FOUNDATION PERSONAL DATA PROCESSING POLICY
This Policy for the Treatment of Personal Data and Information (hereinafter the "Policy"), aims to implement the provisions contained in Law 1581 of 2012 and Decree 1377 of 2013, as it refers exclusively to databases, files and information containing personal data subject to treatment and explains how La Fundaci贸n Cigarra (La Fundaci贸n Cigarra), collects, stores, uses, circulates and treats information that you provide us through different means, due to the educational activity and administrative management that it develops.
1. CONTACT DETAILS OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA
Cicada Foundation 71st Street Q south No. 27-60.
Puertas del Para铆so Neighborhood
Bogota-Colombia, Bogota-Colombia
E-mail: info@cigarra.org
Phone: (57+) 321 246 5421
2. PERSONAL DATA PROTECTION REGIME
- Political Constitution of Colombia
- Law 1266 of 2008
- Law 1581 of 2012
- Decree 1377 of 2013.
- Decision C-748 of 2011.
- Decree 1074 of 2015.
- Decree 886 of 2014.
3. GUIDING PRINCIPLES
It is a commitment of the Cicada Foundation in the development of its management, to understand and harmoniously apply the principles established in Law 1581 of 2012:
- Principle of legality in data processing: The Processing referred to in this law is a regulated activity that must be subject to the provisions set forth therein and in the other provisions that develop it.
- Principle of purpose: The processing must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject.
- Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the Consent.
- Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.
- Principle of transparency: The right of the Data Subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed.
- Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of the personal data, the provisions of this Law and the Constitution. In this sense, the Processing may only be carried out by persons authorized by the Holder and/or by the persons provided for in this Law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Data Controllers or third parties authorized in accordance with this Law.
- Security Principle: The information subject to Processing by the Data Controller or Data Processor referred to in this law, shall be handled with the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
- Principle of confidentiality: All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the processing, and may only provide or communicate personal data when it corresponds to the development of the activities authorized in this law and under the terms of the same.
4. TREATMENT AND PURPOSE OF PERSONAL DATA
The Cicada Foundation has defined the data it manages, including identification, contact, academic and health data, as well as the activities it carries out with such data, particularly in its reception, conservation, disposal and administration for the purposes of educational and administrative management.
In the development of its management, La Fundaci贸n Cigarra may collect sensitive personal data such as:
- Health information, necessary for the priority medical attention provided in the Medical Service, the therapeutic processes developed in the CADI - Center for Attention and Integral Development and the counseling for emotional, learning and relational situations provided in School Counseling.
- Biometric information such as hand measurement for identification of students and employees, photographs, videos and voice recordings. Being sensitive personal data, the authorization for its treatment is optional.
The Cicada Foundation may hire third parties for the development of specific activities that may include the processing of personal data. In this case, the person in charge must comply with the obligations defined by law, as well as this Information Processing Policy. Likewise, it may transfer personal data to third parties necessary to carry out the purposes described in the Policy.
PURPOSES OF DATA PROCESSING:
The Cicada Foundation collects personal data from the different members of the educational community: children and adolescents who are its students and their families (parents, siblings and guardians); teachers, employees and managers, people who work with different suppliers or third parties with whom the Cicada Foundation has a relationship in the development of its activity. This policy applies to all of them.
The purposes of data collection by the Cicada Foundation are part of the work of the Institution:
- Provide formal education services.
- To develop the academic management of the student during their stay at La Fundaci贸n Cigarra and afterwards to guarantee the availability of the pertinent information that may be required by it.
- To develop recreational, sporting, cultural and educational extracurricular activities through third parties, inside or outside the country, who will accredit the sufficiency in compliance with the rules on the protection of personal data.
- Generate content and material for internal communications and publications of the Cicada Foundation.
- Provide food services, counseling, medical services, CADI, etc.
- Learning and integral development center, school transportation and other complementary services required for school management.
- Conduct studies on student habits and behaviors for the evaluation and improvement of the services provided.
- Circulate or transfer information to external control entities, such as the Ministry of National Education and the Secretariat of Education of the Capital District, among others.
- Evaluate and implement health prevention activities guided by the plans developed by the State to act jointly with educational establishments.
- Execute the admission, evaluation and hiring processes and the execution of the contractual relationship with parents and/or guardians, students, candidates for employees, employees, managers and suppliers, including the requirement of payment of their contractual obligations.
- Maintain ongoing communication with parents about students' academic performance and other relevant information. This includes communication about Cicada Foundation activities and non-profit events.
- To dispose of the information to circulate, transmit or transfer it when it is going to be used for pre-judicial and judicial collection actions by specialized collection entities, or by the attorney-in-fact, hired for this purpose by La Fundaci贸n Cigarra;
- Comply with legal requirements for retention of student and employee information.
- To know and follow up on the financial suitability and commercial behavior of suppliers, as well as to have the information required to make the necessary payments and to demand the fulfillment of the obligations contracted with La Fundaci贸n Cigarra. Likewise, the data of former suppliers are kept in order to give a reference of commercial character when it is requested to the College, and to contact them again for the provision of new services.
- Monitor the school operation to maintain the safety conditions of La Fundaci贸n Cigarra for its students, employees and other members of the community who access the facilities.
- To provide, share, send or deliver personal data with institutions dedicated to the provision of educational services or third parties that require the information for the same purposes indicated herein. - Evaluate the quality of the service and support the corresponding processes.
- To support statistical, historical, technical-actuarial processes of their own or of trade associations of the educational sector, or to preserve the institutional historical and cultural memory.
- Conduct non-profit campaigns, promotions or contests aimed at supporting institutions dedicated to social and community service.
- Health purposes of contact tracing in case of contagion.
5. RIGHTS OF THE OWNERS
a. To know, update, rectify or delete (the latter provided that there is no legal or contractual link that requires it) their personal data against La Fundaci贸n Cigarra in its capacity as Data Controller. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
b. Request proof of the authorization granted to La Fundaci贸n Cigarra except when, in accordance with the Law, the Processing being carried out does not require it.
c. Be informed by La Fundaci贸n Cigarra upon request, regarding the use it makes of your personal data.
d. File complaints before the Superintendence of Industry and Commerce for violations of Law 1581 of 2012 and its regulatory decrees. Previously, the consultation or complaint process must have been carried out before La Fundaci贸n Cigarra.
e. To revoke the authorization and/or request the deletion of the data when the processing does not respect the constitutional and legal principles, rights and guarantees.
f. Access free of charge, through the channels provided by La Fundaci贸n Cigarra to your personal data that have been processed.
6. DUTIES OF THE Cicada Foundation AS RESPONSIBLE FOR TREATMENT
a. Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data.
b. Request and keep, under the conditions provided for, a copy of the respective authorization granted by the Holder.
c. Duly inform the Data Subject about the purpose of the collection and the rights he/she is entitled to by virtue of the authorization granted. d. Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
e. Ensure that the information provided to the Data Processors is truthful, complete, accurate, updated, verifiable and understandable.
f. Update the information, communicating in a timely manner to the Data Processors, all developments with respect to the data of the Data Controller. In addition, adopt the necessary measures to keep the information updated.
g. Rectify the information when it is incorrect and communicate the pertinent to the Data Processors.
h. To provide to the Data Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions.
i. To respect the security and privacy conditions of the Data Subject's information and to demand the same from the Data Processors.
j. To process the consultations and claims formulated in the agreed terms.
k. Inform the Data Processors when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not been completed.
l. Inform at the holder's request about the use given to his data.
m. To inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the Data Holders.
n. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce on the particular subject.
7. AUTHORIZATION OF THE OWNERS
Without prejudice to the exceptions provided for in the Law, the processing of personal data of the Data Subject requires the prior and informed authorization of the Data Subject, which must be obtained by any means that may be subject to consultation and subsequent verification, or through a suitable technological mechanism that allows the Data Subject to express his/her consent to unequivocally conclude that, if a certain action had not been taken, the data would never have been captured and stored in the database.
Data collection will be limited to those personal data that are relevant and adequate for the purpose for which they are collected.
The authorization will not be necessary in the case of:
a. Information required by a public or administrative entity in the exercise of its legal functions or by court order.
b. Data of a public nature.
c. Cases of medical or sanitary emergency.
d. Processing of information authorized by law for historical, statistical or scientific purposes.
e. Data related to the Civil Registry of Persons.
It is the responsibility of the Holders to provide the information in a truthful, complete, timely and responsible manner.
For the collection and processing of sensitive personal data, it shall be clearly indicated to the Data Subject what the data is, the purpose of the Processing and the information that he/she is not obliged to authorize its Processing.
8. PRIVACY NOTICE
When it is not possible to make available to the Data Subject the personal data processing policy, La Fundaci贸n Cigarra will inform the Data Subject by means of a Privacy Notice about the existence of this policy and how to access it, previously and in any case no later than the time of collection of personal data.
The announcement must emphasize the responsibility of the Holders regarding the updating of their information for the optimal fulfillment of the duties of The Cicada Foundation.
In any case, the Policy of Treatment of Personal Data will be published on the website of the Cicada Foundation www.sgs.edu.co.
9. LEGITIMACY FOR THE EXERCISE OF THE HOLDER'S RIGHT
The rights of the Holders may be exercised by the following persons:
a. By the Holder, who must prove his identity sufficiently by the various means made available to him by The Cicada Foundation.
b. By the Beneficiary's successors (in the event of death or disability of the Beneficiary), who must prove such capacity.
c. By the representative and/or attorney-in-fact of the Holder, prior accreditation of the corresponding representation or power of attorney.
d. By stipulation in favor of or for another.
The rights of children or adolescents shall be exercised by the persons who are empowered to represent them.
10. RESPONSIBLE FOR THE ATTENTION OF QUERIES AND COMPLAINTS
The Cicada Foundation has created the role of Data Protection Officer, assigned to the Head of Information and Technology, who will be responsible for the definition, implementation and monitoring of the actions required to guarantee this right to the Holders of personal data held by the Cicada Foundation in accordance with current regulations.
11. PROCEDURE FOR HANDLING INQUIRIES AND COMPLAINTS
The Data Protection Officer of Fundaci贸n Cigarra will be in charge of receiving, managing and responding to queries and claims submitted by Data Subjects, assignees or attorneys-in-fact.
Inquiries will be answered within a maximum term of fifteen (15) business days from the date of receipt thereof. When it is not possible to answer the consultation within such term, the Holder will be informed, stating the reasons for the delay and indicating the date on which the consultation will be answered, without exceeding eight (8) business days following the expiration of the first term.
Claims for correction, updating or deletion, or for alleged breach of any of the duties contained in the law, will be processed under the following rules:
1. The claim shall be formulated by means of a request addressed to the Data Controller or the Data Processor, with the identification of the Data Subject, the description of the facts that give rise to the claim, the address, and accompanied by the documents to be asserted. If the claim is incomplete, the interested party will be required within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned. In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation.
2. Once the complete claim has been received, a legend will be included in the database stating "claim in process" and the reason for the claim, within a term no longer than two (2) business days. Said legend shall be maintained until the claim is decided; and 3. The maximum term to attend the claim shall be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
12. MODIFICATION AND/OR UPDATING OF THE PERSONAL DATA PROTECTION AND INFORMATION HANDLING POLICY
Any substantial change in the processing policies will be communicated in a timely manner to the data subjects through the usual means of contact and / or through the website of the Cicada Foundation www.sgs.edu.co.
13. PERMANENCE OF THE DATABASES AND VALIDITY OF THE PERSONAL DATA PROCESSING POLICY
The data is kept in accordance with the principles of necessity and reasonableness, as well as with those of expiration and temporality as provided by law and jurisprudence. The Cicada Foundation will keep the data of:
Students: For as long as there is a legal or contractual duty to remain in the databases and as long as any commercial or service relationship, or any other type or obligation in force with La Fundaci贸n Cigarra in compliance with the established purposes.
Former students: up to a maximum period of thirty (30) years, once the relationship with La Fundaci贸n Cigarra has ended.
Employees and Suppliers: Shall be maintained during the term of the contractual relationship and thereafter, as provided by law.
Student applicants and employee candidates: For one (1) year from the end of the recruitment process.
The holder of the information will maintain the authorization granted for as long as there is a legal or contractual duty to remain in the database and as long as any commercial or service relationship, or any other type or obligation in force with La Fundaci贸n Cigarra remains in force, which will constitute the period of validity of the data. Once the legal term has expired and/or all contractual, commercial, service, or any other type of relationship has been extinguished, the personal data will be removed from the database or files of La Fundaci贸n Cigarra.
This Policy is effective as of April 2024.
_____________________________________
CAROLYN ACOSTA
Founder