PERSONAL DATA PROCESSING AND PROTECTION POLICY
The Rochester Educational Foundation defines the document herein known as the “PERSONAL DATA PROCESSING AND PROTECTION POLICY” in accordance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, so that the conditions regulated are met by said law in the processing of personal data. Through the implementation of said policies, all actions that take place in the exercise of its functions, shall be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency, access and restricted movement, security and confidentiality.
Thus, the Rochester Educational Foundation adopts the policy hereunder for the processing of personal data, which will be informed to all holders of data
collected or to be obtained in the future in the exercise of all its activities.
1. SCOPE: The Personal Data Processing and Protection Policy presented below, shall apply to all Databases and/or Files containing personal data which are processed by the Rochester Educational Foundation and Inversiones Alejón S.A.S. held responsible and/or in charge of the processing of personal data.
2. IDENTIFICATION OF THE PARTY RESPONSIBLE FOR PROCESSING:
a. NAME OF THE INSTITUTION: Rochester Educational Foundation identified with TAX I.D. [NIT]. 900509589-7 recognized as legal status through resolution 279 of February 9, 2012 by the Office of the Secretary of Education of chia, hereinafter to be known as the FOUNDATION, a non-profit institution that is the proprietor of the ROCHESTER SCHOOL, licensed for the provision of formal educational services for cycles and/or levels of preschool, basic primary, basic secondary and academic average middle granted
by Resolution Number according to resolution 1905 of October 17, 2012, issued by the Office of the Secretary of Education of Chia, Cundinamarca.
b. DOMICILE AND ADDRESS: The FOUNDATION is domiciled in the municipality of Chia, Cundinamarca, and its headquarters is located at Autopista Norte Km. Vereda Fusca, Chia, Cundinamarca.
c. EMAIL: email@example.com
d. PHONE: (57-1) 7496000 Ext. 2110.
3. LEGAL FRAMEWORK: Constitution, Article 15; Law 1266 of 2008; Law 1581 of 2012; Regulatory Decrees 1727 of 2009 and 2952 of 2010; Partial Regulatory Decree 1377 of 2013; Sentences C – 1011 of 2008, and C – 748 of 2011 from the Constitutional Court.
4. SCOPE OF APPLICATION: The policy hereunder applies to the personal data recorded in any database of the FOUNDATION, whose owner is a natural person or a legal person and whose treatment is derived from the exercise of its corporate purpose or the delegation of the processing of personal data by an associate (as defined in the terminology of the next item).
5. DEFINITIONS: According to current regulations regarding the protection of personal data, the following terms are defined:
a. Authorization: Express and informed consent of the holder to carry out the processing of personal data.
b. Privacy Notice: Verbal or written communication generated by the party responsible for the use of personal data, addressed to the holder thereof, through which personal data processing and protection policy are informed, which will be applicable to them, how to access them, and the purposes of the processing to be given to such data.
c. Associate: Any natural or legal person who through a contract or partnership agreement is responsible for processing data or delegates to the FOUNDATION the processing thereof.
d. Database: Organized set of personal data processed.
e. Personal data: Information associated with a certain or determinable natural or legal person.
f. Public data: Data that is not classifiable as semi-private, private or sensitive. Public data, among others, includes data on marital status, profession, public or private employment. By its nature, public data can be contained, among others, in public records, public documents, official gazettes, and judgments not subject to confidentiality.
g. Sensitive data: Sensitive data are those that affect the privacy of the owner or whose misuse could cause damage such as discrimination, from racial or ethnic origin, political beliefs, religious beliefs, philosophical beliefs, membership in trade unions or social organizations, data concerning health , sexual life and biometric information.
h. Processor: A natural or legal, private or public person, who on their own or in association with others, performs the processing of personal data on behalf of the party responsible thereof.
i. Party responsible for processing: A natural or legal, private or public person, who on their own or in association with others, decides on the use and processing of the database.
j. Owner: The natural or legal person whose personal data are the object of processing.
k. Processing: Any operation or use that is given to personal data such as collection, storage, use, communication, circulation or deletion.
l. Transfer: Forwarding of personal data to a receiver inside or outside the country, who becomes in turn the processing party.
m. Transmission: Communication of personal data in order to perform data processing on behalf of a a party in charge of the processing thereof.
6. PROCESSING AND PURPOSE: The processing to be performed by the FOUNDATION shall be that of collecting, storing, updating, processing, using, transmitting or transfering personal data strictly adhering to the duties of security and confidentiality ordered in Law 1581 of 2012 and Decree 1377 of 2013, for the following purposes:
a. Recording information on personal data in the databases of the FOUNDATION, in order to query, analyze, generate statistics and indicators, necessary for the exercise of its functions and the fulfillment of its objectives, as well as complying with the regulations and legal framework applicable in force for institutions providing formal education services.
7. RIGHTS OF THE OWNER OF THE PERSONAL DATA: As the owner of personal data, you are entitled to:
a. Gain access to, know, update and rectify your information vis-à-vis partial, inaccurate, incomplete, or split data, that are misleading, or those whose processing is forbidden.
b. Requesting from the FOUNDATION proof of the authorization granted to the FOUNDATION or its associates, except where the authorization is not necessary as stipulated in law 1581 of 2012, Article 10.
c. Filing a complaint before the Superintendent of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and all other regulations thereof amending, adding or supplementing, once you have exhausted the complaints process to the party responsible of or in charge of processing personal data .
d. Request the deletion of data when the principles, rights and constitutional and legal guarantees in the course of processing the aforesaid , which shall be respected.
and. when the authority has determined that the Foundation with regard to the processing of data, has engaged in conduct contrary
the Constitution and current regulations, know the policy data processing entity and through it, use or purpose that will be given to personal data, identify the person responsible in the foundation that will process and respond to your requests ; Others mentioned by Article 8 of Law 1581 of 2012.
8. DEPARTMENT RESPONSIBLE FOR THE ATTENTION OF PETITIONS, COMPLAINTS, CONSULTATIONS AND PERSONAL DATA
a. The FOUNDATION is responsible for development work, Implementation, training and monitoring of this Policy.
b. The Systems Division and the Administrative and Financial Department of the Foundation, have been designated by the same as those responsible for the care of requests, inquiries and complaints to which the holder of personal data may exercise their rights to know, update and correct the data.
c. For this purpose, all servers and contractors who perform the processing of personal data in different units, are obliged to transfer to the Administrative and Financial all requests, complaints or claims received by the Holders of Personal Data in the time established by law.
9. PROCEDURE FOR CARE AND RESPONSE TO PETITIONS, QUERIES, COMPLAINTS AND CLAIMS OF HOLDERS OF PERSONAL DATA: Holders of personal data being collected on, stored, processed, used and transmitted or transferred by the Foundation may exercise their rights to know, update and rectify information at any time. For this purpose, the following procedure shall be followed, in accordance with the Law on Protection of Personal Data:
a. Media enabled for submitting requests, inquiries and complaints: The Foundation has provided the following means for the reception and care of requests, inquiries and complaints that preserve evidence of the same:
i. written communication addressed to the Foundation. Administrative and Financial Management. North Highway, Km.15, Vereda Fusca, Chia, Cundinamarca.
ii. Telephone communication: PBX 7496000 Ext. 2110 (Systems Division) or Ext. 2109 (Administrative and Financial) Monday through Friday from 8:00 a.m. to 4:00 p.m.
iii. Request via email: firstname.lastname@example.org.
b. Attention and response to requests and inquiries: The Owner or their agent may request from the FOUNDATION:
i. Information regarding the Personal Data of the Owner that is the object of processing.
ii. Information on the use that has been given by the FOUNDATION to their personal data.
c. Requests and inquiries will be answered within a maximum period of ten (10) business days from the date of receipt thereof. When it is not possible to comply with the request or query within that term, the interested party will be notified, stating the reasons for the delay and indicating when their request or inquiry will be addressed,
which shall in no event exceed five (5) business days following the end of the first term. When the request or inquiry relates directly to local authorities in their capacity as the parties responsible for processing the data they have collected, or in regard to the monitoring to be performed by the latter in terms of respect of habeas data in the relationship established between educational establishments, parents and students, the FOUNDATION shall advise of this situation, both to the pertitioner concerned
, as well as the specific party responsible for data processing, immediately and ex officio forwarding the respective request to the relevant certified local authority in that pertaining to the matters of their competence and responsibility.
d. Attention and response to complaints and claims: The Owner or their counsel may request from the FOUNDATION, through a complaint or claim
submitted through the channels already noted:
i. Corrected or updated information.
ii. That an alledged breach of any of the duties contained in the Law on Protection of Personal Data be remedied or corrected.
e. The application shall contain at a minimum the description of the facts giving rise to the complaint or claim, the address and contact details of the applicant. If the complaint or claim submitted is incomplete, the FOUNDATION shall ask the party concerned within five (5) following receipt of the complaint or claim to remedy the issues. After two (2) months from the date of request, without the applicant submitting the required information, the latter shall be deemed to have withdrawn the complaint or claim. If the office receiving the complaint or claim is not competent to resolve, it will need to transfer it to the Administrative and Financial Department of the FOUNDATION for transmission to the corresponding office in the FOUNDATION, in a maximum term of two (2) working days and report what happened to the party concerned. When it is not possible to deal with the complaint or claim within this term, it will inform the party concerned of the reasons for the delay and the date on which the complaint or claim will be addressed, which in no event shall exceed twenty (20) working days following the expiry of the first term.
10.DURATION: This Personal Data Treatment and Protection Policy
has entered into force from the first (1) of November, two thousand