PERSONAL DATA PROCESSING POLICY

1. INTRODUCTION

In compliance with the provisions of Law 1581 of 2012 and regulatory Decree 1377 of 2013, which establish the General Regime for the Protection of Personal Data, these general policies are implemented for the processing of data of its employees, customers, suppliers or any third party that is part of the database for which CargoCorp UW, its parent company, branches, subsidiaries and other companies of the business group are responsible.

2. OBJECTIVE AND SCOPE

Establish the criteria for the collection, storage, use, circulation and deletion and other uses for the processing that will be given to personal data handled by CargoCorp UW in its capacity as responsible and in charge of processing. This policy applies to all personal information registered in CargoCorp UW databases.

3. DEFINITIONS

  • AUTHORIZATION: It is the express and free consent that the holder will give to CargoCorp UW by documentary means for the processing of their data.
  • SENSITIVE DATA: Those that affect the privacy of the Holder or whose improper use may generate discrimination will be understood as sensitive data.
  • PROCESSOR: It may be CargoCorp UW or a third party authorized for it, who will carry out the processing of the data delivered by the holder, in accordance with Law 1581 of 2012 and its regulatory decrees.
  • CONTROLLER: CargoCorp UW as responsible for the database will decide on it and/or for the processing of the data delivered by the holder, in accordance with Law 1581 of 2012 and its regulatory decrees.
  • HOLDER: Natural or legal person whose data is subject to Processing
  • PROCESSING: It consists of the collection, storage, use, circulation or deletion of data that CargoCorp UW uses to carry out its corporate purpose.

4. DATA CONTROLLER

CargoCorp UW commercial company legally constituted in the United States, with a subsidiary in Colombia domiciled at carrera 12A #79-08 Office 401 in the city of Bogotá.

Website: www.cargocorpuw.com

Phone: (60-1) 7482217

Email: compliance@cargocorpuw.com

5. PROCESSING AND PURPOSE OF DATA COLLECTION

CargoCorp UW will obtain personal data through direct collection or through third parties duly authorized to provide such information for commercial purposes for the fulfillment of its corporate purpose. CargoCorp UW will guarantee the secure storage of the information contained in the database, as well as its non-sale or supply to third parties other than its parent company, subsidiaries and other companies of the business group.

The collected data will be used for commercial, marketing, statistical purposes, data updating, satisfaction surveys, trend analysis and in general other technical studies useful for the promotion of CargoCorp UW products and services and the purposes indicated below:

  • Execute the activities foreseen in the development of the employment and/or contractual relationship with employees, suppliers and administrators
  • Carry out activities related to the Occupational Health and Safety System (SG-SST hereinafter).
  • Process the application for binding as intermediary, policyholder, insured and/or beneficiary of the reinsurance contract.
  • Make decisions regarding the negotiation, placement, renewal and execution of policies with capacity providers (reinsurers) in accordance with underwriting policies, including premium determination and risk selection.
  • Based on legal obligations, control, prevent, detect and investigate crimes, including fraud and money laundering, and analyze and manage other risks applicable to the operation.
  • Consultation, storage, administration, transfer, information processing to information centers or databases duly constituted regarding prevention of money laundering or economic sanctions for the prevention of crimes, terrorism and fraud.
  • Execute and comply with reinsurance contracts, as well as, the evaluation, processing, settlement, adjustment and payment of claims, when appropriate, manage claim disputes, through specialized external lawyers or third parties.
  • Carry out collection procedures, payment reminders, expirations and renewals through emails, telephone contact and others.
  • Respond to requests or petitions from business partners such as capacity providers, intermediaries or regulatory entities.
  • Manage commercial infrastructure and operations; comply with internal policies and procedures, including audits, finance, accounting, information technology systems, data hosting, websites, business continuity; records and document management.
  • Resolve complaints and process requests for data access or correction.
  • Ensure the security of people and property within the facilities for which video surveillance cameras may be available.
  • Transmit information to third parties in charge chosen by CargoCorp UW nationally or internationally for the fulfillment of the purposes informed to the Holder, such as technology providers where the hosting of our servers is located, with our group of companies, service providers, adjusters, investigators, insurance intermediaries, among other business partners.

6. AUTHORIZATION OBTAINING MECHANISMS

CargoCorp UW will require free, prior, express and informed consent from the holder for the collection, storage, use, circulation or deletion of personal data in cases where the company obtains the information directly, as occurs in the process of hiring an employee or eventually a supplier who is a natural person. For this, CargoCorp UW in its condition as responsible for the processing of personal data, has an authorization format that will be shared with the holders prior to their binding, will keep it permanently as proof of authorization.

Due to the CargoCorp UW business model for certain lines such as Motor or Hull, private or semi-private personal data could be obtained, in this scenario CargoCorp UW acts as processor, considering that the intermediary is the one who makes contact with the holder and obtains authorization for data management in cases where local regulation requires it and is empowered to transfer this information to CargoCorp UW for reinsurance product quotation. In case it is required by any regulatory or supervisory entity, proof of authorization will be requested from the intermediary or insurer.

7. SENSITIVE INFORMATION

As part of the SG-SST, data on medical condition and health status, diagnosed or in the process of diagnosing physical or mental illness, symptoms at the time of contact, previous treatments received or occupational medical condition (current or previous), personal habits such as smoking or alcohol consumption must be collected, in case a workplace accident occurs, consult the employee's medical history and process information with associated entities that are part of the health sector.

In the hiring process, the company may obtain information about your criminal background or consult binding and non-binding restrictive lists as part of the money laundering and terrorism financing prevention process. We may also obtain sensitive information if you voluntarily provide it (for example, if you express your preferences regarding medical treatment based on your religious beliefs, gender issues, etc.).

It is possible to collect biometric information such as images and/or video recordings of the Holders as part of facility security and in disciplinary processes, this information will be kept under appropriate measures that ensure its proper custody. We inform you that consent for the Processing of sensitive data is voluntary in nature, for which reason, unless this data is essential for the celebration or execution of the contractual relationship with CargoCorp UW, the Holders are not obligated to authorize its Processing. In those cases where they are required for the formalization of the contractual relationship and the Holder does not agree to provide them, it will be understood that they have no intention of binding and this will be made known to them.

8. HOLDER RIGHTS

The holder of the information has the following rights:

  • Know, update and rectify their personal data with CargoCorp UW
  • Request proof of the authorization granted to CargoCorp UW
  • Be informed, upon request, regarding the use that has been given to their personal data
  • Present complaints to the Superintendency of Industry and Commerce for violations of the provisions of law 1581 of 2012 and other regulations that modify, add or complement it
  • Revoke the authorization and/or request the deletion of data when in the Processing CargoCorp UW did not respect the constitutional and legal principles, rights and guarantees
  • Refrain from answering questions about sensitive data

The following persons may exercise the rights of the holder:

  • The Holder, who must prove their identity sufficiently by the various means made available by the responsible party
  • By their successors, who must prove such capacity
  • By the representative and/or attorney of the Holder, upon accreditation of representation or power of attorney
  • By stipulation in favor of another or for another upon accreditation of such stipulation
  • The rights of children or adolescents will be exercised by persons who are empowered to represent them

9. DUTIES OF CARGOCORP UW AS RESPONSIBLE AND/OR PROCESSOR

  • Request and preserve, under the conditions provided by law, a copy of the respective authorization granted by the Holder which is understood to be included in the offers that the company submits for consideration
  • Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data
  • Properly inform the Holder about the purpose of the collection and the rights that assist them by virtue of the authorization granted
  • Preserve information under the security conditions necessary to prevent its alteration, loss, consultation, use or unauthorized or fraudulent access
  • Rectify information when it is incorrect
  • Report at the request of the Holder on the use given to their data

10. ATTENTION TO PETITIONS, QUERIES AND CLAIMS

The holder may exercise the rights established in this policy as follows: Through written communication or by email may: request information about the personal data that resides in the database managed by CargoCorp UW and exercise the rights provided in this document.

The communication may be addressed to the Legal representative or to the Compliance area at email compliance@cargocorpuw.com. Queries will be attended by the same means in which it has been filed, within a maximum term of ten (10) business days counted from the date of receipt of this. When it is not possible to attend the query within said term, the interested party will be informed, expressing the reasons for the delay and indicating the date on which their query will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

For the filing and attention of requests, the following information is requested:

  • Full name and surnames
  • Contact details (email and contact phone)
  • Reason(s)/fact(s) that give rise to the claim with a brief description of the right you wish to exercise (know, update, rectify, request proof of authorization granted, revoke it, delete, access information)
  • Means to receive response to your request
  • Signature and identification number.

In the event that the Holder or the person duly authorized for the exercise of their rights, consider that the information contained in the database should be subject to correction, updating or deletion, they may present a claim to CargoCorp UW which will be processed under the following rules:

The maximum term to attend the claim will be fifteen (15) business days counted from the day following the date of its receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which their claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first term.

In the event that the related information is incomplete, the interested party will be required within five (5) days following receipt of the claim to remedy the failures. After two (2) months from the date of the requirement, without the applicant presenting the required information, it will be understood that they have withdrawn from the claim.

In case whoever receives the claim is not competent to resolve it, they will transfer to whoever corresponds within a maximum term of two (2) business days and will inform the interested party of the situation.

Once the complete claim is received, a legend that says "claim in process" and the reason for it will be included in the database, within a term no longer than two (2) business days. Said legend will be maintained until the claim is decided.

VALIDITY

This Personal Data Processing Policy is effective from July 31, 2013. The databases in which personal data will be registered will have a validity equal to the time the information is maintained and used for the purposes described in this policy. Once such purpose(s) are fulfilled and provided there is no legal or contractual duty to retain your information, your data will be deleted from our databases.