Data Processing

SPEAL S.A.S., as a company in the industrial sector specialized in the design, manufacture, installation and maintenance of gas generating plants, water treatment systems and technological solutions for health and industry, recognizes the importance of ensuring the privacy, integrity and confidentiality of personal data processed in the development of its activities. This policy is formulated in compliance with Article 15 of the Political Constitution of Colombia, the Statutory Law 1581 of 2012, the Regulatory Decree 1377 of 2013, and other concordant rules on the protection of personal data.

The purpose of the policy is to establish the principles, guidelines and procedures that regulate the processing of personal data collected by SPEAL S.A.S., ensuring the full exercise of the fundamental right to habeas data by the owners, and compliance with legal and ethical duties by the company in its role as data controller.

OBJECTIVE

Define the general guidelines for the collection, storage, use, circulation, updating and deletion of personal data processed by SPEAL S.A.S. in the exercise of its business functions. 

SCOPE 

This policy applies to all databases containing personal data that are processed by SPEAL S.A.S., either as responsible or in charge, both in physical and digital media.

REGULATORY FRAMEWORK

This policy is based on:

  • Article 15 of the Political Constitution of Colombia
  • Law 1581 of 2012 - "Whereby general provisions are issued for the protection of personal data".
  • Decree 1377 of 2013 - "Whereby Law 1581 is partially regulated".
  • Decree 886 of 2014 - On the National Database Registry (RNBD).
  • Circulars, guides and guidelines issued by the Superintendency of Industry and Commerce (SIC).

TERMS AND DEFINITIONS

Authorization: Prior, express and informed consent of the holder to carry out the processing of personal data.

Database: Organized set of personal data that is subject to processing in accordance with the Law.

Files: Set of documents kept by the company containing personal information regulated by law.

Privacy notice: Document that informs the holder about the processing and how to exercise their rights.

Personal data: Any information linked or that can be associated to a determined or determinable natural person.

Sensitive data: Data that affect the privacy of the owner or whose improper use may lead to discrimination (e.g. ethnic origin, religious convictions, biometric data, health).

Data Processor: The natural or legal person who carries out the processing of personal data on behalf of the company.

Data controller: Natural or legal person who decides on the basis and processing of data.

Data subject: Natural person whose personal data is the object of processing.

Processing: Any operation on personal data such as collection, storage, use, circulation or deletion.

Transfer: Sending data to a third party abroad responsible for the processing.

Transmission: Communication of data to a person in charge inside or outside the country.

GUIDING PRINCIPLES APPLICABLE TO PERSONAL DATA.

The following guiding principles shall apply to the protection of personal data: 

  • Principle of legality in data processing: The processing referred to in the Habeas Data Law is a regulated activity that must be subject to the provisions set forth therein and in the other provisions that develop it.
  • Principle of purpose: The processing must obey a legitimate purpose in accordance with the Constitution and the law, which must be informed to the Data Subject.
  • Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves consent.
  • Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.
  • Principle of transparency: The right of the Data Subject to obtain from the Data Controller or Processor, at any time and without restriction, information about the existence of data concerning him/her, must be guaranteed in the processing.
  • Principle of restricted access and circulation: Processing is subject to the limits derived from the nature of the personal data, the provisions of the law and the Constitution. In this sense, the processing may only be carried out by persons authorized by the Data Controller and/or by the persons provided for by law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Data Controller or third parties authorized by law.
  • Security Principle: The information subject to processing by the Data Controller or Data Processor referred to in the Habeas Data Law, shall be handled with the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
  • Principle of confidentiality: All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks involved in the processing, and may only supply or communicate personal data when this corresponds to the development of the activities authorized by law and under the terms of the same.

RIGHTS OF THE OWNERS 

Personal data owners shall enjoy the following rights, and those granted to them by law: 

To know, update and rectify their personal data with respect to the data controller or data processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized; 

Request proof of the authorization granted to the data controller, except when expressly exempted as a requirement for the processing, in accordance with the provisions of Article 10 of the law; 

To be informed by the data controller or the data processor, upon request, regarding the use made of their personal data; 

To file before the Superintendence of Industry and Commerce complaints for violations to the provisions of the law and other regulations that modify, add or complement it; 

To revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the processing. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the data controller or processor has engaged in conduct contrary to the law and the Constitution; 

Access free of charge to your personal data that has been processed.

These rights may be exercised through the channels or means provided by SPEAL SAS, for customer service, the national hotline is 6086704355 - 6086700271 or the cell phone number 3168787885, email info@speal-intl.com and customer service offices nationwide, whose information can be found on the website https://speal-intl.com/ available Monday through Friday from 7:30 am to 6:00 pm, for the attention of requirements related to the processing of my personal data and the exercise of the aforementioned rights.

LEGAL BASIS 

Articles 15 and 20 of the Colombian Constitution provide as follows: 

All persons have the right to their personal and family privacy and to their good name, and the State must respect them and ensure that they are respected. Likewise, they have the right to know, update and rectify the information that has been collected about them in data banks and in the files of public and private entities1.

Article 20: Every person is guaranteed the freedom to express and disseminate his or her thoughts and opinions, to inform and receive truthful and impartial information, and to establish mass media. 

They are free and have social responsibility. The right to rectification under fair conditions is guaranteed. There shall be no censorship.

Law 1581 of 2012 develops the constitutional right that all persons have to know, update and rectify the information that has been collected about them in databases or files, and other rights, freedoms and constitutional guarantees.

According to the Constitutional Court, among the prerogatives or minimum contents that derive from the right to habeas data are at least the following: (i) the right of individuals to know access - the information collected about them in databases, which entails access to the databases where such information is contained; (ii) the right to include new data in order to provide a complete picture of the holder; (iii) the right to update the information, i.e., to update the content of such databases; (iv) the right to have the information contained in databases rectified or corrected, so that it matches reality; (v) the right to exclude information from a database, either because it is being misused, or simply because the owner wishes to do so, except for the exceptions provided for in the regulations. 

That Decree 1377 of 2013, Article 13 provides that data controllers must develop their policies for the processing of personal data and ensure that data processors fully comply with them

That, the Sole Regulatory Decree No 1074 of 2015 establishes that websites must ensure the integrity of the information contained in their databases and prevent any failure in the system that affects their services. Likewise, they must incorporate the information as they receive it from users and may not alter, add, abbreviate or replace the information they receive.

OBLIGATIONS 

This policy is of mandatory and strict compliance for the company SPEAL SAS. 

DATA CONTROLLER

SPEAL SAS, a legally constituted commercial company identified with NIT 900.532.979-2, domiciled in the city of Villavicencio Meta, at the address Calle 17 No. 33 - 40 Barrio la Florida, Telephone 6704355 - 6700271, website https://speal-intl.com/. 

TREATMENT AND PURPOSE 

The data processing carried out by SPEAL SAS, any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion, within or outside the national territory.

ATTENTION TO REQUESTS, INQUIRIES AND COMPLAINTS 

The Quality Management area is in charge of processing the requests of the owners to make their rights effective, for this purpose the company has a link for all persons who have requests, queries and complaints: https://docs.google.com/forms/d/e/1FAIpQLSck0L9xJ0MVFUohjPhhlfE3asRlttW7AKfQS_3cTshHsC6k_Q/viewform

TRANSFER AND TRANSMISSION OF INFORMATION 

The company will provide the personal data subject to processing to the following persons: 

  • Owner of the information or legal representatives.
  • Public or administrative entities in the exercise of their legal functions or by court order.
  • Third parties authorized by the owner or by law.

The company will provide personal data to third parties provided that they have authorization from the owner of the information in order to meet the normal requirements of the operation of their business. In this case, the third party, from the moment it receives the information, becomes responsible for the processing of the same and must comply with legal obligations. All third parties who, due to their relationship with the company, are entrusted with the processing of personal data must be asked to sign a contractual clause expressing their knowledge of the law and their responsibility in complying with it, and shall also require prior authorization from the owner to process his personal data.

INTERNATIONAL TRANSFERS. 

The company transfers personal data to third countries provided that they provide adequate levels of data protection in accordance with the standards set by the Superintendence of Industry and Commerce on the matter, and when: 

  • The owner grants express and unequivocal authorization for the transfer.
  • The exchange of data is required for reasons of public health or hygiene.
  • Bank or stock exchange transfers.
  • The transfer is agreed within the framework of international treaties to which the Republic of Colombia is a party.
  • Is necessary for the performance of a contract between the data subject and the controller or for the performance of pre-contractual measures.
  • Is legally required for the safeguarding of the public interest or for judicial purposes.

PROCEDURE FOR THE EXERCISE OF THE RIGHT TO HABEAS DATA 

In compliance with the rules on the protection of personal data, SPEAL SAS presents the procedure and minimum requirements for the exercise of your rights. For the filing and attention of your requests we ask you to provide the following information: 

  • Full name and surname
  • Contact information such as: Physical address for correspondence, contact telephone numbers, e-mail.
  • Authorized means on your part to send the respective answers.
  • Reasons/facts that give rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request, delete, access). 
  • Signature if applicable and identification number and if necessary.

Note: The maximum term or provided by law to resolve your claim is fifteen (15) working days, counted from the next day from the date of receipt. When it is not possible to address the claim within this term, SPEAL SAS will inform the interested party the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) working days following the expiration of the first term. Once the terms set forth in Law 1581 of 2012 and other rules that regulate or complement it, the holder who is denied, in whole or in part, the exercise of the rights of access, updating, rectification, deletion and revocation, may bring their case to the attention of the Superintendence of Industry and Commerce - Delegate for the protection of personal data.

PRIVACY NOTICE 

This privacy notice of SPEAL SAS, identified with NIT 900.532.979-2 with address at Calle 17 No. 33 - 40 in the neighborhood of La Florida de Villavicencio Meta, will carry out the processing of personal data. 

TREATMENT AND PURPOSE 

The data processing carried out by SPEAL SAS, any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion, within or outside the national territory. 

VIDEO SURVEILLANCE

SPEAL has video surveillance systems installed in its facilities. The images collected may be used for:

  • Access control and monitoring of critical areas
  • Prevention of criminal or irregular activities
  • Security of people, assets and information

The use is informed by visible signs. Entering the facility is considered an affirmative action of acceptance of treatment.

MECHANISMS TO KNOW THE TREATMENT POLICY 

The holder can access our information treatment policy, which is published in our web page https://speal-intl.com/, in a physical medium in our facilities and by e-mail.

CURRENT

This policy is effective as of July 23, 2025. It will remain in effect as long as the database exists or the purposes legally persist.