GLA TRADING S.A.S guarantees the protection of rights such as Habeas Data, privacy, intimacy, good name, and image. For this purpose, all actions will be governed by principles of good faith, legality, informational self-determination, freedom, and transparency.
Political Constitution, article 15.
Law 1266 of 2008
Law 1581 of 2012
Regulatory Decrees 1727 of 2009 and 2952 of 2010, and Decree
Partial Regulatory No. 1377 of 2013
Constitutional Court Rulings C – 1011 of 2008, and C - 748 of 2011;
GLA TRADING S.A.S. will apply the following specific principles, which constitute the rules to follow in the collection, handling, use, processing, storage, and exchange of personal data:
Principle of legality: In the use, capture, collection, and processing of personal data, the current and applicable provisions governing the processing of personal data and other related fundamental rights shall apply.
Principle of freedom: The use, capture, collection, and processing of personal data can only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that waives consent.
Principle of purpose: The use, capture, collection, and processing of personal data that GLA TRADING S.A.S. has access to and collects will be subject to and serve a legitimate purpose, which must be informed to the respective data subject.
Principle of truthfulness or quality: The information subject to use, capture,
collection, and processing of personal data must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.
Principle of transparency: In the use, capture, collection, and processing of personal data, the right of the Data Subject to obtain from GLA TRADING S.A.S., at any time and without restrictions, information about the existence of any type of information or personal data that is of interest or ownership to them must be guaranteed.
Principle of restricted access and circulation: Personal data, except for public information, may not be available on the Internet or other mass dissemination or communication media, unless access is technically controllable to provide restricted knowledge only to Data Subjects or authorized third parties. For these purposes, GLA TRADING S.A.S.'s obligation will be a means to an end.
Principle of security: Personal data and information used, captured, collected, and subject to processing by GLA TRADING S.A.S., will be subject to protection to the extent that technical resources and minimum standards allow, through the adoption of technological protection measures, protocols, and all types of administrative measures that are necessary to provide security to electronic records and repositories, preventing their alteration, modification, loss, consultation, and in general against any unauthorized use or access.
Principle of confidentiality: Each and every one of the people who administer, manage, update, or have access to any type of information found in databases, undertake to keep and maintain in a strictly confidential manner and not disclose to third parties, without prior authorization from the data subject, all personal, commercial, accounting, technical, commercial, or any other type of information provided in the execution and exercise of their functions.
The data collected by GLA TRADING S.A.S. will be processed for the fulfillment of its mission and in accordance with the following purposes:
For the fulfillment of obligations derived from existing contractual relationships with the data subjects.
For the fulfillment of legal obligations involving personal data.
For commercial management and relationship with its stakeholders.
For prospective analysis on trends, preferences,
behaviors and habits of its stakeholders.
To inform about products and their quality, about the company, trends, benefits, events, alliances, general information, among others.
To study and analyze the information provided for the monitoring and improvement of service and attention.
To know and monitor financial suitability.
To verify, consult, and report for statistical, control, supervision, and commercial information purposes to other entities, financial credit information in risk centers and information centers. References related to name(s), surname(s) and identification documents, commercial behavior and credit, payment habits, management of bank account(s) and in general the fulfillment of obligations.
To carry out the consultations and controls established in the current legal terms of prevention of money laundering and terrorism financing to verify in the sources it deems necessary, the information provided in this document, such as the lists of OFAC (Office of Foreign Assets Control) or the United Nations.
For the delivery of behavior references as a Customer and/or Third Party for goods and/or services.
For the delivery of employment references for both commercial and employment purposes, when the data subjects are employees of GLA TRADING S.A.S., linked by means of the corresponding employment contract or under other modalities authorized by law.
For the request of merchandise, regulation of processes, sending of average monthly sales, fulfillment of goals, among other purposes according to the nature of the contractual relationship, when the data subjects are strategic allies, suppliers, clients, contractors and related publics.
To verify the truthfulness of the information provided.
To transfer them for commercial purposes to allied companies.
For the management and processing of sensitive data.
To use information in extrajudicial and judicial processes when the moment warrants it.
To provide data information to state authorities.
To pay invoices.
Sensitive data are understood as those that affect the privacy of the data subject or whose improper use can generate discrimination, such as those that
reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data, among others, the capture of still or moving images, fingerprints, photographs, iris, voice, facial or palm recognition, etc.
First Paragraph - Processing of sensitive data: Sensitive data may be used and processed when:
The Data Subject has given explicit authorization for said processing, except in cases where, by law, such authorization is not required.
The processing is necessary to safeguard the vital interest of the data subject and the data subject is physically or legally incapacitated. In these events, legal representatives must grant their authorization.
The processing is carried out in the course of legitimate activities and with due guarantees by a foundation, NGO, association, or any other non-profit organization, whose purpose is political, philosophical, religious, or trade union, provided that they refer exclusively to its members or to persons who maintain regular contact by reason of its purpose. In these events, the data may not be provided to third parties without the authorization of the data subject.
The processing refers to data that is necessary for the recognition, exercise, or defense of a right in a judicial process.
The processing has a historical, statistical, or scientific purpose. In this event, measures conducive to the suppression of the identity of the Data Subjects must be adopted.
Second Paragraph - Data Subject's authorization: Without prejudice to the exceptions provided by law, processing requires the prior, express, and informed authorization of the data subject, which must be obtained by any means that can be subject to consultation and subsequent verification.
Third Paragraph - Cases in which authorization is not required: The Data Subject's authorization will not be necessary when it concerns:
Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
Public data.
Cases of medical or health emergency.
Processing of information authorized by law for historical, statistical, or scientific purposes.
Data related to the Civil Registry of Persons.
The data controller will be the company "GLA TRADING S.A.S." identified as follows:
NAME: GLA TRADING S.A.S.
NIT: 900.516.761-7
ADDRESS: Calle 80 Sur Nro. 47e 163. Sabaneta.
EMAIL: info@glatrade.com
WEBSITE: www.yves-rocher.co
In processing, respect for the prevailing rights of minors will be ensured.
The processing of personal data of minors is prohibited, except for data that is public in nature.
It is the task of the State and educational institutions of all kinds to provide information and train legal representatives and guardians about the potential risks that minors face regarding the improper processing of their personal data, and to provide knowledge about the responsible and safe use by children and adolescents of their personal data, their right to privacy and protection of their personal information and that of others.
Article 6. RIGHTS OF ALL DATA SUBJECTS VIS-À-VIS GLA TRADING S.A.S.
GLA TRADING S.A.S., in compliance with the Colombian personal data PROCESSING regime set forth in Law 1581 of 2012 and regulatory norms, the personal data subject has the following rights:
Access, know, rectify and update their personal data with GLA TRADING S.A.S., in its capacity as data controller.
By any valid means, request proof of the authorization granted to GLA TRADING S.A.S., in its capacity as Data Controller.
Receive information from GLA TRADING S.A.S. upon request, regarding the use it has given to their personal data.
Modify and revoke the authorization and/or request the suppression of the data when the processing does not respect the constitutional and legal principles, rights and guarantees in force.
Go before the legally constituted authorities, especially before the Superintendency of Industry and Commerce, and file complaints for infractions of the provisions of the current regulations in the applicable norms, after consultation or requirement before the Data Controller.
Have knowledge and free access to their personal data that has been subject to processing.
The personal data subject must guarantee GLA TRADING S.A.S. that their provided data is truthful, and they will promptly update their personal data.
In case of falsity in the information provided or the lack of timely update of personal data, GLA TRADING S.A.S. is exempt from any responsibility derived from the inaccuracy of such data.
When acting as the Personal Data Controller, GLA TRADING S.A.S. will comply with the following duties:
Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.
Request and keep a copy of the corresponding authorization granted by the data subject.
Duly inform the data subject about the purpose of the collection and the rights that assist them by virtue of the granted authorization.
Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.
Ensure that the information provided to the data processor
is truthful, complete, accurate, updated, verifiable, and understandable.
Update the information, timely communicating to the data processor all new developments regarding the data previously provided to them, and adopt other necessary measures to keep the information provided to them updated.
Rectify the information when it is incorrect and communicate the relevant details to the data processor.
Provide the Data Processor, as appropriate, only data whose Processing is previously authorized.
Demand from the Data Processor, at all times, respect for the security and privacy conditions of the Data Subject's information.
Process queries and complaints submitted.
Inform the Data Processor when certain information is under discussion by the Data Subject, once the claim has been filed and the respective procedure has not concluded.
Inform the Data Subject, upon request, about the use of their data.
Inform the data protection authority when there are violations of security codes and risks in the administration of Data Subjects' information.
GLA TRADING S.A.S. will always bear in mind that personal data belongs to the individuals to whom it refers and that only they can decide on it. In this sense, it will use the data only for those purposes for which it is duly authorized, and in all cases respecting the current regulations on personal data protection.
GLA TRADING S.A.S. will proceed in accordance with current regulations and the regulations issued for this purpose by the National Government, to register its databases with the National Database Registry (RNBD), which will be administered by the Superintendence of Industry and Commerce. The RNBD is the public directory of databases subject to Processing that operate in the country; and it will be freely accessible to citizens, in accordance with the
regulations issued for this purpose by the National Government.
The main Database processed by GLA TRADING S.A.S., in order to fulfill the purposes set forth in the previous chapter of this MANUAL OF PERSONAL INFORMATION PROCESSING POLICIES, is the database of its
CLIENTS for products and services provided by GLA TRADING S.A.S. This Database has been built and continues to be built with PERSONAL INFORMATION provided by natural and legal persons at the time of acquiring products or services, at which time CLIENTS sign the prior, express, and written authorization for their information to be processed.
First Paragraph. To ensure the continuity of personal data PROCESSING concerning CLIENTS, which was in the possession of GLA TRADING S.A.S. at the entry into force of Law 1581 of 2012 and its regulatory norms, GLA TRADING S.A.S., in its capacity as CONTROLLER, used the efficient communication mechanisms it employs in the ordinary course of its interaction with clients (article 10 # 1 and 2) of Decree 1377 of 2013, i.e., physical forms, chats, emails, and website, in order to obtain the legal consequences provided for by numeral 4° of article 10 of Decree 1377 of 2013.
For the fulfillment of the general and specific purposes, and the Mission of GLA TRADING S.A.S. mentioned in Chapter I of this Manual of Personal Data Processing Policies, GLA TRADING S.A.S. builds and develops databases with information from its strategic partners, suppliers, contractors, and related publics.
First Paragraph. In order to continue processing the information obtained prior to Law 1581 of 2012 and its regulatory norms, GLA TRADING S.A.S., in its capacity as CONTROLLER, used the efficient communication mechanisms it employs in the ordinary course of its interaction with clients (article 10 # 1 and 2) of Decree 1377 of 2013, i.e., physical forms, chats, emails, and website, in order to obtain the legal consequences provided for by numeral 4° of article 10 of Decree 1377 of 2013.
Second Paragraph. Due to the fact that this Database is built from the contractual relationship with employees, GLA TRADING S.A.S. will apply the exception set forth in article 9, second paragraph, and article 11, final part of the first paragraph, of Decree 1377 of 2013, which state that: the
revocation of authorization will not proceed when the information is required for the fulfillment of a contractual obligation.
Also with the aim of fulfilling the Mission of GLA TRADING S.A.S. and the general and specific Purposes for which the information is sufficiently related in Chapter I of this Manual of Personal Data Processing Policies, GLA TRADING S.A.S. has an internal database of employees linked by the corresponding employment contract or under other modalities authorized by law.
First Paragraph. Due to the fact that this Database is built from the contractual relationship with employees, GLA TRADING S.A.S. will apply the exception set forth in article 9, second paragraph, and article 11, final part of the first paragraph, of Decree 1377 of 2013, which state that: the revocation of authorization will not proceed when the information is required for the fulfillment of a contractual obligation.
The collection, storage, use, circulation, or deletion of personal data by GLA TRADING S.A.S. requires the free, prior, express, and informed consent of the data subject. First Paragraph. The means and/or manifestations for granting authorization for the processing of Personal Data by the data subject may be in a physical document, electronic document, data message, Internet, Websites, in any other format that guarantees its subsequent consultation, or through an appropriate technical or technological mechanism that allows expressing or obtaining consent via click or double-click, by which it can be unequivocally concluded that if a data subject's action had not occurred, the data would never have been captured and stored in the database. The authorization will be generated by GLA TRADING S.A.S. and will be made available to the data subject in advance and prior to the processing of their personal data.
Second Paragraph. GLA TRADING S.A.S. will use the mechanisms it currently has, and will implement and adopt the necessary actions to maintain suitable records or technical or technological mechanisms of when and
how it obtained authorization from the personal data subjects for their processing. To comply with the foregoing, physical files or electronic repositories may be established, directly or through third parties contracted for this purpose.
The Privacy Notice is a physical or electronic document or in any other known or yet-to-be-known format, which is made available to the Data Subject for the processing of their personal data. Through this document, the Data Subject is informed about the existence of the information processing policies that will apply to them, how to access them, and the characteristics of the intended processing of personal data. GLA TRADING S.A.S. will inform the data subjects of the privacy notice specified by law, complying with the specifications in Decree 1377 of 2013, and to ensure its dissemination, it will inform within the authorization granted by the data subject for personal data processing.
The Privacy Notice must contain, at a minimum, the following information:
The identity, address, and contact details of the Data Controller.
The type of processing to which the data will be subjected and its purpose.
The general mechanisms established by the Controller for the Data Subject to be aware of the information processing policy and any substantial changes that occur in it. In all cases, it must inform the data subject how to access or consult the information processing policy.
GLA TRADING S.A.S., as an institution and in the terms established by current regulations, will act as the CONTROLLER of Personal Data; and the different administrative departments will act as PROCESSORS of personal data.
The company designates the email info@glatrade.com, to receive, process, and channel the different
requests received, which will be registered with the date, day, and time of their reception and will be forwarded to the respective aforementioned departments responsible for processing, departments that, once these communications are received, will fulfill the function of personal data protection and must process the requests of the data subjects, in the terms, deadlines, and conditions established by current regulations for the exercise of the rights of access, consultation, rectification, updating, deletion, and revocation referred to in current personal data protection regulations.
In the event that you consider that GLA TRADING S.A.S. used your data in a manner contrary to what was authorized and to applicable laws, you may contact us via email at: info@glatrade.com; or by written communication to Calle 80 Sur Nro. 47e 163- Sabaneta, Antioquia.
GLA TRADING S.A.S. will guarantee the right to inquiry, providing data subjects with all the information contained in the individual record or linked to the Data Subject's identification. For this purpose, the personal information holder may submit an inquiry to the Data Controller, channeling and forwarding it through the designated department whose contact details are specified in Article 21 of this document.
The Data Subject or their successors who believe that the information contained in a database should be corrected, updated or deleted, or when they notice an alleged breach of any of the duties contained in the Law, may submit a complaint to the Data Controller, channeling and forwarding it through the designated department whose contact details are specified later in Article 21 of this document.
The complaint may be submitted by the Data Subject, taking into account the information indicated in Article 15 of Law 1581 of 2012 and in Decree 1377 of 2013, and other norms that modify or add to them.
First Paragraph. The data subject or their successor may only file a
complaint with the Superintendency of Industry and Commerce, once they have exhausted the INQUIRY or COMPLAINT process with GLA TRADING S.A.S. as the DATA CONTROLLER. This procedural requirement is described in Article 16 of Law 1581 of 2012.
At any time and free of charge, the data subject or their representative may request the GLA TRADING S.A.S. staff to rectify, update or delete their personal data, after proving their identity.
The rights of rectification, update or deletion may only be exercised by:
The data subject or their successors, after proving their identity, or through electronic instruments that allow them to be identified.
Their representative, after proving the representation.
When the request is made by a person other than the data subject, the legal personality or mandate to act must be duly proven; and if such capacity is not proven, the request will be considered not submitted.
First Paragraph. The request for rectification, update, or deletion must be submitted through the means enabled by GLA TRADING S.A.S. indicated in the privacy notice and contain, at a minimum, the following information:
Name of the data subject.
Physical address of the data subject's domicile or any other means to receive a response.
Identity document number.
Tax ID number (Nit) if it is a legal entity.
Email address.
Telephone number(s)
Capacity in which they act; if not directly, the corresponding power of attorney or capacity in which they act must be proven.
Documents proving the identity or legal personality of their representative.
A clear and precise description of the personal data concerning which the data subject seeks to exercise any of their rights.
In order to guarantee the right enshrined in the Political Constitution for the protection of personal data, GLA TRADING S.A.S. establishes the following procedure that must be observed by data subjects for the submission of their requests:
The responsible area is: Customer Service
Communications must be sent to the email info@glatrade.com; or by written communication to the address Calle 80 sur Nro. 47e 163- Sabaneta Antioquia.
Once the communication is received by GLA TRADING SAS
S.A.S. we will respond within 10 business days.
Requests must contain perfect identification of the information holder, indicate their legitimacy as the holder to make this request, a precise description of the situation(s) that give rise to the claim and what is sought with the request (update, correct, delete).
When the documentation is not complete, GLA TRADING
S.A.S. will request the respective person to complete the pertinent information within five business days. If 15 calendar days pass without the person completing the information, it will be understood that they have withdrawn their request.
GLA TRADING S.A.S. will respond, at most, within ten business days following the receipt of the complete and fully filled-out request.
The data subject has the right, at any time, to request GLA TRADING S.A.S. to suppress (delete) their personal data when:
They consider that the data is not being processed in accordance with the principles, duties, and obligations set forth in current regulations.
The data is no longer necessary or relevant for the purpose for which it was collected.
GLA TRADING S.A.S. is obligated to rectify and update, at the data subject's request, their information that is incomplete or inaccurate, in accordance with the procedure and terms indicated in Article 20 of this document. In this regard, the following will be taken into account:
In requests for rectification and update of personal data, the data subject must indicate the corrections to be made and provide documentation that supports their request.
GLA TRADING S.A.S. has full freedom to enable mechanisms that facilitate the exercise of this right, provided that these benefit the data subject. Consequently, electronic or other means deemed pertinent may be enabled.
The owners of personal data may revoke consent to the processing of their personal data at any time, provided that no legal or contractual provision prevents it. For this purpose, GLA TRADING
S.A.S. must establish simple and free mechanisms that allow the owner to revoke their consent, at least by the same means by which it was granted.
It should be noted that there are two modalities in which the revocation of consent can occur. The first, can be over all the purposes consented to, that is, that GLA TRADING S.A.S. must completely stop processing the owner's data; the second, can occur over certain types of processing, such as for advertising purposes or market research. With the second modality, that is, the partial revocation of consent, other processing purposes that the data controller, in accordance with the authorization granted, can carry out and with which the owner agrees, are kept safe.
GLA TRADING S.A.S. will do everything possible to guarantee the use of personal data by implementing the necessary human, technical, computer, and administrative measures, largely preventing the loss, alteration, adulteration
or fraudulent use of personal data, as well as preventing other people who are not GLA TRADING S.A.S. employees, and/or have any link with GLA TRADING S.A.S. from knowing the personal data that authorized its processing.
First Paragraph. GLA TRADING S.A.S. declares that the information captured and PROCESSED by the company is for the purpose of fulfilling the mission and purposes described in Chapter I of this manual.
Second Paragraph. GLA TRADING S.A.S. ordinarily, within the course of its activity, does not capture or PROCESS sensitive information, nor that of children, and when it does, it will apply the provisions of Law 1581 of 2012 and its regulatory norms that govern the matter.
This MANUAL AND PERSONAL DATA PROCESSING POLICY OF
GLA TRADING S.A.S. may be modified at any time, in which case the data subjects will be notified.
Its last update date is January 5, 2022.
