Personal Data Processing Policy

Scope of application of the Personal Data Processing Policy

This policy applies to MCA SYSTEMS S.A.S, a Colombian company identified under NIT 900.382.317-2, with its registered office at Calle 86 # 42D-90, Barranquilla, Atlántico, Colombia. Its purpose is to safeguard the privacy and intimacy of the data subjects whose personal data is stored in its databases and files, and to comply with the current regulations on personal data protection as set forth in Law 1581 of 2012.

Hereinafter MCA SYSTEMS S.A.S, acting as RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA, informs its stakeholders —identified as EMPLOYEES, INTERNS, JOB CANDIDATES, SUPPLIERS OF GOODS AND SERVICES, DISTRIBUTOR CLIENTS, END CONSUMERS, PROSPECTS, INSTALLERS, COMMERCIAL PARTNERS and, in general, all natural persons who provide or have provided their personal data— of the content of this PERSONAL DATA PROCESSING POLICY.

Definitions

To help determine, in a simple way, the meaning of the technical vocabulary frequently used in personal-data protection matters, any data subject whose personal data is processed by MCA SYSTEMS S.A.S as the RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA must understand the following terms:

Authorization: prior, express and informed consent of the Data Subject to carry out the processing of personal data (Source: Statutory Law 1581 of October 17, 2012).
Database: an organized set of personal data that is subject to Processing (Source: Statutory Law 1581 of October 17, 2012).
Data Subject’s consent: an informed, free and unequivocal manifestation of will, through which the data subject accepts that a third party uses their information for commercial purposes.
Queries: Data Subjects or their heirs may consult the personal information of the Data Subject held in any database, whether public or private. The Responsible or the Processor must provide them with all the information contained in the individual record or linked to the Data Subject’s identification (Source: Statutory Law 1581 of October 17, 2012).
Personal data: information about natural persons (identified or identifiable), relating to both their identity (name and surname, address, parentage, etc.) and to their existence and occupations (studies, work, illnesses, etc.).
Public data: data qualified as such under the law or the Political Constitution and all data that are not semi-private or private. They include, among others, data contained in public documents, final court judgments not subject to reservation, and data relating to marital status (Source: Statutory Law 1266 of 2008).
Semi-private data: data that is neither intimate, reserved, nor public, and whose knowledge or disclosure may interest not only its holder but also a certain sector or group of persons or society in general, such as financial and credit data from commercial or service activities (Source: Statutory Law 1266 of 2008).
Private data: data that, due to its intimate or reserved nature, is only relevant to the data subject (Source: Statutory Law 1266 of 2008).
Sensitive data: data that affects the Data Subject’s intimacy or whose improper use may generate discrimination, such as that which reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social or human-rights organizations, or that promotes the interests of any political party or guarantees the rights of opposition political parties, as well as data relating to health, sexual life and biometric data.
Processor (Encargado del tratamiento): the person who handles personal data but does not decide how or for what purpose. Their work is operational and is carried out based on the instructions of the Responsible.
Habeas Data: the right of any holder of personal information to know, update, rectify or oppose the information concerning their personal data.
Personal data protection: a fundamental right of all natural persons, aimed at protecting their privacy from possible violation through improper processing by a third party.
Complaint (Reclamo): the Data Subject or their heirs who consider that the information contained in a database should be corrected, updated or deleted, or who notice an alleged breach of any of the duties contained in this law, may file a complaint before the Responsible or the Processor (Source: Statutory Law 1581 of October 17, 2012).
Responsible for the Processing: a natural or legal person, public or private, that —by itself or in association with others— decides on the database and/or the Processing of the data (Source: Statutory Law 1581 of October 17, 2012).
Processing (Tratamiento): any operation or physical or automated procedure that allows capturing, recording, reproducing, retaining, organizing, modifying or transmitting personal data.
Processing of data: as a general rule, the data subject’s consent is required to carry out any processing of their personal data.
Data Subject (Titular): the natural person whose personal data is processed by a third party.

Exercise of Data Subject rights

If you, as a Data Subject, wish to consult, claim, modify, update, rectify, delete or revoke the authorization granted for the processing of your data, you may contact us through the following channels:

Website, accessible at http://www.horussmartcontrol.com/contacto.
Email: habeasdata@horus-sc.com.
Postal communication addressed to the registered office of the RESPONSIBLE FOR THE PROCESSING, located at Calle 86 # 42D-90, Barranquilla, Atlántico, Colombia.

The subject line of your communication must include the term «CONSULTA O RECLAMO DE HABEAS DATA».

Privacy policy regarding personal data processing

This policy will help data subjects —employees, interns, job candidates, suppliers of goods and services, distributor clients, end consumers, prospects, installers, commercial partners and, in general, every data subject whose data is held in our databases and files— to understand what type of data we use and the conditions under which MCA SYSTEMS S.A.S will process any personal data provided to us directly, indirectly or in person.

MCA SYSTEMS S.A.S will at all times comply with current regulations on personal data protection, will guarantee the exercise of habeas data rights of all Data Subjects whose personal data is held in its databases and files, and will develop technical, legal, procedural and organizational controls aimed at establishing security conditions —according to the state of the art— in order to prevent unauthorized access, loss, alteration and fraudulent use of the data.

Changes to the policy

MCA SYSTEMS S.A.S informs that, if changes are introduced to this privacy policy, they will be published at the following electronic address: http://www.horussmartcontrol.com/legal, with the purpose of keeping all Data Subjects informed and up to date on the conditions of use of their data.

If you, as a Data Subject, do not agree with the changes made to the personal data protection policy, we ask you to exercise your right of habeas data through the channels established in the third section of this policy.

Governing principles of data protection

MCA SYSTEMS S.A.S is committed to maintaining the freedom, integrity, transparency, confidentiality, accuracy and availability of the personal data of employees, interns, job candidates, suppliers of goods and services, distributor clients, end consumers, prospects, installers, commercial partners and any other natural person whose data is held in our databases and files. MCA SYSTEMS S.A.S guarantees the application of the general principles for the processing of this type of data, as contemplated in Law 1581 and its regulatory decrees.

MCA SYSTEMS S.A.S informs that, through free, prior, express and informed authorization, you —as a Data Subject— authorize your personal data to be captured, stored, transmitted, used, updated, circulated and, in general, processed in accordance with the purposes set out in this policy.

Any Data Subject may at any time revoke their consent to the processing of their data, provided it is legally and/or contractually permitted, by sending a communication and/or request through the channels listed in the third section «Exercise of Data Subject rights» of this policy, attaching a copy of their identification document (national ID and/or passport) in order to verify their identity.

Processing and purposes applied to personal data

You, as a Data Subject, through your prior, express and informed authorization, accept that your data will be collected, stored, used, circulated and, in general, processed for the purposes described in this section.

MCA SYSTEMS S.A.S informs the purposes of processing personal data that will generally apply to every Data Subject in our databases and files:

In the event of substantial changes to MCA SYSTEMS S.A.S’s information-processing policies, notify Data Subjects through our website http://www.horussmartcontrol.com/legal.
Respond to requests, queries and complaints filed through any of the channels made available by MCA SYSTEMS S.A.S for the exercise of habeas data rights.
Cross-check the personal information provided by the Data Subject with public databases, credit bureaus and risk-prevention systems, specialized companies, references and contacts for confirmation activities.
Transfer or transmit personal data to entities and/or judicial and/or administrative authorities when required in relation to their purpose and necessary for the performance of their functions.

Purposes for employees, interns and job candidates

MCA SYSTEMS S.A.S will be responsible for the handling of personal data provided by employees and, likewise, for the use and protection thereof. The personal data we collect from employees and interns will be used to:

Establish and manage the recruitment, selection and hiring process carried out by MCA SYSTEMS S.A.S.
Conduct tests and other assessments deemed appropriate to identify the suitability of hiring the person as an employee of MCA SYSTEMS S.A.S.
Include the Data Subject’s personal data in the employment contract, as well as in any other documents necessary to manage the employment relationship and its derived obligations.
Manage the personal data of the Data Subject and of their family nucleus for affiliation procedures with Health Service Providers (EPS), family compensation funds, Occupational Risk Administrators (ARL), and any other entity required for MCA SYSTEMS S.A.S to fulfill its duty as an employer.
Comply with the obligations arising from the employment relationship entered into.
Respond to the employee regarding requests for certificates, certifications and other documents requested from MCA SYSTEMS S.A.S as a result of the employment relationship.
Administer personal data to make correct payroll payments, including deductions for payments to third parties previously authorized by the employee.
Evaluate performance and results arising from the employment relationship.

Regarding job candidates within MCA SYSTEMS S.A.S, the personal data captured during the selection process will be processed according to the following purposes:

Establish and manage the recruitment, selection and hiring process carried out by MCA SYSTEMS S.A.S.
Process personal data to perform —when required— performance, competence and ability tests, home visits, psychosocial evaluations, and any other evaluation generated in order to define an employment relationship.

The personal data of job candidates will be stored in a physical and/or digital file or folder identified with the name Selección, which will be kept for a maximum of six (6) months. Once this term has elapsed, the information will be deleted or suppressed. The file or folder may be accessed by MCA SYSTEMS S.A.S or by the person in charge of the selection and pre-contractual management process.

Suppliers of goods and/or services

MCA SYSTEMS S.A.S understands that the personal data of third parties you provide —such as workers authorized to carry out the commissioned service, commercial references and certifications— are provided with the authorization of the Data Subjects to be delivered and processed in accordance with this Personal Data Processing Policy. The personal data we collect from suppliers, their employees or dependents, are necessary to:

Collect, register, update and maintain their personal data in order to inform, communicate, organize, control, attend to and accredit the activities related to their status as supplier and contractor of MCA SYSTEMS S.A.S.
Analyze financial, technical and any other aspects that allow MCA SYSTEMS S.A.S to identify the supplier’s ability to comply.
Develop and apply selection and evaluation processes, prepare responses to requests for information, prepare quote requests and proposals, and/or award contracts.
Manage data to process payments of invoices and collection accounts presented to MCA SYSTEMS S.A.S.
Comply with the obligations arising from the commercial relationship established.
Send —through any means of communication, electronic or physical, known or to be known— information required within the commercial relationship, general information, notifications of a general, commercial and/or marketing nature related to the products and services offered by MCA SYSTEMS S.A.S.
Eventually MCA SYSTEMS S.A.S may share with third parties some of the Data Subject’s identification data, such as name, surname, ID number, mobile or fixed phone number, or home address.

Distributor clients, end consumer, prospects and commercial partners

The personal data we collect from our clients —whether distributor clients, end consumers, prospects or commercial partners— are necessary to:

Register them in our databases and files.
Collect, register and update their personal data in order to inform, communicate, organize, control, attend to and accredit the activities related to their status as clients of MCA SYSTEMS S.A.S.
Include their personal data on invoices and any other documents necessary to manage the commercial relationship and derived obligations that are under the responsibility of MCA SYSTEMS S.A.S as RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA.
Respond to requests or inquiries about our products.
Contact you when so requested.
Register, safeguard and eventually publish their personal data as a winner of prizes in marketing activities carried out by MCA SYSTEMS S.A.S, either on its website or on the social networks where the contest or marketing and loyalty activities have been managed.
Send —by any physical or electronic means, known or to be known— commercial, marketing, promotional and event information about the products provided by MCA SYSTEMS S.A.S.
Eventually MCA SYSTEMS S.A.S may share with third parties some of the Data Subject’s identification data, such as name, surname, ID number, mobile or fixed phone number, or home address.

Horus Certified Installers

MCA SYSTEMS S.A.S will collect data from its certified installers that are pertinent and necessary to manage product installation training and facilitate them so they may be contacted by third parties (end consumer and/or prospects). The personal data we collect are necessary to:

Include the installer in the database or files as a Horus Certified Installer.
Provide technical training that grants the Horus Certified Installer status for the installation of products manufactured or commercialized by MCA SYSTEMS S.A.S.
Publish their personal data on the MCA SYSTEMS S.A.S website, identifying them as a certified technician, which will allow third parties and end consumers to contact them to provide their services.
Conduct performance evaluations, which may be carried out directly or through third parties and end consumers; they may be kept internally within the entity, as well as published on the MCA SYSTEMS S.A.S website.

Considering that MCA SYSTEMS S.A.S may eventually share with third parties some of the personal data of those within its stakeholder group and any other natural person whose personal data is held in our databases and files —including identification data such as name, surname, ID number, mobile or fixed phone number, or home address— MCA SYSTEMS S.A.S informs that it provides this information when required to its advisors and consultants for the performance of the tasks entrusted to them. Such sharing is carried out on the basis of confidentiality agreements through which the confidentiality of the information and due compliance with this Personal Data Processing Policy are protected.

Special requirements for the processing of certain personal data

Sensitive data

Current personal-data protection regulations consider sensitive data as «that which affects the Data Subject’s intimacy or whose improper use may generate discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social or human-rights organizations, or that promotes the interests of any political party or guarantees the rights of opposition political parties, as well as data relating to health, sexual life and biometric data».

Regarding sensitive data that MCA SYSTEMS S.A.S may eventually collect or store —including but not limited to biometric data, union membership, and health data— it will process them in compliance with the following objectives:

Implement special attention and reinforce its responsibility regarding the processing of this type of data, which translates into a higher requirement in terms of compliance with the principles and duties established by current personal-data protection regulations.
Establish the technical, legal and administrative security levels to treat such information adequately.
Increase access and use restrictions for MCA SYSTEMS S.A.S employees and suppliers.

Personal data of minors

The processing of personal data of children and adolescents by MCA SYSTEMS S.A.S will always respect the following requirements:

Always respond to and respect the best interest of children and adolescents.
Always ensure, on the part of the Responsible, respect for their fundamental rights.
To the extent possible, such processing will be carried out taking into account the opinion of the minor Data Subjects, considering the following factors: (i) maturity, (ii) autonomy, (iii) ability to understand the purpose of the processing, (iv) explanation of the consequences entailed by the processing.

The assessments of the above characteristics will not be carried out by MCA SYSTEMS S.A.S in a general way. MCA SYSTEMS S.A.S —or any Processor or third party involved in the processing of minors’ personal data— must always ensure the proper use of this type of personal data. Data Subjects are not obliged, under current personal-data protection regulations, to authorize the processing of their sensitive data; however, in cases where such data is necessary, MCA SYSTEMS S.A.S must obtain explicit consent for the processing of such data from their parents, representatives or guardians.

Data from social networks such as Facebook, Instagram, Twitter, LinkedIn belong to independent legal entities; therefore, these digital platforms are not under the responsibility of MCA SYSTEMS S.A.S.

If MCA SYSTEMS S.A.S needs to use such personal data, it must request the prior, informed and express consent of each Data Subject regarding the authorization for their processing.

Information security measures

In development of the security principle established in Law 1581 of 2012, MCA SYSTEMS S.A.S —as RESPONSIBLE FOR THE PROCESSING— has adopted the technical, legal and administrative measures necessary to guarantee the security of personal information and to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.

MCA SYSTEMS S.A.S has procedures and technological tools that allow a secure administration of the information collected, verification means regarding compliance with this Personal Data Processing Policy, as well as contingency plans aimed at maintaining operational continuity, which in turn allow it to manage situations that may put the information collected at risk.

The following is a list of some of the security measures implemented:

Training of Company personnel on personal-data protection, the Personal Data Processing Policy and the security mechanisms for processing this data.
Procedures, rules and corporate guidelines aimed at guaranteeing the level of security as effective internal policies.
Labor, commercial and civil contracts that include appropriate clauses on personal-data processing and confidentiality.
Restriction of physical and logical access to our employees, dependents, subordinates and contractors with respect to the personal information kept on the different stakeholder categories, granting access only to those who need to know and handle the information under strict confidentiality obligations, with the understanding that they may be sanctioned or dismissed if they fail to comply with these obligations and prohibitions.
Access controls to physical information.
Backup and data recovery procedures (security copies).
Access controls to information through secure passwords.
Incident notification, management and response procedure.
Annual internal audit program on compliance with the personal-data protection management program.
Implementation of perimeter security equipment.
Our own equipment is physically protected in a secure location.

Validity

This privacy policy has been in effect since January 2, 2016.