PERSONAL DATA PROCESSING AND PRIVACY POLICY   

HOW DO WE USE YOUR DATA? 

Pursuant to the legal regulations of each country where CLAI PAYMENTS® Technologies operates and in compliance with the General Data Protection Regulation of the European Union (EU), Personal Information Protection Act. 

Main purposes of data processing 

I. Verify the identity of the Data Subject(s), personal, work or professional conditions and social environment, as well as their financial activity or criminal record by any means, including the use of any legitimate external source, such as third parties, public or private databases, public records, criminal or security records legitimately constituted. 

II. Manage and assess any type of risk (reputational, conduct, legal or disciplinary and others to which CLAI PAYMENTS® Technologies may be exposed) associated with initiating or continuing a business or employment relationship, including the prevention and detection of fraud or criminal activity or to manage and resolve any actual or potential loss in connection with a crime or fraud in order to track and monitor all of the above activities on an ongoing basis. 

III. Recording and conducting internal and external events organized by the Human Resources area, where audiovisual, audio and photographic content, among others, can be produced. 

IV. Transfer or share personal data information to different areas of the organization and its related companies in Colombia or abroad when required for the development of processes related to the work relationship. V. Attend and/or follow up and/or respond to requests from the competent judicial or administrative authorities. VI. Perform activities aimed at testing, executing and supporting CLAI PAYMENTS® Technologies Business Continuity Plans.

VII. Comply with requests made by the authorities when necessary to safeguard the public interest, the enforcement or administration of justice.

VIII. Carry out data update campaigns. 

In addition to: 

Send administrative information. We may use your information to send you updates about products, services and new features and/or information about changes in our terms, conditions and policies. 

Meet and manage requests. We may use your data to fulfill and manage your requests, payments, returns and exchanges made. 

Publish testimonials. We publish testimonials on our site that may contain your information. Prior to publishing a testimonial, we will obtain your consent to use your data. Should you wish to update or delete your testimonial, please contact us at contact@clai.com and be sure to include your name, location of the testimonial and contact information. 

Request comments. We may use your information to request feedback and to contact you about your use of our products. 

Customer Database. We will store your information such as name, identification number, work address, corporate email and contact telephone number. 

Databases, Suppliers and Third Parties. We will store your information such as name, identification number, work address, corporate email and contact telephone number. 

Collaborators Database. We will store your information such as name, identification number, residential address, personal e-mail, contact telephone number, RH, family unit and other additional information required for legal procedures. 

The purpose of the database of Clients, Suppliers and Third Parties will be as follows: 

I. Determine the suitability to perform the contracted services through due diligence processes and exercise the right to sufficiently know the client, supplier or third party, including review of the criminal record and consultations at any time with credit bureaus, credit reporting agencies, or any other entity authorized for risk consultations.

II. Assess the present or future risk of the contractual relationship, as well as manage, administer, monitor and supervise the contractual relationship and compliance with policies, procedures, practices and general guidelines.

III. Comply with operational, legal, or security parameters that may be reasonably applicable, such as registration in the customer, supplier or third-party systems, updates and evaluation visits.

IV. Use, share, transfer and/or transmit Personal Data to other companies that are or will be part of CLAI PAYMENTS® Technologies, as well as to its business partners or third parties both inside and outside the country, local or foreign, public or private, in order to carry out the aforementioned activities.

V. Create and retain a profile of the customer, supplier or third party to identify and assess their suitability for new contractual opportunities. 

The purpose of the Collaborators database will be: 

I. Comply with legal and regulatory obligations, as well as identify and monitor possible conduct breaching the company’s Code of Conduct, or any other policy, directive, standard that is implemented by DATA CONTROLLER. For the above, THE DATA CONTROLLER may request information related to the DATA SUBJECT(s) including personal data of spouse, permanent partner and persons who are related up to the 4th degree of consanguinity, 2nd degree of affinity and first-degree relationship. 

II. Conduct campaigns to update the socio-demographic information of the DATA SUBJECT(s); as well as the spouse, permanent partner and persons related up to the 4th degree of consanguinity, 2nd degree of affinity and first-degree relationship.

III. Consult in a centralized manner the details of work and academic history and additional information required for internal purposes that are necessary for the recruitment and selection process, such as matters related to your identification document, identification number, nationality, country of residence, address, telephone, marital status, corporate and personal email, salary, and bank account, among others.

IV. Comply with legal and regulatory obligations, as well as identify and monitor possible behaviors contrary to the company’s Code of Conduct, or any other policy, directive, standard that is implemented by the organization. To this end, CLAI PAYMENTS® Technologies may request information related to the family environment of the collaborator, including personal data of spouse, permanent partner and people who are related up to the 4th degree of consanguinity, 2nd degree of affinity and first-degree relationship.

V. Comply with CLAI PAYMENTS® Technologies’ labor laws and obligations such as, labor law, social security and taxes (payment made to the tax authorities of each country for amounts withheld, issuance of income and withholding certificates), labor certifications, among others. 

VI. Enter into, execute and terminate the employment contract, manage active personnel, administer and manage payroll and other uses required to qualify for CLAI PAYMENTS® Technologies’ non-mandatory benefits. 

The Visitors database will have the following purposes: 

I. Control access to the facilities and establish security measures deemed pertinent. 

II. Handle emergencies that may occur in the facilities of the indicated companies and that may affect the user community or individuals. 

III. Deliver information to the emergency brigades to inform, train, educate and prepare them in general so that they are able to act and protect the health and integrity of the people in the facilities in the event of an actual or potential emergency. 

INFORMATION DELIVERY: 

By means of any channel including, but not limited to, social media, text messages, push notifications, email, phone call, etc., related to the corporate purpose of CLAI PAYMENTS® Technologies such as marketing activities and/or any request made by the data subject to CLAI PAYMENTS® Technologies, among others. 

• Preparation, execution and management of business proposals and contracts for services provided. 
• Provide adequately and with excellent quality the services offered and/or contracted. 
• Submit reports to the authorities and process the requirements made by administrative or judicial agencies.
• In case of other purposes or processing, prior, express and informed authorization will be requested to the Data Subject.

WILL YOUR DATA BE SHARED WITH ANYONE?

We only share data upon your consent, to comply with laws and legal obligations, to protect your rights, or to fulfill contracts and other business obligations.

We may process or share data in accordance with the following legal terms and conditions: 

• Consent: We may process your data if you have granted us your consent to use your data for a specific purpose. 

• Legitimate Business Interests: We may process your data whenever such processing is reasonably necessary to pursue our legitimate business interests.

• Performance of a contract: In cases where we have entered into a contract with you, we may process your data in order to fulfill the terms of such contract. 

• Legal Obligations: We may disclose your data when we are legally compelled to do so to comply with applicable law, governmental requests, regulatory requests, a judicial proceeding, a court order or other legal process, in response to a court order or a subpoena (including in response to authorities to meet national security or law enforcement requirements). 

• Anonymized: We may disclose your data provided they are anonymous. In other words, subjecting it to a procedure in which personal data are detached from the data subject, rendering the shared data incapable of being used or combined to identify the data subject. 

• Vital Interests: We may disclose your data when we believe disclosure is necessary to investigate, prevent, or take action regarding possible breaches of our agreements, contracts, policies, applicable laws and rules and regulations, suspected fraud, situations involving potential threats to the health or safety of any person, illegal activities, or as evidence in any litigation in which we are involved. 

HOW DO WE KEEP YOUR DATA SECURE? 

Our goal is to protect your data through a system of organizational security measures. We have implemented appropriate organizational security measures in order to protect the integrity of any data we collect and process, to provide an adequate level of security. 

At CLAI PAYMENTS® Technologies we will ensure and do our best to protect your data, the transmission of data to and from our websites is at your own risk, remember to access our site whilst in a secure environment. We will only request information through our website that is necessary to contact us subsequently, information such as name, email and company. 

We will not request identification number, cell phone number or residential or business address. 

PROCESSING PROCEDURES

1. Given the aforementioned purposes for Employees, Applicants for vacancies, Suppliers and Third Parties, and Visitors, the DATA CONTROLLER and/or the third parties hired to develop internal processes required for its operation, may carry out the following processing/activities: 

2. Collect, capture, consult, store, update, modify or adapt, process, conserve, order, catalog, classify, compare, analyze, evaluate, monitor, combine, divide, separate, eliminate or destroy, link, associate, disclose or give access, among others, to the relevant authorities in accordance with the law to information provided by the data subject by any means or channel. 

3. Associate, connect, complete, consult, link, tie, use, relate, gather, assemble, among others, the information related to your identity and reputation available in the digital environment. 

4. Access, consult, compare, verify, corroborate, monitor, update and evaluate, among others, all the information about the data subject that is stored in the databases of any criminal record or security database, either of a state or private, domestic or foreign nature, or any commercial or service database. Furthermore, update the information or contact details or other personal data required for the performance of the contract or the fulfillment of other legal obligations. 

5. Transmit or transfer to third parties, located in the national territory or abroad, external service providers to process or handle information on behalf of CLAI PAYMENTS® Technologies or on its own behalf and provide support with various services associated with the stated purposes and processing operations or when it is necessary for the development of processes related to the business or work relationship. As well as to any other natural or legal person expressly authorized by the Data Subject. 

6. Report, communicate or allow, among others, access to the information provided by the data subject or information available about said data subject to: 

a. The authorities that may request them, in the exercise of their competence and with legal authorization, or before which it is appropriate to file a complaint, lawsuit, arbitration summons, grievance or claim. 

b. Any other natural or legal person to whom the data subject expressly authorizes.

WHAT ARE YOUR PRIVACY AND PERSONAL DATA PROTECTION RIGHTS? 

• Right of access. You may have the right to access and receive copies of your data that we hold and to receive details about how and why we use your data.

• The right to request proof of the authorization granted for processing. You can ask the data controller to provide you with a record of the consent you have granted for processing your personal data.

• Right to data portability. You may have the right to obtain your data for your own purposes, including so that you may provide or “port” that data elsewhere. • Right to erasure. You may have the right to request that we delete data we have about you. We may also forward your requests to other third parties with whom we have shared your information. 

• Right to exercise your rights without discrimination. You may have the right to exercise these rights without facing discrimination.  

• Right to file a complaint. You may have the right to file a complaint with the applicable data protection authority about our collection and use of your data. • Right to not participate. If you do not agree to our collection of your data, you may inform us of your choice of not participating. 

• Right to opt out and/or revoke. You may have the right to revoke your consent for us to collect and/or process your data and/or stop marketing communications and/or opt out of receiving future marketing communications, even if our reasons are grounded in legitimate business interests. You may also have the right to opt out of other processing activities. 

• Right to rectification. You may have the right to have us rectify any inaccurate or incomplete personal information. 

• Right of restriction. In certain circumstances, you may be able to request that we restrict the collection and/or processing of your data. Contact us for more information on the circumstances under which this right can apply at contact@clai.com. 

• Right to appoint others. Certain locations allow you to designate another person to act on your behalf. This is usually done through a document such as a power of attorney. If your address so permits, please understand that we will require this designee to provide proof of such appointment, which may include verifying your identity directly with us and/or our third-party identity verification partner. 

• Right to confidentiality. You have the right to have your personal data protected in a manner suitable to their degree of confidentiality.  

• Right to be anonymous, blocking or erasure of data that is unnecessary, excessive or processed contrary to the provisions of the Legislation. 

• The right to obtain from the data controller, in relation to the data subject’s data processed by the controller, at any time and upon request, confirmation regarding the existence of the processing. 

RESPONSIBILITIES AND OBLIGATIONS OF THE DATA CONTROLLER:

CLAI PAYMENTS® Technologies as data controller must comply with the following responsibilities, without prejudice to the other provisions of the law and others governing its activity:

1. Guarantee full and effective exercise of the right of habeas data to the data subject at all times. 

2. Request and keep a copy of the respective Authorization granted by the data subject. 

3. Duly inform the data subject about the purpose of the collection and the rights derived from the authorization granted. 

4. Keep information under the necessary security conditions to prevent tampering, loss, unauthorized or fraudulent consultation, use or access. 

5. Ensure that the processed information is truthful, complete, accurate, updated, verifiable and understandable. 

6. Rectify the information in case it is incorrect. 

7. Delete the information upon request of the data subject and as required by law and pursuant to the contractual provisions. 

8. Handle queries and claims formulated by the data subjects in the terms set forth in the law. 

9. Inform the data protection authority whenever there are violations to the security codes and risks regarding the administration of the data subject’s information.

MECHANISMS AND PROCEDURES TO EXERCISE THE RIGHTS OF CONSULTATION AND COMPLAINT: 

In order to exercise your rights as data subject to know, update, rectify the information about you in our files and revoke your authorization, in the terms indicated, CLAI PAYMENTS® Technologies has provided the following contact channels: 

INFORMATION AND CHANNELS OF THE DATA CONTROLLER 

Name of the data controller: CLAI PAYMENTS® Technologies E-mail: contacto@clai.com 

The DATA SUBJECTS may exercise their rights before CLAI PAYMENTS® Technologies by sending an e-mail to contacto@clai.com. The request must clearly state your contact information such as full name and surname, ID number, e-mail address and the purpose of the request, in order to provide a timely response. 

HOW DO WE PROCESS THE PERSONAL DATA OF OUR COLLABORATORS? 

CLAI PAYMENTS® Technologies is responsible for the processing of the personal data you provide to us from the time of your selection process, hiring and, if the selection process is successful, when the employment relationship begins and until it ends, regardless of the cause. The personal data collected will be processed for the purpose of integrating the file as a candidate or employee at the service of CLAI PAYMENTS® Technologies, accredit your identity, location, perform selection and recruitment procedures, administrative and tax procedures, cover the job profile, pay salaries and benefits, allocate and verify travel expenses and domestic and international flights, integrate billing, be insured in Social Security or other similar government obligations or benefits and designate beneficiaries, receive all types of legal and non-mandatory benefits, monitor attendance and grant social security benefits, economic, in-kind and health benefits; and schedule training activities. If you notify CLAI PAYMENTS® Technologies that you do not want your personal data to be transferred while you are employed by CLAI PAYMENTS® Technologies, this will be deemed to be your written notice of voluntary resignation from your employment with CLAI PAYMENTS® Technologies. Should you not express your refusal to such transfers, we will assume that you have given us your consent to such transfers. 

HOW DO WE PROCESS THE PERSONAL DATA OF OUR CUSTOMERS, SUPPLIERS AND THIRD PARTIES? 

CLAI PAYMENTS® Technologies is responsible for the processing of the personal data that you provide to us from your information provision process, through the website, direct contact, commercial events, regardless of the cause. The personal data collected will be processed for the purpose of integrating the file as a customer, supplier or third party of CLAI PAYMENTS® Technologies. 

ENTIRETY OF THE AGREEMENT 

This document constitutes the entire agreement between Customer and CLAI PAYMENTS® Technologies for the subject matter described herein, and no other documents, representations or warranties except as set forth herein shall be binding unless in writing and executed by both parties. 

DATABASE VALIDITY 

The personal data will remain in the databases as long as the data controller requires them for the development of the aforementioned activities and as long as the data subject does not revoke the authorization, provided that it is appropriate, in other words, we only keep your data for as long as it is necessary to fulfill the purposes described in this personal data processing and privacy policy.

POLICY VALIDITY 

As of the date of availability and issuance.