English reference translation of the official GLOBALSOFT WIGILABS S.A.S. manual. This translation is provided for informational purposes. In the event of any discrepancy, the original Spanish document prevails. Download the official privacy and personal data processing manual in Spanish (PDF).
I. Introduction
GLOBALSOFT WIGILABS S.A.S. is committed to the appropriate protection and management of personal data and other information supplied to it, in accordance with the Colombian rules governing this subject, particularly Law 1581 of 2012 and the provisions that regulate, amend or replace it.
This manual establishes the privacy and personal data processing rules applicable to customers, prospective customers, suppliers, employees, contractors and any third party that provides information to Wigilabs. Its purpose is to ensure appropriate preservation, management, protection, integrity and confidentiality.
II. Definitions
Authorization: the data subject’s prior, express and informed consent to the processing of personal data.
Privacy notice: a verbal or written communication informing the data subject that a processing policy exists, how it may be accessed and the purposes for which the information will be used.
Database: an organized set of personal data subject to processing.
Personal data: any information linked or capable of being associated with one or more identified or identifiable individuals. Public, private and sensitive data are treated according to their nature and the applicable legal safeguards.
Data processor: the individual or public or private legal entity that processes personal data on behalf of the data controller.
Data controller: the individual or public or private legal entity that decides on the database and the processing of personal data.
Data subject: the individual whose personal data is processed.
Processing: any operation or set of operations involving personal data, including collection, storage, use, circulation, updating, correction or deletion.
Transfer: the delivery of personal data by a controller or processor located in Colombia to another controller located in or outside Colombia.
III. Guiding principles
3.1 Restricted access and circulation
Processing is limited by the nature of the information, the Constitution and the law. Except for public information, personal data must not be openly available online or through mass communication channels unless access is technically restricted to authorized persons.
3.2 Confidentiality
Everyone involved in processing non-public personal data must preserve its confidentiality, including after their relationship with Wigilabs ends, and may disclose it only when authorized by law and for authorized activities.
3.3 Purpose limitation
Processing must serve a legitimate purpose under the Constitution and the law, and that purpose must be communicated to the data subject.
3.4 Lawfulness
Personal data processing is a regulated activity governed by Law 1581 of 2012, Decree 1377 of 2013 and any rules that supplement, amend or replace them.
3.5 Freedom
Processing requires the data subject’s prior, express and informed consent, except where a legal or judicial rule permits processing without authorization. Public records and other data legally classified as public may be processed under the applicable exceptions.
3.6 Security
Wigilabs and its processors must adopt the technical, human and administrative safeguards necessary to prevent alteration, loss, unauthorized consultation, misuse, fraudulent access or unauthorized disclosure.
3.7 Transparency
Data subjects may obtain information from the controller or processor at any time about whether Wigilabs stores or processes personal data concerning them.
3.8 Accuracy and quality
Information subject to processing must be truthful, complete, accurate, current, verifiable and understandable. Partial, incomplete, fragmented or misleading information must not be processed.
IV. Purposes of personal data processing
Wigilabs processes personal data to manage relationships with customers and interested parties; develop and deliver its products and services; answer requests; prepare quotations and proposals; manage contracts, billing and collections; provide support; conduct service, quality and satisfaction activities; communicate business and institutional information; and comply with legal, accounting and tax obligations.
Supplier and contractor information may be used for selection, registration, contracting, payment, performance monitoring, security controls and compliance. Employee and candidate information may be used for recruitment, hiring, payroll, benefits, occupational health and safety, training, performance management, access control and the fulfillment of employment and social-security obligations.
Information may also be used to preserve evidence of transactions and authorizations, prevent fraud, manage physical and information security, defend legal claims, respond to competent authorities and maintain business continuity.
V. Authorization
Wigilabs must obtain prior, express and informed authorization from the data subject through physical, electronic, oral or other mechanisms that allow later consultation and proof. Authorization is not required in the cases expressly provided by law, including requests from competent public or administrative authorities, data of a public nature, medical or health emergencies and other legally recognized exceptions.
When sensitive data is requested, Wigilabs must inform the data subject that providing it is optional, identify which data is sensitive and explain the intended processing. Information about children and adolescents must receive enhanced protection and may be processed only when their best interests and fundamental rights are respected.
VI. Rights and duties
6.1 Data subject rights
Data subjects may know, update and correct their personal data; request proof of authorization; ask how their information has been used; submit complaints to the Colombian Data Protection Authority after completing the internal consultation or complaint process; revoke consent or request deletion when processing violates the Constitution or the law; and access their processed personal data free of charge.
6.2 Wigilabs’ duties
Wigilabs must guarantee the effective exercise of data subject rights; request and retain authorization when required; clearly explain the purpose of collection; safeguard information under appropriate security conditions; keep information accurate and updated; correct inaccurate data; ensure that processors respect the policy; process consultations and complaints; record disputed or judicially restricted information when applicable; report security incidents and comply with instructions issued by the competent authority.
6.3 Data processor duties
Processors acting for Wigilabs must protect the information, process it only for authorized purposes, keep it updated, apply corrections communicated by Wigilabs, manage requests within the legal periods, maintain the required records and report risks or incidents without undue delay.
VII. Access, consultation and complaint procedures
7.1 Channels
Data subjects, their successors, representatives and other persons authorized by law may submit requests through the contact channels made available by Wigilabs. The requester must provide enough information to verify identity, locate the relevant data and understand the request.
7.2 Consultations
Requests to consult personal information will be answered within the period established by Colombian law. If the request cannot be answered within that period, Wigilabs will explain the delay and state the new response date, subject to the applicable legal limit.
7.3 Complaints
Requests for correction, updating, deletion, revocation or alleged non-compliance must describe the facts, identify the data subject, provide contact information and include supporting documents where appropriate. Incomplete requests will be handled according to the correction and abandonment rules established by law.
7.4 Right to submit complaints
Once a complete complaint is received, Wigilabs will record that the matter is under review and will respond within the applicable legal period. If Wigilabs is not responsible for resolving it, the request will be transferred to the appropriate party when possible and the requester will be informed.
VIII. Information security
Wigilabs adopts reasonable administrative, technical and physical measures based on the nature of the information and the risks involved. Access is limited to authorized persons, confidentiality obligations remain in effect after the relationship ends, and incidents must be managed and reported in accordance with applicable law.
No security method is infallible. Wigilabs continually reviews its controls and expects employees, contractors, suppliers and processors to comply with its information-security requirements.
IX. Final provisions
Wigilabs may update this policy to reflect legal, regulatory, organizational or technological changes. Material changes affecting the purposes of processing will be communicated and, when required, new authorization will be obtained.
The policy remains effective for as long as Wigilabs processes personal data. The original Spanish manual and Colombian law govern its interpretation and application.