PRIVACY POLICY

HANKE S.A.S. – E.S.P. is committed to protecting the privacy of individuals who visit its website and those who use its contact channels. Therefore, guarantees the protection of rights such as Habeas Data, privacy, intimacy, good name and image, for this purpose all actions will be governed by principles of good faith, legality, self-determination, freedom and transparency.

This Privacy Policy outlines the types of personal information HANKE S.A.S. – E.S.P. collects through its contact channels and how it is used, shared, and protected in compliance with the General Data Protection Regulation (GDPR). By means of this Privacy Policy, HANKE S.A.S. – E.S.P. would like to inform the general public of the nature, scope, and purpose of the personal data collected, used and processed. Furthermore, data subjects are informed, by means of this Privacy Policy, of the rights to which they are entitled.

The present Privacy Policy is based on the terms used by the General Data Protection Regulation (GDPR). Therefore, it should be legible and understandable for the general public. To ensure this, we allow ourselves to define the terminology used:

• Personal data: all information associated with an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

• Data subject: any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.

• Controller or responsible for the processing/treatment: natural or legal person, public or private, who, by themselves or in association with others, carries out the processing of personal data, and determines the purposes and means of the processing of personal data.

• Third party: natural or legal person, public authority, agency or other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

• Notice of Privacy: verbal or written communication generated by the controller addressed to the data subject for the processing of their personal data, through which they are informed about the existence of the Privacy Policies that will be applicable to them, the way to access them and the purposes of the treatment that is intended to be given to their personal data.

• Databases: organized set of personal data that is subject to processing.

• Private data: data that, due to its intimate or reserved nature, is only relevant to the data subject.

• Public data: data that is not private or sensitive. Public data are considered, among others, data relating to the marital status of people, their profession or trade and their status as a merchant or public servant. Due to its nature, public data may be contained, among others, in public records, public documents, official newsletters, and duly executed judicial rulings that are not subject to confidentiality.

• Sensitive data: those that affect the privacy of the data subject or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights or that promotes the interests of any political party or guarantees the rights of opposition political parties, as well as data related to health, sexual life and bio-metric data.

• Processing/Treatment: any operation or set of operations on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or making available otherwise, alignment or combination, restriction or elimination.

• Restriction of processing: marking of stored personal data with the aim of limiting their processing in the future.

• Profiling: any form of automated processing of personal data, in particular to analyze or predict aspects concerning an individual’s characteristics, such as nationality, age, interests, socioeconomic situation, gender, etc., to make predictions or decisions about them.

• Pseudonymization: processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable data subject.

• Transfer: the transfer of data takes place when the controller of the processing of personal data sends the personal data to a recipient, who in turn is responsible for the processing of personal data.

• Consent: any free, specific, informed and unequivocal manifestation of the will of the data subject by which they, by means of a declaration or a clear affirmative action, express their agreement with the processing of personal data that concerns them.

• Claim: request for correction, updating or deletion of the information contained in the database used by the controller, or request for alleged non-compliance with any of the duties contained in the General Data Protection Regulation (GDPR), made by the data subject or their representatives.

• Business name: EMPRESA DE SERVICIOS PUBLICOS HANKE S.A.S. – E.S.P.
• Address: Servicio Nacional de Aprendizaje SENA. Carretera Central Variante Buga – Tulúa Buga, Colombia
• Tax ID number (NIT): 901152818-8
• General manager: Tobias Hanke
• E-mail: info@hanke.com.co
• Website: www.hanke.com.co

In accordance with the General Data Protection Regulation (GDPR), HANKE S.A.S. – E.S.P. relies on the following legal bases for the processing of personal data:

Processing of personal data is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract. Example: When you fill our Contact Form available at hanke.com.co, we collect and process the personal data to fulfill our contractual obligations (responding to your inquiries).

Processing is based on the data subject’s explicit consent for one or more specific purposes. Example: When you provide your email address and explicitly consent to receive marketing communications from us.

Processing is necessary for compliance with a legal obligation to which HANKE S.A.S. – E.S.P. is subject. Example: We may process personal data to meet regulatory or legal requirements.

Processing is necessary in order to protect the vital interests of the data subject or another natural person. Example: In emergency situations where the health or safety of an individual is at risk, we may process personal data to protect their vital interests.

Processing is necessary for the purposes of the legitimate interests pursued by HANKE S.A.S. – E.S.P. or a third party, except where such interests are overridden by the interests, rights, or freedoms of the data subject. Example: We may process personal data for marketing purposes, provided that privacy rights and interests are not infringed.

Processing is necessary for the establishment, exercise, or defense of legal claims or whenever courts are acting in their judicial capacity. Example: We may process personal data to establish, exercise, or defend legal claims in legal proceedings.

These policies are mandatory and strict compliance for HANKE S.A.S. – E.S.P., as responsible, as well as all third parties acting on its behalf, or who, without acting on behalf of HANKE S.A.S. – E.S.P., process personal data at its disposal as processors. Both the person in charge and people responsible, that is, employees, contractors and third parties, must observe and respect these policies in the fulfillment of their functions and/or activities even after legal, commercial, labor or any kind of relationship has ended. Likewise, they undertake to maintain strict confidentiality in relation to the data processed. Any breach of the obligations and, in general, of the policies contained in this document must be reported to info@hanke.com.co.

The individuals who use our Contact Form should provide truthful information about their personal data for the purposes of establishing an adequate relationship with HANKE S.A.S. – E.S.P., whether for the provision of services, or for compliance with its legal and/or contractual obligations.

HANKE S.A.S. – E.S.P. presumes the veracity of the information provided and does not verify, nor assumes the obligation to verify the identity of its clients, nor the veracity, validity, sufficiency and authenticity of the data that they may provide. Therefore, HANKE S.A.S. – E.S.P. does not assume responsibility for damages and/or losses of any nature that may arise from the lack of veracity, validity, sufficiency or authenticity of the information, including damages that may be due to homonyms or impersonation.

• The treatment will be lawfull and clear, ensuring that the processing aligns with the principles of fairness and transparency.
• Personal data will be collected, stored, used and circulated only for as long as is necessary and reasonable in accordance with the purposes for which authorization is requested.
• It will be only collected and processed personal data that is necessary for the specific purposes for which it was collected. Excessive or irrelevant information will be not processed.
• Communications with commercial content will never expose email information of our clients.
• Our database will not be sold, trade, shared or otherwise transfer to third parties for commercial purposes, except transfers for the purposes of responding to your requests or as required by law.

• To respond to your inquiries, provide assistance, and address any specific requests or concerns you may have communicated through the Contact Form.
• To process your orders, fulfill product or service requests, and facilitate transactions.
• To promote and advertise our activities, products and services.
• To comply with legal obligations and regulatory requirements. This includes meeting legal and regulatory standards, responding to lawful requests, and fulfilling obligations related to the protection of personal data.

Under the General Data Protection Regulation (GDPR), the data subject has the following rights regarding their personal information:

Each data subject shall have the right to obtain from the controller the confirmation as to whether or not personal data concerning them are being processed.

Each data subject shall have the right to access, at any time, to their personal data stored by the controller, and to have a copy of this information.

Each data subject shall have the right to rectify, with the controller, inaccurate or incomplete information concerning them. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• The personal data have not been treated in accordance with the principles, duties and obligations provided for in the General Data Protection Regulation (GDPR).
• The personal data are no longer necessary in relation to the purposes for which they were collected or processed.
• The period necessary to fulfill the purposes for which the personal data were collected has been exceeded.
• The data subject withdraws consent to which the processing is based according to the GDPR, and where there is no other legal or contractual basis for the processing.
• When it deems appropriate.

• The data subject has requested the rectification of their personal data.
• There is no legal or contractual basis for the processing, however the data subject opposes the erasure of their personal data and requests instead the restriction of its use.
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims.
• The data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

• Applies to personal data that a data subject has provided to a data controller.
• Encompasses data provided based on consent or for the performance of a contract.

In addition, the data subject has the right, based on their particular situation, to object the processing of their personal data by HANKE S.A.S. – E.S.P. for statistical or historical research purposes, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Each data subject shall have the right to withdraw their consent to processing of their personal data at any time.

Under the General Data Protection Regulation (GDPR), when a data subject wishes to exercise their rights, they may, at any time, contact HANKE S.A.S. – E.S.P.. The methods to exercise the rights of the data subject are the following:

• The E-mail info@hanke.com.co
• The website hanke.com.co in the Contact section.

• The maximum term to address the claim will be fifteen business days counted from the day following the date of receipt. When it is not possible to attend to it within such period, the interested party will be informed, before the expiration of the period, of the reasons for the delay and the date on which their claim will be attended to.

• Information and means of contact to receive the response such as name, telephone number, e-mail and residence address of the data subject.
• Documents that prove the identity of the data subject or their representative.
• Clear and precise description of the personal data which the data subject seeks to exercise any of the rights.
• If necessary, other elements or documents that facilitate the location of personal data.

The data subject or representative may only file a complaint with the respective entity in charge of carrying out such process, once the consultation or claim process has been exhausted before HANKE S.A.S. – E.S.P., in accordance with the aforementioned procedures.

In accordance, HANKE S.A.S. – E.S.P. undertakes to permanently comply with the following duties:

• Inform the data subject clearly and sufficiently about the purpose of the collection and the rights granted to them by virtue of the authorization granted.
• Guarantee the data subject, at all times, the full and effective exercise of the right of Habeas Data, that is, knowing, updating or rectifying their personal data.
• Inform at the request of the data subject about the use given to their personal data.
• Process queries and claims made in the terms indicated in this policy.
• Timely update, rectify or delete data.
• Allow access to the information only to people authorized by the data subject or empowered by law for this purpose.
• Inform the respective legal entity when violations of security codes occur and there are risks in the administration of the data subjects’ information.
• Comply with the instructions and requirements issued by the General Data Protection Regulation (GDPR).

• Observe the principles of quality, security and confidentiality in the terms established in the General Data Protection Regulation (GDPR).
• Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
• Update information when necessary.
• Rectify personal data when appropriate.

However, the data subject assumes the risks that arise from delivering their personal information in digital mediums such as the Internet, and having their data processed in digital databases, which may in principle have security gaps as cyber attacks, technical or technological failures, among others. Therefore, an absolute protection may not be guaranteed.

The website hanke.com.co contains information that allows quick electronic contact with our company, as well as direct communication with us. If an interested party contacts HANKE S.A.S. – E.S.P. by means of an email or a Contact Form, the personal data transmitted by the interested party will be automatically stored. These personal data voluntarily transmitted by the interested party to HANKE S.A.S. – E.S.P. are stored for the purpose of processing them or contacting the interested party.

If the storage purpose is not applicable, or if a storage period prescribed by the competent legislator expires, the personal data must be blocked or erased in accordance with legal requirements.

The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment or the initiation of a contract.

The data subject may, at any time, prevent the setting of cookies through hanke.com.co by means of the corresponding configuration of the Internet browser used and, therefore, may permanently deny the installation of cookies. Furthermore, already installed cookies can be deleted at any time from the Internet browser or other software programs. If the user deactivates the setting of cookies in the Internet browser used, some functions of hanke.com.co may not be accessible.

Each application operates under its own privacy policies, which will be presented below:

To learn more information about data processing by Google LLC and its privacy policies, visit: https://policies.google.com/terms?hl=en-US.

To learn more about the terms and conditions of this service, please visit: https://policies.google.com/terms. Find more information about Google LLC‘s privacy policies at: https://policies.google.com/privacy.

To learn more about the terms and conditions of this service, please visit: https://www.cookieyes.com/privacy-policy/.

HANKE S.A.S. – E.S.P. reserves the right to make modifications or updates to this Privacy Policy at any time, to address legislative developments, internal policies or new requirements for the provision or offering of its services or products.