Web policies manual

The information treatment policy is developed in compliance with articles 15 and 20 of the Political Constitution; with articles 17 literal k) and 18 literal f) of Statutory Law 1581 of 2012, which establishes general provisions for the Protection of Personal Data (LEPD); and with article 13 of Decree 1377 of 2013, which partially regulates the previous law.

This policy will apply to all personal data registered in databases that are subject to treatment by the data controller.

2. Definitions established in article 3 of the LEPD and article 3 of Decree 1377 of 2013

• Authorization: Prior, express, and informed consent of the Data Subject to carry out the treatment of personal data.

• Database: Organized set of personal data that is subject to treatment.

• Personal data: Any information linked or that can be associated with one or several determined or determinable natural persons.

• Public data: It is the data that is not semi-private, private, or sensitive. Public data includes, among others, data related to the civil status of individuals, their profession or trade, and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public records, public documents, gazettes and official bulletins, and judicial rulings that are duly executed and not subject to confidentiality.

• Sensitive data: Sensitive data refers to those that affect the privacy of the Data Subject or whose improper use may lead to discrimination, such as those revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or that promote the interests of any political party or guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.

• Data processor: Natural or legal person, public or private, who by themselves or in association with others, carries out the treatment of personal data on behalf of the data controller.

• Data controller: Natural or legal person, public or private, who by themselves or in association with others, decides on the database and/or the treatment of the data.

• Data Subject: Natural person whose personal data is subject to treatment.

• Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

• Privacy notice: Verbal or written communication generated by the controller, directed to the Data Subject for the treatment of their personal data, through which they are informed about the existence of the information treatment policies that will apply to them, how to access them, and the purposes of the treatment intended for the personal data.

• Transfer: The transfer of data occurs when the controller and/or processor of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is located inside or outside the country.

• Transmission: Treatment of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia when it aims to carry out treatment by the processor on behalf of the controller.

3. Authorization of the treatment policy

According to article 9 of the LEPD, the treatment of personal data requires the prior and informed authorization of the Data Subject. By accepting this policy, any Data Subject who provides information related to their personal data is consenting to the treatment of their data by ASOCIACION COLOMBIANA DE PETROLEO under the terms and conditions set forth herein.

Authorization from the Data Subject will not be necessary when it concerns:

• Information required by a public or administrative entity in the exercise of its legal functions or by court order.

• Publicly available data.

• Cases of medical or health emergency.

• Processing of information authorized by law for historical, statistical, or scientific purposes.

• Data related to the Civil Registry of individuals.

4. Data controller

The data controller of the databases subject to this policy is ASOCIACION COLOMBIANA DE PETROLEO, whose contact details are as follows: 

Address: 
CR 7 73 47 P 12 Bogotá, Capital District – Colombia 

Email: 
fflor@acp.com.co 

Phone: 
2125758

5. Processing and purposes of the databases

ASOCIACION COLOMBIANA DE PETROLEO, in the development of its business activity, carries out the processing of personal data related to natural persons that are contained and processed in databases intended for legitimate purposes, complying with the Constitution and the Law.

The following table (Table I) presents the different databases managed by the company and the purposes assigned to each of them.

Table 1. Databases and purposes

 [prefix_table]

Database:	Purpose:

[/prefix_table]

 

6. Browsing data

The navigation system and the software necessary for the operation of this website collect some personal data, the transmission of which is implicit in the use of Internet communication protocols.

By its very nature, the information collected could allow the identification of users through its association with third-party data even if it is not obtained for that purpose. This category of data includes the IP address or the domain name of the device used by the user to access the website, the URL, the date and time, and other parameters related to the user's operating system.

This data is used solely for the purpose of obtaining anonymous statistical information about the use of the website or to monitor its proper technical functioning, and is deleted immediately after being verified.

7. Cookies or web bugs

This website does not use cookies or web bugs to collect personal data from the user, but their use is limited to facilitating user access to the website. The use of session cookies, which are not permanently stored on the user's device and disappear when the browser is closed, is limited to collecting technical information to identify the session in order to facilitate secure and efficient access to the website. If you do not wish to allow the use of cookies, you can reject them or delete any existing ones by configuring your browser and disabling the JavaScript code in the browser's security settings.

8. Rights of the data subjects

In accordance with Article 8 of the LEPD and Articles 21 and 22 of Decree 1377 of 2013, data subjects may exercise a series of rights regarding the processing of their personal data. These rights may be exercised by the following persons.

1. By the data subject, who must sufficiently prove their identity by the various means made available by the data controller.

2. By their successors, who must prove such status.

3. By the representative and/or attorney of the data subject, upon proving the representation or power of attorney.

4. By stipulation in favor of another and for another.

The rights of children or adolescents will be exercised by those who are authorized to represent them.

The rights of the data subject are as follows:

• Right of access or consultation: This is the right of the data subject to be informed by the data controller, upon request, regarding the origin, use, and purpose given to their personal data.

• Rights of complaints and claims: The Law distinguishes four types of claims:

  • Claim for correction: the right of the data subject to have partial, inaccurate, incomplete, fragmented data that may lead to error, or data whose processing is expressly prohibited or has not been authorized, updated, rectified, or modified.

  • Claim for deletion: the right of the data subject to have data that is inadequate, excessive, or does not respect constitutional and legal principles, rights, and guarantees deleted.

  • Claim for revocation: the right of the data subject to revoke the authorization previously granted for the processing of their personal data.

  • Claim for infringement: the right of the data subject to request that the non-compliance with data protection regulations be remedied.

• Right to request proof of the authorization granted to the data controller: unless expressly exempted as a requirement for processing in accordance with the provisions of Article 10 of the LEPD.

• Right to file complaints with the Superintendence of Industry and Commerce for infringements: the data subject or successor may only file this complaint once they have exhausted the consultation or claim process with the data controller or processor.

9. Attention to data subjects

FRANCISCO JOSE LOREDA MERA identified with CC number 79337350 of COLOMBIAN PETROLEUM ASSOCIATION, will be responsible for handling requests, inquiries, and complaints before which the Data Subject can exercise their rights. Phone: 2125758, Email: fflor@acp.com.co.

10. Procedures to exercise the rights of the Data Subject

10.1. Right of access to inquiry

According to Article 21 of Decree 1377 of 2013, the Data Subject may consult their personal data free of charge in two cases:

1. At least once every calendar month.

2. Each time there are substantial modifications to the information processing policies that motivate new inquiries.

For inquiries whose frequency is greater than one per calendar month, COLOMBIAN PETROLEUM ASSOCIATION, they may only charge the Data Subject for the costs of shipping, reproduction, and, if applicable, certification of documents. The reproduction costs may not exceed the costs of recovering the corresponding material. For this purpose, the responsible party must demonstrate to the Superintendence of Industry and Commerce, when required, the support for such expenses.

The Data Subject can exercise the right of access or inquiry of their data by means of a written request addressed to COLOMBIAN PETROLEUM ASSOCIATION, sent via email to fflor@acp.com.co, indicating in the Subject «Exercise of the right of access or inquiry,» or through postal mail sent to CR 7 73 47 P 12 Bogotá, Capital District – Colombia. The request must contain the following information:

• Name and surname of the Data Subject.

• Copy of the Data Subject's Citizenship Card and, if applicable, of the person representing them, as well as the document proving such representation.

• Request specifying the request for access or inquiry.

• Address for notifications, date, and signature of the applicant.

• Supporting documents for the request made, when applicable.

The Holder may choose one of the following ways to consult the database to receive the requested information:

• On-screen display.

• In writing, with a copy or photocopy sent by certified or non-certified mail.

• Fax.

• Email or other electronic means.

• Another system suitable for the configuration of the database or the nature of the processing, offered by COLOMBIAN PETROLEUM ASSOCIATION.

Once the request is received, COLOMBIAN PETROLEUM ASSOCIATION it will resolve the consultation request within a maximum period of ten (10) business days from the date of receipt. When it is not possible to attend to the consultation within this term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their consultation will be addressed, which in no case may exceed five (5) business days following the expiration of the first term. These deadlines are set forth in Article 14 of the LEPD.

Once the consultation process is exhausted, the Holder or beneficiary may file a complaint with the Superintendence of Industry and Commerce.

10.2. Rights of complaints and claims

The data Holder may exercise the rights of complaint regarding their data by means of a written request addressed to COLOMBIAN PETROLEUM ASSOCIATION, sent via email to fflor@acp.com.co, indicating in the Subject «Exercise of the right of access or inquiry,» or through postal mail sent to CR 7 73 47 P 12 Bogotá, Capital District – Colombia, the request must contain the following information:

• Name and surname of the Data Subject.

• Copy of the Data Subject's Citizenship Card and, if applicable, of the person representing them, as well as the document proving such representation.

• Description of the facts and request that specifies the request for correction, deletion, revocation, or inflation.

• Address for notifications, date, and signature of the applicant.

• Supporting documents for the request made that are to be asserted, when applicable.

If the complaint is incomplete, the interested party will be required within five (5) days following the receipt of the complaint to correct the deficiencies. After two (2) months from the date of the requirement, without the applicant presenting the required information, it will be understood that they have withdrawn the complaint.

Once the complete complaint is received, a legend stating “complaint in process” and the reason for it will be included in the database, within a period not exceeding two (2) business days. This legend must be maintained until the complaint is resolved.

COLOMBIAN PETROLEUM ASSOCIATION, it will resolve the consultation request within a maximum period of fifteen (15) business days from the date of receipt. When it is not possible to attend to the complaint within this term, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

Once the complaint process is exhausted, the Holder or beneficiary may file a complaint with the Superintendence of Industry and Commerce.

11. Security measures

COLOMBIAN PETROLEUM ASSOCIATION, In order to comply with the security principle enshrined in article 4 literal g) of the LEPD, it has implemented the necessary technical, human, and administrative measures to ensure the security of records, preventing their alteration, loss, consultation, use, or unauthorized or fraudulent access.

On the other hand, COLOMBIAN PETROLEUM ASSOCIATION, by signing the corresponding transmission contracts, it has required the data processors it works with to implement the necessary security measures to ensure the security and confidentiality of the information in the processing of personal data.

The security measures implemented by the NAME OF THE INSTITUTION OR COMPANY are outlined and developed in its Internal Security Manual (Tables II, III, IV, and V).

Table 2. Common security measures for all types of data (public, semi-private, private, sensitive) and databases (automated, non-automated)

Document and media management

1. Measures to prevent unauthorized access or recovery of data that has been discarded, deleted, or destroyed.
2. Restricted access to the location where the data is stored.
3. Authorization from the responsible party for the exit of documents or media by physical or electronic means.
4. Labeling or identification system for the type of information.
5. Inventory of media.

Access control

1. User access limited to the data necessary for the performance of their functions.
2. Updated list of users and authorized accesses.
3. Mechanisms to prevent access to data with rights other than those authorized.
4. Granting, alteration, or cancellation of permissions by authorized personnel.

Incidents

1. Incident log: type of incident, time it occurred, notifier, recipient of the notification, effects, and corrective measures.
2. Incident notification and management procedure.

Personnel

1. Definition of the functions and obligations of users with access to the data.
2. Definition of the control functions and authorizations delegated by the data controller.
3. Dissemination among staff of the rules and the consequences of non-compliance with them.

Internal security manual

1. Development and implementation of the mandatory manual for staff.
2. Minimum content: scope of application, security measures and procedures, functions and obligations of staff, description of databases, incident handling procedure, data backup and recovery procedure, security measures for transport, destruction and reuse of documents, identification of data processors.

Table 3. Common security measures for all types of data (public, semi-private, private, sensitive) according to the type of databases

Non-automated databases: Archive

1. Archiving documentation following procedures that ensure proper preservation, location, and consultation and allow the exercise of the rights of the Data Subjects.

Non-automated databases: Document storage

1. Storage devices with mechanisms that prevent access to unauthorized persons.

Non-automated databases: Document custody

1. Duty of diligence and custody of the person in charge of documents during their review or processing.

Automated databases: Identification and authentication

1. Personalized identification of users to access information systems and verification of their authorization.
2. Identification and authentication mechanisms; Passwords: assignment, expiration, and encrypted storage.

Automated databases: Telecommunications

1. Access to data through secure networks.

Table 4. Security measures for private data according to the type of databases

Automated and non-automated databases: Audit

1. Ordinary audit (internal or external) every two months.
2. Extraordinary audit for substantial modifications in information systems.
3. Report on the detection of deficiencies and proposal for corrections.
4. Analysis and conclusions from the security officer and the data processing officer.
5. Retention of the report available to the authority.

Automated and non-automated databases: Security officer

1. Designation of one or more security officers.
2. Designation of one or more persons in charge of controlling and coordinating the measures of the Internal Security Manual.
3. Prohibition of delegating the responsibility of the data processing officer to the security officer.

Automated and non-automated databases: Internal Security Manual

1. Periodic compliance checks.

Non-automated databases: Document and media management

1. Record of entry and exit of documents and media: date, sender and receiver, number, type of information, method of delivery, person responsible for receipt or delivery.

Non-automated databases: Access control

1. Access control to the location or locations where the information systems are located.

Non-automated databases: Identification and authentication

1. Mechanism that limits the number of repeated attempts of unauthorized access.

Non-automated databases: Incidents

1. Record of data recovery procedures, person executing them, restored data, and manually recorded data.
2. Authorization from the data processing officer for the execution of recovery procedures.

Table 5. Security measures for sensitive data according to the type of databases

Non-automated databases: Access control

1. Access only for authorized personnel.
2. Access identification mechanism.
3. Log of unauthorized user accesses.

Non-automated databases: Document storage

1. File cabinets, lockers, or others located in areas with access protected by keys or other measures.

Non-automated databases: Copy or reproduction

1. Only by authorized users.
2. Destruction that prevents access or recovery of the data.

Non-automated databases: Transfer of documentation

1. Measures that prevent access or manipulation of documents.

Automated databases: Document and media management

1. Confidential labeling system.
2. Data encryption.
3. Encryption of portable devices when taken outside.

Automated databases: Access control

1. Access log: user, time, database accessed, type of access, record accessed.
2. Control of the access log by the security officer. Monthly report.
3. Data retention: 2 years.

Automated databases: Telecommunications

1. Data transmission via encrypted electronic networks.

Transfer of data to third countries.

According to Title VIII of the LEPD, the transfer of personal data to countries that do not provide adequate levels of data protection is prohibited. It is understood that a country offers an adequate level of data protection when it meets the standards set by the Superintendence of Industry and Commerce on the matter, which in no case may be lower than those required by this law for its recipients. This prohibition shall not apply when it concerns:

• Information for which the Data Subject has given their express and unequivocal consent for the transfer.

• Exchange of medical data, when required by the treatment of the Data Subject for reasons of health or public hygiene.

• Bank or stock transfers, in accordance with the applicable legislation.

• Transfers agreed upon within the framework of international treaties in which the Republic of Colombia is a party, based on the principle of reciprocity.

• Transfers necessary for the execution of a contract between the Data Subject and the data controller, or for the execution of pre-contractual measures provided that the Data Subject's authorization is obtained.

• Transfers legally required for the safeguarding of the public interest, or for the recognition, exercise, or defense of a right in a judicial process.

In cases not contemplated as exceptions, it will be the responsibility of the Superintendence of Industry and Commerce to issue the declaration of conformity regarding the international transfer of personal data. The Superintendent is authorized to request information and carry out the procedures aimed at establishing compliance with the requirements necessary for the viability of the operation.

International transmissions of personal data carried out between a data controller and a data processor to allow the processor to carry out the processing on behalf of the controller will not require informing the Data Subject or obtaining their consent, provided that there is a data transmission contract.

13. Validity

The databases under the responsibility of COLOMBIAN PETROLEUM ASSOCIATION, will be subject to processing for as long as is reasonable and necessary for the purpose for which the data is collected. Once the purpose or purposes of the processing have been fulfilled, and without prejudice to legal provisions to the contrary. COLOMBIAN PETROLEUM ASSOCIATION, the deletion of the personal data in its possession will proceed unless there is a legal or contractual obligation requiring its retention. For all these reasons, this database has been created without a defined validity period.