Personal Data Processing Policy

1) Objective: ProColombia, in compliance with Statutory Law 1581 of 2012, which establishes the General Regime for Data Protection in Colombia, and Regulatory Decree No. 1377 of 2013, as well as international best practices on this matter, is responsible for processing your personal data. This policy establishes the general guidelines that are followed to properly handle personal data provided in accordance with the applicable regulatory requirements on the subject matter covered herein

2) Data Controller:The ProColombia Trust is an autonomous trust fund created by Law 7 of 1991 and Decree 663/2993 Organic Statute of the Financial System. It does not have legal personality and was constituted by means of a commercial trust agreement entered into between the Nation (today the Ministry of Trade, Industry, and Tourism) and Fiduciaria Colombiana de Comercio Exterior S.A.- Fiducoldex S.A. In accordance with the purposes of its creation, ProColombia is in charge of promoting tourism, attracting foreign investment in Colombia, and promoting non-mining and non-energy exports as well as the country's image abroad. This trust is responsible for the personal data provided to us through various means, such as direct interactions (e.g., forms or communicating with us by mail, phone, or email), automated technologies or interactions (e.g., cookies), and third party or publicly available information sources.

As responsible for data processing, ProColombia makes the following information available to the personal data subjects:

Address: Calle 28 No. 13 A-15, Piso 35, Bogotá D.C. - Colombia
Telephone number in Bogotá D.C.+57 601 5600100 - Fax: +57 601 5600104, outside Bogotá D.C.(+57) 01-900-33-10021
e-mail: [email protected],
Website: www.procolombia.co (and related websites).

3) Scope: This policy is applicable to all personal data stored or registered in the databases of the ProColombia Trust.

4) Processing and Purpose: Personal data will be used by ProColombia for the purposes of its constituent act, such as the promotion of non-mining and non-energy exports, the attraction of foreign direct investment to Colombia, and the promotion of international tourism as well as the country’s image abroad, and in particular for the following:

To carry out Trust activities
To make business contacts with companies in Colombia.
To provide information on tourism promotions.
To send invitations to events organized by ProColombia.
To respond to requests made by the Ministry of Trade, Industry, and Tourism of Colombia or any other authority.
Additionally, personal data collected will be used in the following circumstances:

When required to establish a contractual relationship with you, in the context of the purposes described above.
When required to comply with a legal obligation1 or a decision made by a competent authority.
In other events that are expressly authorized in Law 1581 of 2012 and Regulatory Decree 1377 of 2013.

¹When ProColombia Trust is required to comply with a legal obligation that means processing your personal data

5) Sensitive Data Processing:Personal data classified as sensitive, such as race or ethnicity, are only collected as statistical data to measure our management indicators. The following sensitive data are not collected: religious or philosophical beliefs, sex life, sexual orientation, political opinions, union membership, health information, genetic and biometric data, information on criminal convictions and offenses. If, in order to comply with a legal requirement, collecting any type of sensitive data is necessary, the data subject will be previously informed and the regulatory guidelines provided on processing this type of information will be applied.

It should be noted that the information referred to in this section is collected with the data subject’s prior authorization.

6) Data Subject Rights: Under data protection laws, the following are your Rights as the Data Subject:

To consult, update, correct, eliminate, and revoke personal data. This right, among others, may be exercised with regards to partial, inaccurate, incomplete, fragmented, or misleading data, or data whose processing is expressly prohibited or has not been authorized.
To request proof of consent or authorization of processing granted.
To be informed about how ProColombia is using the personal data.
To file before the corresponding control bodies, complaints for violations of the provisions of the regulations in force and other standards that may modify, add to, or complement them.
To access personal data that have been processed, free of charge.
To refrain from answering questions about sensitive data.

7) Procedures for Consulting, Updating, Eliminating, Revoking, and Confirming Personal Data

Through the contact channels mentioned in the following paragraph, the data subject may request to update, eliminate, revoke, and confirm the information and/or consult or make claims related to their information.

ProColombia will validate the identification, analyze, classify, and issue a response to the request within the times established by law. Responses will be sent via the same means through which the request was received, or as specified by the data subject in the request. Personal data shall not be eliminated and/or authorization to process the information shall not be revoked if the data subject has a legal or contractual duty to remain in ProColombia’s databases.

Such requests will be processed as long as they comply with the following requirements:

The request must be addressed to ProColombia.
It must have the data subject’s identification, or that of his/her successor, representative, or agent.
It must contain a description of the facts giving rise to the request.
it must provide contact details for notification of response
It must provide documents and other information to support the request.

If the request is incomplete because it does not meet all the requirements, the applicant will be notified to correct the omissions within five (5) days following the receipt of the request. If the required information is not received after two (2) months from the date the applicant received the request to correct the omissions, it shall be understood that he/she has abandoned the claim.

The maximum term to issue a response to the request will be fifteen (15) business days from the day following the its receipt.

If it is not possible to respond to a request within the term initially established by the current regulations due to its complexity, the applicant will be informed why a response is not possible within the term established. In the notification addressing why it is impossible to respond within the term initially indicated, the applicant must be provided a date on which a response will be received, which in no case may exceed eight (8) working days following the expiration of the initial term.

8) Response to Requests, Queries, and Complaints:

Channels through which you can exercise your rights. The channels provided by ProColombia to receive and respond to requests, queries, and complaints regarding personal data are via mail to Calle 28 #13A 24 Piso 6 Torre B, postal code 110311, Bogotá D.C.; or via e-mail to the following address: [email protected]; or through the Questions, Complaints, Claims, Compliments, and Suggestions form found at: https://procolombia.co/informacion/pqr.

Area responsible for complaints, claims, compliments, and suggestions. ProColombia's Quality and Sustainability Department is responsible for following up and monitoring these cases through the aforementioned channels.

9) ProColombia's Personal Data Processing Policies:

Comply with personal data processing policies within the parameters set forth in the Constitution and current regulations.
In accordance with the provisions established in current regulations, obtain the express authorization of owners, either physically, electronically and/or by telephone, in order to allow a subsequent consultation and explicitly confirm that without the consent of the owner, the information would have never been obtained or stored in electronic of physical means. Similarly, we may reasonably infer from clear and unequivocal conducts of the owner that he/she granted the consent to process his/her personal information.
The persons responsible or in charge of data processing shall protect the confidentiality, integrity, and availability of the personal information.
Personal data shall only be handled by the employees who require it, based on the activities of their role, or by the persons responsible or in charge; the latter shall be provided with the necessary information to fulfill their contractual obligations.
Employees shall ensure the confidentiality of the information during their employment period with ProColombia, or the validity of the contract, when applicable, and after the termination or dissociation thereof.
Process personal data according to the purposes authorized by the owners.
Not disclose personal information online or via another mass communication media, unless it is public information or information required by current regulations.
The personal information of the owners shall be protected in accordance with information security and retention policies of the organization.
Adopt other necessary measures for the information to be up to date.
Correct the information when it is incorrect and notify the corresponding process to any authorized third-party.
Process queries and claims filed by owners in the terms established by current regulations.
At the request of the owner, and when he/she does not have any legal or contractual obligation to remain in the databases, the information of the owner shall be eliminated.
Preserve the information under the necessary security conditions to prevent them from being tampered, lost, queried, used, or accessed fraudulently or without authorization.
ProColombia shall apply suitable security measures to treat sensitive information, including, among others, the personal information of employees’ children (boys, girls, teenagers).
Strengthen a corporate culture that promotes and protects the rights of owners by offering training sessions.
Ensure, at all times, the full and effective implementation of habeas data rights.
Duly inform owners of the purpose of data collection and the rights bestowed by granting authorization.
Ensure that the information provided to any authorized third-party, within the parameters set forth in current regulations, is true, complete, exact, updated, verifiable, and legible.
ProColombia may exchange personal information with public entities, when requested, in carrying out their obligations, for matters related to plans, programs, and projects in the development of public policy.
The established policies may be modified at any time. These modifications shall comply with current legal regulations as well as best international practices on the matter and shall enter into force from the moment of publication in the channels provided for the knowledge of owners.
The transfer of personal information to countries that do not offer adequate data protection levels shall take place under the conditions established in current regulations.
Carry out the required activities to fulfill the obligations related to the Database Registry, when applicable.

10) Validity:

The databases in which personal data will be recorded will be valid for the time the information is kept and used for the purposes described in this policy.

Our privacy policy is periodically reviewed. This version was last updated on February 23, 2023.

It is important that the personal information we have about you is accurate and up to date. Please let us know if your personal data changes during your relationship with us.