LITTIO PERSONAL DATA TREATMENT POLICY
1. Objective
Selenio S.A.S., a company established and existing in accordance with the laws of the Republic of Colombia, with its principal office in the city of Bogotá D.C. and identified with NIT 901.551.748-2 (“Littio Colombia”), as an entity linked to Littio Inc., a company established and existing in accordance with the laws of the state of Delaware, USA, and its affiliated entities (“Littio”), is committed to protecting personal data and the privacy of the holders of personal data that Littio Colombia handles in the development of its corporate purpose.
Therefore, Littio Colombia presents this personal data processing policy (“Policy”) with the aim of establishing the criteria for the collection, storage, use, circulation, management, transfer, transmission, and deletion of personal data processed by Littio Colombia.
2. Scope of application
The guidelines and procedures contained in this Policy apply to the databases for which Littio Colombia is responsible and/or in charge, as well as to the data processors that it designates.
In accordance with the above, this Policy is mandatory and must be strictly observed by Littio Colombia and the appointed data processors for the purposes of processing. For this reason, such individuals will fully comply with the obligations set forth in Law 1581 of 2012, Decree 1074 of 2015, the Political Constitution, and other applicable regulations regarding personal data protection (the “Applicable Law”).
3. Principles
Littio Colombia structures this Policy following the principles applicable to the protection of personal data, which are established in Title II of Law 1581 of 2012 and are:
3.1 Principle of legality
The processing of personal data carried out by Littio Colombia will be subject to the regulations in force in the Republic of Colombia.
3.2 Principle of Purpose
The processing of personal data carried out by Littio Colombia must obey a legitimate purpose in accordance with the Constitution and the Law, which must be communicated to the data subject.
3.3 Principle of Freedom
The processing of personal data carried out by Littio Colombia may only be done with the prior, explicit, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.
3.4 Principle of truthfulness or quality
The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading personal data is prohibited.
3.5 Principle of Transparency
Littio Colombia will guarantee the right of information holders to obtain from the responsible party or the person in charge, as appropriate, at any time and without restrictions, information about the existence of the personal data that concerns them.
3.6 Principle of Restricted Access and Circulation
The processing that Littio Colombia performs on personal data is subject to the limits derived from the nature of the personal data, except for the exceptions expressly provided for in the Applicable Law. In this sense, the processing may only be carried out by persons authorized by the owner and/or by the persons provided for in the Applicable Law, except for the exceptions expressly provided for therein.
3.7 Security Principle
The personal data subject to processing by Littio Colombia must be handled with the necessary technical, human, and administrative measures to ensure the security of the records, preventing their alteration, loss, consultation, unauthorized use, or fraudulent access.
3.8 Confidentiality Principle
All persons involved in the processing of personal data that is not public in nature are obliged to ensure the confidentiality of the information, even after their relationship with any of the tasks involved in the processing has ended, being able to only supply or communicate personal data when it corresponds to the development of the activities authorized by the Applicable Law, except for the exceptions expressly enshrined therein.
4. Authorizations
The authorizations granted by the holders of the personal data will be collected by any of the means authorized by the Applicable Law and, in any case, under schemes that allow for their subsequent consultation.
The authorizations will be granted by the holder to Littio Colombia, or to whomever they designate, and, in such case, it will be understood that the holder guarantees that they have been informed of both this Policy and the rights that assist them in the context of the processing to which the personal data they provide are subject.
Littio Colombia will adopt the necessary measures to maintain records of the manner and time in which the corresponding authorization was obtained.
5. Treatment
Littio Colombia, as the data controller, collects, directly or indirectly, all or some of the personal data of the data subjects depending on their relationship with Littio Colombia, among others the following: (i) name, last names, and identification data, (ii) location and contact data (including, but not limited to physical addresses, non-institutional email addresses, and phone and mobile numbers), (iii) data related to gender and age, (iv) personal characteristics data, (v) social circumstances data, (vi) academic and professional data, (vii) employment data, (viii) transaction, financial or insurance data, (ix) date of birth, (x) interests, (xi) preferences, (xii) information related to how the data subject learned about Littio Colombia's products and/or services, (xiii) biometric data and those related to the image when required, (xiv) health data, (xv) and sensitive information of the data subject when necessary.
Littio Colombia may collect financial information for, among other purposes, materializing the payment relationship, establishing and maintaining a contractual or commercial relationship, whatever its nature, reporting to risk centers, as well as for evaluating the risks arising from an existing contractual relationship. The processing of such information will be carried out in accordance with applicable legislation regarding financial, commercial, and credit data (including, but not limited to Law 1266 of 2008, or those norms that modify, add, or repeal it).
Littio Colombia may report negative information about non-compliance with obligations of the personal data subjects who have given their authorization for such purposes. In any case, to carry out such reports, it will be required to communicate it to the data subject in advance.
The data subject acknowledges that the personal data provided will be used for the purposes of the celebration and/or execution of acts or contracts in which Littio Colombia, Littio and/or its allies participate, directly or indirectly, as appropriate. In accordance with the above, the data subject is fully aware that if they decide not to provide the personal data that are requested, all or part of the products or services subject to the acts or contracts, as applicable, cannot be delivered or rendered, as appropriate, nor can the information of interest be sent to them through the communication channels available for that purpose.
Littio Colombia will comply with the duty of confidentiality regarding the personal data of the data subject and will retain them for the time required to meet the purposes described in this Policy, until the data subject requests their deletion provided that there are no legal or contractual obligations to retain them.
6. Sensitive data and minors' information
In cases where Littio Colombia, or whoever it designates, requests and collects sensitive data, it will strictly observe the legal limitations on the processing of sensitive data, processing sensitive data only when the data subject has granted their authorization, except for the exceptions provided in the Applicable Law. Littio Colombia will inform the data subjects regarding the specific purposes for which such information will be used and will indicate the voluntary nature of their provision in accordance with the Applicable Law. No activity may be conditioned on the provision of sensitive data.
When processing personal data of minors in the context of activities carried out in accordance with the provisions of the Policy, the prevailing rights of minors will be taken into account, and in any case, the following will be guaranteed: (i) the processing will respond to and respect the best interests of minors, (ii) at all times, the fundamental rights of minors will be ensured, (iii) the minor will be heard, and their opinion will be valued taking into account their maturity, autonomy, and capacity to understand the matter.
7. Purposes
The processing of personal data subject to this Policy will be carried out in order to conduct the management for the development of the corporate purpose of Littio Colombia, as well as for the negotiation, execution, modification, or termination of related acts and/or contracts, and, in general, for the purposes indicated in the corresponding authorizations, as well as those listed below:
7.1 General
Carry out all necessary actions aimed at confirming and updating the information of the holders.
Carry out the preliminary discussions aimed at formalizing the relationship between the parties.
Negotiate, execute, modify, or terminate the acts and/or contracts entered into, as appropriate.
Contact for sending information related to the existing relationship between the parties as appropriate.
Know, store, and process all information provided in one or more databases, in the format deemed most convenient.
Creation of accounts and profiles on platforms or websites.
Consult, at any time, databases managed by credit bureaus or other operators, all relevant information to know the performance as a debtor, their payment capacity, the viability to establish or maintain a contractual relationship or any other purpose derived from the knowledge of this information.
Report to credit bureaus or other data operators on compliance or non-compliance with their credit obligations, their legal duties of patrimonial content, their location and contact, their credit requests, and others related to the commercial, financial, or socioeconomic relationships of the information holder.
Consult, directly or indirectly, databases, fraud prevention systems or risks such as money laundering and terrorist financing, liens, and others related with the purpose of identifying criminal, disciplinary, tax backgrounds, etc.
Submit reports to inspection, surveillance, and control authorities and respond timely to requests made by various administrative or judicial authorities.
Comply with internal policies.
Resolve PQRs, issue timely and corresponding responses, and allow the exercise of their rights as the holder of personal data.
Attend to requests and complaints submitted, as well as all types of procedures related to the parties and their interests.
Manage the administrative, accounting, tax, financial, operational, and logistical aspects associated with the compliance of obligations of both parties.
Carry out the transfers and/or transmissions of personal data required within the framework of corporate reorganization processes (including, but not limited to asset acquisitions and/or business establishment, mergers and/or splits, among others).
Perform activities of archiving, updating, storing, and processing information by Littio Colombia or through third parties hired for this purpose.
Protect the security of Littio Colombia's facilities (including, but not limited to the personnel and assets found therein).
Identify and control the registration of incoming and outgoing equipment, visitors, authorized personnel, and carry out other physical security activities.
Record and use recordings from closed-circuit television cameras or images, to carry out investigations or defenses and, in general, any measures required to safeguard the interests of Littio Colombia, Littio, or allies and/or related parties with them.
7.2 Individuals - Clients
Collect information for commercial and marketing research purposes.
Store the collected personal data to maintain a historical record of customer needs and preferences, create market segmentation, and conduct business prospecting.
Collect information through customer satisfaction surveys to improve service quality and generate a historical record of customer consumption preferences.
Verification of legal, technical, and financial requirements.
Resolve customer inquiries and complaints, issue timely and appropriate responses, and allow the exercise of their rights as data subjects.
Validate and verify the identity of the data subject for the offering and adequate provision of Littio’s products and services through any means or channel.
Access personal data contained in databases of third-party information operators of all types to: (a) carry out scoring, income validation tools, predictive income tools, tools to prevent fraud and impersonation, and in general, carry out adequate risk management, and (b) compare, contrast, and complement it with information available from credit information agencies and/or information database operators (including but not limited to financial and commercial information, among others).
Consult personal data in information agencies to know the performance as a debtor, payment capacity, or to assess risks associated with contracting products and/or services.
Other purposes aimed at developing the commercial relationship that are inherent to the nature of this type of relationship.
7.3 Users and visitors of the Littio website
Provide access to the Litito website and make it available to users and visitors.
Ensure the proper functioning of the website.
Continuously improve the experience of users and visitors, as well as the presentation, features, and functionalities of the website.
Remember the preferences of visitors and users.
Offer products and services, loyalty programs, promotions, and discounts.
Create profiles of users and visitors based on their consumption preferences, behavior, and activity on the website, on third-party websites linked to the website, and on search engines, application interfaces, social networks, and any other interface or functionality linked to the website.
Make geographic references to offer personalized content according to location.
Personalize the website and ads according to the tastes and interests of users and visitors based on the monitoring and tracking of their activity on the website, on third-party websites linked to the website, and on search engines, application interfaces, social networks, and any other interface or functionality linked to the website.
Record patterns of use and behavior and track, register, and trace the activity of users and visitors on the website, on third-party websites linked to the website, and on search engines, application interfaces, social networks, and any other interface or functionality linked to the website.
Monitor and ensure the proper use of the website by users and visitors and identify any attempt to violate security measures or technological protection measures of the website, misuse, fraud, or illegal activity through or on the website.
Carry out statistical analysis of the collected data to optimize the functioning of the website and analyze traffic on the website and on third-party pages and sites.
7.4 Individuals - Providers and Contractors
Contact the information holders in order to send or receive information related to the management of existing relationships between the parties.
Verification of legal, technical, and financial requirements.
Store the collected personal data, in order to keep a historical record of needs and preferences, create market segmentation, and carry out business prospecting.
Perform controls and collect information in order to prevent fraud and misuse of the information.
Others that aim to develop the business relationship and that are typical of the nature of this type of relationship.
7.5 Individuals - Candidates, employees, former employees, collaborators
Administration of contracts, management of active personnel, payroll administration and other payments, affiliations to the Comprehensive Social Security System and family compensation funds, payment of parafiscal contributions, affiliation to any type of benefit directly or indirectly related to the employment relationship (including, but not limited to health plans, life insurance, etc.), affiliation to individual or collective health policies, management of judicial embargoes through payroll, administration of salaries and extralegal benefits, conducting performance evaluations, coordinating professional development, allowing access to computer resources and assisting them in their use, planning business activities and, in general, complying with legal obligations and, in particular, with the obligations derived from the labor relationship.
Contact to send information related to the contractual and obligational relationship that may arise and, in particular, to execute the contract that binds the parties.
Comply with internal policies and the internal work regulations.
Carry out procedures such as issuing labor certifications and sending job offers and requesting all types of tests required for the performance of contracted tasks (including, but not limited to psychotechnical tests, language tests, technical knowledge tests, etc.).
Preserve, collect, and use recordings from closed-circuit television cameras in order to conduct investigations or disciplinary sanctions as appropriate.
Storage of résumés and notes in the employment history.
Transmit and/or transfer information to other Littio entities for the development of contractual relationships, benefit plans, among others.
Transmission of information to third parties responsible for processing for tasks such as payroll payment, offering benefit plans, among others.
Transmission of identification information to provide services at client premises and/or remotely on the equipment of the responsible party with which it develops its social object.
Develop different types of activities, training, and corporate wellness programs.
Directly identify or through local or international entities operations that may signify among others, frauds, abusive access to computer systems, illegitimate obstruction to computer systems, interception of data, computer damages, use of malicious software, violation of personal data, impersonation of websites.
Collect data through satisfaction surveys in order to improve service quality and to generate a historical record of preferences.
Attend to disciplinary procedures in accordance with regulations and internal rules.
Others that aim to develop the labor relationship and that are inherent to the nature of these types of relationships.
8. Transfer and Transmission
Littio Colombia may communicate, transmit, or transfer the personal data provided by the holders to third parties located inside or outside the national territory, in accordance with the provisions established in the Applicable Law. The personal information of the Holders may be communicated to Littio's companies, whether located inside or outside the country, to commercial establishments and business partners with whom there is a valid contractual relationship for the fulfillment of the purposes authorized by the holders, and to third parties who require the information for its processing according to the purposes contained in this Policy.
In particular, but not limited to this, Littio Colombia may carry out the transfer and/or transmission of the information, depending on its particular needs in each case, to third parties located in Colombia or abroad, not only to countries that have an adequate level of protection for personal data but also in all countries where Littio Colombia and/or the companies linked to Littio provide and/or offer their products and/or services at any time, and all those expressly authorized by the holders.
9. Cookies and third-party technologies
Littio Colombia may use cookies and other identification technologies on the platforms it manages and operates, on its website, electronic communications, advertisements, marketing, among other online services, with the purpose of understanding the online behaviors and interests of the individuals who interact with the online services offered by Littio Colombia (including, but not limited to user authentication, remembering user preferences and settings, determining content popularity, delivering and measuring the effectiveness of advertising campaigns, and analyzing the traffic of the corresponding channels and trends).
The owner of personal data can configure their browser to accept all cookies, reject them, or receive a notification when a cookie is sent.
Please note that if you choose to reject all cookies, the owner of personal data may not be able to effectively use some of the products, resources, and/or services offered by Littio Colombia.
The Littio website may contain mechanisms (including, but not limited to links, hyperlinks, hypertexts, and search tools, among others) that may lead the owner to other pages or platforms operated by third parties. Any processing of personal data carried out by third parties will be subject to the corresponding authorizations and policies.
In accordance with the above, Littio will not be responsible for the use, publication, disclosure and/or dissemination of personal data collected, used, published, disclosed and/or disseminated through third-party pages.
10. Rights of the holders
Your rights as a data subject are those provided for in the Applicable Law, especially the following:
Access free of charge to the data provided that have been processed.
Know, update and rectify your information regarding partial, inaccurate, incomplete, fragmented data, that induce error, or those whose processing is prohibited or has not been authorized.
Request proof of the authorization granted.
File complaints with the Superintendence of Industry and Commerce (“SIC”) for violations of the provisions of the Applicable Law.
Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual obligation preventing their elimination.
Refrain from answering questions about sensitive data.
*Responses regarding sensitive data or data of minors will be optional.
The exercise of these rights will be free and unlimited, and will be subject, in any case, to the legal provisions regulating their exercise. The exercise of these rights is personal to the data subject and, unless the exceptions expressly provided for in the Applicable Law, will be exercised exclusively by them.
11. Inquiries and complaints
The processing of personal data subject to this Policy will be carried out in order to conduct the management for the development of the corporate purpose of Littio Colombia, as well as for the negotiation, execution, modification, or termination of related acts and/or contracts, and, in general, for the purposes indicated in the corresponding authorizations, as well as those listed below:
11.1 Consultations
The holder of the personal data provided to Littio Colombia or the persons duly authorized for this purpose in accordance with the exceptions explicitly enshrined in the Applicable Law may make inquiries about their personal data through the channels stipulated in this Policy, for which the following shall be taken into account:
Littio Colombia will guarantee the right to inquire, providing all the information contained with the identification of the corresponding holder.
The inquiry must include: (i) the identification of the holder; (ii) the description of the matters subject to inquiry; and (iii) the physical or electronic address where they wish to receive notifications.
The inquiry will be addressed within a maximum term of 10 business days counted from the date of receipt of the same.
When it is not possible to address the inquiry within that term, this will be duly informed, stating the reasons for the delay and indicating the date on which the inquiry will be addressed, which in no case may exceed 5 business days following the expiration of the initial term.
11.2 Claims
The holder of the personal data provided to Littio Colombia or the persons duly authorized for this purpose in accordance with the exceptions expressly provided in the Applicable Law, who consider that the information contained in Littio Colombia's databases should be subject to correction, updating or deletion, or when they notice the alleged non-compliance with any of the duties contained in the exceptions expressly provided in the Applicable Law or this Policy, may submit a written complaint to Littio Colombia through the channels provided in the Policy, in accordance with the following instructions:
The complaint must include: (i) the identification of the holder; (ii) a description of the facts that give rise to the complaint; (iii) the physical or electronic address where notifications should be received; and (iv) the documents that support the facts of the complaint.
If the complaint is submitted incompletely, the applicant will be required within 5 business days following the receipt of the complaint to complete the complaint.
Two months after the date of the requirement, without the applicant presenting the required information, it will be understood that the complainant has withdrawn their claim.
Once the complete complaint is received, a note stating "complaint in process" and the reason for it will be included in the corresponding database, within no more than 2 business days counted from its receipt. This note must be maintained until the complaint is resolved.
The maximum term to address the complaint will be 15 business days counted from the day following the date of its receipt.
When it is not possible to address the complaint within that term, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which in no case may exceed 8 business days following the expiration of the first term.
11.3 Before the authority of personal data protection
It is recommended that the holder of personal data or third parties duly authorized by the Applicable Law, except for the exceptions expressly granted in the Applicable Law, exhaust the previous procedures with Littio Colombia prior to filing any complaint with the SIC.
12. Validity
This Policy has been in effect since January 27, 2022, and applies to all personal data collected, stored, used, transmitted, and transferred up to the date of its publication, and thereafter.
This Policy may be modified from time to time by Littio and will be part of the contracts that Littio enters into that involve the processing of personal data. Any substantial modification of this Policy must be communicated to the data subjects in advance through efficient mechanisms, such as Littio's website and/or emails. A substantial modification is understood to include, among other things, a change in the identification of the area, department, or person responsible for addressing inquiries and complaints.