data of the Holders will remain in the data bases of PROSEGUROS CORREDORES DE SEGUROS S.A. until the date on which the purpose for which they were collected is fulfilled or until the day on which by legal disposition, they must be conserved.
Once the validity of the database has expired, the personal data will be deleted, however PROSEGUROS CORREDORES DE SEGUROS S.A. will keep the personal data for the fulfillment of legal or contractual obligations.

9. DUTIES OF THE PERSON RESPONSIBLE FOR THE PROCESSING PROSEGUROS CORREDORES DE SEGUROS S.A.

Recognizes that the ownership of the personal data belongs to the Holders and therefore only they can decide about them. In accordance with the provisions of Article 17 of Law 1581 of 2012, PROSEGUROS CORREDORES DE SEGUROS S.A.is committed to permanently comply with the following duties related to the processing of personal data:

• Guarantee the holder, at all times, the full and effective exercise of the right of habeas data;
• To request and keep a copy of the authorization granted by the holder;
• To duly inform the holder about the purpose of the collection and the rights he/she has by virtue of the authorization granted;
• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
• To guarantee that the information provided to private, public, governmental and judicial entities is truthful, complete, accurate, updated, verifiable and understandable;
• Timely update, rectification and deletion of personal data, communicating the news to the person in charge of the treatment;
• *o provide private, public, governmental and judicial entities, as the case may be, only data whose processing has been previously authorized;
• To process queries and claims formulated in the terms set forth in article 14 of Law 1581 of 2012;
• To inform, at the request of the holder, about the use and treatment given to his/her personal data;
• To inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information and personal data of the owners;
• To insert in the database the information and personal data of the owners;
• Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality or details of the personal data;
• Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce;
• Register in the database the legend "claim in process" when the holders of the personal data file claims under the terms of Law 1258 of 2012 or in numeral 6 of this Manual; * Refrain from circulating or using the personal data in any way that may affect the quality or details of the personal data; * Refrain from using the personal data in any way that may affect the quality or details of the personal data;
• Refrain from circulating or using information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce;
• Allow access to the information only to persons authorized by law or by judicial or administrative authority.

10. AUTHORIZATION

PROSEGUROS CORREDORES DE SEGUROS S.A. is committed to obtain authorization from its employees, customers, and suppliers for the collection, storage, management, use, circulation, transfer or deletion of personal data, this authorization must be prior, express and informed, for which PROSEGUROS CORREDORES DE SEGUROS S.A. in its capacity as data controller, has provided a written authorization form, which will be made available to the Data Controllers, prior to the processing of their personal data, which must be read and signed by the Data Controllers, and which is an integral part of this Manual and which is included in the form of knowledge of the client and in Annex No. 1 of this document. The collection of personal data will be limited to relevant and adequate data to fulfill the purpose for which they are collected or required in accordance with the provisions of this Manual and current regulations. PROSEGUROS CORREDORES DE SEGUROS S.A., shall keep the proof of the authorization granted by the Holders of the personal data to be able to carry out the treatment of the same.

11. PRIVACY NOTICE

The privacy notice is the physical document, electronic or in any other format that is made available to the holders of personal data, through which it informs the existence of the information processing policies that will be applicable, how to access them and the characteristics of the treatment that is intended to give to personal data. The privacy notice of PROSEGUROS CORREDORES DE SEGUROS S.A., is an integral part of this Manual as Annex No. 2.

12. RESERVATION AND CUSTODY OF INFORMATION

Except in cases expressly provided by law, no personal data may be collected without the authorization of the Holders. The treatment of data includes the collection, storage, administration, use, circulation or transfer, in the form permitted by law and is carried out according to the purpose established in this Manual, for each database. Likewise PROSEGUROS CORREDORES DE SEGUROS S.A., guarantees the confidentiality, freedom, security, veracity, transparency, access and restricted circulation of the personal information provided by its employees, clients and suppliers, in observance of the principles of confidentiality and security contemplated in the national laws. In development of such principles, PROSEGUROS CORREDORES DE SEGUROS S.A. handles under strict technical measures, the information provided by its employees, clients and suppliers, guaranteeing the security of the records avoiding its adulteration, loss or unauthorized use. Likewise, PROSEGUROS CORREDORES DE SEGUROS S.A. guarantees the confidentiality of the information and its exclusive use in the development of its legal and contractual relations with the subjects of application of this policy.

13. MODIFICATION OF THE MANUAL

PROSEGUROS CORREDORES DE SEGUROS S.A. may unilaterally modify the present policy of treatment of personal data at any time, as long as the modification is associated with the fulfillment of its corporate purpose and is in accordance with the applicable regulations. For which PROSEGUROS CORREDORES DE SEGUROS S.A., will communicate the modifications to the Holders of the personal data previously or at the moment of the implementation of the same, by means of publication in its web page: www.howdengroup.com/co-en and www.howdengroup.com/co-es.

When the change in the policies refers to the purpose of the processing, a new authorization must be obtained from the Holders of the personal data.

14. VALIDITY OF THE DATA BASES

The data bases of the employees, clients and suppliers of PROSEGUROS CORREDORES DE SEGUROS S.A., will be in force until the purpose of the treatment of the personal data is fulfilled, without prejudice of the personal data that must be conserved by virtue of legal or contractual obligations.

15. EFFECTIVENESS OF THE PERSONAL DATA PROCESSING POLICY MANUAL

This Personal Data Processing Policy Manual shall be effective as of January 01, 2017.

PRIVACY NOTICE PROSEGUROS CORREDORES DE SEGUROS S.A.

PROSEGUROS CORREDORES DE SEGUROS S.A., commercial company, identified with NIT.860. .024. 858- 6, domiciled in the city of Bogota located at Autopista Norte # 102 - 10 Piso 6, telephone 6075500, in its capacity as responsible for the processing of personal data, reports that it will collect, store, manage, circulate and transfer your personal data to its related companies and companies incorporated in Colombia and abroad, in furtherance of its corporate purpose, and for commercial, labor, statistical, historical and administrative purposes, among other purposes set forth in the Privacy Notice and in the Manual of Policies for the Processing of Personal Data published on the website: www.howdengroup.com/co-en and www.howdengroup.com/co-es.
Calling your attention to the fact that as a Personal Data Holder, you have the right to update, rectify, delete or revoke the authorization, as well as to make inquiries and claims. For these purposes, the Company has provided the operations area to answer your queries and claims through the e-mail: [email protected], the user service line 6075500 or directly to the following address: Autopista Norte # 102 - 10 Piso 6.
We clarify that the provision of personal data of children and adolescents, as well as other data considered sensitive, is optional.

CLASSIFICATION AND HANDLING OF PRE-INSURANCE INFORMATION

The purpose of this policy is to ensure that all information held by or within Howden receives an appropriate level of protection both in accordance with the Information Security Policy and in compliance with applicable data protection law.
A classification scheme will be used to indicate the need and priority for security protection; this will ensure that:

• The appropriate level of sensitivity of the information is recognized.
• The appropriate method of handling and storing the information is identified and the information is protected accordingly.
• Employees are aware of the different levels of sensitivity and can apply appropriate controls.

HC Consulting S.A.S
MANUAL OF PERSONAL DATA PROCESSING POLICIES

1. PURPOSE

The purpose of this Policy Manual and Personal Data Processing, is to regulate the collection, storage, use, management, circulation and transfer of personal data of employees, customers and suppliers of HC CONSULTING S.A.S., for the purposes set out in this document.

2. RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

HC CONSULTING S.A.S., commercial company identified with NIT. 901002362-9, domiciled in the city of Bogotá D.C., located at Autopista Norte # 102 - 10 floor 6, with telephone 6075500, website: https://www.howdencolombia.co/ and email address [email protected], is the entity responsible for the processing of personal data of its employees, customers and suppliers.

3. TREATMENT AND PURPOSE

HC CONSULTING S.A.S., in exercise of its corporate purpose, performs the collection, storage, management, use, circulation and transfer of personal data of its employees, customers and suppliers to fulfill the purposes set out below.
By virtue of the development of its corporate purpose, HC CONSULTING S.A.S., will transfer the personal data of its clients to its related companies, insurance companies, reinsurance companies, insurance brokers and reinsurance brokers, Colombian and foreign, in order that the latter carry out the study of risks and evaluate the possibility of entering into insurance contracts.
Likewise, the personal data of its customers, suppliers and employees will be transferred to governmental or administrative entities when the law so provides and they will be processed to comply with the following purpose.

Clients:

• Offer and quote insurance policies and promotions;
• Collect policy premiums;
• To perform brokerage and insurance intermediation tasks with insurance companies, reinsurance companies, insurance brokers and reinsurance brokers, incorporated in Colombia or abroad, in order for them to carry out the risk study for the granting of insurance policies and to enter into the sale of insurance policies;
• To guide the procurement of insurance policies;
• Offering the renewal of insurance policies;
• Offering new products of insurance companies or prepaid medical companies or risk management companies (including occupational risk management).
• Offering promotions of products that are in any way related to insurance, prepaid medicine or risks;
• Conducting market research on the behavior of the insurance market.
• Conducting market research on the behavior of the insured, in which case their identity will remain anonymous and will never be exhibited individually but as part of an aggregate or collective;
• Conduct customer profiling studies to detect needs for insurance options or advice on risks of interest to the customer.

Employees:

• Link them to the Labor Risks Social Security System before the Labor Risks Administrator;
• Link them to the Compensation Funds;
• Make payroll payments;
• Make the contributions to the Social Security System in Health, Labor Risks and Pensions, before the Health Promoting Entities, the Labor Risks Administrators and the Pension Funds;
• To execute the labor contract that the employee has signed with HC CONSULTING S.A.S. and/or with its related companies, in accordance with polyfunctional clauses;
• To carry out any type of administrative or judicial action before the Administrative and Judicial Authorities related to the labor contract entered into;
• Comply with labor obligations;
• Keep the information of the candidates' resumes with their professional profile for possible future hiring;
• Verify compliance with the terms and conditions of the employment contract;
• Keep the information of the candidates' resumes with their professional profile for possible future hiring;
• Verify compliance with the conditions of the workers to perform the assigned work;
• Perform any type of administrative or judicial action related to the labor relationship.

Suppliers:

• Negotiate, enter into and execute contracts of a commercial nature;
• To obtain the resources and supplies required for the development of its corporate purpose;
• Evaluate the proposals submitted and select the suppliers of the required goods and services;
• Pay for the services rendered;
• To pay for services rendered;
• To pay for the goods supplied;
• To offer and quote insurance policies and promotions;
• Carry out any type of administrative or judicial action related to the commercial relationship.

4. RIGHTS OF THE HOLDERS OF PERSONAL DATA

Customers, suppliers and employees of HC CONSULTING S.A.S. shall have the right to:
* Know, update and rectify their personal data before HC CONSULTING S.A.S. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading data, or those whose Treatment is expressly prohibited or has not been authorized;
* To request proof of the authorization granted to HC CONSULTING S.A.S. for the processing of data;
* To be informed by HC CONSULTING S.A.S. or by the person in charge of the treatment, upon request, regarding the treatment that has been given to their personal data;
* To file complaints before the Superintendence of Industry and Commerce for violations of the provisions of this Manual and the applicable rules;
* To revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees.
* To access free of charge to the personal data that have been subject to processing.

5. PERSONAL DATA PROTECTION AREA OR GROUP

HC CONSULTING S.A.S. has made available to the Holders of personal data, the Operations Area. Therefore, the Owners of personal data may submit queries, request the update, rectification, deletion or revocation of the authorization, via email: [email protected], on the user service line: 6075500 or directly by written communication at the following address: Autopista Norte # 102 - 10 floor 6.
Employees may submit queries, request the updating, rectification, deletion or revocation of the authorization of their personal data, to the Human Resources Area through the e-mail: electró[email protected].

6. CONSULTATION PROCEDURE

The Owners of the personal data or their successors may make inquiries to HC CONSULTING S.A.S., regarding the personal data of the Owners that HC CONSULTING S.A.S. keeps in its databases, through the mechanisms provided in the preceding paragraph. If the consultation refers to a deceased owner, his relatives must submit the death certificate of the owner of the information and a copy of the civil registry proving the blood relationship or the oath before a notary of two people who prove the status of heirs of the deceased. In the case of a de facto marital union, they must present an extra-judicial declaration.
In this way, HC CONSULTING S.A.S. will attend the consultations in a maximum term of ten (10) working days counted from the date of its reception. When it is not possible to attend the consultation within such term, the interested party will be informed before the expiration of the ten (10) days, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term.

7. PROCESSING OF CLAIMS

In the event that the data subjects consider that the information contained in the databases of HC CONSULTING S.A.S. should be subject to correction, updating, deletion or revocation of the authorization of treatment, or if they noticed the alleged breach of any of the duties contained in Law 1581 of 2012, they may file a claim with HC CONSULTING S.A.S., which will be processed under the following rules:
By request addressed through the mechanisms provided by HC CONSULTING S.A.S. for such purpose, mentioned in numeral 5 of this Manual, with the identification of the holder, the description of the facts giving rise to the claim, the address, together with the documents that they wish to assert. If the claim is incomplete, the interested party will be required within five (5) working days following receipt of the claim to correct the faults. After one (1) month from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been withdrawn. In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.
Once the complete claim has been received, a legend will be included in the database stating "claim in process" and the reason for it, within a term not exceeding two (2) business days. This legend will be maintained until the claim is decided.
HC CONSULTING S.A.S. has a maximum period of fifteen (15) working days from the day following the date of receipt of the claim to address it. When it is not possible to address the claim within that period, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) working days following the expiration of the first deadline. The Holders or assignee may only file a complaint before the Superintendence of Industry and Commerce once the consultation or complaint process has been exhausted before HC CONSULTING S.A.S.

8. REVOCATION OF AUTHORIZATION AND DELETION OF DATA

The owners of personal data may request at any time to HC CONSULTING S.A.S., the deletion of their personal data and / or revoke the authorization for the processing of these, in the manner and terms described in paragraph 7 of this Manual.
The personal data of the Data Controllers will remain in the databases of HC CONSULTING S.A.S. until the date on which the purpose for which they were collected is fulfilled or until the day on which, by legal provision, they must be retained.
Once the validity of the database expires, the personal data will be deleted, however, HC CONSULTING S.A.S. will keep the personal data for the fulfillment of legal or contractual obligations.

9. DUTIES OF THE DATA CONTROLLER

HC CONSULTING S.A.S., recognizes that the ownership of personal data belongs to the Data Controllers and therefore only they can decide on them. In accordance with the provisions of Article 17 of Law 1581 of 2012, HC CONSULTING S.A.S. is committed to permanently comply with the following duties related to the processing of personal data:

• Guarantee the holder, at all times, the full and effective exercise of the right of habeas data;
• To request and keep a copy of the authorization granted by the holder;
• To duly inform the holder about the purpose of the collection and the rights he/she has by virtue of the authorization granted;
• Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;
• To guarantee that the information provided to private, public, governmental and judicial entities is truthful, complete, accurate, updated, verifiable and understandable;
• Timely update, rectification and deletion of personal data, communicating the news to the person in charge of the treatment;
• To provide private, public, governmental and judicial entities, as the case may be, only data whose processing has been previously authorized;
• To process the queries and claims formulated in the terms set forth in article 14 of Law 1581 of 2012
• To inform, at the request of the holder, about the use and treatment given to his personal data; * To inform the protection authority about the use and treatment given to his personal data;
• To inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information and personal data of the owners;
• Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality or details of the personal data;
• Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce;
• Register in the database the legend "claim in process" when the holders of the personal data file claims under the terms of Law 1258 of 2012 or in numeral 6 of this Manual; * Refrain from circulating or using the personal data in any way that may affect the quality or details of the personal data; * Refrain from using the personal data in any way that may affect the quality or details of the personal data;
• Refrain from circulating or using information that is being disputed by the owner and whose blocking has been ordered by the Superintendence of Industry and Commerce;
• To allow access to the information only to persons authorized by law or by judicial or administrative authority.

10. AUTHORIZATION HC CONSULTING S.A.S.

undertakes to obtain authorization from its employees, customers, and suppliers for the collection, storage, management, use, circulation, transfer or deletion of personal data, this authorization must be prior, express and informed, for which HC CONSULTING S.A.S., in its capacity as controller of personal data, shall obtain prior, express and informed authorization from its employees, customers, and suppliers for the collection, storage, management, use, circulation, transfer or deletion of personal data. in its capacity as data controller, has provided a written authorization form, which will be made available to the Data Controllers, prior to the processing of their personal data, which must be read and signed by the Data Controllers, and which is an integral part of this Manual and which is included in the form of knowledge of the client and in Annex No. 1 of this document.
The collection of personal data will be limited to the relevant and adequate data to fulfill the purpose for which they are collected or required in accordance with the provisions of this Manual and current regulations.
HC CONSULTING S.A.S., shall retain proof of authorization granted by the owners of the personal data to carry out the treatment of these.

11. PRIVACY NOTICE

The privacy notice is the physical document, electronic or in any other format that is made available to the holders of personal data, through which the existence of the information processing policies that will be applicable, how to access them and the characteristics of the treatment that is intended to be given to personal data is reported. The privacy notice of HC CONSULTING S.A.S., is an integral part of this Manual as Annex No. 2. 12. RESERVATION AND CUSTODY OF INFORMATION Except in cases expressly provided by law, personal data may not be collected without the authorization of the Holders. The processing of data includes the collection, storage, administration, use, circulation or transfer, in the manner permitted by law and is carried out in accordance with the purpose established in this Manual, for each database. Likewise, HC CONSULTING S.A.S., guarantees the confidentiality, freedom, security, veracity, transparency, access and restricted circulation of the personal information provided by its employees, clients and suppliers, in observance of the principles of confidentiality and security contemplated in the national laws. In development of such principles, HC CONSULTING S.A.S. handles under strict technical measures, the information provided by its employees, clients and suppliers, guaranteeing the security of the records avoiding its adulteration, loss or unauthorized use. Likewise, HC CONSULTING S.A.S. guarantees the confidentiality of the information and its exclusive use in the development of its legal and contractual relations with the subjects of application of this policy.

13. MODIFICATION OF THE MANUAL HC CONSULTING S.A.S.

may modify this policy of treatment of personal data unilaterally, at any time, provided that the modification is associated with the fulfillment of its corporate purpose and is in accordance with applicable law. For which HC CONSULTING S.A.S., will communicate the modifications to the Owners of the personal data previously or at the moment of the implementation of these, through publication in its web page: https://www.howdencolombia.co/ When the change of the policies refers to the purpose of the treatment, a new authorization of the Owners of the personal data must be obtained.

14. VALIDITY OF THE DATABASES

The databases of employees, customers and suppliers of HC CONSULTING S.A.S., will be valid until the purpose of the processing of personal data is fulfilled, without prejudice to the personal data that must be retained under legal or contractual obligations.

15. EFFECTIVENESS OF THE PERSONAL DATA PROCESSING POLICY MANUAL

This Personal Data Processing Policy Manual shall be effective as of January 01, 2017.

PRIVACY NOTICE HC CONSULTING S.A.S.

HC CONSULTING S.A.S. identified with NIT 901.002.362-9, located at Autopista Norte # 102 - 10 floor 6, Bogotá D.C., with telephone number 6075500, in its capacity as responsible for the processing of personal data, informs that it will collect, store, manage, circulate and transfer your personal data to its related companies and to companies incorporated in Colombia and abroad, in the development of its corporate purpose, and for commercial, labor, statistical, historical and administrative purposes, among other purposes established in the Privacy Notice and in the Manual of Personal Data Processing Policies published on the website: https://www.howdencolombia.co/.
Calling your attention to the fact that as a Personal Data Holder, you have the right to update, rectify, delete or revoke the authorization, as well as to make inquiries and claims. For these purposes, the Company has provided the operations area to answer your queries and claims through the email: [email protected], the user service line 6075500 or directly to the following address: Autopista Norte # 102 - 10 floor 6.
We clarify that the provision of personal data of children and adolescents, as well as other data considered sensitive, is optional.

CLASSIFICATION AND HANDLING OF HOWDEN CORREDORES DE SEGUROS INFORMATION

The purpose of this policy is to ensure that all information held by or within Howden receives an appropriate level of protection both in accordance with the Information Security Policy and in compliance with applicable data protection law.
A classification scheme will be used to indicate the need and priority for security protection; this will ensure that:

• The appropriate level of sensitivity of the information is recognized.
• The appropriate method of handling and storing the information is identified and the information is protected accordingly.
• Employees are aware of the different levels of sensitivity and are able to apply appropriate controls.