PRIVACY AND PERSONAL DATA PROCESSING POLICY

Version May 1, 2023

Serdale S.A.S. (“Tarkus Pharma Lab”), aware of the importance of personal data and the responsibility it has acquired towards the owners of the personal information it processes (the “Owners” or the “Data Subject”), makes available to the interested parties, the Personal Data Processing Policy (the “Data Processing Policy” or the “Policy”), in compliance with the provisions of Law 1581 of 2012, Decree 1074 of 2015 and other provisions that modify, add or complement them.

 

I. DEFINITIONS

For interpretative purposes and to provide greater understanding of the Data Processing Policy, the following definitions are adopted:

Authorization: is the prior, express and informed consent addressed to the data controller and issued by the Data Subject to carry out the processing of his/her personal data.

Databases: is the organized set of personal data that is subject to processing.

Collaborator: any natural person with whom Tarkus Pharma Lab has a valid work contract in accordance with the applicable regulations.

Personal data: any information linked or that can be associated to one or several determined or determinable natural persons.

Private data: all personal data that due to its intimate or reserved nature is only relevant to the Data Subject.

Public data: all personal data concerning a general interest, such as data relating to the marital status of individuals, their profession or trade and their status as merchants or public servants. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, and duly executed judicial decisions that are not subject to confidentiality.

Semi-private data: all personal data that are not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to the Data Subject but also to a certain sector or society in general.

Sensitive data: all personal data that affect the privacy of the Data Subject or whose improper use may lead to discrimination.

Data processor: is the natural or legal person, public or private, who by himself or in association with others, performs the processing of personal data on behalf of the controller of personal data.

Data controller: natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the processing of personal data. Tarkus Pharma Lab is who, for the purposes of this Policy, will be responsible for personal data in the terms established in Law 1581 of 2012.

Company name: Serdale S.A.S. Address: Calle 81 # 11- 08, We Work 81 building, 5th floor, office 127. Bogotá D.C. NIT: 901235469-8 E-mail: info@tarkuslab.com

Data subject: is the natural person whose personal data are subject to processing and are part of the databases of Tarkus Pharma Lab.

Transfer: the transfer of personal data takes place when the person responsible and/or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is responsible for the processing and is located inside or outside the country.

Transmission: processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when the purpose is the performance of a processing operation by the processor on behalf of the data controller.

Processing: any operation or set of operations carried out by the controller or processor on personal data, such as collection, storage, use, circulation or deletion.

 

II. REGULATORY FRAMEWORK

For those situations not regulated by the Data Processing Policy, the provisions of the following shall apply:

– Article 15 of the Political Constitution of Colombia.

– Statutory Law 1266 of 2008.

– Law 1273 of 2009.

– Statutory Law 1581 of 2012.

– Decree 1377 of 2013.

– Decree 886 of 2014.

– Decree 1074 of 2015.

 

III. PURPOSE

The purpose of this Data Processing Policy is to regulate all activities related to the processing to which the personal data of the Data Controllers will be submitted, mainly in relation to the purpose of the processing, the rights of the Data Controllers, the commitments acquired by Tarkus Pharma Lab with the Data Controllers in its capacity as data controller and the tools adopted so that the Data Controllers may adequately exercise their rights.

All collaborators, contractors, allies and third parties that have a relationship with Tarkus Pharma Lab and that for the purposes of the provisions of this Policy have the status of data processors must comply with the provisions of this Policy.

 

IV. GUIDING PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

For the adequate treatment of personal data, in all acts performed by Tarkus Pharma Lab on the personal data of the Data Controllers, as well as in the interpretation and execution of this Policy, the following principles shall be observed:

Principle of legality: during all stages and activities of information processing by Tarkus Pharma Lab or whoever it designates as data processor, the rules described in section II and all those that regulate, add, modify or delete them shall be applied, in addition to the provisions of this Policy.

Principle of purpose: Tarkus Pharma Lab will process personal data for a legitimate purpose in accordance with the Constitution and the law, which must be informed to the Data Subject.

Principle of freedom: the processing activities to which the personal data governed by this Policy will be subjected will be executed only when the Holder has issued, previously or expressly, authorization for that purpose, except for those that, under the provisions of Article 10 of Law 1581 of 2012, do not require authorization from the holder.

Principle of truthfulness or quality: Tarkus Pharma Lab is committed with the Holders of the information that makes up its database, to ensure that it is truthful, complete, accurate, current, verifiable and understandable, consequently, it will refrain from processing partial, incomplete, fractioned or misleading data.

Principle of transparency: Tarkus Pharma Lab has adopted the appropriate mechanisms to ensure that the Data Subject can obtain, at any time and without restrictions, information about the existence of personal data concerning him/her.

Principle of restricted access and circulation: Access to the information contained in the databases is restricted to the exclusive use of specialized personnel previously trained to handle this type of information. With the exception of public information, Tarkus Pharma Lab will not make personal data available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties in accordance with Law 1581 of 2012.

Security Principle: Tarkus Pharma Lab has adopted a series of technical, human and administrative measures, according to the nature of the personal data being processed, to prevent them from being adulterated, lost, consulted, used or accessed by unauthorized personnel.

Principle of confidentiality: All persons involved in the processing of personal data will keep such information confidential, even after the end of the processing work, or their contractual relationship with Tarkus Pharma Lab.

 

V. PERSONAL DATA SUBJECT TO PROCESSING

In order to comply with the purposes described in this Policy, Tarkus Pharma Lab will process the following data:

– Identification data: information that makes it possible to identify one Data Subject from another. These data include: name and surname, autographic signature, electronic signature, copy of the document that proves your identity (citizenship card, foreigner’s identity card).

– Contact data: information that allows to maintain contact with the Holder. This data includes e-mail, telephone and address.

– Patrimonial or financial data: information related to the assets or rights of the Holder, credit history, etc.

– Electronic records: includes information about access credentials to the website and/or application for mobile devices, IP address, browser type and information about the Holder’s activity and preferences.

– Data necessary for the fulfillment of legal, commercial or contractual obligations.

 

VI. AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

The personal data processing activities regulated by this Policy will be carried out exclusively on personal data whose Owners have given their express and informed prior authorization.

Notwithstanding the foregoing, Tarkus Pharma Lab reserves the right to carry out processing activities on information whose authorization is not required by virtue of the legal provisions that regulate the matter, in which case the commitments of Tarkus Pharma Lab as data controller before the Data Controllers continue to be in force, as established in this Policy.

For the pertinent effects, it is important to highlight that Tarkus Pharma Lab may use any of the following modalities to obtain the personal data subject to treatment:

Data collected directly by Tarkus Pharma Lab

In general, Tarkus Pharma Lab collects personal data directly from the Data Subject. Tarkus Pharma Lab will obtain the authorization through different means, among them, physical or electronic documents, data messages, Internet, Web Sites, or any other format that in any case allows obtaining the consent through unequivocal conducts through which it is concluded that if the consent had not been given by the Holder, the personal data would not have been stored in Tarkus Pharma Lab’s databases. Authorization will be requested by Tarkus Pharma Lab prior to the processing of personal data.

Tarkus Pharma Lab will keep the proof of the authorization, for which it will use the mechanisms currently available and will take the necessary actions to keep the record of the form and date in which it was obtained. Consequently, Tarkus Pharma Lab may establish physical files or electronic repositories made directly or through third parties hired for such purpose.

Additionally, Tarkus Pharma Lab will be able to collect, save and process information about the devices on which the Holder accesses the web page, the cell phone, the Internet browser used, as well as the behavior of the Holder. Tarkus Pharma Lab makes available to the Holders all the information about the cookies used to obtain this information, in the Cookies Policy.

 

Data provided by third parties

In addition to the personal data collected directly from the Holder, Tarkus Pharma Lab may obtain personal data from databases provided by third parties, who must have previously obtained authorization from the Holders, such as commercial allies, service providers, credit information centers, among others.

 

VII. LEVEL OF INTERVENTION

For all legal purposes related to the processing of personal data and in accordance with the provisions of this Policy and Law 1581 of 2012, Tarkus Pharma Lab is considered responsible for the processing of personal information. By virtue of the foregoing, Tarkus Pharma Lab decides on the treatment to which the personal data that make up the databases will be subjected, and is the one who executes the processing activities in accordance with this Policy.

Notwithstanding the foregoing, Tarkus Pharma Lab reserves the right to delegate certain processing activities to third parties to be carried out on its behalf, in which case the latter must comply with the commitments set forth in this Policy.

 

VIII. PURPOSE AND PROCESSING ACTIVITIES

The processing of personal data will be carried out within the legal framework that regulates the matter, in order to comply with the corporate purpose of Tarkus Pharma Lab. To this extent, the Holders by accepting this Policy authorize Tarkus Pharma Lab to collect and process personal data for the following purposes:

– To provide personalized advice for the search and acquisition of real estate.

– Perform statistical analysis and market research.

– Conduct surveys related to the services or goods offered by Tarkus Pharma Lab.

– Manage customer service attention.

– Recording of all incoming and outgoing telephone calls between the Holder and Tarkus Pharma Lab , for purposes of verification of the quality of service and for security purposes.

– To send and disseminate advertising information (“Advertising Information”) related to commercial offers of new and used properties, information about project launches, activities, news, contents by area of interest, products and other services offered by Tarkus Pharma Lab.

– To elaborate profiles of the users accessing the platform in order to evaluate some personal aspects of the Registrants such as interests, preferences, behaviors or location, and thus provide a better service according to their preferences and needs.

– Manage users’ accounts and profiles on the website and mobile application.

– To share the Holder’s personal data with builders, developers and/or real estate companies with which Tarkus Pharma Lab has commercial agreements, so that they in turn can contact the Holders and manage the process of acquiring the property.

– Share the personal data of the Holder with financial institutions in those cases in which the Holder wishes to hire a service with them, aimed at the acquisition of a property.

– Transfer the personal data of the Holder, to third parties, suppliers of goods or services, and commercial allies of Tarkus Pharma Lab, as necessary for the purposes of compliance with the obligations arising from existing relationships with the Holders.

– Comply with the obligations of prevention of money laundering and financing of terrorism.

– Access and consult personal data in credit and financial information centers, and collect relevant information on credit behavior. For the processing of personal data in accordance with this purpose, Tarkus Pharma Lab will expressly inform the user about such processing.

– To make inquiries about criminal, judicial, commercial and financial background in public or private lists.

– To meet the requirements of control and surveillance agencies.

– Other activities related to the development of Tarkus Pharma Lab’s corporate purpose and resulting from the development of the relationship with the Holder.

The Holder may contact Tarkus Pharma Lab at any time to reject receiving Advertising Information. The fact that the Holder decides not to receive Advertising Information will not affect the possibility of accessing the services offered by Tarkus Pharma Lab.

 

IX. TREATMENT OF SENSITIVE PERSONAL DATA

Tarkus Pharma Lab will not treat sensitive data unless it is strictly necessary. In these cases, Tarkus Pharma Lab will adopt the necessary measures to ensure the protection of the rights of the Data Subject and will also reinforce the compliance with the principles that regulate the treatment of personal data, established in numeral IV of this Policy. For the treatment of sensitive data Tarkus Pharma Lab will be obliged in accordance with the provisions of articles 5 and 6 of Law 1581 of 2012.

 

X. PROCESSING OF MINORS’ DATA

As a general rule, in the execution of any personal data processing activity, Tarkus Pharma Lab will refrain from processing data whose Data Subject is a minor, in light of the provisions of Article 7 of Law 1581 of 2012.

Exceptionally, Tarkus Pharma Lab will require to submit to treatment personal data of minors, when this occurs, Tarkus Pharma Lab will submit the treatment of data of this nature to the following rules:

– Respect for the best interest of the minor Data Subject.

– Respect for the fundamental rights of the minor Data Subject.

– Authorization issued by the legal representative of the minor Data Subject.

 

XI. NATIONAL OR INTERNATIONAL TRANSMISSION AND/OR TRANSFER

Tarkus Pharma Lab may transfer and transmit personal data of the Data Subject to third parties with whom it has a commercial relationship in order to ensure the development of the purposes described in this Policy.

By way of example but not limited to, Tarkus Pharma Lab may transmit and/or transfer personal data to:

– Service or product providers with whom Tarkus Pharma Lab has a contractual relationship.

– Commercial allies with which Tarkus Pharma Lab has a collaboration or alliance relationship.

– Companies of the “Tarkus Pharma Lab Group” which are companies that belong to the corporate group and operate under the same processes and internal policies.

– Developers, construction companies, real estate companies, owners of the properties and/or real estate projects promoted through the platform, who in turn may communicate with the Holder in order to manage the process of acquiring the property.

– Financial entities that offer services for which the Holder has expressed interest in acquiring.

– Public authorities.

As these companies may be located outside Colombia, these transfers may involve an international transfer of personal data.

Tarkus Pharma Lab will adopt the necessary measures so that third parties that have access to the personal data of the Holders comply with the present Policy and with the principles of personal data protection and obligations established in the regulations in force. Notwithstanding the above, Tarkus Pharma Lab will not be responsible for the improper use of personal information made by any third party when these third parties are the ones who directly collect and/or treat the personal information of the Holders as responsible for its treatment.

 

XII.DURATION OF PROCESSING AND STORAGE OF PERSONAL DATA

As a general rule, Tarkus Pharma Lab will process personal data for as long as it is necessary for the maintenance of an appropriate commercial, labor or civil relationship with the Data Subject, and to fulfill the purpose for which it was collected, to comply with regulatory or legal requirements or during the period of legal prescription against possible legal or contractual liabilities.

 

XIII. THIRD PARTY OBLIGATIONS

Tarkus Pharma Lab has suppliers of products and services and commercial allies for the fulfillment of its corporate purpose and therefore may delegate the performance of certain activities related to the processing of personal data to these third parties who will act as data processors or responsible parties according to the nature of the relationship. In this sense, each of the third parties in charge and responsible for the processing of personal data that are part of the databases of Tarkus Pharma Lab, undertake to:

– Strictly comply with the principles and obligations contained in the Data Processing Policy.

– Comply with the applicable regulatory framework on data protection, especially the obligations contained in Law 1581 of 2012 and Decree 1377 of 2013 in accordance with the processing of personal data they perform.

– In the case of data processors, process the data in accordance with the instructions of the data controller.

– Keep the personal data under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

– Timely update, rectify or delete data when required by Tarkus Pharma Lab or directly by the Data Subject.

– Assist Tarkus Pharma Lab as data controller in the responses to the exercise of those described in paragraph XIV of the Policy.

– Adopt data processing policies that ensure the proper treatment of personal data.

– To provide personal data treatment policies to Tarkus Pharma Lab as data controller.

– Ensure that all human resources involved in the provision of services according to the business relationship with Tarkus Pharma Lab, know the security and confidentiality obligations that correspond to them in accordance with current regulations.

– Not to communicate the data to third parties, except with the express authorization of Tarkus Pharma Lab , in the legally admissible cases.

– In the case of information subject to controversy before an administrative or judicial authority, or which is the subject of a claim by the Holder, or whose blocking has been ordered by the competent authority; take all appropriate measures to prevent such information from continuing to be processed, except in relation to the storage of this, until a substantive decision is taken.

– To notify Tarkus Pharma Lab without undue delay, about the violations of the security of personal data under its responsibility of which it becomes aware, together with all relevant information for the documentation and communication of the incident.

– Inform the Superintendent delegated for the Protection of Personal Data, or whoever takes his place, when there are violations to the security codes and there are risks in the administration of the information of the Holders.

Tarkus Pharma Lab may request third parties to prove compliance with the regulations in force, obligations described in this Policy, as well as those stipulated in the contracts it has with each of the third parties.

 

XIV. RIGHTS OF THE OWNERS

Tarkus Pharma Lab , in its commitment to respect the interests of the Holders of the personal data submitted to its treatment and, aware of the importance of the due treatment of personal data, recognizes that the Holders may exercise the following rights free of charge:

Knowledge: by virtue of this right, the Data Holder is entitled to request, at any time and free of charge, information about the data about him/her being handled by Tarkus Pharma Lab , and the use given to such data.

Rectification: power recognized to the owner of the data to request, at any time, the correction of inaccurate information contained in the databases of Tarkus Pharma Lab.

Updating: power of the holder of the personal data to request that, for reasons other than the correction of data, the information contained in the databases of Tarkus Pharma Lab, is complete and updated, in this order of ideas, may request the entry or deletion of all types of information it deems appropriate.

Request a copy of authorization: when, in accordance with the provisions of articles 9 and 10 of Law 1581 of 2012, it is required to obtain authorization from the Data Controller so that their data are subject to processing activities, the Data Controller shall be entitled to request, at any time and free of charge, a copy of the authorization issued by the Data Controller.

To revoke the authorization: when, in accordance with the provisions of articles 9 and 10 of Law 1581, it is required to obtain authorization from the Data Controller so that his/her data may be subject to processing activities, he/she shall be entitled to revoke, at any time, the authorization issued.

File complaints: the Data Subject, when he/she evidences an illegal treatment of his/her personal data by the company, may file complaints before the Superintendence of Industry and Commerce of Colombia.

Suppression: by virtue of this right, the Holder may request Tarkus Pharma Lab at any time, the suppression of the data contained in the databases of Tarkus Pharma Lab, provided that there is no legal or contractual duty to remain in it.

 

XV. PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF THE DATA OWNERS

In order to exercise the rights mentioned in numeral XIII of this Policy, the Holder of the personal data may contact Tarkus Pharma Lab by e-mail at info@tarkuslab.com or at the address Calle 81 # 11- 08, We Work 81 building, 5th floor, office 127. Bogotá D.C. Inquiries For the exercise of the rights of knowledge, access to information and request for a copy of the authorization, Tarkus Pharma Lab will respond within ten (10) working days from the date of receipt of the same. When it is not possible to answer the consultation within the term indicated above, the applicant will be informed indicating the reasons for the delay and the date on which the request will be resolved, a date that in no case will exceed five (5) business days following the expiration of the first term.

 

Petitions or claims For the exercise of the rights of rectification, updating, revocation of authorization and deletion of information, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, or the rule that replaces or supplements it, the Holders or the persons entitled in accordance with the provisions of paragraph XV of this Policy, may submit their petitions, under the observance of the following rules:

Petitions shall be raised by written request briefly describing the facts that motivate the request, the correspondence address, identification data, attaching the documents that support their request and that prove their legitimacy to act, when the person submitting the request is not the Data Subject.

Incomplete request: when Tarkus Pharma Lab considers that the request submitted by the Data Subject or by whoever is authorized to do so, is incomplete due to lack of the requirements set forth in the previous paragraph, it will require, within five (5) days following the receipt of the request, the interested party to correct the faults.

After two (2) months from the date of the requirement by Tarkus Pharma Lab to the interested party, without the latter submitting the requested information, it will be understood that the claim has been abandoned, without prejudice to the possibility of submitting a new petition in the same sense, in which case the terms to resolve will begin to be counted from the new petition.

Complete request: Once the complete claim has been received or the defects have been corrected within the term established in the previous paragraph, Tarkus Pharma Lab will give an answer within fifteen (15) working days from the date of receipt of the claim or from the date on which the request was corrected. When it is not possible to attend the request within the term indicated above, the Holder will be informed about such situation, the reasons for the delay and the date in which the request will be solved, date that in no case will exceed eight (8) working days following the expiration of the first term.

Decision The data protection area of the Legal Department of Tarkus Pharma Lab will respond to the requests of the Data Controllers, within the terms established in the previous section, in writing to the physical or electronic address provided by the applicant for such purpose.

When the applicant provides a physical and an electronic address, or more than one of these addresses, Tarkus Pharma Lab will decide to which address to send the answer to the consultation or request.

 

XVI. LEGITIMACY

The data subject, his or her successors in title and the persons authorized by him or her are entitled to exercise the rights set forth in numeral XIII and the others recognized by law; in the last two cases, the quality whose recognition is requested must be accredited through suitable mechanisms.

 

XVII. VALIDITY

This Policy is effective as of the date of its publication and will be in force during the time that Tarkus Pharma Lab executes the purposes described in this document and may be modified at any time in order to adapt it to new practices that may be developed, new legislation or jurisprudence on the matter. Any update will be made available to the Holders at www.tarkuslab.com/politicas-tratamiento-datos , or by any other means considered pertinent, indicating the effective date of the corresponding modification or update, as the case may be.

 

XVIII. NATIONAL DATA PROTECTION AUTHORITY

Tarkus Pharma Lab, watching over the effective protection of the personal data of the Holders, makes available to the general public, information related to the Delegation for the Protection of Personal Data, competent authority at national level that exercises surveillance over the processing activities developed in the national territory, which may be consulted at the following link https://www.sic.gov.co/.