1. Introduction

bpdocument is a company in the technology sector, specialized in Document Management with more than 20 years in the market, a leader in the development, implementation and consulting of business solutions in Document Management.

In consideration of the foregoing, bpdocument protects the personal data of its clients, prospective clients, workers and former employees, contractors or individuals within the framework of pre-contractual, contractual and post-contractual relationships, for which bpdocument has developed and adopted this Personal Data Processing Policy in order to protect, respect and inform the rights of the Holders of the data that are in their possession and control, either in their IT applications or stored in databases or other systems, not excluding physical files.

2. Object

This policy seeks to sufficiently develop the constitutional right to Habeas Data held by all the people with respect to whom the company has collected, manages or conserves personal information. Likewise, the personal contact data of users when they are going to be used for the purposes of the corporate purpose will be treated following the provisions and mandates of the Law.

3. Definition

bpdocument: from now on BP DOCUMENT S.A.S., located at Carrera 15 # 88-21 Office 702 – Torre Unika Virrey Building, Bogotá D.C., Colombia; e-mail info@masterdocumental.com; phone number of the person in charge: (57-1) 744-66-68.

Authorization: Prior, express and informed consent of the Holder to carry out the Processing of personal data.

Privacy notice: Verbal or written communication generated by the person responsible for data processing, addressed to the Owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable, the way to access them and the purposes of the treatment that is intended to give personal data.

Databases: Organized set of personal data that is subject to Treatment.

Personal data: Any information linked or that may be associated with one or more specific or determinable natural persons.

Public data: It is the data that is not semi-private, private or sensitive. Public data, among others, are data related to people’s marital status, their profession or trade and their status as a merchant or public servant. By its nature, public data may be contained, among others, in public registers, public documents, gazettes and official gazettes and duly executed judicial decisions that are not subject to reservation.

Sensitive data: Sensitive data is understood to be those that affect the privacy of the Holder or whose improper use may generate discrimination, such as revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, organizations. social, human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.

Responsible for the Treatment of Data: Natural or legal person, public or private, that by itself or in association with others, carries out the Treatment of personal data on behalf of the person responsible for the Treatment.

Responsible for Data Processing: Natural or legal person, public or private, who by itself or in association with others, decides on the database and / or Data Processing.

Owner: Natural person whose personal data are subject to Treatment.

Data Processing: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion.

Data Transfer: takes place when the person in charge and / or person in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is inside or outside the country. .

Transmission of Data: Processing of personal data that implies the communication of the same within or outside the territory of the Republic of Colombia when it aims to carry out data processing by the person in charge on behalf of the person in charge.

4. Legal Framework

This personal data treatment policy is prepared in accordance with the provisions of:

Political Constitution of the Republic of Colombia.

Law 1581 of 2012.

Regulatory Decree 1377 of 2013.

Regulatory Decree 886 of 2014.

Regulatory Decree 1074 of 2015.

As well as other complementary provisions and will be applied by BP DOCUMENT S.A.S. regarding the collection, storage, use, circulation, deletion and all those activities that constitute the processing of personal data.

5. Area of Application

This policy will be applicable to the personal data registered in any database of BP DOCUMENT S.A.S. whose owner is a natural person.

6. Principles for Data Processing

In accordance with the applicable legal regulations, BP DOCUMENT S.A.S. will comply with the following principles for the processing of personal data:

Principle of Legality in Data Processing Matters: Data processing is a regulated activity, which must be subject to current and applicable legal provisions that regulate the subject.

Principle of Purpose: The personal data processing activity carried out by BP DOCUMENT S.A.S. or to which you have access, will obey a legitimate purpose in accordance with the Political Constitution of Colombia, which must be informed to the respective owner of the personal data.

Principle of Freedom: The processing of personal data can only be carried out with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that relieves consent.

Principle of Truthfulness or Quality: The information subject to the processing of personal data must be truthful, complete, exact, updated, verifiable and understandable. The processing of partial, incomplete, fractioned or misleading data is prohibited.

Principle of Transparency: In the processing of personal data, BP DOCUMENT S.A.S. will guarantee the Holder his right to obtain at any time and without restrictions, information about the existence of any type of information or personal data that is of interest or ownership of him.

Principle of Access and Restricted Circulation: The processing of personal data is subject to the limits derived from their nature, from the provisions of the law and the Constitution. Consequently, the treatment can only be done by people authorized by the owner and / or by the people provided by law.

Personal data, except for public information, may not be available on the internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to holders or authorized third parties in accordance with the law. For these purposes, the obligation of BP DOCUMENT S.A.S., will be a mediator.

Security Principle: The information subject to treatment by BP DOCUMENT S.A.S., must be handled with the technical, human and administrative measures that are necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.

Principle of Confidentiality: All the people who in BP DOCUMENT S.A.S. administer, handle, update or have access to information of any kind found in Databases, they are obliged to guarantee the reservation of information, for which they undertake to keep and keep it strictly confidential and not reveal to third parties, all the information that they come to know in the execution and exercise of their functions; Except in the case of activities expressly authorized by the data protection law. This obligation persists and will be maintained even after the end of your relationship with any of the tasks that includes data processing.

7. Purpose of the Data

BP DOCUMENT S.A.S. may use personal data to:

Execute the existing contractual relationship with its clients, suppliers and workers, including the payment of contractual obligations.

Provide the services and / or products required by its users.

Inform about new products or services and / or about changes in them.

Evaluate the quality of the service.

Send to physical, electronic, cell phone or mobile device, via text messages (SMS and / or MMS) or through any other analog and / or digital means of communication created or to be created, commercial, advertising or promotional information about the products and / or services, events and / or promotions of a commercial or non-commercial nature, in order to promote, invite, direct, execute, inform and in general, carry out campaigns, promotions or contests of a commercial or advertising nature, advanced by BP DOCUMENT S.A.S and / or by third parties hired for these purposes.

Develop the process of selection, evaluation, and employment relationship.

Support internal or external audit processes.

Register the information of employees and / or pensioners (active and inactive) in the databases of BP DOCUMENT S.A.S.

Those indicated in the authorization granted by the owner of the data or described in the respective privacy notice, as the case may be.

Provide, share, send or deliver your personal data to partner companies located in Colombia or any other country in the event that said companies require the information for the purposes indicated here.

8. Data Processing

8.1 Authorization

Without prejudice to the exceptions provided for in the law, the owner of the personal data must give their prior, express and informed authorization for their treatment, which must be obtained by any means that may be subject to subsequent consultation.

Authorization for the treatment of the owner of personal data will not be necessary in the following cases:

Information required by a public or administrative entity in the exercise of its legal functions or by court order.

Data of a public nature.

Cases of medical or health emergency.

Treatment of information authorized by law for historical, statistical and / or scientific purposes.

Data related to the Civil Registry of Persons.

The authorization may appear in a physical, electronic document, data message, Internet, Websites, in any other format that allows guaranteeing its subsequent consultation, or through a suitable technical or technological mechanism, which allows expressing or obtaining consent via click or double click, through which it can be unequivocally concluded that, had the owner not behaved, the data would never have been captured and stored in the database.

The authorization will be generated by BP DOCUMENT S.A.S. and it will be made available to the owner in advance and prior to the processing of his personal data.

If personal data is provided, said information will be used only for the purposes of this policy indicated, and, therefore, BP DOCUMENT S.A.S. will not proceed to sell, license, transmit, or disclose it, unless:

There is express authorization to do so.

It is necessary to allow contractors or agents to provide the services entrusted.

It is necessary in order to provide our services and / or products.

It is necessary to disclose it to the entities that provide marketing services on behalf of BP DOCUMENT S.A.S. or to other entities with which they have joint market agreements.

The information is related to a merger, consolidation, acquisition, divestment, or other restructuring process of the company.

That is required or permitted by law. BP DOCUMENT S.A.S. may subcontract to third parties for the processing of certain functions or information. When the processing of personal information is effectively outsourced to third parties or personal information is provided to third party service providers, BP DOCUMENT S.A.S. advises such third parties of the need to protect such personal information with appropriate security measures, the use of the information for their own purposes is prohibited, and it is requested that personal information not be disclosed to others.

8.2 Privacy Notice

In cases in which it is not possible to make the information treatment policies available to the owner, the owner will be informed through the Privacy Notice. This is a physical document, electronic or in any other format, made available to the owner to inform him about the processing of his personal data. Through this document, the owner will be informed of the information related to the existence of the information treatment policies of BP DOCUMENT S.A.S. and that will be applicable, the way to access them and the characteristics of the treatment that is intended to give personal data.

The privacy notice must contain, as a minimum, the following information:

The identity, address and contact information of the person responsible for the treatment.

The type of treatment to which the data will be submitted and the purpose thereof.

The rights of the owner.

The general mechanisms provided by the person in charge so that the owner knows the information treatment policy and the substantial changes that occur in it.

How to access or consult the information treatment policy.

The optional nature of the answer regarding questions about sensitive data.

8.3 Limited Use

Master Documental use and transfer of information received from Google APIs to any other application will comply with the Google API Services User Data Policy, including limited use requirements. (Google API Services User Data Policy).

9. Conservation of Information

The data is kept in accordance with the principles of necessity and reasonableness, expiration and temporality and with the provisions of the special rules that regulate the conservation of documents.

10. Information Supply Channels

BP DOCUMENT S.A.S., establishes as communication channels with the Holders:

E-mail: seguridad@bpdocument.com.

For inquiries and claims: seguridad@bpdocument.com.

Website: masterdocumental.com: Complaints and suggestions system.

Physical Address: Carrera 15 # 88-21 Office 702 – Torre Unika Virrey Building, Bogotá-Colombia (to attend to inquiries and claims).

Phone Number: (57-1) 744-66-68.

11. Rights

Right of Access: By virtue of which you can access the personal data that are under the control of BP DOCUMENT S.A.S., for the purpose of consulting them free of charge at least once every calendar month, and each time there are substantial modifications to the Policies of Treatment of the information that motivates new consultations.

Right to Update, Rectification and Deletion: By virtue of which you may request the updating, rectification and / or deletion of the personal data being processed, in such a way that the purposes of the treatment are satisfied.

Right to Request Proof of Authorization: Except in events in which, according to current legal regulations, authorization is not required to carry out the treatment.

Right to be informed regarding the use of personal data.

Right to File Complaints Before the Superintendency of Industry and Commerce: For infractions of the provisions of current regulations on the processing of personal data.

Right to require compliance with the orders issued by the superintendency of industry and commerce.

12. Obligations for the Responsible

BP DOCUMENT S.A.S., in its capacity as responsible for the treatment of the data that is supplied to it, must:

Keep proof of the authorization of the Holder and the information that he provided at the time of obtaining said authorization, as well as the information under security conditions to prevent adulteration, loss, consultation, use or fraudulent or unauthorized access.

Inform the Holder expressly and clearly of the Treatment to which the personal data will be submitted and its purpose; the optional nature of the answer to the questions that are asked, when these concern sensitive data or the data of infants and adolescents; the rights that assist you as the Owner and the identification, physical or electronic address and telephone number of the person responsible for data processing.

Process the queries and claims formulated in the terms indicated in this policy.

Ensure that the principles of truthfulness, quality, security and confidentiality in the terms established in the following policy.

Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.

Update the information and inform the data processor when necessary.

Rectify the information and communicate the pertinent to the person in charge of the data processing when it is appropriate.

Guarantee the owner, at all times, the full and effective exercise of the right to Habeas Data.

Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the Superintendency of Industry and Commerce.

Allow access to information only to persons authorized by the owner or empowered by law for that purpose.

Provide the data controller with the authorized information.

Require the person in charge of data processing to respect the rules on personal data to guarantee the security and privacy of the Owner’s information.

Inform the Superintendency of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the holders.

Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

13. Security of the Information

BP DOCUMENT S.A.S., will adopt all the technical, human and administrative measures that are essential to provide security for its databases, avoiding their adulteration, loss, consultation, unauthorized or fraudulent access.

Among others, the security measures adopted include, but are not limited to:

Establishment of contractual confidentiality clauses with employees that go beyond the duration of the contract, as well as independent confidentiality agreements with consultants, for the management of information contained in the database.

Implementation of security processes to verify the identity of the people who access the information either physically or electronically.

Permanent updating of security measures to adapt them to current regulations.

Adoption of firewall security systems and detection of unauthorized access.

Periodic monitoring of suspicious activities and physical and electronic maintenance of the databases.

Internal restriction of access to databases only to authorized personnel.

Establishment of internal database restoration policies and customer support channels.

14. Area Responsible for the Protection of Personal Data

The systems area of BP DOCUMENT S.A.S. will be responsible for responding to requests, complaints and claims made by the owner of the data in exercise of the rights contemplated in numeral 11. RIGHTS.

15. Procedure for the Information Holders to Exercise their Rights

15.1 Claims

The Holder or his successors in title who consider that the information contained in a database should be subject to correction, updating or deletion, or when they notice the alleged breach of any of the duties contained in the law, they may file a claim with BP DOCUMENT S.A.S., which will be processed under the following rules:

The Holder’s claim will be formulated through a request addressed to BP DOCUMENT S.A.S. to the e-mail seguridad@bpdocument.com or by written communication addressed to the Systems Area, with the identification of the owner, the description of the facts that give rise to the claim, the address, and accompanying the documents that you want to enforce. If the claim is incomplete, the interested party will be required within five (5) days after receiving the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim. In the event that the person who receives the claim is not competent to resolve it, he / she will send it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation.

Once the complete claim is received, it will be cataloged with the label “claim in process” and the reason for it, in a term no longer than two (2) business days. Said label will be kept until the claim is decided.

The maximum term to attend the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished.

15.2 Request for Update and/or Rectification

BP DOCUMENT S.A.S., will rectify and update at the request of the owner the information of the latter that is incomplete or inaccurate, in accordance with the procedure and the terms indicated above, for which the following will be taken into account:

The owner must send the request to the e-mail seguridad@bpdocument.com or in a physical medium addressed to the Systems Area indicating the update and / or rectification to be carried out and will provide the documentation that supports their request.

BP DOCUMENT S.A.S., may enable mechanisms that facilitate the exercise of this right to the owner, as long as they benefit him. Consequently, electronic or other means that it deems pertinent may be enabled, which will be informed in the privacy notice and will be made available to interested parties on the website.

15.3 Request For Data Delete

The owner of the personal data has the right to request BP DOCUMENT S.A.S. its deletion (deletion) in any of the following events:

Consider that they are not being treated in accordance with the principles, duties and obligations provided for in current regulations.

They are no longer necessary or relevant for the purpose for which they were collected.

The period necessary for the fulfillment of the purposes for which they were collected has been exceeded.

This deletion implies the total or partial elimination of personal information in accordance with what is requested by the owner in the records, files, databases or treatments carried out by BP DOCUMENT S.A.S. However, this right of the owner is not absolute and consequently BP DOCUMENT S.A.S. may deny the exercise of the same when:

The owner has a legal or contractual duty to remain in the database.

The elimination of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions.

The data is necessary to protect the legally protected interests of the owner; to carry out an action based on the public interest, or to comply with an obligation legally acquired by the owner.

16. Validity

This policy is effective as of August two (2), 2021 and renders the previous regulations or special manuals without effect. BP DOCUMENT S.A.S. reserves the right to modify them, under the terms and with the limitations provided by law.