PRIVACY POLICY

1. LEGAL BASIS AND SCOPE OF APPLICATION

The information processing policy is developed in compliance with Articles 15 and 20 of the Political Constitution of Colombia, as well as based on Articles 17 literal k) and 18 literal f) of Statutory Law 1581 of 2012, which establishes general provisions for Personal Data Protection (LEPD). Additionally, in compliance with Article 2.2.2.25.1.1 section 1 chapter 25 of Decree 1074 of 2015, which partially regulates Law 1581 of 2012.

This policy shall apply to all personal data registered in databases that are subject to processing by the Data Controller.

1.1. Scope
This document shall apply to all personal data or any other type of information used or residing in the databases and files of MARIANO AGENCIA FLORAL S.A.S., respecting the criteria for obtaining, collecting, using, processing, exchanging, transferring, and transmitting personal data, and establishing the obligations and guidelines for the administration and processing of personal data residing in its databases and files. This Manual applies to all processes of MARIANO AGENCIA FLORAL S.A.S. that perform Data Processing (public data, semi-private data, private data, sensitive data, data of children and adolescents), in its capacity as Data Controller and Data Processor.

1.2. Applicable Regulations

  • Political Constitution of Colombia
  • Law 1581 of 2012
  • Decree 1074 of 2015 Chapter 25 and Chapter 26, compiling:
    • Decree 1377 of 2013
    • Decree 886 of 2014
  • Law 1266 of 2008 "Which dictates general provisions of Habeas Data".
  • Administrative acts issued by the Superintendency of Industry and Commerce (SIC).

2. DEFINITIONS

The following definitions are established in Article 3 of the LEPD and Article 2.2.2.25.1.3 Section 1 Chapter 25 of Decree 1074 of 2015 (Article 3 of Decree 1377 of 2013).

2.1. Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of personal data.

2.2. Database: Organized set of personal data subject to processing, belonging to the same context and systematically stored for later use.

2.3. Personal Data: Any information linked or that can be associated with one or more specific or determinable natural persons. These data are classified as public, semi-private, private, and sensitive:

  • 2.3.1. Public Data: Data that is not semi-private, private, or sensitive. Related to marital status, profession or occupation, and status as a merchant or public servant.
  • 2.3.2. Semi-private Data: Information that is not of an intimate, reserved, or public nature, whose knowledge is of interest to a certain sector or group of people (e.g., financial, credit, commercial information).
  • 2.3.3. Private Data: Information of an intimate or reserved nature that only interests the owner (e.g., telephone numbers, personal email addresses, employment records).
  • 2.3.4. Sensitive Data: Data affecting the Data Subject's privacy or whose improper use may generate discrimination (e.g., racial origin, political orientation, religious convictions, health data, and biometric data).

2.4. Data Processor: Natural or legal person, public or private, that by itself or in association with others, performs personal data processing on behalf of the Data Controller.

2.5. Data Controller: Natural or legal person, public or private, that decides on the database and/or the processing of the data (MARIANO AGENCIA FLORAL S.A.S.).

2.6. Database Administrator: Employee responsible for controlling and coordinating the proper application of data processing policies.

2.7. Data Protection Officer: Natural person assuming the role of coordinating the implementation of the legal framework in personal data protection.

2.8. Data Subject: Natural person whose personal data is subject to processing.

2.9. Processing: Any operation or set of operations on personal data (collection, storage, use, circulation, or deletion).

2.10. Privacy Notice: Verbal or written communication generated by the Controller addressed to the Data Subject.

2.11. Transfer: Transmission of personal data to a recipient who is also a Data Controller located inside or outside the country.

2.12. Transmission: Communication of data inside or outside Colombia for processing by the Processor on behalf of the Controller.

3. DATA PROTECTION PRINCIPLES

Article 4 of the LEPD establishes the guiding principles for harmonious and comprehensive application:

  • 3.1. Principle of Legality: Regulated activity subject to law.
  • 3.2. Principle of Purpose: Obeying a legitimate purpose informed to the Data Subject.
  • 3.3. Principle of Freedom: Exclusive exercise with prior, express, and informed consent.
  • 3.4. Principle of Truthfulness or Quality: Information must be truthful, complete, accurate, and updated.
  • 3.5. Principle of Transparency: Guaranteeing the Data Subject's right to obtain information about their data.
  • 3.6. Principle of Restricted Access and Circulation: Subject to limits derived from the nature of the data and the law.
  • 3.7. Principle of Security: Handling with necessary technical, human, and administrative measures.
  • 3.8. Principle of Confidentiality: Obligation to guarantee secrecy of information.

4. AUTHORIZATION FOR USE OF PERSONAL DATA

In accordance with Article 9 of the LEPD, authorization from the Data Subject is required, except in legal exceptions (information required by a public entity in the exercise of its functions, data of a public nature, medical emergencies, historical/statistical purposes, or civil registry).

5. AUTHORIZATION REQUEST TO THE DATA SUBJECT

Authorization will be requested in writing, orally, through automated channels, or through unequivocal actions, explicitly informing the purpose, the optional nature of sensitive data, the rights of the Data Subject, and the contact details of MARIANO AGENCIA FLORAL S.A.S.

6. DATA CONTROLLER

The entity responsible for processing the databases is MARIANO AGENCIA FLORAL S.A.S. (Tax ID / NIT 901813025-1):

  • Address: Calle 44a #54-31, Barrio La Esmeralda, Localidad Teusaquillo, Bogotá D.C.
  • Email: marianoagenciafloral@gmail.com
  • Phone / WhatsApp: +57 320 8445431

7. PROCESSING AND PURPOSES OF DATABASES

MARIANO AGENCIA FLORAL S.A.S. processes personal data for contract execution, floral order management, purchase confirmations, customer service, marketing, commercial prospecting, web analytics, and compliance with legal obligations.

8. DATABASE VALIDITY

Incorporated personal data will remain active for the period necessary to fulfill authorized purposes and special retention regulations.

9. RIGHTS OF DATA SUBJECTS

Pursuant to Article 8 of the LEPD, Data Subjects have the right to know, update, rectify, delete their data, request proof of authorization, be informed about data usage, revoke authorization, and submit complaints to the Superintendency of Industry and Commerce (SIC).

9.1. Right of Access or Consultation
9.2. Right to File Complaints and Claims (correction, deletion, revocation, infringement)
9.3. Right to Request Proof of Authorization
9.4. Right to File Complaints with the SIC

10. PROCESSING DATA OF MINORS

Processed respecting the best interests and fundamental rights of minors, obtaining prior authorization from their legal representative after hearing the minor's opinion.

11. DUTIES AS DATA CONTROLLER

Guaranteeing habeas data, retaining authorization, informing purposes, handling consultations/claims, and adopting internal security manuals.

12. DUTIES AS DATA PROCESSOR

Maintaining information under security conditions, updating it promptly, handling claims, and complying with instructions from the SIC.

13. ATTENTION TO DATA SUBJECTS

Through email at marianoagenciafloral@gmail.com and physical address in Bogotá D.C.

14. PROCEDURES FOR EXERCISING RIGHTS

Inquiries will be resolved within a maximum of ten (10) business days, and claims within fifteen (15) business days, complying with legal identification requirements.

15. DATA PROCESSING IN VIDEO SURVEILLANCE SYSTEMS

Used strictly for security purposes, informed through visible notices, and with restricted storage access.

16. SECURITY MEASURES (INTERNAL POLICY)

Implementation of technical, human, and administrative measures structured across four security levels:

Level Scope / Base Type Implemented Measures and Controls
TABLE I Common (All data) Document management, role-restricted access control, incident logging, and Internal Security Manual.
TABLE II Automated and non-automated bases Secure archives, physical custody, user identification with expiring passwords, secure networks.
TABLE III Private Data Periodic audits, designation of database administrators, encryption in transmissions.
TABLE IV Sensitive Data Restricted access control with confidential labeling, storage encryption, and Virtual Private Networks (VPN).

17. COOKIES OR WEB BUGS

Use of first-party and third-party cookies for web analytics and experience personalization. Users can disable them in browser settings (Chrome, Edge, Firefox, Safari).

18. SECURITY INCIDENT MANAGEMENT PROTOCOL

Documented procedure to identify, contain, mitigate, and report security incidents to the SIC and control entities within statutory deadlines.

19. ASSOCIATED RISK MANAGEMENT

Management aimed at mitigating threats arising from crime, physical events, negligence, or institutional decisions.

20. DATA DELIVERY TO AUTHORITIES

Verification of legality and relevance prior to delivering information by judicial or administrative order.

21. INTERNATIONAL TRANSFER AND TRANSMISSION

Conducted under standards required by the Superintendency of Industry and Commerce and data transmission contracts.

22. BIOMETRIC DATA PROCESSING

Collected exclusively for security and access control reasons under strict encryption measures.

23. NATIONAL DATABASE REGISTRY (RNBD)

Registration of databases with the Superintendency of Industry and Commerce according to current regulations.

24. INFORMATION SECURITY

Permanent institutional commitment to protection, technological backups, use of secure protocols, and secure software development.

25. DOCUMENT MANAGEMENT

Traceability, coding, retention, and final disposition of physical and digital documents containing personal data.

26. VALIDITY

This policy is effective upon its official publication and updates across digital channels of MARIANO AGENCIA FLORAL S.A.S.

27. APPENDIX

Provisions applicable according to the structure and operational needs of the agency.