{"id":3334,"date":"2026-07-09T20:25:37","date_gmt":"2026-07-09T20:25:37","guid":{"rendered":"https:\/\/kreston.20sagencia.com\/personal-data-processing-policy\/"},"modified":"2026-08-11T20:27:23","modified_gmt":"2026-08-11T20:27:23","slug":"personal-data-processing-policy","status":"publish","type":"page","link":"https:\/\/kreston.20sagencia.com\/en\/personal-data-processing-policy\/","title":{"rendered":"Personal Data Processing Policy"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Personal Data Processing Policy<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

OBJECTIVE<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This policy aims to establish the guidelines for handling personal data of stakeholders with the intention of complying with Colombian legislation and safeguarding the good name of the Firm and its associates.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

SCOPE<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This policy applies to all stakeholders of Kreston RM S.A. (employees, managers, partners, competitors, suppliers, contractors, allies, state entities, clients, visitors, the general community, others).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

DEFINITIONS<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Authorization: <\/b>Prior, express, and informed consent of the Data Subject to carry out the Processing of personal data.<\/p>

Data Subject’s Authorization: <\/b>For the purposes mentioned above, Kreston Colombia requires free, prior, express, and duly informed authorization from the data subjects. To this end, it has established suitable mechanisms, ensuring in each case that the granting of such authorization can be verified. This authorization may be in any medium, whether a physical document, electronic, or any format that guarantees its subsequent consultation through technical, technological tools and public information security developments on our website https:\/\/kreston.com.co\/contacto.php <\/p>

Privacy Notice: <\/b>Verbal or written communication generated by the controller, addressed to the Data Subject for the Processing of their personal data, through which they are informed about the existence of the information Processing policies that will apply to them, how to access them, and the purposes of the intended Processing of personal data.<\/p>

Database: <\/b>Organized set of personal data that is subject to Processing;<\/p>

National Assignment or Transfer of the Database: <\/b>Information related to the national assignment or transfer of data includes the identification of the assignee, who will be considered responsible for the processing of the assigned database from the moment the assignment is perfected. It is not mandatory for the assignor to register the assignment of the database. However, the assignee, as the data controller, must comply with the registration of the database that has been assigned to them. <\/p>

Personal Data: <\/b>Any information linked or that can be associated with one or more individuals.<\/p>

Public Data: <\/b>Data that is not semi-private, private, or sensitive. Public data includes, among others, data related to the civil status of individuals, their profession or trade, and their status as a merchant or public servant. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial sentences that are not subject to confidentiality. <\/p>

Sensitive Data: <\/b>Those that affect the Data Subject’s privacy or whose improper use may lead to discrimination, such as those revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations, or those promoting the interests of any political party or guaranteeing the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.<\/p>

Data of Minors: <\/b>The provision of personal data of minors is optional and must be done with the authorization of the parents or legal representatives of the minor.<\/p>

Data Processor: <\/b>Natural or legal person, public or private, who by themselves or in association with others, performs the Processing of personal data on behalf of the Data Controller.<\/p>

Information stored in the database: <\/b>This refers to the classification of personal data stored in each database, grouped by categories and subcategories, according to their nature.<\/p>

Information Security Measures: <\/b>Corresponds to the controls implemented by the data controller to guarantee the security of the databases being registered, taking into account the questions provided for this purpose in the RNBD.<\/p>

Origin of Personal Data: <\/b>The origin of the data refers to whether it is collected from the data subject or provided by third parties, and whether there is authorization for processing or if there is a cause for exemption, in accordance with Article 10 of Law 1581 of 2012.<\/p>

Data Controller: <\/b>Natural or legal person, public or private, who by themselves or in association with others, decides on the database and\/or the Processing of data.<\/p>

Data Subject: <\/b>Natural person whose personal data is subject to Processing.<\/p>

Processing: <\/b>Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.<\/p>

Transfer: <\/b>Data transfer occurs when the Data Controller and\/or Data Processor of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is a Data Controller and is located inside or outside the country.<\/p>

Transmission<\/b>: Processing of personal data that implies the communication of such data within or outside the territory of the Republic of Colombia when its purpose is to carry out Processing by the Processor on behalf of the controller.<\/p>

International Transfer of Personal Data: <\/b>Includes the identification of the recipient as the data controller, the country where it is located, and whether the operation is covered by a declaration of conformity issued by the Delegation for the Protection of Personal Data of the SIC or by an exception clause in the terms indicated in Article 26 of Law 1581 of 2012.<\/p>

International Transmission of Personal Data: <\/b>Includes the identification of the recipient as the Data Processor, the country where it is located, whether there is a data transmission contract in the terms indicated in Article 2.2.2.25.5.2 of Section 5 of Chapter 25 of Unique Decree 1074 of 2015, or if the operation is covered by a declaration of conformity issued by the Delegation for the Protection of Personal Data of the SIC.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

POLICY DESCRIPTION<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In compliance with Law 1581 of 2012, its Decrees 1377 of 2013, Decree 1074 of 2015, and Decree 1759 of 2016, and the circulars issued by the Superintendence of Industry and Commerce, Kreston RM SA. (Kreston Colombia) adopts the personal data processing policy for the collection, storage, use, circulation, and deletion of personal data. This policy will be informed to all data subjects whose data has been collected or will be obtained in the course of Kreston Colombia’s activities. <\/p>

The main purpose of this Policy is to inform Data Subjects of their rights, the procedures and mechanisms defined by Kreston Colombia to enforce those rights, and to make them aware of the scope and purpose of the Processing to which Personal Data will be subjected if the Data Subject grants their express and prior authorization. It also seeks to ensure that personal data is not disclosed and used by third parties without the prior, express, and free authorization of the data subject.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

REGULATORY FRAMEWORK OF THE POLICY<\/h3>\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t